EP3960580A1 - Railway control system with an interface adapter and method for configuration - Google Patents

Abstract

To avoid re-approval of a railway control system (11) when connecting a new type of signaling system, be it a signal box (211) or a radio block center RBC (211), a signaling system interface adapter (SSA, 4) is proposed, which is shown on page Control system ( 11) has a universal safety system interface (40, 41) and has a safety system type-specific interface (42) on the safety system (211) side, so that the conversion of operating commands and status reports does not require any topological configuration data interface adapter (SSA, 4).

Description

The present invention relates to a railway control system with a safety system interface adapter for an interlocking or a radio block center according to patent claim 1 and to a method for configuring and operating a railway control system according to patent claim 8.

The monitoring and control of railway operations are divided into different levels: The individual levels are the control level, the security level and the protection level. For an explanation of these levels, refer to the FIG 1 referenced.

The control level 1 is formed by one or more distributed railroad control systems 11. In the following, these railroad control systems are only abbreviated to the term "control system". Each control system 11 is operated from at least one operator station 12 . From the control level 1, the operating personnel can issue commands to the underlying security level 2 via the aforementioned operator stations 12, but also via automatic components (eg train control). Such control systems 11 are known. Reference is made to sources [1] and [2] purely by way of example.

Security level 2 is divided into a so-called indoor system 21 and an outdoor system 22. The indoor system 21 is formed by signal boxes 211 with associated optional signal box workstations 212. The outdoor system 22 contains (in an incomplete list) the railway components with switches 221, track vacancy detectors 222, signals 223 , Train protection devices 224 such as a balise. In addition or as an alternative to an interlocking 211, a radio block center RBC 211 can be present. The interlockings 211 and/or the radio block center RBC 211 ensure collision-free traffic on the tracks and, in particular, guarantee the safety of the vehicles. This security must meet the requirements of SIL 4 according to EN 50128 [3]. Interlockings and Radio Block Center RBC are dated Expert subsumed under the generic term "safety system", cf. eg [4].

The protection level 3 is formed from the running vehicles/trains 30 and their train protection devices 31. Instead of the term protection level 3, the term railway system 3 is also used. The terms protection level 3 or railway system 3 always refer to the components of protection level 3 or controlled elements of the railway system 3 that are protected by the relevant control system 11.

How from the FIG 1 is not difficult to derive, several signal boxes 211 or radio block centers 211 are usually connected to a control system 11 . Depending on the country, the railway company or for historical reasons, very different signal box types have to be connected. This difference is due to the age or the technical generation of the relevant interlockings, even if these interlockings come from the same supplier. Likewise, the Radio Block Center RBC are not standardized with regard to the interface to a control system. This interface is defined by the RBC suppliers, which means that there are also different «RBC types» for the RBC. However, the interface between RBC and vehicle is standardized, see → ETCS/ERMS.

The connection of a new type of interlocking or the connection of an RBC to be introduced to a control system causes various problems. As a rule, a rail operator does not have a choice as to whether or not to introduce a new type of interlocking in its rail infrastructure, as this is mandatory due to expansion or a change in the technology of the interlockings.

Different interlocking types and different "RBC types" use interlocking type-specific or RBC-type-specific interfaces for display and operating systems. No standardization has yet been introduced at this level, or standardization would have to be ahead of operational and technological development. Below are the Problems with the introduction of a new type of interlocking set out. This explanation is equally valid and applicable for the introduction of a new RBC type. For the sake of simplicity, this is only presented here for interlocking types.

1. a) Mit der Erweiterung verliert das betreffende Leitsystem seine eisenbahntechnische behördliche Zulassung. Für die erneute Zulassung ist in Zusammenarbeit mit der Zulassungsbehörde und dem Betreiber ein aufwendiges Verfahren notwendig.
2. b) Die Erweiterung bedingt einen neuen Release/Version des Leitsystems. Ein neuer Release ist aufwändig und steht meist erst nach 1 bis 2 Jahren Entwicklungszeit zur Verfügung.

If a new interlocking type is to be connected to a control system via a new interlocking type-specific interface, the control system must be expanded accordingly, which leads to further problems:

1. a) With the expansion, the relevant control system loses its official railway license. A complex procedure in cooperation with the approval authority and the operator is necessary for the renewed approval.
2. b) The expansion requires a new release/version of the control system. A new release is complex and is usually only available after 1 to 2 years of development.

