EP4650247A1

EP4650247A1 - Railway vehicle monitoring and signalling system and method

Info

Publication number: EP4650247A1
Application number: EP25175593.0A
Authority: EP
Inventors: Simon Chadwick; Michael Chapman; Mark Ferrer; Mark Thomas
Original assignee: Siemens Mobility Ltd
Current assignee: Siemens Mobility Ltd
Priority date: 2024-05-17
Filing date: 2025-05-12
Publication date: 2025-11-19
Also published as: GB2641130A; GB202407071D0

Abstract

A railway vehicle monitoring and signalling system arranged to validate SIL2 reported data for input into a SIL4 ETCS system, and a method of validating the SIL2 reported data are described.

Description

The present invention relates to a railway vehicle monitoring and signalling system and a computer-implemented method of validating SIL2 level signalling and/or track data reported by trackside train detection devices located alongside a railway track to generate Movement Authorities (MA) in an ETCS (European Train Control System) signalling system, in particular a system and method wherein the trackside train detection devices include trackside relay logics.

The European Train Control System (ETCS) is the signalling and control component of the European Rail Traffic Management System (ERTMS). It is designed to replace the various legacy signalling systems in place across Europe, ensuring a common standard. In addition, it has been adopted as an option globally, and offers Positive Train Control (PTC) in various locations across the world. There are currently three numbered levels of ETCS, based upon the extent of cab-based signalling versus trackside equipment in the train control process. The levels are as follows:

Table 1: ETCS levels

Level	Description
0	ETCS compliant rolling stock does not interact with trackside equipment
NTC	ETCS-compliant train rolling stock is provided with additional Specific Transmission Modules (STM) to interact with legacy signalling systems under National Train Control (NTC)
1	ETCS trackside equipment is installed and spot transmission of data between trackside equipment and rolling stock via balises takes place
2	As level 1 but signalling information is provided by continuous transmission with a Radio Block Centre (RBC) via GSM-R (Global System for Mobile Communication - Railway), with balises used to detect train position

