EP3943363B1 - Railway control system with restriction - Google Patents

Description

The present invention relates to a railway control system with an operating inhibition according to patent claim 1.

The monitoring and control of railway operations are divided into different levels: The individual levels are the control level, the security level and the protection level. For an explanation of these levels, refer to the FIG 1 referenced.

The control level 1 is formed by one or more distributed railroad control systems 11. In the following, these railroad control systems are only abbreviated to the term “control system”. Each control system 11 is operated from at least one operator station 12 . From the control level 1, the operating personnel can issue commands to the underlying security level 2 via the aforementioned operator stations 12, but also via automatic components (eg train control). Such control systems 11 are known. Reference is made to sources [1] and [2] purely by way of example.

Security level 2 is divided into a so-called indoor system 21 and an outdoor system 22. The indoor system 2 is formed by signal boxes 211 with associated optional signal box workstations 212. The outdoor system 22 contains (in an incomplete list) the railway components with switches 221, track vacancy detectors 222, signals 223 , train protection devices 224 such as a balise and the radio block centers RBC (RBC's are in FIG 1 not shown). The signal boxes 211 and the Radio Block Center RBC ensure collision-free traffic on the tracks and, in particular, guarantee the safety of the vehicles. This security must meet the requirements of SIL 4 according to EN 50128 [3].

Protection level 3 is formed from the running vehicles/trains 30 and their train protection devices 31. Persons 31 responsible for the maintenance of the railway systems can also be subsumed for protection level 3.

The existing architecture of the control system works with a so-called operating input component, which accepts operations from operating personnel at corresponding control system workstations or from internal automatic components such as train control (not explained explicitly above) in a form that is independent of the type of interlocking. This operator input component converts the operations into an interlocking type-specific command sequence and transfers this to a corresponding command output component. The command output component converts the commands into the definitive interlocking-specific format for forwarding to the relevant interlocking.

In the case of a train route setting, this is a non-critical operation. This operation is referred to as regular operation. In this case, the safety level with the signal box ensures the required safety (for the vehicles) and only sets routes if all the necessary prerequisites are met.

Due to the high density of trains and the fact that the railway is running 24 hours a day, construction and maintenance work usually has to be carried out while the railway is running, if necessary by closing one of several parallel tracks. These people for construction and maintenance in the track area must be warned of approaching vehicles/trains so that they can leave the danger area in good time. For this purpose, specially trained warning personnel (security guards or warners and, if necessary, additional pre-warners) are used today, who trigger a warning at an early stage and monitor the timely triggering of the alarm devices such as flashing lights and sirens that are automatically controlled from the protection level.

The railway operators would like to improve this warning process through the use of technology. For this purpose, a warning system should be used on the safety level, which controls the (mobile) warning devices in the track area (protection level) in a suitable way. Such a warning system at the security level is hereinafter referred to as "Signal Controlled Warning System" SCWS. This warning system must not be confused with the warning devices (protection level) located in the track area: The warning devices should be controlled by the warning system (safety level).

In order for such a warning system to be able to trigger warnings in good time in any case, it must also be ensured that certain operations of the signal box, such as in particular the setting of certain routes that allow a train to travel on a certain section, can be prevented or delayed. The document EP 1 308 366 A1 shows a railway control system with such an operating inhibition.

1. i) Diese Stellwerktyp-spezifische Lösung muss für jeden Stellwerktyp neu realisiert werden und eignet sich insbesondere nicht für sogenannte Relais-Stellwerke.
2. ii) Auf der Leitebene können so vorgenommene Bedienungen zwar keine Gefährdung des Baustellenpersonals bewirken, doch erfolgt keine differenzierte Rückmeldung an die Leitebene, warum eine so vorgenommene Bedienung nicht ausgeführt wurde.