So that a control system does not have to be expanded for each new interlocking-type-specific interface, the control system could offer an interlocking-independent, control-system-specific interface. With such a “standardized” interlocking interface, interlockings could be connected to the control system via an interlocking type-specific adapter.

An adapter located between the interlocking and the control system converts the information - mostly status reports - from the interlocking-specific interface to information from the standardized interlocking interface. Conversely, operating commands for the interlocking in a standardized command format are converted into an interlocking-specific command format in such an adapter. However, the adapter requires a topology-dependent configuration for this conversion.

• Bahnhof als hierarchisch zusammenfassendes Konstrukt von zu steuernden bzw überwachenden Elementen;
• Gleisabschnitte;
• Sequenz von Gleisabschnitten;
• Weichen;
• Kreuzungen;
• Barrieren (für Strassenübergänge).

Gleisabschnitte, Weichen, usw werden als Elemente bezeichnet und sind im Leitsystem mit entsprechenden Bezeichnern in leitsystemspezifischer Form und Codierung abgebildet. Diese topologieabhängige Konfiguration wird zur Projektierungszeit in das Leitsystem eingebracht. Eine Änderung der Gleisanlage wie zB die Inbetriebnahme eines zweiten Streckengeleises erfordern vor der Betriebsfreigabe eine Anpassung der topologieabhängigen Konfiguration im Leitsystem, wofür jedoch keine neue eisenbahntechnische Typenzulassung des Leitsystems selber erforderlich ist. Es braucht jedoch immer noch eine spezifische Zulassung für die spezifische Anlage im Feld.The term topology-dependent configuration refers to data that contain an image of the railway system to be controlled, such as

• Train station as a hierarchically summarizing construct of elements to be controlled or monitored;
• track sections;
• sequence of track sections;
• switches;
• crossings;
• Barriers (for road crossings).

Track sections, switches, etc. are referred to as elements and are mapped in the control system with corresponding identifiers in a control system-specific form and coding. This topology-dependent configuration is introduced into the control system during project planning. A change to the track system, such as the commissioning of a second track, requires an adjustment of the topology-dependent configuration in the control system before the release for operation, which, however, does not require a new railway type approval of the control system itself. However, it still needs specific approval for the specific plant in the field.

If control system-specific status identifications (e.g. station, element type, element name, status name) were to be transmitted via the standardized interlocking interface between the adapter and the control system, then the adapter would have to carry out a conversion, since the elements or statuses are identified differently on the interlocking (type)-specific interface will. On the interlocking (type)-specific interface, the elements are identified with an index, for example, and the states contained therein are identified with a bit position. A topology-dependent configuration would be required for this conversion, since the elements are part of the topology.

To clarify the term “interlocking (type)-specific” used above, the following is stated here:
The conversion in the adapter includes, on the one hand, a conversion into the format specified for the relevant signal box type (Structure) and on the other hand a conversion according to the elements of the railway system to be controlled (topology, content, numbering, indexing, etc.). In the following, this distinction will only be made where relevant to the present invention.

1. i) Jede Änderung an der Topologie der Bahnanlage und damit im Stellwerk bedingt eine Anpassung der topologieabhängigen Konfiguration im betreffenden Adapter. Die geänderte Konfiguration muss geprüft und zum richtigen Zeitpunkt im Adapter installiert werden. Der Adapter ist örtlich oft irgendwo zwischen Leitsystem und Stellwerk. Die Verbindung kann über Internet erfolgen und sich somit über mehrere Kilometer Distanz erstrecken.
2. ii) Für die Wandlung der Informationen - also Zustandsmeldungen und/oder Bedienbefehle - und die Interpretation der topologieabhängigen Konfiguration wird ein solcher Adapter entsprechend komplex. Für jede neue stellwerkpezifische Schnittstelle muss ein neuer Adapter mit dem entsprechenden Aufwand entwickelt werden.
3. iii) Bei einem Bahnbetreiber mit einem Streckennetz von zB über 2000km ergeben sich ca 10 verschiedene Stellwerktypen bei rund 600 installierten Stellwerken und etwa 3 verschiedene RBC-Typen. Pro solchem Sicherungsanlagentyp wäre ein spezifischer Adapter vorzusehen. Bei einer Änderung am Stellwerk müsste darüber hinaus die Konfiguration des zugehörigen Adapters, sowie die Konfiguration im zugehörigen Leitsystem oder Leitsystemzelle geändert und geprüft werden. Die Prüfung erfolgt mit Stellwerk, Adapter und Leitsystem/Leitsystemzelle. Bei grösseren Änderungen erfolgt dies auch etappenweise. Das bedeutet, dass nur während Zugspausen geprüft werden kann. Für diese Prüfungen muss zuerst die neue, zu prüfende Konfiguration geladen werden und nach Abschluss wieder die ursprüngliche Konfiguration geladen werden, damit der Bahnbetrieb wieder aufgenommen werden kann.