Level 1 is a cab-signalling system that is often superimposed on existing signalling systems. The balises are electronic beacons or transponders placed between the rails of the railway track that provide data as a train passes over via an uplink. A fixed balise is programmed to provide the same information to every train, and a programmable balise is used to transmit data to a train from a Lineside Electronic Unit (LEU) as part of ETCS Level 1 signalling control. Balises are installed in pairs so that the direction of travel can be indicated by the order in which the balises are detected.
An ETCS signalling design specifies the locations in which the balises are installed. In a Level 1 system, the balise installation points are determined by the position of the existing signalling system, as indicated in Figure 1. Figure 1 is a schematic diagram of the interaction between an ETCS design and an existing signalling system. A railway track 1 comprises two rails 2 (of which one is shown) mounted on sleepers 3 resting on ballast 4. A signal 5 is provided at the start of a track section, along with an interlocking 6. A balise 7 is provided close to the signal 5. An approaching train 8 is provided with an ETCS Balise reader 9 and a GSM-R antenna 10. As the train 8 approaches the signal 5, the balise 7 provides details of its location and the state of the signal 5 based on interaction with the interlocking 6. As the train 8 passes though the signal 5 and over the train detection section boundary 11, the interlocking 6 detects the train movement and the aspect of the signal 5 is changed.
Longer term, moving to an ETCS Level 2 signalling system, with or without trackside signals and/or ATO (Automatic Train Operation) is greatly desirable. The transition to a cab-based signalling system rather than a lineside-based signalling system brings significant benefits including improved safety, increased performance, reduced cost and lower environmental impact. However, the path to achieving a system that does not rely on lineside signalling is not clear. For example, moving to ETCS Level 2 requires the fitting of essential equipment into thousands of train cabs as well as training tens of thousands of train drivers. Although new trains can be fitted with the equipment or trains retrofitted with the equipment required, train drivers must refresh their training and knowledge regularly in order to maintain their competence in driving using such equipment.
One solution to this issue is to overlay an ETCS system onto a legacy signalling system, such as NTC (National Train Control). Attempting to include ETCS capability in existing SSI and RRI interlockings comes with technical challenges due to the memory capacity and/or complexity of these systems. Although it is more likely that such functionality may be added into a more modern interlocking these account for a much smaller number of interlockings throughout the United Kingdom, for example, than the older SSI and RRI equipment. Providing ETCS functionality is typically done therefore by re-signalling the route to provide either ETCS alone or a combination of ETCS signalling and legacy signalling along the route, re-engineering the existing SSI (Solid State Interlocking) and RRI (Trackside relay logic) systems. The cost of re-signalling however may run into hundreds of millions of GBP and require a huge amount of time and resources depending upon the route(s) being re-signalled. Consequently, whilst this is the preferred solution for some routes, it may not always be possible to justify for every route in a move towards cab-based signalling. It also does not deal with the issue of re-equipping trains with the equipment required to communicate with a Radio Block Centre or with the need to train so many train drivers.
A further issue is dealing with track sections where RRIs (Trackside relay logic) systems are used. These are often part of the implementation of an auto section, where plain track sections of railway are more or less autonomous, with the signal aspects determined by local logic at the trackside. This is illustrated further in Figure 2. Figure 2 is a schematic diagram of an auto section of a railway implemented using trackside relay logics. The auto section 20 comprises a stretch of railway track 21 divided into track sections TA, TB, TC, TD, TE, TF, TG, TH, and signal sections 22, each delimited by a pair of signals S1, S3, S5, S7 and containing two track sections. The direction of travel shown is from left to right. A train 23 is illustrated as being within the signal section 22 delimited by the signals S5 and S7. Signal S7 is showing a proceed aspect (green), signal S5 is showing a do not proceed aspect (red), signal S3 is showing a yellow aspect, and signal S1 is showing a green aspect. As the train 23 advances along the railway track 21, the logic required for the signalling sequences is implemented in wiring laid alongside the railway track 21. For the purposes of being able to overlay an ETCS system onto such an auto section, it is necessary to be able to access the data inputs and outputs of the signals and trackside train detection devices. However, in an auto section there is no input/output available the central interlocking, making a traditional ETCS overlay scheme very difficult to implement. Any track indications available at a Radio Block Centre will be at SIL2 and relate to non-safety attributes and therefore cannot be used for determining signal aspects and generating Movement Authorities, since these require SIL4 input data. SIL is an acronym for Safety Integrity Level, and the four levels are defined in IEC 61508. Rail specific definitions are found in EN50128 (railway applications, - software for railway control and protection), EN 50129 (railway applications - safety related electronic systems for signalling) and EN 50657 (railway applications - software on board of rolling stock). As a general rule, data having a lower SIL cannot be used in functions requiring input data with a higher SIL. For example, SIL2 cannot be used directly as an input to a SIL4 system, such as ETCS. It is therefore desirable to be able to implement an ETCS overlay scheme in an auto section of a railway with the minimum possible infrastructure changes.
The present invention aims to address these issues by providing a railway vehicle monitoring and signalling system comprising: trackside train detection devices and signals located alongside a railway track and capable of indicating the presence or absence of a train in an associated track section of the railway track, the trackside train detection devices being adapted to report data regarding the presence or absence of a train as SIL2 reported data and the signals being adapted to report a signal state as SIL2 reported data;

a processor adapted to perform conditional analysis to validate SIL2 data reported by the trackside train detection devices and/or signals, wherein the validated SIL2 reported data corresponds to SIL4 input data required to issue a Movement Authority; and
communication means linked to each of the trackside train detection devices and signals adapted to communicate the SIL2 reported data reported by the trackside train detection devices and signals to the processor.