This prevention or delay of operating actions for the signal box, also known as operating inhibition, can in principle be solved by appropriate communication between the warning system and the relevant signal box. The previously known solution uses the approach with the aforementioned direct communication between the warning system and the specific interlocking. This solution has the following disadvantages:

1. i) This interlocking type-specific solution must be newly implemented for each interlocking type and is particularly not suitable for so-called relay interlockings.
2. ii) Operations carried out in this way at the control level cannot endanger the construction site personnel, but there is no differentiated feedback to the control level as to why such an operation was not carried out.

Due to the high degree of automation, most of the signal boxes at the stations are no longer operated by operators, but are remotely controlled exclusively from the control level above using transmitted commands.

The present invention is therefore based on the object of specifying an operating inhibition for a control system, so that hazards to construction site personnel are reliably ruled out can be and the aforementioned disadvantages are excluded in a signal box-specific solution.

This object is achieved for a control system with an operating inhibition according to the features specified in independent patent claim 1 . Advantageous configurations of the invention are specified in further claims.

With regard to the control system with an operating inhibition, this object is achieved according to the invention by a

• das sich dadurch auszeichnet, dass
• das Leitsystem vor Übermittlung eines Befehls an das Stellwerk eine Bedienerlaubnis-Anfrage an das Warnsystem richtet und erst nach Erhalt einer positiven Bedienerlaubnis-Antwort vom Warnsystem die Bedienhemmung aufhebt und den Befehl an das Stellwerk übermittelt.

Railway control system with an operating inhibition for the transmission of commands from the control system to a signal box for a railway system, wherein a warning system is assigned to the signal box, which controls a warning device located on the railway system,

• which is characterized in that
• the control system sends an operator permission request to the warning system before transmitting a command to the signal box and only after receiving a positive operator permission response from the warning system removes the operating inhibition and transmits the command to the signal box.

1. A) Dadurch dass das Leitsystem vor Übermittlung eines Befehls an das Stellwerk eine Bedienerlaubnis-Anfrage an das Warnsystem richtet und erst nach Erhalt einer positiven Bedienerlaubnis-Antwort vom Warnsystem die Bedienhemmung aufhebt,
   sind die vom Leitsystem abgegebenen Befehle an das Stellwerk vom Warnsystem her freigegeben und erfolgt die Kommunikation auf der Leitsystem-Ebene und benötigt keine spezifische Anpassung der Schnittstelle zwischen Stellwerk und Warnsystem, da diese direkte Schnittstelle entfällt.
2. B) Dadurch dass das Leitsystem vor Übermittlung eines Befehls an das Stellwerk eine Bedienerlaubnis-Anfrage an das Warnsystem richtet und erst nach Erhalt einer positiven Bedienerlaubnis-Antwort vom Warnsystem die Bedienhemmung aufhebt,
   sind die vom Leitsystem abgegebenen Befehle an das Stellwerk vom Warnsystem her freigegeben und erfordern keine Rückfrage beim Baustellenwarnpersonal.
3. C) Dadurch dass das Leitsystem vor Übermittlung eines Befehls an das Stellwerk eine Bedienerlaubnis-Anfrage an das Warnsystem richtet und erst nach Erhalt einer positiven Bedienerlaubnis-Antwort vom Warnsystem die Bedienhemmung aufhebt,
   sind die vom Leitsystem abgegebenen Befehle an das Stellwerk vom Warnsystem her freigegeben und Baustellen können vom Betriebsablauf her genau gleich behandelt werden wie der übrige Bahnbetrieb - mit zB vom Fahrpersonal abgegebenen Abfahrbefehlen auf einem Perron - und erfordern vor Ort keine Stellwerkbedienungen.