However, a topology-dependent configuration is undesirable in an adapter for several reasons:

1. i) Any change to the topology of the railway system and thus to the interlocking requires an adjustment of the topology-dependent configuration in the relevant adapter. The changed configuration must be checked and installed in the adapter at the correct time. The adapter is often located somewhere between the control system and the signal box. The connection can be made via the Internet and thus extend over a distance of several kilometers.
2. ii) Such an adapter becomes correspondingly complex for the conversion of the information—that is, status reports and/or operating commands—and the interpretation of the topology-dependent configuration. A new adapter with the corresponding effort has to be developed for each new interlocking-specific interface.
3. iii) In the case of a railway operator with a route network of, for example, more than 2000 km, there are around 10 different types of interlockings with around 600 installed interlockings and around 3 different RBC types. A specific adapter would have to be provided for each type of safety system. In the case of a change to the interlocking, the configuration of the associated adapter and the configuration in the associated control system or control system cell would also have to be changed and checked. The test is carried out with signal box, adapter and control system/control system cell. In the case of major changes, this is also done in stages. This means that checks can only be carried out during train breaks. For these tests, the new configuration to be tested must first be loaded and then the original one again after completion configuration must be loaded so that railway operations can be resumed.

Reason iii) above in particular shows that the existence of a topology-dependent configuration in the interface adapter entails massive disadvantages for the railway operators for operational reasons as well as for reasons of logistics.

The present invention is therefore based on the object of creating a railway control system with an interface adapter for connecting an interlocking or a radio block center RBC, with which the considerable disadvantages set out above when changing the railway system to be controlled are eliminated and in particular the effort for Connection of a new interlocking type or an RBC type to be introduced can be significantly reduced. The present invention is also based on the object of specifying a method for configuring and operating a railway control system, so that changes to the railway system to be controlled only affect the control system.

This object is achieved for a railway control system by the features specified in patent claim 1 and for a method for configuring and operating a railway control system by the features and method steps specified in patent claim 8 . Advantageous configurations of the invention are specified in further claims.

• im Leitsystem von der Sicherungsanlage Zustandsmeldungen empfangen und Bedienbefehle generiert und an die mindestens eine Sicherungsanlage übermittelt werden und wobei
• jeder Sicherungsanlage ein bestimmter Sicherungsanlagentyp zugeordnet ist,

welches Eisenbahnleitsystem sich dadurch auszeichnet, dass die Generierung der Bedienbefehle im Leitsystem auf empfangenen Zustandsmeldungen und auf topologischen Konfigurationsdaten beruht, die beide ein Abbild der zu steuernden Bahnanlage repräsentieren,
die Anbindung der Sicherungsanlage über einen Sicherungsanlagen Schnittstellen-Adapter erfolgt, so dass

• zwischen Leitsystem und Sicherungsanlagen Schnittstellen-Adapter eine universelle Sicherungsanlagenschnittstelle vorgesehen ist und so dass
• zwischen Sicherungsanlagen Schnittstellen-Adapter und Sicherungsanlage eine Sicherungsanlagentyp-spezifische Schnittstelle vorgesehen ist und
• im Sicherungsanlagen Schnittstellen-Adapter die generierten Bedienbefehle in Sicherungsanlagentyp-spezifische Bedienbefehle nach einem vorgegebenen Schema unabhängig von topologischen Konfigurationsdaten gewandelt werden.

The railway control system according to the invention is a railway control system for a railway installation with a connection to at least one signal box or to a radio block center - both referred to below as the safety system - where

• receive status reports from the security system in the control system and generate operating commands and transmit them to the at least one security system and wherein
• each security system is assigned a specific type of security system,

which railway control system is characterized by the fact that the generation of the operating commands in the control system is based on received status reports and on topological configuration data, both of which represent an image of the railway system to be controlled,
the security system is connected via a security system interface adapter, so that

• A universal safety system interface is provided between the control system and safety system interface adapter and so that
• a security system type-specific interface is provided between the security system interface adapter and the security system, and
• in the safety system interface adapter, the generated operating commands are converted into safety system type-specific operating commands according to a predetermined scheme, independently of topological configuration data.

