FR2971473A1 - SECURITY DETECTION DEVICE, METHOD AND SYSTEM FOR PRESENCE DETECTION BY RFID DETECTION ON A TRACK, IN PARTICULAR RAILWAY. - Google Patents

Abstract

The present invention relates to a safe system and method for detecting the presence of a vehicle in a portion of a traffic lane, in particular a railway lane, as well as an RFID barrier detection device used with or within such a process system. or safe system. The reader module selects and sends a series of query data to its reference module. This calculates and returns a series of response data based on the received query data. A security calculator verifies that the response data corresponds to the interrogation data and the tag of the reference module. A good correspondence, renewed on a sufficient number of data, large makes it possible to guarantee a probability of catastrophic event lower than a chosen value. - The response data are calculated for example by reading memory boxes in the tag from a list of addresses issued by the reader.

Description

The present invention relates to a system and a safe method for detecting the presence of a vehicle in a portion of a traffic lane, in particular a "detection device, a method and a secure system for detecting presence by RFID detection on a track, particularly a railroad track". rail, as well as an RFID barrier detection device used with or within such a process system or security system.

Traffic management and coordination systems, in particular rail traffic, are increasingly computerized or even automated and increasingly use means of detecting the presence of vehicles positioned in different locations of a network. Detection technologies exist operating by mechanical detection, or electrical detection by modulation of electrical signals crossing the rails as described by the document WO 2010 100054, which have a number of disadvantages due in particular to the problems caused by the mechanical contacts. Non-contact light barrier technologies also exist, for example at the Porte de Charenton station in the metropolitan area of Paris since 2006. This system consists of a transmitter and an infrared receiver, which is positioned at a certain distance from one another to the height of the wagons, on poles on each side of the railway. The system thus forms a virtual line induced by the beam coming out of the transmitter and picked up by the receiver. The crossing of this line by an object interrupts the infrared beam, which causes a change of state of the receiver. When this object no longer blocks the beam, the receiver returns to the active initial state. However, to maintain a good availability of the system and the monitored track, it is important to regularly clean the emitters and detectors, to prevent fouling clogging the beam even in the absence of vehicle. It is therefore practically impossible to use such an optical system in the vertical direction, because the transmitter or the receiver should be fixed on the track which is a particularly dirty place. Such cleaning represents an important work on the entire network, for example once every two months for each of the 150 detection barriers existing on a Paris metro line. In addition, all these components must be particularly reliable and of quantifiable operation to be classified at a sufficient safety level, SIL4 in the case of rail transport in France. These are important constraints in terms of hardware cost and installation, as well as maintenance and operation.

Indeed, to ensure the safety of traffic and maneuvers, for example in the case of high speeds or automated maneuvers or remotely controlled, it is necessary that the operation of such detection systems has a high level of security. In particular, it is important to limit the risks of a "catastrophic" type of operating error, that is to say likely to cause a collision, typically by information that falsely indicates a lack of vehicle at a given location. The security standards establish a maximum acceptable probability value for the risk of occurrence of such a catastrophic error. Thus, equipment is "SIL 4" safe If it is shown that the probability that the receiver is in an active state when an object cuts the beam is less than 10-9 / h (standards EN 50 126 and EN 50, 129). The realization of security level systems is therefore particularly delicate and expensive, and leads to multiple constraints in the development and programming methods but also in the choice of types of technologies that can be used. It is therefore advantageous to be able to obtain a security detection, for example of SIL4 level, by at least partially using standard detection components of a lower security level, such as SILO (standard EN 50 128), or even a unquantified security level. It is also interesting to be able to implement new modes of detection bringing new advantages, for example in terms of cost or simplicity of installation or maintenance or operation, even when these detection modes operate in a way -3 - too irregular or random to be able to provide directly secure detection by direct reading or at the expense of low availability.

An object of the invention is to provide a detection device compatible with a safe detection and representing less cost, labor and complexity, in the choice of equipment and for its installation, maintenance and / or operation. Another aim is to propose a method and a security detection system implementing such a device, or enabling the use of technologies offering such advantages, even when the nature of these technologies does not allow a level to be directly obtained. quantified security or only at the price of low availability. The invention described here is described in the context of a railway application. However, it may also be applied to other types of vehicles on non-rail traffic lanes, eg wheeled motor vehicles or in specific transport networks within infrastructures such as warehouses or factories. Safe Method and System The invention proposes a safe method for detecting the presence of a vehicle in a determined portion of a traffic lane by negative detection. According to the invention, this method uses a detection device comprising at least one electronic reference module and an electronic reader module disposed on either side of this portion of the channel. This arrangement on both sides must here be understood as meaning around the circulation space of a material to be detected on this path, preferably vertically but possibly also in other orientations around the axis of the way and for example horizontally. This electronic reference module and this electronic reader module, for example associated together, cooperate with each other to maintain active communication, which is interrupted or disturbed in the presence of a vehicle. This maintenance of an active communication comprises at least one iteration of a so-called interrogation operation comprising the following steps: - constitution by the security computer of one or more data called interrogation; transmission of this interrogation data by a reader module to a reference module which corresponds to it or is associated with it; in the event of reception of this interrogation data by this reference module, elaboration of response data each dependent on one of these interrogation data and according to a method specific to this reference module; - transmission of this response data by this reference module to its respective reader module; in the case of reception of said response data by the reader module, analysis of said response data by the security calculator to determine whether the received data correspond to the expected response data from said reference module, and therefore whether they reflect good positive communication between this reader module and this reference module; according to the results of this analysis, transmission or storage of information representing a presence or absence of a vehicle within the barrier formed by these modules.