With the additional functional units—which are implemented in hardware and/or software—the control system according to the invention has the following advantages:

1. A) Due to the fact that the control system sends an operator permission request to the warning system before transmitting a command to the interlocking and only removes the operating inhibition after receiving a positive operator permission response from the warning system,
   the commands issued by the control system to the signal box are released by the warning system and communication takes place at the control system level and does not require any specific adaptation of the interface between the signal box and the warning system, since this direct interface is not required.
2. B) The fact that the control system sends an operator permission request to the warning system before transmitting a command to the interlocking and only lifts the operating inhibition after receiving a positive operator permission response from the warning system,
   the commands issued by the control system to the interlocking are released by the warning system and do not require any consultation with the construction site warning staff.
3. C) Due to the fact that the control system sends an operator permission request to the warning system before transmitting a command to the interlocking and only removes the operating inhibition after receiving a positive operator permission response from the warning system,
   the commands issued by the control system to the signal box are released by the warning system and construction sites can be treated in exactly the same way as other railway operations - for example with departure commands given by the drivers on a platform - and do not require any signal box operations on site.

1. i) Durch die Zuführung der Bedienerlaubnis-Antwort einer im Leitsystem enthaltenen Bedieneingabe-Komponente und einer im Leitsystem enthaltenen Befehlsausgabe-Komponente, bleibt bei einer Fehlfunktion in einer der vorstehend genannten zwei Komponenten die Bedienhemmung erhalten. Damit ist für diesen Fall die geforderte Sicherheit auch auf Ebene des Leitsystems sichergestellt (Anspruch 3).
2. ii) Durch die Übertragung der Bedienerlaubnis-Anfrage an das Warnsystem und die Bedienerlaubnis-Antwort vom Warnsystem auf je zwei getrennten Kanälen erfolgt, bleibt bei einer Fehlfunktion der Übertragung die Bedienhemmung erhalten (Anspruch 4).
3. iii) Durch eine Bedienerlaubnis-Antwort mit der Ausprägung «noch nicht freigegeben» festgelegte Zeitdauer für eine nachfolgende Bedienerlaubnis-Antwort mit der Ausprägung «Freigabe» und durch Nichtempfang einer weiteren Bedienerlaubnis-Antwort innerhalb der Zeitdauer hat die Annullation eines Befehls den Vorteil, dass Blockierungen auf der Ebene des Leitsystems nur während der festgelegten Zeitdauer möglich sind (Anspruch 6).
4. iv) Durch die zweikanalige Übermittlung von vom Stellwerk entstammenden Zustandsinformationen an das Warnsystem und dadurch dass das Warnsystem gemäss diesen Zustandsinformationen und gemäss im Warnsystem gespeicherten Topologie-Daten der Bahnanlage eine Bedienerlaubnis-Antwort generiert, ist die Sicherheit im der Warnanlage zugeordneten Streckenabschnitt unabhängig realisiert (Anspruch 10).
5. v) Durch die Übermittlung von Zustandsinformationen der Warneinrichtungen an das Warnsystem und durch die Abhängigkeit einer Bedienerlaubnis-Antwort von diesen Zustandsinformationen der Warneinrichtungen, kann eine Bedienhemmung auch bei einer defekten Warneinrichtung sichergestellt werden (Anspruch 11).

Advantageous further developments of the control system according to the invention include:

1. i) By supplying the operator permission response to an operator input component contained in the control system and a command output component contained in the control system, the operator inhibition is maintained in the event of a malfunction in one of the two components mentioned above. In this case, the required security is also ensured at the level of the control system (Claim 3).
2. ii) By transmitting the operator permission request to the warning system and the operator permission response from the warning system on two separate channels in each case, the operator's inhibition is retained if the transmission malfunctions (claim 4).
3. iii) A period of time specified by an operator permission response with the specification "not yet released" for a subsequent operator permission response with the specification "release" and by not receiving a further operator permission response within the period of time, the cancellation of a command has the advantage that blocking at the level of the control system are only possible during the defined period of time (claim 6).
4. iv) The two-channel transmission of status information originating from the interlocking to the warning system and the fact that the warning system generates an operator permission response according to this status information and according to the topology data of the railway system stored in the warning system, safety in the route section assigned to the warning system is independently implemented (claim 10).
5. v) By transmitting status information of the warning devices to the warning system and by the dependence of an operator permission response on this status information of the warning devices, an operator inhibition can be ensured even if the warning device is defective (claim 11).