By utilising the SIL2 data already available in legacy railway and signalling systems such as NTC, rather than converting the entire track section to work with the higher level SIL4 data associated with ETCS, a successful overlay of an auto section of track implemented using trackside relay logic can be achieved.
Preferably, the trackside train detection device is a track circuit.
Preferably, the communication means are one of: a communications network, a copper cable, a fibre optic cable or a radio.
The present invention also provides a computer-implemented method of validating SIL2 level signalling and/or track data reported by trackside train detection devices and/or signals located alongside a railway track to generate Movement Authorities (MA) in an ETCS (European Train Control System) signalling system, comprising: gathering SIL2 reported data for signals and/or tracks as reported by trackside train detection devices and/or signals located alongside a railway track, the input data indicating the reported state of a signal or a track section; validating the SIL2 reported data of the signal or track section using conditional analysis to produce validated SIL2 reported data that corresponds to SIL4 input data in an ETCS signalling system; and generating a Movement Authority relating to the signal or track on the basis of the validated SIL2 reported data of the signal or track section.
Preferably, the validated SIL2 reported data for a signal state is proceed and the validated SIL2 reported data for a track state is clear.
Preferably, if the SIL2 reported data indicates the reported state of a signal, then for each signal the conditional analysis comprises determining whether the signal has a proceed aspect that is usable as SIL4 input data.
Preferably, if the trackside train detection devices report SIL2 reported data indicating the reported state of a track section, then for each signal the conditional analysis comprises determining whether the track section has a clear track state that is usable as SIL4 input data.
The steps of gathering and validating and generating may be carried out trackside by a processor installed in a trackside device. Alternatively, all steps may be carried out at a Radio Block Centre (RBC), and wherein the method further comprises communicating SIL2 data to the Radio Block Centre (RBC).
Preferably, the trackside train detection devices include a trackside relay logic.
Preferably, the track section is an auto section.
The present invention will now be described by way of example only, and with reference to the accompany drawings, in which:

Figure 1 is a schematic diagram of the interaction between an ETCS design and an existing signalling system;
Figure 2 is a schematic diagram of an auto section of a railway implemented using trackside relay logics;
Figure 3 is a schematic diagram of a railway vehicle monitoring and signalling system;
Figure 4 is a flowchart illustrating a computer-implemented method of validating SIL2 level signalling and/or track data in accordance with embodiments of the present invention;
Figure 5 is a flowchart illustrating a second embodiment of a computer-implemented method of validating SIL2 level signalling and/or track data;
Figure 6 is a flowchart illustrating a third embodiment of a computer-implemented method of validating SIL2 level signalling and/or track data; and
Figure 7 is a flowchart illustrating a first embodiment of a computer-implemented method of validating SIL2 level signalling and/or track data.