By interrogating the reference module not only on its presence but also on its specific knowledge or its specific processing of determined interrogation information, it is thus possible to obtain a guarantee of the actual maintenance of this communication of the reader module with the correct reference module. Indeed, the risk of obtaining a correct answer other than from the reference module, for example by a random response or interference, can be measured by evaluating the mathematical probabilities of obtaining correct response data without having the specific programming of the reference module concerned.

According to an advantageous feature of the invention, the method comprises a reading of the response data by the reference module (by wire circuit, and for example internally tag) in a memory of its own. The method then furthermore comprises the following features: the interrogation data are chosen by pseudo-random selection from a list representing a plurality of memory addresses within a response table presenting a predetermined content which is stored in a non-volatile memory of the reference module; and said reference module obtains the response data corresponding to these interrogation data by reading the data stored in said memory addresses; and the analysis step by the security calculator comprises a comparison between, on the one hand, said received response data and, on the other hand, control data stored in a control table corresponding to the response table of said module of reference. The number and size of the response table data can then be used to calculate the probability that a random read within this response table will match the expected response, thus providing a quantification of the security level of such a response. interrogation operation. According to another feature of the invention, which can be combined or not with the reading of the response data in the memory of the reference module, the response data can be obtained dynamically by encryption type calculation. The method may then further comprise the following features: the reference module obtains the response data corresponding to these interrogation data by an encryption type calculation; and the analysis step by the security calculator comprises a comparison between, on the one hand, said received response data and, on the other hand, control data calculated independently of the reader from said interrogation data, or stored in a control table corresponding to the response table of said reference module. According to the invention, this method may comprise, within a detection cycle, a repetition of the interrogation operation in a number of iterations (N) chosen according to the number and size of the data of - E - the response table so that the probability that a random reading within said response table is lower for said number of iterations to a predetermined value corresponding to a predetermined security level. By choosing this number of iterations so that this probability is less than 10-9 / h, it is thus possible to obtain a security method of level SIL4. More particularly, the method can be implemented in embodiments in which the reader electronic module comprises at least one reader communicating with at least one RFID-type radio-tag included in the electronic reference module.

According to another aspect, the invention proposes a safe system for detecting the presence of a vehicle in a given portion of a traffic lane. This system comprises a computer, said security calculator, selected and programmed according to a secure method, including SIL4 level, and arranged to provide a safe detection of the presence of a vehicle by implementing a safe process as described above . Such a system can in particular be programmed to provide information of absence of a vehicle of a security level, including SIL4, strictly higher than the security level, including SILO, the detection device that it controls. More particularly, the detection device of such a system may advantageously comprise one or more detection barriers by reading one or more RFID type RFID tags to provide a vehicle-free information of a safe level, such as as explained below. RFID barrier In the context of the method and / or system according to the invention, it is proposed here to use more particularly a detection device comprising at least two electronic modules arranged on either side of said portion of track and cooperating between them by radio waves to provide a negative detection by maintaining between them an active communication which is interrupted or disturbed in the presence of a vehicle, thus achieving a so-called elementary barrier. According to the invention, the two electronic modules comprise at least: a so-called reference module including at least one electronic chip tag, and a reader module including at least one reader able to communicate remotely with the electronic chip of said radio tag by radio waves. In particular, it is possible to use an RFID tag type radio of a model already existing on the market, including a model intended for unsafe applications such as inventory management or article tracking. The use of radio wave communication makes it possible in particular to limit the cleaning requirements of transmitters or receivers. According to a particularity, the reference module comprises one or more passive radio tags including permanent memory means, and preferably only passive radio tags, ie. powered only by the electromagnetic flow of the reader. The power supply constraints are thus reduced, and it is for example possible to install the reference module without any connection, that is to say in complete autonomy. Thus, each barrier requires only one wiring point, unlike infrared barriers that require both the transmitter and the receiver to be connected. Advantageously, the reference module may further comprise a radio-tag with at least two electronic chips, typically an antenna and two chips, which makes it possible to increase the memory available for the response table compared with the standard capacities of the existing chips. . According to another feature, at least one of the two electronic modules of at least one elementary barrier is disposed under the position of the vehicle to be detected, the other electronic module being disposed in a position above said vehicle. The reference module is for example installed above the track, without any electrical wiring, for example fixed to the ceiling of a tunnel or on a pole or a gallows. The reader module can be installed on the ground, for example on one side or between the rails, which limits the space requirement and the access requirements around the track. In preferred embodiments, the two modules are located in a substantially vertical plane longitudinally to the taxiway, and form in this plane a non-zero angle with the vertical, for example between 10 ° and 30 °. This inclination makes it possible to prevent the reader from being able to communicate with the radio-tag through the space that can separate two wagons within a train. redundant barrier According to a feature of the invention, the detection device may comprise at least two elementary barriers arranged to detect the presence of the same vehicle located on the same track. This provides a dual barrier providing redundancy in the detection for a given location, thus increasing the availability of the channel by reducing the risk of total failure for this detection location. Preferably, the reference modules of these elementary barriers are arranged on the same side of the vehicle position, for example above the vehicle. Their reading modules are then located on the same other side of said position, for example on the floor between the rails. The two modules on the same side are then typically located within one meter of each other and can thus be connected to the network at a single point of wiring for the entire redundant barrier.