The present invention relates to a warning system with a connected warning system. However, the invention is not limited to this application alone, but can also be used for further communication with components assigned to the security level, such as level crossings, which has so far been carried out as a function of the type of signal box.

• Figur 1 Übersicht über die verschiedenen Ebenen der Überwachung und Steuerung des Bahnbetriebs;
• Figur 2 Ergänzung der in FIG 1 gezeigten Übersicht mit einem Warnsystem und einer zugehörigen Warnanlage;
• Figur 3 Struktur und Funktion der involvierten Komponenten auf der Leitebene zur Ansteuerung eines Warnsystems.

The invention is explained in more detail below with reference to the drawing, for example. show:

• figure 1 Overview of the different levels of monitoring and control of railway operations;
• figure 2 addition to the in FIG 1 overview shown with a warning system and an associated warning system;
• figure 3 Structure and function of the components involved at the control level for controlling a warning system.

In an overview shows FIG 1 the various levels for monitoring and controlling rail operations as follows:

The control level 1 contains at least one control system 11 and associated operator stations 12. In FIG 1 only one control system 11 and only one operator station 12 are shown; in practice, a plurality of (distributed) control systems 11 and a plurality of operator stations 12 per control system 11 are actually present.

The security level 2 is divided into an indoor system 21 and an outdoor system 22. The indoor system 21 contains a signal box 211 with an optional signal box operator station 212, for example in a train station. The external system 22 contains a non-exhaustive list of the technical railway components such as points 221, track vacancy detectors 222, signals 223 and train protection devices 224, e.g ETCS level 3.

The protection level contains the vehicles/trains 30 moving on the tracks, the safety devices 31 on the train, for example antennas 31 and any persons 32 in the track area.

FIG 2 shows the arrangement of a warning system 213 in the interior system of security level 2 for an exemplary embodiment of the present invention. This warning system 213 is connected to the control system 11 and to the warning system 225 . A warning light 225 and a horn/siren 225 are shown as warning system components purely by way of example. In reality, however, a plurality of such warning lights 225 and sirens 225 are installed.

The specific configuration for an exemplary embodiment of the present invention of a connection between the warning system 213 and the control system 11 is that 3 refer to.

1. i) «Freigabe»,
2. ii) «noch nicht freigegeben».

Starting from a control system operator station 12, which is connected to an operator input component 40, an operator permission request 41 is sent to the warning system 213 before a command is sent to the signal box 211. This operator permission request 41 is sent on separate channels—that is, in two channels— supplied to a respective operating inhibition component 44 ₁ and 44 ₂ that is operated independently of one another. The operating inhibiting components 44 ₁ and 44 ₂ are—since they fulfill a safety-related function—each implemented with differently configured software code that runs independently of one another on two processor systems. The operator permission request ₄₁ is forwarded to the warning system 213 by these operator control components 44 ₁ and 44 ₂ on separate channels—i.e. _two channels. The operator permission response 42 is preferably specified with the following response characteristics:

1. i) «Release»,
2. ii) «not yet released».

An operator permission response 42 with the response specification “release” is also referred to as a positive operator permission response 42 . A first operator permission response 42 should occur within 2s.

If the answer is “not yet released”, wait the components in the control system 11 to a positive operator permission response 42 during a predetermined time in the range of about 1 minute to 2 minutes. If this time is exceeded, a so-called time-out occurs and the desired and thus inhibited operation is canceled when the time-out occurs. This operator permission response 42 is supplied by the operator control inhibition component 44 ₁ to the operator input component 40 and, in the event of an operator permission response 42 "not yet released", causes an operator control inhibition at the control system operator station 12. This single operator control inhibition is not sufficient for safety reasons. The operator permission response 42 is therefore also supplied to the command output component 43 by the second operator inhibition component 44 ₂ . The command output component 43 converts the commands from the operating component 40 into interlocking type-specific commands in order to forward them to the interlocking 211 in this way. The aforementioned supply of the operator permission response 42 to the command output component 43 has the effect that a command incorrectly given by the operator input component 40 can still be blocked in the command output component 43 .