The embodiments of the present invention take the approach that the validation of SIL2 data can be used to create the SIL4 input data required by a Radio Block Centre (RBC) to generate a Movement Authority. Such a railway vehicle monitoring and signalling system comprises trackside train detection devices located alongside a railway track, which are capable of indicating the presence or absence of a train in an associated track section of the railway track. The trackside train detection devices are also adapted to report data regarding the presence or absence of a train as SIL2 data. A processor is provided, either in a trackside train detection device or at a Radio Block Centre, and adapted to perform conditional analysis to validate SIL2 data reported by the trackside train detection devices and signals. This validated SIL2 data corresponds to SIL4 input data required to issue a Movement Authority. Communication means are linked to each of the trackside train detection devices and adapted to communicate the SIL2 data reported by the trackside train detection devices to the processor. Using the processor enables a computer-implemented method of validating the SIL2 level signalling and/or track data reported by trackside train detection devices located alongside a railway track to generate Movement Authorities. This is done by first gathering SIL2 reported data for signals and/or tracks as reported by trackside train detection devices located alongside a railway track, the input data indicating the reported state of a signal or a track section. Then, the SIL2 reported data of the signal or track section is validated using conditional analysis to produce validated SIL2 reported data that corresponds to SIL4 input data in an ETCS signalling system. Finally, a Movement Authority relating to the signal or track on the basis of the validated SIL2 reported data of the signal or track section is generated. These and other features of the embodiments of the present invention are discussed in more detail below.
Figure 3 is a schematic diagram of a railway vehicle monitoring and signalling system. The railway vehicle monitoring and signalling system 30 is provided alongside an auto section of a railway line 31 under the control of trackside relay logic 32. An auto section is one where the trackside relay logic 32 is operated without the need for an operator, since, providing there are no conflicting movements of other trains in progress, the approach of the train sets its own interlocking. The auto section of railway line 31 is divided into signal sections 33 and track sections 34. The signal section 33 illustrated is delimited by two signals S_x and S_y, each of which is linked to a controller 35_x, 35_y. The signal section 33 is divided into two track sections 34, each of which is delimited by two trackside train detectors 36, which in this example are track circuit. The trackside relay logic 32 is linked to other trackside relay logics (not shown), the signals S_x, S_y and the track circuit 36 by a communication means 37, which in this case is a wire connection, such as a copper cable. A second communication means 38, which is preferably one of a communications network (such as a Local Area Network, LAN), a copper cable, a fibre optic cable or a radio (Such as GSM-R) is provided to enable communication of reported date and/or the results of the conditional analysis to a Radio Block centre 39 is also provided.
In some embodiments of the present invention, it may be desirable to include a processor for carrying out data gathering and analysis at the lineside. In this situation, a processor 40 may be installed into a control housing of the trackside relay logic 32, and provided with communication means 41 with which to send reported data and/or the results of the conditional analysis to the Radio Block Centre 39. Alternatively, in some embodiments of the present invention, this processor 40 may be provided at the Radio Block Centre 39.
The additional communication means 38, on a legacy auto section of railway line 31 equipped with trackside relay logic may be installed easily, either by laying additional cable or providing each controller 35x, 35y, trackside train detection device or trackside device with the ability to utilise wireless communication, such as cellular, radio or LAN. In each case the radio connection is a GSM-R (Global System for Mobile Communications - Railway) radio connection, and the cellular network is whatever is available locally (3G, 4G, 5G, for example). A LAN (Local Area Network) may be provided using either copper cabling or by utilising existing fibre optic cabling installed alongside the railway track and used in signalling. As well as delimiting track sections 34 by using track circuits, it is also possible to do this using axle counters. Where ana track circuit detects a train travelling over or past by means of the disturbance of a magnetic field from magnets installed on the rails of the railway track, a track circuit operates by using the contact between the train wheels to create an electrical short circuit. Both devices indicate the presence or absence of a train within a particular track section 34, and both will indicate the presence of a train should a failure occur (both are therefore fail-safe devices).
Figure 4 is a schematic representation of a computer-implemented method of validating SIL2 level signalling and/or track data in accordance with embodiments of the present invention. The data is reported by trackside train detection devices located alongside a railway track and used to generate Movement Authorities (MA) in an ETCS (European Train Control System) signalling system. The method 400 begins with gathering SIL2 signalling and/or track input data reported by trackside train detection devices located alongside a railway track at step 402. This input data is the input data indicating the reported state of a signal or a track section. At step 404A, B, SIL2 signalling and/or track input data is separated according to type and routed to one of two conditional analysis processes, illustrated in further detail in Figures 5, 6 and 7. Reported track states (occupied or clear) are sent, at step 406A, to one of the conditional analysis processes shown in Figures 5 and 6. Reported signal states (LampProved, aspects) are sent, at step 406B, to the conditional analysis process illustrated in Figure 7. This enables the reported state of the signal or track section to be validated using a conditional analysis to produce a SIL2 validated state that corresponds to SIL4 input data in an ETCS signalling system. At step 408A, B, data is received from the respective conditional analysis process, and indicates either the track states (step 408A) or the signal states (step 408B) for SIL4 data. For example, track states for SIL 4 may be occupied, unknown or clear, and signal states may be proceed or not proceed. At this point, the track states may be provided to the conditional analysis process illustrated in Figure 7 as an additional input. Once the SIL4 data is generated, it is combined with relevant central interlocking data at step 410 and transmitted to a SIL4 system (the RBC) at step 414. At this point, the data received at the RBC corresponds to the SIL4 input data required to issue a Movement Authority relating to the signal or track on the basis of the SIL2 validated state of the signal or track section. Validated SIL2 reported data for a signal state is therefore proceed and the validated SIL2 reported data for a track state is clear. By validating the state of the SIL2 data received from the trackside train detection devices the issues around the use of data with a lower SIL, such as SIL2, being used as input data in a system with a higher SIL, such as SIL4, are negated, as the validation of the data effectively raises the SIL due to the conditional analysis used.
