ES2919925T3 - Train traffic control system and method for carrying out safety-critical operations within a train traffic control system - Google Patents

Abstract

A train traffic control system comprising a traffic management system (TMS) to execute safety critical operations, a route and route control system (RTCS) and a command and status adapter (cost), in the that the train traffic control system is adapted to exchange information and commands between the traffic management system (TMS) and the route and train control system (RTC), in which the command and status adapter (COST ) comprises software components to perform functions with basic integrity, wherein the traffic control system further comprises software The component to perform a function to control critical security operations is characterized in that the function to control critical security operations are outsourced from the command and state adapter (cost). The inventive train traffic control system, on the one hand, realizes a high level of safety and, on the other hand, enables considerable cost reduction. (Automatic translation with Google Translate, without legal value)

Description

DESCRIPTION

Train traffic control system and method for carrying out safety-critical operations within a train traffic control system

Background of the invention

The invention relates to a train traffic control system comprising a traffic management system to execute safety-critical operations, a route and train control system, and a command and status adapter, where the system The train traffic control system is adapted to exchange information and commands between the traffic management system and the route and train control system through the command and status adapter, and wherein the command and status adapter comprises components of software for performing functions with basic integrity, wherein the traffic control system further comprises at least one software component for performing a function for the control of safety-critical operations. The invention also relates to a method for carrying out safety-critical operations within a train traffic control system.

A corresponding train traffic control system is known from [1].

Route and train control systems are adapted to safely manage routes and movement authorities on the railway network for running trains and to control, protect and protect trains from running too fast or beyond your movement authority limit. Route and train control systems may comprise an interlocking system, a radio jamming center or a similar system.

Remote control through Operational/Traffic Control Centers to control interlocking systems and other route and train control systems is becoming increasingly important. A long known situation in traffic management systems in Traffic/Operational Control Centers is that several different (legacy) interlocking systems need to be controlled/monitored at a remote operator's workplace. Examples of this case are the systems in Finland [1], for the metro systems in Munich [2] or for the German Main Railway DB [3]. Typically, special adapter modules (command and status adapter) have been developed like the SAM or SCM modules in [1] or the FL90 product in [3], which cover all the necessary functionality in a system.

The different route and train control systems, which have to be controlled by the remote operator, transmit status information to the traffic management system in the form of specific protocols. The command and status adapter (COST adapter) converts the specific protocols into generic protocols and provides the status of the route and train control system for further processing by the traffic management system in a standardized form. Also, it converts operational commands to the specific format of a specific route and train control system.

The traffic management system comprises a human-machine interface for operating the route and train control system by a human operator. The route and train control system receives commands from the traffic management system concerning regular operation as well as concerning safety-critical operations for supervision of an approval procedure. Safety-critical operations are carried out in special operational situations or in the event of disturbances using the route and train control system. Unlike regular operations whose admissibility can be checked at any time by the train control system, safety-critical operations are instructed by the operator while elements of the route and train control system (e.g. , radio lock center or interlock system). Safety-critical operations are operator actions, eg, safety-critical path clearance, safety-critical point change, etc., ie the operator can bypass a secure system configuration.

Since the control of security-critical operations is related to security, high security requirements have to be met when developing the COST adapter. According to [1], COST adapters are developed on the basis of fail-safe computer systems (for example, such as SAM or SCM based on the TAS-PLF system patented by Thales). However, this results in high hardware costs for this dedicated computer and also high software development, integration and testing costs, because all these components have to be developed to a high Safety Integrity Level (typically SIL4) according to the standard EN 50128 [4].

[5] describes a computer interlocking system as well as a method for describing errors when displaying information concerning auxiliary controls (Hilfsbedienungen). The system comprises an operating channel with SIL 0 and a reference channel with a higher SIL level. The operating channel is used to send auxiliary operating instructions to the ESTW latch. The reference channel provides the screen backup. For this purpose, there is a data link between the operating channel and the reference system, through which item-specific details of items relevant to the operation can be requested and transmitted. The reference frame reads a relevant image section from the screen and uses it to form a checksum, which is compared to a checksum of the working channel's process state data. This allows the operating channel to have a SIL level of 0.

[6] refers to the monitoring of the execution of regular operations by the control system. [6] teaches how to ensure that regular operations are carried out correctly as long as an exceptional situation does not occur, such as a malfunction of a monitoring device.