The topology data of the railway system 3 to be monitored are stored in the warning system 213 (also called SCWS) from a project planning phase—ie before the warning system 213 is put into operation.

From the described interaction of the four components 40, 43, 44 ₁ and 44 ₂ involved in the operation inhibition process, it is not difficult to see that, due to the selected structure, at least two of the four components would have to have a malfunction at the same time for operation to be carried out without the appropriate permission would.

The warning system 213 detects the status data of the warning devices 225 in order to depending on this an expression of the operator permission response 42 to the control system 11 - precisely to the control system 11 contained in the control inhibiting components 44 ₁ and 44 ₂ to transmit. This status data about the warning devices 225 can be similar to what is known from light signal monitoring in railway technology.

The control system 11 forwards status information from the interlocking messages to the warning system 213 . This forwarding is also carried out in two channels and for reasons of clarity in the FIG 2 and 3 not shown. From this status information together with corresponding topology data, the warning system 213 can perform its function as explained above:
Release or inhibit or delay operations for execution with the operator permission response 42 with the response characteristic “not yet released”.

The advantage mentioned above due to the two operating inhibition components 44 ₁ and 44 ₂ involved in the operating inhibition process also extends to the transmission of the status information to the warning system 213, so that both operating inhibition components 44 ₁ and 44 ₂ would also have to malfunction at the same time so that operation without a corresponding permission would be carried out.

• Empfang von Bedienerlaubnis-Anfragen 41 von der Bedieneingabe-Komponente 40;
• Weiterleitung von Bedienerlaubnis-Anfragen 41 an das Warnsystem 213;
• Empfang von Bedienerlaubnis-Antworten 42 des Warnsystems 213 und gemäss Bedienerlaubnis-Antwort 42 die Bedienung entweder hemmen oder an die Bedieneingabe-Komponenten 40 respektive an die Befehlausgabe-Komponente 43 mit der Antwortausprägung «Freigabe» weiterleiten;
• Überwachung, ob die Kommunikation mit dem Warnsystem 213 noch spezifikationsgemäss funktioniert, vgl im Detail wie vorstehend erläutert;
• ist die spezifikationsgemässe Kommunikation mit dem Warnsystem 213 nicht mehr gegeben, werden alle neu eintreffenden Bedienerlaubnis-Anfragen 41 mit einer Bedienerlaubnis-Antwort 42 der Ausprägung «noch nicht freigegeben» an die an die Bedieneingabe-Komponenten 40 respektive an die Befehlausgabe-Komponente 43 beantwortet.

In addition to the above statements on the structure of the operating inhibition components 44 ₁ and 44 ₂ , the various functions of the two operating inhibition components 44 ₁ and 44 ₂ can include:

• receiving operator permission requests 41 from operator input component 40;
• forwarding operator permission requests 41 to the warning system 213;
• Reception of operator permission responses 42 from the warning system 213 and, according to the operator permission response 42, either inhibit operation or forward it to the operator input components 40 or to the command output component 43 with the response characteristic “release”;
• Monitoring whether the communication with the warning system 213 is still working according to specification, see in detail as explained above;
• if there is no longer communication with the warning system 213 as specified, all newly arriving operator permission requests 41 are answered with an operator permission response 42 of the form "not yet released" to the operator input components 40 or the command output component 43.

To understand the above embodiment are in the 3 reference number 46 shows the previous operating processing without operator restriction and reference number 47 shows the signal box type-dependent communication between signal box 211 and warning system 213 .

