EP4101727A1

EP4101727A1 - Smart object controller for railway tracks

Info

Publication number: EP4101727A1
Application number: EP21305801.9A
Authority: EP
Inventors: Sara Motta; Renzo GARUTI; Pasquale CAPASSO; Andrea SILVESTRINI
Original assignee: Alstom Transport Technologies SAS
Current assignee: Alstom Holdings SA
Priority date: 2021-06-11
Filing date: 2021-06-11
Publication date: 2022-12-14

Abstract

A Smart Object Controller for mounting along a railway track comprising:- a cybersecurity management module (10) arranged to receive and transmit, from or to a remote station (108), route control data representing a configuration of the railway track, and to decrypt or encrypt said route control data into safety data;- a safety data processing module (12) arranged to receive and transmit, from or to the cybersecurity management module (10), said safety data and to convert the safety data into boolean variables and vice versa;-a boolean equation module (14) arranged to receive, from the safety data processing module (12), the boolean variables, and to execute boolean equations based on said boolean variables, thus obtaining command data to be sent to trackside equipment (4) of the railway track to get said configuration.

Description

The present invention relates to a Smart Object Controller for railway tracks.
A Smart Object Controller (SmOC) is a device which operates in a context of Digital Railway Evolution, as for example in a Regional ERMTS low density architecture as shown in figure 1, wherein railway vehicles 100 move on respective railway tracks 102 and a plurality of GSM local radio equipment 104 communicate each other through a plurality of antennas 106.
A Smart Object Controller is a device which is placed along a railway track, next to trackside equipment, and is arranged to receive control commands from a remote station 108 and to control, in turn, such trackside equipment.
The Smart Object Controller is usually placed in a same local technological cabin where the GSM local radio equipment 104 is located.
Nowadays, in the railway architectures, it is required an enhanced digitalization of a railway infrastructure, including smart radio-controlled object controllers, allowing communication on open networks and fulfilling compliancy with standardized interoperability protocols.
Various railway architectures are known, and they often include Smart Object Controllers interfaced to a Route Control Signalling system (part of the remote station 108) to translate control commands provided by the Route Control Signalling system into specific trackside equipment controls (activation of level crossing, signals, point machines, eurobalises).
Moreover, a Smart Object Controller is arranged to acquire data from the trackside equipment and to elaborate them in order to provide to the Route Control Signalling system a feedback from the trackside equipment.
The communication between the Smart Object Controller with the Route Control Signalling system is usually protected by encryption.
A Smart Object Controller supports also the deployment of architectures without the need of a Central Interlocking Computer, and it can be directly connected to a Radio Block Center or to a Traffic Management System per se known.
Known Smart Object Controllers are arranged to communicate and exchange data with the other components of a railway instrastructure, however, it is always necessary that the remote station 108 takes care of the security of the whole data exchange, even with the aid of other security components located along the railway track and external to the Smart Object Controller, so as to allow communication with an open network communication system of the architecture.
As a result, there is a high overall number of components and a complexity of the architecture.
In fact, in known railway architectures, all the control logic is concentrated in the remote station 108 (and/or other related components) and the Smart Object Controllers are just « passive » devices, which receive and translate commands and feedbacks to and from the remote station or the trackside equipment.
In order to exchange information with an open network, it is therefore always necessary that the remote station 108 takes care of the security of such data exchange.
There is therefore the need to develop an innovative smart object controller which is capable of interfacing directly with an open network communication system without additional external equipment, thus overcoming the problem of the prior art.
This and other objects are fully achieved by a smart object controller for mounting along a railway track, characterized in that it comprises:

a cybersecurity management module arranged to receive and transmit, from or to a remote station, route control data representing a configuration of the railway track, and to decrypt or encrypt said route control data into safety data;
a safety data processing module arranged to receive and transmit, from or to the cybersecurity management module, said safety data and to convert the safety data into boolean variables and vice versa;
a boolean equation module arranged to receive, from the safety data processing module, the boolean variables, and to execute boolean equations based on said boolean variables, thus obtaining command data to be sent to trackside equipment of the railway track to get said configuration.