Object of the invention

Therefore, it is an object of the invention to suggest a train traffic control system that, on the one hand, realizes the required high level of security and, on the other hand, allows a considerable cost reduction.

Description of the invention

This object is solved by a train traffic control system according to claim 1 and a method according to claim 10.

According to the invention, the function for controlling safety-critical operations is outsourced from the command and status adapter (COST adapter). That is, security-related functions (function to control critical security operations) are functionally separate from functions with basic integrity and can (but do not have to) be installed in separate locations. The COST adapter is developed according to SIL0, which is much cheaper compared to the high security level COST adapter known from the state of the art. Thus, the inventive traffic management system enables execution of safety-critical operations for a safety-critical system from an operator station at reduced cost.

In a special embodiment, the function for controlling safety-critical operations is integrated in the route and train control system. No additional computer is required. This makes this embodiment especially profitable. However, an additional function has to be integrated in all route and train control systems, which have to be managed by the traffic management system.

In an alternative embodiment, the system further comprises a controller, which is separate from the command and status adapter (COST), where the function to control safety-critical operations is integrated in the controller. The controller is adapted to control safety-critical operations. No additional functions have to be integrated into the route and train control system. Therefore, the command and state adapter of foreign companies can be used.

According to the invention, the command and status adapter has a security level SIL=0. Due to the low level of security, command and status (COST) adapters can be provided at low cost.

In a highly preferred variant, the traffic control system comprises route and train control systems of different types, for example, electronic interlocking systems and relay-based interlocking systems or interlocking systems produced by different companies.

Preferably, the software components to perform functions with basic integrity for the different types of route and train control systems are provided within one (the same) computer. Due to the low level of security, which is required for the command and status adapter of the present invention, only little power is required to operate the command and status adapter. Thus, various functions with basic integrity for different types of route and train control systems can be powered by the same computer.

In a highly preferred embodiment, the controller is adapted to control safety-critical operations for all types of route and train control systems of the traffic control system.

At least one of the basic integrity functions is integrated into the traffic management system. Corresponding software components can be integrated into an operator workstation. The traffic management system then comprises at least parts of the COST adapter. In case all the functions with basic integrity are integrated in the traffic management system, no separate computer is required for the command and status adapter.

It is preferred that the command and status adapter comprises a decryptor. This enables the transmission of encrypted messages comprising information concerning security-critical operations through the command and status adapter, thereby ensuring that the command and status adapter cannot unintentionally modify the message. Within the command and status adapter, the decryptor is preferably arranged on the output side.

Alternatively, the decryption of the messages can be carried out within the route and train control system.

Message encryption can be done within the controller (if applicable). In this case, the controller comprises an encryptor.

In a preferred embodiment, the functions with basic integrity comprise the function of adaptation of regular operations and/or the function of adaptation of a state of the control system of routes and trains, and/or the function of conversion of protocols to be transmitted between the route and train control system, and the traffic management system.

The invention also relates to a method for carrying out safety-critical operations within a train traffic control system comprising a traffic management system, a route and train control system, and a command adapter. and status, the method comprising the steps of claim 10. According to the invention, safety-critical operations are controlled outside of the command and status adapter, i.e., in a component dedicated to performing a function to control the safety-critical operations.

Preferably, the messages are transmitted through the command and status adapter. Only one interface is required in the route and train control system.

In a first variant, safety-critical operations are controlled within the route and train control system.

In a second variant, safety-critical operations are controlled within a controller, which is separate from the command and state adapter.

The inventive architectural principle of separation of basic integrity components (SIL0) and safety-related components (SIL>0) enables cost-effective control of different types of route and train control systems.

Additional advantages can be derived from the description and the attached drawing.

The mentioned embodiments are not to be understood as an exhaustive enumeration but are rather exemplary for the description of the invention.

Drawings

The invention is shown in the drawing.

Fig. 1 shows the architecture of a traffic control system according to the state of the art.

Fig. 2a shows the architecture of a traffic control system according to the invention, where the function for controlling safety-critical operations is integrated in the route and train control system.

Fig. 3b shows the architecture of a traffic control system according to Fig. 2a with multiple types of route and train control systems.

Fig. 3a shows the architecture of a traffic control system according to the invention, where the function for controlling safety-critical operations is integrated in a separate controller. Fig. 3b shows the architecture of a traffic control system according to Fig. 3a with multiple types of route and train control systems.