List of References

1

management level

11

Railway control system, control system

12

Control system operator station, operator station

2

security level

21

indoor plant

211

signal boxes

212

signal box operator station

213

warning system

22

outdoor facility

221

soft

222

track vacancy detector

223

signals

224

train protection devices in the outdoor area; balise

225

warning device, warning system; Flashing light, horn

3

Protection level, railway system

30

vehicles

31

train protection device on vehicle; antenna

32

person in the track area

40

Operator input component (function)

41

Operator Permission Request

42

Operator Permission Response

43

Command Output Component (Function)

441

first operating inhibition component (function)

442

second operating inhibition component (function)

45

Command to signal box

46

Previous operation processing without operator permission

47

Interlocking type-dependent communication between interlocking and warning system

List of documents cited, sources, list of acronyms used

1. [1] Integral control and information system ILTIS https://de.wikipedia.org/wiki/Integrales control and information system
2. [2] WO 2012/119879 A1
   RAILWAY CONTROL SYSTEM
   SIEMENS AKTIENGESELLSCHAFT, DE 80333 Munich
3. [3] EN 50128: 2012-03
   Railway applications - Telecommunications technology, signaling technology and data processing systems - Software for railway control and monitoring systems

• ETCS European Train Control System https://en.wikipedia.org/wiki/European Train Control Sys tem
• RBC Radio Block Center
• SCWS Signal Controlled Warning System

Claims (11)

1. Railway control system (11) with a control restriction for transmitting commands from the railway control system (11) to a signal box (211) for a railway installation (3), the signal box (211) having an associated warning system (213) that controls a warning device (225) located on the railway installation (3),
   characterized in that
   before transmitting a command to the signal box (211) the railway control system (11) sends a control permission request (41) to the warning system (213), and lifts the control restriction and transmits the command to the signal box (211) only after a positive control permission response (42) has been received from the warning system (213).
2. Railway control system (11) according to Claim 1,
   characterized in that
   the commands from a control input component (40) contained in the railway control system (11) are routed to a command output component (43) contained in the railway control system and are transmitted to the signal box (211) by said command output component in a form specific to the signal box type.
3. Railway control system (11) according to Claim 2,
   characterized in that
   the control permission response (42) is routed to a control input component (40) contained in the railway control system (11) and to a command output component (43) contained in the railway control system (11) in order to ensure a twofold control restriction in the railway control system (11) in this way.
4. Railway control system (11) according to one of Claims 1 to 3,
   characterized in that
   the control permission request (41) to the warning system (213) and the control permission response (42) from the warning system (213) are each provided on two separate channels.
5. Railway control system (11) according to one of Claims 1 to 4,
   characterized in that
   the control permission response (42) contains at least the following two characteristics:

   - "cleared",

   - "not yet cleared", the characteristic "not yet cleared" producing a control restriction for the transmission of a command from the railway control system (11) to a signal box (211) .
6. Railway control system (11) according to Claim 5,
   characterized in that
   a control permission response (42) containing the characteristic "not yet cleared" is followed by a defined period of time for a subsequent control permission response (42) containing the characteristic "cleared", and if a further control permission response (42) is not received within the period of time then a command is cancelled.
7. Railway control system (11) according to one Claims 1 to 6,
   characterized in that
   the control permission request (41) to the warning system (213) and the control permission response (42) are taken via two independent control restriction components (44₁, 44₂) contained in the railway control system (11).
8. Railway control system (11) according to Claim 7,
   characterized in that
   software code in the two control restriction components (44₁, 44₂) runs on different processors.
9. Railway control system (11) according to Claim 8,
   characterized in that
   the software code in the two control restriction components (44₁, 44₂) is configured differently.
10. Railway control system (11) according to one of Claims 1 to 9,
    characterized in that
    the railway control system (11) transmits state information coming from the signal box (211) to the warning system (213) on two channels and in that the warning system (213) takes this state information and topology data relating to the railway installation (3) that are stored in the warning system (213) as a basis for generating a control permission response (42) for the transmission.
11. Railway control system (11) according to one of Claims 1 to 10,
    characterized in that
    state information relating to the warning devices (225) is received by the warning system (213) and a control permission response (42) is dependent on this state information relating to the warning devices (225).

Images