According to some embodiments, the smart object controller according to the present invention may comprise one or more of the following features, which may be combined in any technical feasible combination:

the boolean equation module is further arranged to process object indication data received from signalling object management module to confirm the requested configuration to the remote station through the safety data processing module and the cybersecurity management module;
the smart object controller further comprises a signalling object module arranged to receive configuration data from the remote station and command data from the safety data processing module, to elaborate such command data to obtain final command instructions to be sent to trackside equipment of the railway track to get said configuration;
the signalling object management module is further arranged to elaborate trackside indication data received from the trackside equipment to obtain object indication data to be sent to the boolean equation module through the safety data processing module;
the smart object controller comprises a maintenance data processing module arranged to receive from the boolean equation module variable monitoring data representative of the set of boolean variables that has to be monitored and to obtain object monitoring data from the signalling object management module for diagnostic purposes and to transmit maintenance data to the remote station;
the cybersecurity management module implements an Access Protection Layer;
the boolean equation module and the safety data processing module implement a two-out-of-two ("2oo2") safety architecture;
the boolean equation module comprise two processors which execute at the same time, in redundant configuration, the boolean equations.

This and other objects are also achieved by a railway line comprising trackside equipment and a smart object controller above indicated, and in particular as described hereinafter and defined in the appended relevant claims, which is configured to control the trackside equipment.
Preferred embodiments of the invention are specified in the dependent claims, whose subject-matter is to be understood as forming an integral part of the present description.
Further characteristics and advantages of the present invention will become apparent from the following description, provided merely by way of a non-limiting example, with reference to the enclosed drawings, in which:

Figure 1 is a schematic picture of a Regional ERMTS low density architecture ; and
Figure 2 is a block diagram of a smart object controller according to the present invention.

The present invention concerns the delocalization of part of the safety logic on the Smart Object Controller itself, and to interface directly the Smart Object Controller with an open network communication system of a railway infrastructure, without additional external equipment and integrating support functions such as for example cybersecurity or maintenance elaboration.
The Smart Object Controller according to the present invention, in a decentralized architecture, is installed close to trackside equipment of a railway track and manages directly the equipment through a configured local logic.
It is also possible to create a cluster of Smart Object Controllers, each assigned to a section of a railway station, wherein the Smart Object Controllers are capable of communicating each other to coordinate different operations on the trackside equipment so as to implement different « configurations » or « scenarios » communicated from the remote station 108.
In this context, the terms « configuration » or « scenario » are used in an manner equivalent to each other and refer each to a predetermined situation on the railway track including different conditions for various trackside equipment, such as lights, position of level crossings, position of the point machines, etc.
The Smart Object Controller according to the present invention also comprises a cybersecurity module arranged to perform cybersecurity functions, thus providing secure communication on open networks (public network) of the railway infrastructure.
The Smart Object Controller according to the present invention collects and elaborates data concerning the signalling functions of a railway infrastructure, without external additional equipment, and it comprises local logic modules assuring safe trackside equipment management with a redundant configuration.
Thanks to the direct management of the data, consistency between signalling events managed by the Smart Object Controller is assured, helping also maintenance and investigation operations.
Figure 2 shows a block diagram of a Smart Object Controller 2 according to the present invention.
In particular, the Smart Object Controller 2 is arranged to perform a plurality of functions described in detail here below.
A radio block center, a wayside controller and a maintenance system per se known are indicated with reference 6 and are arranged to send to and receive from to a cybersecurity management module 10 of the Smart Object Controller 2 route control data.
These devices 6 are part of or are connected to the remote station 108.
The route control data represent the all set of data applicable to a configuration or scenario of a railway track along with said Smart Object Controller is placed, such as control command data, control indication data, maintenance data.
The route control data represent also the data used to perform remote reprogramming or remote reconfiguration of the Smart Object Controller 2.
The cybersecurity management module 10 is also arranged to receive and transmit, from or to the remote station 108 or any device 6 thereof, maintenance data.
The maintenance data represent for example alarms and measures acquired from trackside equipment 4 elaborated by the Smart Object Controller.
In particular, the cybersecurity management module 10 is arranged to decrypt or encrypt the route control data received from/sent to the remote station 108 or any device 6 thereof into safety data to assure protection from non authorized access.
In order to perform such safety control, an Access Protection Layer is implemented in the cybersecurity management module 10 in a manner per se known. This function allows the Smart Object Controller 2 to directly interface with an open network.
The cybersecurity management module 10 is then arranged to exchange the safety data with te-a safety data processing module 12, to send configuration data related in a manner per se known to the route control data to a signalling object management module 16, and to receive the maintenance data from the maintenance data processing module 18, as detailed here below.
The configuration data defines: the local logic, the commands/indications data flow exchanged with the trackside equipment 4, the parameters to be used for the safety communications and the cryptographic keys for the cyber communications.
Thanks to the cybersecurity management module 10, all data entering or exiting from the Smart Object Controller 2 are protected from cyber attacks.
An encryption is added to the safety data, in order to be able to support public open network communication.
The safety data processing module 12 is arranged to receive, from the cybersecurity management module 10, the safety data, which are data related to the control commands sent by the remote station 108 and which represent different configurations.
The safety data processing module 12 is also arranged to transmit, to the cybersecurity management module 10, the safety data which are data related to the indications received by the trackside equipment 4 through signalling object management module 16.
These data are then transmitted to the remote station 108.
The safety data processing module 12 converts, in a manner per se known, the safety data into boolean variables and send such boolean variables to a boolean equation module 14.
The boolean equation module 14 is the core of the Smart Object Controller 2 and represents the implementation of a local logic: it applies a signalling safety principle to the equipment managed by the Smart Object Control 2 such as the trackside equipment 4.
The boolean equation module 14 is able to execute boolean equations per se known assuring adherence to a local logic defined by a predetermined application represented by such equations. This is a safety related function ("SIL4").
The boolean equation module 14 represents the added value of the Smart Object Controller 2 according to the present invention.
The delocalization of the logic inside the Smart Object Controller 2 permits to reduce the response time because the Smart Object Controller 2 directly controls the trackside equipment 4 and reacts in autonomy, applying a safe principle as configured.
The boolean equation module 14 is realized by a redundant architecture where each single section (active section and stand-by section) performs a configurable cyclic process split in four phases :