Fig. 1 shows an architecture of a traffic control system to execute safety-critical operations according to the state of the art. An RTCS train and route control system is connected to a TMS traffic management system. Status information and commands are exchanged between the traffic management system TMS and the route and train control system TRCS. Since the traffic management system TMS and the route and train control system RTCS are generally not compatible concerning the type of executable protocols, a COST' command and status adapter comprising functions for protocol conversion, adaptation of operations schedules, adaptation of the status of the RTCS route and train control system and control of safety-critical operations. The COST' command and state adapter. In order to ensure the required security, the COST command and status adapter has to be developed at a high security level (SIL>0).

According to the invention, the function to control safety-critical operations is separated/outsourced from the COST command and status adapter and provided separately. Therefore, functions related to security and functions with basic integrity are separated. According to the invention, the COST command and status adapter does not understand safety-related functions, but only understands functions with basic integrity and is therefore developed at a lower safety level SIL0.

Fig. 2a shows the architecture of a first embodiment of the inventive traffic control system with a modified COST command and status adapter. The COST command and status adapter according to the invention comprises software components in order to carry out the function of adapting regular operations of the route and train control system, the function of adapting a state of the route control system and trains to the internal data model of the traffic control system, and the conversion function of information protocols/commands to be sent from the traffic management system TMS to the route and train control system RTCS from a generic protocol to a specific protocol and convert information protocols to be sent from the route and train control system RTCS to the traffic management system TMS from a specific protocol to a generic protocol respectively.

The safety-critical operations control function is integrated into the RTCS train and route control system (instead of the COST' command and status adapter). That is, the software components that control safety-critical operation are transferred to the RTCS. The remaining functionality of the COST command and state adapter is no longer security related. Thus, the COST command and status adapter is developed according to SIL0, which drastically reduces the cost compared to the COST' command and status adapter known from the state of the art.

Fig. 2b shows a suitable architecture for a traffic control system comprising multiple types of RTCS train and route control systems (type 1,..., type n). Only one COST command and status adapter comprising the required software components (functions for regular operation adaptation, status adaptation and for protocol conversion) is required for a multitude of types, preferably for all types of control systems of RTCS routes and trains, which are connected to the respective TMS traffic management system.

This first embodiment is particularly interesting for RTCS train and route control systems that are built by the same manufacturer as the other components of the traffic control system.

In the case of an existing RTCS train and route control system that cannot be modified (for example, because it was built by a third party), a second embodiment of the inventive traffic control system is preferable, as shown in Fig. 3a. In this case, an additional computer (CTRL controller) is provided and the software component that controls the safety-critical operation is built into the CTRL controller. The CTRL controller is connected to the TMS traffic management system to exchange commands/information in the form of generic protocols. The information exchange procedure between the CTRL controller and the TMS traffic management system verifies that the correct safety critical operation will be executed. The result of this check, i.e. the successful safety critical operation, is sent from the CTRL controller via the COST command and status adapter to the RTCS train and route control system, usually in an encrypted format, so that an unintentional modification by the COST command and status adapter (which is implemented only with SIL0) can be detected by the RTCS train and route control system. Although this does not reduce hardware costs, it does reduce software development, integration, and testing costs for the command and state adapter components COST.

Fig. 3b shows a suitable architecture for a traffic control system comprising multiple types of RTCS train and route control systems (type 1,..., type n). Analogously to Fig. 2b, only one COST command and state adapter comprising the required software components (functions for regular operation adaptation, state adaptation, and for protocol conversion) is required for a multitude of types, preferably for all types of RTCS train and route control systems, which are connected to the respective TMS traffic management system. In addition, only one CTRL controller comprising the software component is required to control safety-critical operations for the multitude of RTCS train and route control systems.

In both embodiments, the remaining functionalities within the COST command and status adapter are adapted to transmit only the messages concerning safety-critical operation (rather than transmit and process). In other words, concerning safety-critical operation commands, the COST command and status adapter according to the invention functions as a "transparent channel". Otherwise, the "Control Safety Critical Operation" function would not be able to detect any incorrect behavior with the required safety integrity.

In case multiple types of RTCS train and route control systems need to be connected, in particular multiple types of interlocking, either multiple COST command and status adapters or one command and status adapter have to be developed and provided. COST comprising a multitude of adaptation and conversion functionalities (as shown in Fig. 2b and Fig. 3b). Therefore, the effort savings (based on the inventive development of SIL0) will increase by a factor depending on the number of types of RTCS train and route control systems, because for each type, the state adaptation and regular operation, as well as the protocol conversion can now be developed according to SIL0.