• im Leitsystem von der Sicherungsanlage Zustandsmeldungen empfangen und Bedienbefehle generiert und an die mindestens eine Sicherungsanlage übermittelt werden und wobei
• jeder Sicherungsanlage ein bestimmter Sicherungsanlagentyp zugeordnet ist,

welches Verfahren sich dadurch auszeichnet, dass die Anbindung der Sicherungsanlage über einen Sicherungsanlagen Schnittstellen-Adapter erfolgt und dass topologische Konfigurationsdaten, die ein Abbild der zu steuernden Bahnanlage repräsentieren, in einer Projektierungsphase in das Leitsystem geladen werden so dass im Betrieb das Leitsystems die Generierung der Bedienbefehle auf empfangenen Zustandsmeldungen und auf den topologischen Konfigurationsdaten beruht und in einem universellen Format dem Sicherungsanlagen Schnittstellen-Adapter übermittelt werden wobei im Sicherungsanlagen Schnittstellen-Adapter die Wandlung der Bedienbefehle unabhängig von topologischen Konfigurationsdaten in ein sicherungsanlagentyp-spezifisches Format nach einem vorgegebenen Schema erfolgt.The method according to the invention for configuring and operating a railway control system
a method for configuring and operating a railway control system for a railway system with a connection to at least one signal box or to a radio block center - both referred to below as safety systems - wherein

• receive status reports from the security system in the control system and generate operating commands and transmit them to the at least one security system and wherein
• each security system is assigned a specific type of security system,

which method is characterized in that the safety system is connected via a safety system interface adapter and that topological configuration data, which represent an image of the railway system to be controlled, is loaded into the control system in a project planning phase, so that the control system can generate the operating commands during operation based on received status messages and on the topological configuration data and in a universal format the security systems Interface adapters are transmitted, with the conversion of the operating commands being carried out in the security system interface adapter, independently of topological configuration data, into a format specific to the type of security system according to a predetermined scheme.

1. i) Der SSA kann relativ einfach aufgebaut sein, da topologieabhängige Konfigurationsdaten weder vorhanden sein müssen noch gewandelt werden müssen.
2. ii) Mit der Vereinfachung gemäss i) steht ein neuer SSA in kürzerer Zeit und kostengünstiger zur Verfügung.
3. iii) Da im SSA keine topologieabhängige Konfiguration notwendig ist, bleibt der SSA bei einer Bahnanlagenänderung davon nicht betroffen, diese muss nur noch im betreffenden Stellwerk und/oder RBC nachgeführt werden. Eine Nachführung im Leitsystem ist jedoch auf jeden Fall vorzunehmen.
4. iv) Für den Einsatz eines neuen Stellwerktyps mit neuer stellwerktypspezifischer Schnittstelle müssen im Leitsystem lediglich die Konfigurationsdaten angepasst werden. Es braucht keine neue Zulassung des Leitsystems. Da der SSA keine Abhängigkeit zum Bahnleitsystem hat, kann ein neuer Stellwerktyp mit dem Leitsystem betrieben werden, sobald der zugehörige SSA zur Verfügung steht. Ein neuer Release des Leitsystems ist nicht erforderlich.

To ensure that no topology-dependent configuration is necessary in the safety system interface adapter - hereinafter referred to as «SSA» - the data (see the detailed description above) is processed in the control system to such an extent that the SSA transfers this data to and from the interlocking ( type)-specific information without its own topology-dependent configuration data. In order for this to be possible, however, the interface between the SSA and the control system must also be designed in such a way that the interlocking-specific information for each type of interlocking can be transmitted via the same interface. This is possible (in contrast to the standardized interlocking interface, see paragraph [0012] above) with the universal interlocking interface. The processing of the interlocking (type)-specific information is carried out in the control system with the aid of a topology-dependent configuration. This results in the following advantages:

1. i) The SSA can have a relatively simple structure, since topology-dependent configuration data does not have to be present or converted.
2. ii) With the simplification according to i), a new SSA is available in a shorter time and more cost-effectively.
3. iii) Since no topology-dependent configuration is necessary in the SSA, the SSA is not affected by a change in the railway system; this only has to be updated in the relevant interlocking and/or RBC. However, tracking in the control system must be carried out in any case.
4. iv) For the use of a new interlocking type with a new interlocking type-specific interface, im only the configuration data needs to be adjusted. No new approval of the control system is required. Since the SSA is not dependent on the railway control system, a new type of interlocking can be operated with the control system as soon as the associated SSA is available. A new release of the control system is not required.