input phase : boolean variables are read from the safety data processing module 12 and from the trackside equipment 4 through a signalling object management module 16 and a safety data processing module 12;
output phase : boolean variables are written into the safety data processing module 12 and routed through signalling object management module 16 to the trackside equipment 4; output boolean variables representing indications can also be trasmitted to one or more of devices 6 basing on configuration
equation computation phase : based on the input variables read in the previous phase.
redundancy management phase : alignment of the redundant boolean equation outputs and internal states.

The active section transmits these said data to the stand-by section and to the safety data processing module 12, the stand-by section receives them and overwrite its internal data to be ready in case of switch-over avoiding a temporary loss of the safety data during boards switches.
In particular, the boolean equation module 14 receives from the safety data processing module 12 the boolean variables and executes the boolean equations, based on such boolean variables.
The boolean equations are predetermined equations defined in a configuration phase of the boolean equation module 14, to cover specific functions and fulfilling specific safety requirement.
As a result, the boolean equation module 14, after appropriate further elaborations here below detailed, calculates all the variables and transmits variables to be monitored (variable monitoring data) to the maintenance data processing module 18, thus obtaining command data to be or commands to be transmitted to the trackside equipment 4,
The boolean equation module 14 is also arranged to process object indication data received from a signalling object management module 16 to confirm the requested configuration to the remote station 108 through the safety data processing module 12 and the cybersecurity management module 10.
In this way, the boolean equation module 14, finally transmits indications, through the safety data processing module 12, and cybersecurity management module 10 to the remote station 108, to get and confirm the configuration required by the route control data.
Each section of the boolean equation module 14 (active and stand-by) and the safety data processing module 12 are based on a two-out-of-two ("2oo2") safety architecture providing two processors, which execute at the same time the boolean equations and cross-check of the results obtained.
In particular the cross check of the results is obtained through a two-out-of-two ("2oo2") vote of a CRC result computed on the whole set of the boolean variables.
The boolean equation module 14 sends these variables monitoring data, representative of the set of boolean variables that has to be monitored, to the maintenance data processing module 18.
The maintenance data processing module 18, which is a standard module, is also configured to obtain object monitoring data from the signalling object management module 16 for diagnostic purposes and to transmit maintenance data to the remote station 108.
The signalling object management module 16, after having received the control object data coming from the safety data processing module 12, and the configuration data received from the cybersecurity management module 10, elaborates, in a manner per se known, such data to obtain final command instructions to be sent to trackside equipment 4, such as a signal device, a point machine or a relay, to activate and control such devices and get the requested configuration.
In particular, the signalling object management module 16 is also arranged to elaborate trackside indication data received from the trackside equipment 4 to obtain object indication data to be sent to the boolean equation module 14 through the safety data processing module 12.
Thus, the signalling object management module 16 detects the trackside equipment and provides to the safety data processing module 12 the indication data to be elaborated by the boolean equation module 14 and combines route control indication data to confirm the requested configuration status.
The signalling object management module 16 performs therefore a trackside equipment management, in a manner per se known, based on the controls calculated by the boolean equation module 14.
All the data exchanged with the Smart Object Controller 2 are transformed, in a manner per se known, into digital/analogic signals according to the components involved in the respective function.
The system of the present invention permits to manage complete functional blocks dislocated remotely along a railway line.
The Smart Object Controller 2 according to the present invention manages autonomously complex functions, such as for example the level crossing function, by managing directly level crossing signals, barriers, acoustic warning and axle counters.
It is not necessary to involve the Route Control Signaling system (the remote station 108), because the Smart Object Controller 2 is capable of directly manage route information derived from other Wayside Controller or from a Radio Block Center, through a wireless encrypted communication.
Thanks to this new functionality the response time to activate/deactivate the trackside equipment or the reaction time in case of degraded mode is reduced and globally the reaction of the system is enhanced.
The main advantages of the invention can be summarized as follows :