Documents cited

[1] Meier et al.

Kompakte Mensch-Maschine-Schnittstelle (Compact HMI)

Signal & Draht (95) 7+8/2003

[2] WeiB et al.

Innovative Fernsteuerung von Alcatel für die U-Bahn München,

Signal & Draht (92) 7+8/2000

[3] Rahn et al.

Anschluss von Relaisstellwerken an Betriebszentralen

Signal & Draht (95) 10/2003

[4] Standard EN50128, 2011

[5] DE 102012221 714 A1

[6] WO 2006/051355 A1

List of reference signs

1, ..., n types of route and train control systems

COST' command and status adapter according to the state of the art COST command and status adapter according to the invention

CTRL controller

RTCS route and train control system

TMS traffic management system

Claims (13)

1. Train traffic control system comprising a traffic management system (TMS) to execute regular operations, where the traffic control system is adapted to check the admissibility of regular operations at any time, a route and train control system (RTCS), and a command and status (COST) adapter, wherein the train traffic control system is adapted to exchange information and commands between the traffic management system (TMS) and the route and train control system (RTCS) through the command and status adapter (COST) , wherein the command and status adapter (COST) comprises software components to perform functions with basic integrity, wherein the traffic management system (TMS) comprises a human-machine interface to operate the route and train control system by a human operator, where the traffic management system (TMS) is configured to perform safety-critical operations, which bypass a secure route and train control system (RTCS) configuration, where the traffic management system (TMS) is configured to receive instructions on safety-critical operations that are instructed by the operator while elements of the route and train control system (RTCS) are bypassed, wherein the traffic control system further comprises at least one software component to perform a function to control safety-critical operations, where the function to control safety-critical operations is outsourced from the command and status (COST) adapter and the command and status (COST) adapter has a safety level of SIL0. 2. Traffic control system according to claim 1, characterized in that the function for controlling safety-critical operations is integrated into the route and train control system (RTCS). 3. Train control system according to claim 1, characterized in that the system further comprises a controller (CTRL) that is separate from the command and status adapter (COST), where the function to control safety-critical operations is integrated into the controller (CTRL). 4. Traffic control system according to any one of the preceding claims, characterized in that the traffic control system comprises route and train control systems of different types (1, .., n). 5. Traffic control system according to claim 4, characterized in that the software components to carry out functions with basic integrity for the different types (1, .., n) of route and train control systems (RTCS) are provided within a computer. Traffic control system according to claim 3 and one of claims 4 or 5, characterized in that the controller is adapted to control safety-critical operations for all types (1, ..., n) of traffic systems. route and train control (RTCS) of the traffic control system. 7. Traffic control system according to any one of the preceding claims, characterized in that at least one of the functions with basic integrity is integrated in the traffic management system (TMS). 8. Traffic control system according to any one of the preceding claims, characterized in that the command and status adapter (COST) comprises a decryptor. 9. Traffic control system according to any one of the preceding claims, characterized in that the functions with basic integrity comprise the adaptation function of regular operations and/or the function of adaptation of a state of the route and train control system ( RTCS), and/or the protocol conversion function to be transmitted between the route and train control system (RTCS) and the traffic management system (TMS). 10. Method for carrying out regular operations and safety-critical operations within a train traffic control system comprising: a traffic management system (TMS) to run regular operations, a route and train control system (RTCS), and a command and status adapter (COST) comprising software components to perform functions with basic integrity and having a security level of SIL0, where information and commands are transmitted between the traffic management system (TMS) and the route and train control system (RTCS) through the command and status adapter (COST), where the traffic management system (TMS) comprises a human-machine interface to operate the route and train control system by a human operator: wherein the traffic control system further comprises at least one software component to perform a function to control safety-critical operations, where the traffic control system is adapted to check the admissibility of regular operations at any time, where safety-critical operations are executed by the traffic management system (TMS), bypass a secure route and train control system (RTCS) configuration, and are controlled outside the command and state (COST) adapter, Y wherein the traffic management system (TMS) receives instructions on safety-critical operations that are instructed by an operator while bypassing elements of the route and train control system (RTCS). Method according to claim 10, characterized in that the messages are transmitted through the command and status adapter (COST). Method according to claim 10 or 11, characterized in that the safety-critical operations are controlled within the route and train control system (RTCS). Method according to claim 10 or 11, characterized in that the safety-critical operations are controlled within a controller (CTRL) that is separate from the command and status adapter (COST).