Figure 5 is a flowchart illustrating a first embodiment of a computer-implemented method of validating SIL2 level signalling and/or track data. The method 500 outlines the conditional analysis required to determine whether or not a train can proceed based upon the validation of SIL2 reported data indicating whether a track section is clear, from step 406A of Figure 4. The analysis is separated into SIL2 reported data on the left and SIL4 input data on the right. The method begins, at step 502, with the analysis determining whether the track in the track section is reported as being occupied for each track of a track of a track section. If the answer is yes, then there is no validated SIL2 reported data for a clear track section, and the SIL4 input data is that the track is occupied, such that a Movement Authority cannot be generated. If the answer is no, then at step 504, the analysis determines whether or not the track was treated as being occupied when last evaluated. If the answer to this is no, then the SIL2 reported data for the clear track is validated, and the SIL4 input data is that the track is clear, such that a Movement Authority can be generated. If the answer is yes, then at step 506, the analysis determines whether or not an adjacent track in the track section is occupied. If no, then there is no validated SIL2 reported data for the clear track section, and the SIL4 input data is that the track is occupied, such that a Movement Authority cannot be generated. If the answer is yes, then the SIL2 reported data for the clear track is validated, and the SIL4 data is that the track is clear, such that a Movement Authority can be generated.
Figure 6 is a flowchart illustrating a second embodiment of a computer-implemented method of validating SIL2 level signalling and/or track data. The method 600 outlines the conditional analysis required to determine whether or not a train can proceed based upon the validation of SIL2 reported data indicating whether a track section is clear, from step 406A from Figure 4. Occasionally, the occupancy of the track section may be unknown as the SIL2 reported data reporting ceases to be in correspondence with the SIL4 input data. The analysis is separated into SIL2 reported data on the left and SIL4 input data on the right. The method begins, at step 602, with the analysis determining whether the track in the track section is reported as being occupied for each track of the track section. If the answer is yes, then the SIL2 reported data is not validated as a clear track section, and SIL4 input data is that the track is occupied, such that a Movement Authority cannot be generated. If the answer is no, then at step 604, the analysis determines whether or not the track was treated as being occupied when last evaluated. If the answer to this is no, then the SIL2 reported data for the clear track is validated, and the SIL4 input data is that the track is clear, such that a Movement Authority can be generated. If the answer is yes, then at step 606, the analysis determines whether or not an adjacent track in the track section is occupied. If no, then the SIL2 data is not validated as a clear track section, and SIL4 input data is that the track is occupied, such that a Movement Authority cannot be generated. If the answer is yes, then the SIL2 reported data for the clear track is validated, and the SIL4 input data is that the track is clear, such that a Movement Authority can be generated. However, in this example, if the answer is no, then the track section is treated as having an unknown occupancy by the SIL4 ETCS system as the SIL2 reported data cannot be validated to indicate a clear or an occupied track state.
Figure 7 is a flowchart illustrating a third embodiment of a computer-implemented method of validating SIL2 level signalling and/or track data. The results of the conditional analysis processes outlined in Figures 5 and 6 above may be used as inputs to this embodiment. The method 700 outlines the conditional analysis required to determine whether or not a train can proceed based upon the validation of the signal aspect, and takes place as a series of substeps during step 406B of Figure 4. This is the situation where the SIL2 reported data indicates the reported state of a signal. The analysis is separated into SIL2 reported data on the left and SIL4 input data on the right. Initially, the analysis determines, at step 702, whether the signal lamp is proved, in other words, is the signal lamp lit. If the answer to this is no, then the SIL2 reported data corresponds to a state of not proceed, and the SIL4 input data is that the signal shows do not proceed such that a Movement Authority cannot be generated. If the answer to this is yes, then at step 704, the analysis determines whether all tracks in the signal section are clear. If the answer to this is no, then again, the SIL2 reported data corresponds to a state of not proceed, and SIL4 input data is that the signal shows do not proceed, such that a Movement Authority cannot be generated. If the answer to this is yes, then the analysis determines at step 706 whether this signal shows a proceed aspect. If the answer to this is no, then again, the SIL2 reported data corresponds to a state of not proceed, and the SIL4 input data is that the signal shows do not proceed, such that a Movement Authority cannot be generated. If the answer to this is yes, then, if more than two signal aspects can be reported for the signal, the analysis determines at step 708 whether more than two signal aspects are shown at the trackside. Here, if the answer is no, then the SIL2 reported data is validated and the state of the signal is confirmed as a proceed aspect. Since the SIL2 data has been validated, the SIL4 input data is that the signal shows proceed, and a Movement Authority can be generated. However, if the answer is yes, the then analysis continues at step 710 by determining whether the reported signal aspect matches a pre-set signal aspect such that a proceed aspect is consistent according to aspect sequencing rules, which determines whether or not a proceed aspect is consistent with a forward signal. The reported signal aspect can be compared to a reported forward aspect that is expected for that signal at that particular time. This is illustrated further in Table 2: Table 2: signal aspect correspondence