reduction of more than 50% on the system response time due to the local logic management;
reduction of more than 10% on cost of field cables, and sharing components and services such as power supply distribution, diagnostic and network connectivity thanks to the standardization of the Smart Object Controller.

Clearly, the principle of the invention remaining the same, the embodiments and the details of production can be varied considerably from what has been described and illustrated purely by way of non-limiting example, without departing from the scope of protection of the present invention as defined by the attached claims.

Claims

A Smart Object Controller (2) for mounting along a railway track, characterized in that it comprises:
- a cybersecurity management module (10) arranged to receive and transmit, from or to a remote station (108), route control data representing a configuration of the railway track, and to decrypt or encrypt said route control data into safety data;

- a safety data processing module (12) arranged to receive and transmit, from or to the cybersecurity management module (10), said safety data and to convert the safety data into boolean variables and vice versa;

- a boolean equation module (14) arranged to receive, from the safety data processing module (12), the boolean variables, and to execute boolean equations based on said boolean variables, thus obtaining command data to be sent to trackside equipment (4) of the railway track to get said configuration.
The Smart Object Controller (2) according to claim 1, wherein said boolean equation module (14) is further arranged to process object indication data received from signalling object management module (16) to confirm the requested configuration to the remote station (108) through the safety data processing module (12) and the cybersecurity management module (10).
The Smart Object Controller (2) according to claim 1 or 2, further comprising a signalling object management module (16) arranged to receive configuration data from the remote station (108) and command data from the safety data processing module (12), to elaborate such command data to obtain final command instructions to be sent to trackside equipment (4) of the railway track to get said configuration.
The Smart Object Controller (2) according to claim 3, wherein said signalling object management module (16) is further arranged to elaborate trackside indication data received from the trackside equipment (4) to obtain object indication data to be sent to the boolean equation module (14) through the safety data processing module (12).
The Smart Object Controller (2) according to claim 4, comprising a maintenance data processing module (18) arranged to receive from the boolean equation module (14) variable monitoring data representative of the set of boolean variables that has to be monitored and to obtain object monitoring data from the signalling object management module (16) for diagnostic purposes and to transmit maintenance data to the remote station (108).
The Smart Object Controller (2) according to any of the preceding claims, wherein the cybersecurity management module (10) implements an Access Protection Layer.
The Smart Object Controller (2) according to any of the preceding claims, wherein the boolean equation module (14) and the safety data processing module (12) implement a two-out-of-two (2oo2) safety architecture.
The Smart Object Controller (2) according to any of the preceding claims, wherein the boolean equation module (14) comprise two processors which execute at the same time, in redundant configuration, the boolean equations.
A railway line comprising trackside equipment (4), characterized in that it further comprises a Smart Object Controller (2) according to one or more of the preceding claims configured to control the trackside equipment (4).