• Figur 1 Übersicht über die verschiedenen Ebenen der Überwachung und Steuerung des Bahnbetriebs;
• Figur 2 Einbettung eines Adapters zwischen einem Leitsystem und einem Stellwerk bzw RBC.

The invention is explained in more detail below with reference to the drawing, for example. show:

• figure 1 Overview of the different levels of monitoring and control of railway operations;
• figure 2 Embedding an adapter between a control system and an interlocking or RBC.

In an overview shows FIG 1 the various levels for monitoring and controlling rail operations as follows, detailed information on FIG 1 can be found above.

The control level 1 contains at least one control system 11 or control system cells 11 and associated operator stations 12. In FIG 1 only one control system 11 and only one operator station 12 is shown.

The security level 2 is divided into an indoor system 21 and an outdoor system 22. The indoor system 21 contains a signal box 211 with an optional signal box operator station 212, for example in a train station. The external system 22 contains a non-exhaustive list of technical railway components such as points 221, track vacancy detectors 222, signals 223 and train protection devices 224, e.g ETCS Level 3. Not explicitly shown in FIG 2 In addition or as an alternative to the interlockings 211, so-called radio block centers 211.

The protection level 3 contains the vehicles/trains 30 moving on the tracks, the safety devices 31 on the train, for example antennas 31. Instead of the term protection level 3, the term railway system 3 is also used.

• eine universelle Sicherungsanlagen Schnittstelle 40 für Bedienbefehle, also in Richtung Leitsystem 11 → SSA 4 und in
• eine universelle Sicherungsanlagen Schnittstelle 41 für Zustandsmeldungen, also in Richtung SSA 4 → Leitsystem 11.

Zwischen SSA 4 und Sicherungsanlage 211 ist eine Schnittstelle vorgesehen, die hier Sicherungsanlagentyp-spezifische Schnittstelle 42 genannt ist. Diese Schnittstelle 42 ist einerseits Sicherungsanlagentyp-spezifisch und andererseits hinsichtlich der verwendeten Bezeichnungen/Nummern Sicherungsanlagenspezifisch. FIG 2 shows the specific embedding of a security system interface adapter SSA 4 - hereinafter referred to as "SSA 4" - between a control system 11 and a Interlocking 211 or RBC 211. Specifically, a terminology is introduced below together with the corresponding reference numbers:
Security system 211 stands for
a signal box 211 or a radio block center 211, RBC 211 for short.
The universal security systems interface is divided into

• a universal safety system interface 40 for operating commands, i.e. in the direction of the control system 11 → SSA 4 and in
• a universal safety system interface 41 for status reports, i.e. in the direction of SSA 4 → control system 11.

An interface is provided between the SSA 4 and the security system 211, which is referred to here as the interface 42 specific to the type of security system. This interface 42 is, on the one hand, specific to the type of safety system and, on the other hand, specific to the safety system with regard to the designations/numbers used.

Since there can be several kilometers in a wide area of up to around 100 km between the control system 11 and the security system 211, the spatial arrangement of the relevant SSA 4 is very different. Leased lines, for example, can be used as the transmission medium with appropriate redundancy. The transmission itself can take place via IP using the known protocol security techniques.

The universal interface 40, 41 between the SSA 4 and the control system 11 is designed in such a way that the same interface 40, 41 can always be used for different signal boxes 211 and signal box types. Within the universal interface 40, 41 between the SSA 4 and the control system 11, status reports and element identifications are interlocking-specific--but not interlocking-type-specific. This means that the SSA 4 can carry out a conversion according to a specified scheme without a configuration in the SSA 4 being necessary for this.

The whole thing also applies to operations where the elements to be operated are transmitted with interlocking-specific element identifications via the universal interface. The control system 11 also contains an operating and display control 111.

An SSA 4 is designed as a computer platform with appropriate hardware components and hardware interfaces. An operating system is implemented on this computer platform. Since an SSA 4 performs safety-related functions for railway operations, operations (operating commands, status reports) must be processed and/or transmitted in two independent ways. In the present case, the conversion of the operating commands generated in the control system into operating commands specific to the type of safety system must therefore be carried out in two independent ways in the SSA. For both types, however, the conversion takes place according to a specified scheme and is independent of topological configuration data. Two independent messages must be transmitted for the safety-related functions. However, these messages must be processed independently of one another. Since the messages are secured with a checksum, they can also be transmitted on a common channel Depending on the application, two physically separate transmission channels can also be provided.