Reported Signal Aspect Reported Forward Aspect Validated

Y R No

YY Y No

G YY No

G G Yes

(R - red, do not proceed, Y - yellow, proceed slowly with caution, YY - double yellow, proceed slowly, G - green, proceed)

If the result of the comparison is that the SIL2 reported data corresponds to a state of not proceed as the signal aspects from the reported data and the pre-set expectation do not match. The SIL4 input data is that the signal shows do not proceed, and a Movement Authority cannot be generated. If the result of the comparison is that the SIL2 reported data is validated as the signal aspects from the reported data and the pre-set expectation do match, then the SIL4 data is that the signal shows proceed, and a Movement Authority can be generated.
Since, in general, the higher the SIL of a system or data, the more expensive it is to implement, being able to use SIL2 data already available to be reported on an existing legacy railway track is a far more cost-effective and therefore more attractive to implement than a completely new system with SIL4 requirements. By reducing the overall cost of upgrading legacy signalling systems to ETCS, the performance and safety improvements associated with ETCS levels 2 and 3 are readily available. Overall, the sustainability of an existing legacy railway and signalling system is improved, since the need for raw materials, labour, energy and transportation is significantly reduced by employing the embodiments of the present invention.

Claims

A railway vehicle monitoring and signalling system comprising:
trackside train detection devices and signals located alongside a railway track and capable of indicating the presence or absence of a train in an associated track section of the railway track, the trackside train detection devices being adapted to report data regarding the presence or absence of a train as SIL2 reported data and the signals being adapted to report a signal state as SIL2 reported data;

a processor adapted to perform conditional analysis to validate SIL2 data reported by the trackside train detection devices and/or signals, wherein the validated SIL2 reported data corresponds to SIL4 input data required to issue a Movement Authority; and

communication means linked to each of the trackside train detection devices and signals adapted to communicate the SIL2 reported data reported by the trackside train detection devices and signals to the processor.
A railway vehicle monitoring and signalling system as claimed in claim 1, wherein the trackside train detection device is a track circuit.
A railway vehicle monitoring and signalling system as claimed in claim 1 or 2, wherein the communication means are one of: a communications network, a copper cable, a fibre optic cable or a radio.
A computer-implemented method of validating SIL2 level signalling and/or track data reported by trackside train detection devices and/or signals located alongside a railway track to generate Movement Authorities (MA) in an ETCS (European Train Control System) signalling system, comprising:
gathering SIL2 reported data for signals and/or tracks as reported by trackside train detection devices and/or signals located alongside a railway track, the input data indicating the reported state of a signal or a track section;

validating the SIL2 reported data of the signal or track section using conditional analysis to produce validated SIL2 reported data that corresponds to SIL4 input data in an ETCS signalling system; and

generating a Movement Authority relating to the signal or track on the basis of the validated SIL2 reported data of the signal or track section.
A computer-implemented method as claimed in claim 4, wherein validated SIL2 reported data for a signal state is proceed and the validated SIL2 reported data for a track state is clear.
A computer-implemented method as claimed in claim 4 or 5, wherein if the SIL2 reported data indicates the reported state of a signal, then for each signal the conditional analysis comprises determining whether the signal has a proceed aspect that is usable as SIL4 input data.
A computer-implemented method as claimed in claim 4 or 5, wherein if the trackside train detection devices report SIL2 reported data indicating the reported state of a track section, then for each signal the conditional analysis comprises determining whether the track section has a clear track state that is usable as SIL4 input data
A railway vehicle monitoring and signalling system as claimed in any of claims 1 to 3, or a computer-implemented method as claimed in any of claims 4 to 7, wherein the steps of gathering and validating and generating are carried out trackside by a processor installed in a trackside device.
A railway vehicle monitoring and signalling system as claimed in any of claims 1 to 3, or a computer-implemented method as claimed in any of claims 4 to 8, wherein all steps are carried out at a Radio Block Centre (RBC), and wherein the method further comprises communicating SIL2 data to the Radio Block Centre (RBC).
A railway vehicle monitoring and signalling system as claimed or a computer-implemented method as claimed in claim 9, wherein the track section is an auto section equipped with trackside relay logic.