List of reference symbols, glossary

1

management level

11

Railway control system, control system

111

Operating and display control

12

Control system operator station, operator station

120

operating converter

121

message converter

2

security level

21

indoor plant

211

security system; Interlocking, RBC

212

signal box operator station

22

outdoor facility

221

soft

222

track vacancy detector

223

signals

224

train protection devices in the outdoor area; balise

3

Protection level, railway system, railway system

30

vehicle

31

train protection device on vehicle; antenna

4

Security systems interface adapters, interlocking interface adapters, RBC interface adapters

40

Universal security system interface for operating commands

41

Universal safety system interface for status reports

42

Safety system type-specific interface, interlocking type-specific interface, RBC type-specific interface,

List of documents cited, sources, list of acronyms used

[1]

Integral control and information system ILTIS https://de.wikipedia.org/wiki/Integrales control and information system

[2]

WO 2012/119879 A1
RAILWAY CONTROL SYSTEM
SIEMENS AKTIENGESELLSCHAFT, DE - 80333 Munich

[3]

EN 50128: 2012-03
Railway applications - Telecommunications technology, signaling technology and data processing systems - Software for railway control and monitoring systems

[4]

https://www.zevrail.de/

ETC

European Train Control System https://en.wikipedia.org/wiki/European Train Control System

ERM

The European Rail Traffic Management System http://www.ertms.net/

IP

Internet Protocol.

RBC

Radio Block Center

SSA

Security system interface adapter

Claims (8)

Railway control system (11) for a railway system (3) with a connection to at least one signal box (211) or to a radio block center (RBC, 211) - both referred to below as safety system (211) -, wherein - In the control system (11) from the security system (211) status reports are received and operating commands are generated and transmitted to the at least one security system (211) and wherein - each security system (211) is assigned a specific type of security system, characterized in that
the generation of the operating commands in the control system is based on status reports received and on topological configuration data, both of which represent an image of the railway system (3) to be controlled,
the security system (211) is connected via a security system interface adapter (SSA, 4), so that - A universal safety system interface (40, 41) is provided between the control system (11) and safety system interface adapter (SSA, 4) and so that - A security system type-specific interface (42) is provided between the security system interface adapter (SSA, 4) and the security system (211) and - In the security system interface adapter (SSA, 4), the generated operating commands are converted into security system type-specific operating commands according to a predetermined scheme, regardless of topological configuration data. Guidance system (11) according to claim 1,
characterized in that
the security systems interface adapter (SSA, 4) is designed as a computer platform and that an operating system is implemented on this computer platform. Guidance system (11) according to claim 1 or 2,
characterized in that
the universal security system interface (40, 41) is designed with separate directions. Guidance system (11) according to claim 3,
characterized in that
the universal security system interface (40, 41) has independent transmission channels for each direction. Guidance system (11) according to claim 4,
characterized in that
which establishes the independence of the two transmission channels by protocol or physically. Guidance system (11) according to one of Claims 1 to 5,
characterized in that
in the safety system interface adapter (SSA, 4) the generated operating commands are converted into safety system type-specific operating commands in two independent ways. Guidance system (11) according to one of Claims 1 to 6,
characterized in that
the safety system-specific operating commands transmitted via the safety system type-specific interface (42) contain the designations and numbers corresponding to the relevant railway system (3). Method for configuring and operating a railway control system (11) for a railway system (3) with a connection to at least one signal box (211) or to a radio block center (RBC, 211) - both referred to below as a signaling system (211) - according to a of claims 1 to 7, wherein - In the control system (11) from the security system (211) status reports are received and operating commands are generated and transmitted to the at least one security system (211) and wherein - Each security system (211) is assigned a specific type of security system characterized in that
the connection of the safety system (211) takes place via a safety system interface adapter (SSA, 4) and that topological configuration data, which represent an image of the railway system (3) to be controlled, are loaded into the control system (11) in a project planning phase, so that in Operation of the control system, the generation of the operating commands is based on received status messages and on the topological configuration data and is transmitted to the safety system interface adapter (SSA, 4) in a universal format, with the transformation of the operating commands in the safety system interface adapter (SSA, 4) being independent of topological configuration data in a protection system type-specific format according to a predetermined scheme.

Images