Optionally, the two elementary barriers can use the same frequency or the same channel, which makes it possible to limit the problems of choice of frequencies, and the risks of interference such as for example intermodulation interference IP3 with other radio equipment on the network. To avoid interference between the two elementary barriers, their reader modules are configured to communicate each with its respective reference module by radio transmission according to a specific polarization, typically linear polarizations. These polarizations are chosen to form cross polarizations, for example forming between them an angle between 85 ° and 90 °. Adjacent barriers The invention may comprise at least two barriers, for example two double redundant barriers operating in cross polarization, arranged inside the same portion of a path, for example at most 20 m, even 3m. It is thus possible to detect the presence of two different vehicles located on two adjacent lanes, for example parallel or forming an acute angle between them. Preferably, the two elementary barriers use the same frequency or the same channel, which makes it possible to limit the problems of choice of frequencies, and the risks of IP3 interference with other radio equipment on the network. To avoid interference between two adjacent adjacent path barriers, the reference modules of these barriers are located in two different directions, for example opposite, with respect to their respective reader modules. These reader modules are thus oriented in different directions from one another. The reader modules are arranged for example in the right of each other, or can be spaced apart from each other in the direction of its respective reference module.

The invention provides a particularly interesting synergy using the security method set forth above to secure a negative detection provided by a radio tag or RFID device and / or a system as set forth above. It makes it possible to create a SIL4 level system based on RFID components, whereas the characteristics of this technology seem at first sight completely incompatible with such security requirements, especially with components and equipment of a security level. less than the required level, eg SILO level components or even standard components not developed for a safe purpose and in a safe process. It should be noted, however, that the characteristics of RFID detection barriers described may also be advantageously applied in unsecured systems, or secured by means of methods or systems different from those described herein, providing similar advantages in terms of for example performance and / or simplicity of installation, maintenance and operation.

Various embodiments of the invention are provided, integrating, according to all of their possible combinations, the various optional features set forth herein. Other features and advantages of the invention will emerge from the detailed description of a non-limiting embodiment, and the accompanying drawings in which: FIGURE 1 is a block diagram, in normal view to the taxiway illustrating an exemplary architecture of a security detection system according to the invention, applied to a metropolitan road; FIG. 2 is a block diagram illustrating a detection device according to the invention, in one embodiment comprising an elementary barrier with a two-chip radio-tag; FIG. 3 is a block diagram illustrating the electronic architecture of an exemplary two-chip reference module; - FIGURE 4 is a block diagram illustrating a detection device according to the invention, in one embodiment comprising a redundant barrier including two elementary barriers with two-chip radio tags; FIGURE 5 is a diagram illustrating an implementation of the invention in a metropolitan tunnel seen in longitudinal section, in one embodiment of the invention with inclined redundant barrier; FIGURE 6 is a flowchart illustrating an exemplary embodiment of the security method according to the invention; FIGURE 7, FIGURE 8 and FIGURE 9 are block diagrams illustrating different examples of security system architecture according to the invention; FIG. 10 is a simplified diagram in plan view illustrating an embodiment of the invention in an exemplary configuration comprising a plurality of detection barriers distributed over a plurality of adjacent parallel paths. 2971473 -11-

As illustrated in FIGURE 1 and FIGURE 2, the detection device according to the invention comprises at least one elementary barrier Be including a reading module ML electrically and digitally connected to the network, and an independent reference module MR, preferably without power supply. The reference module MR comprises a reference antenna AR and a radio tag TR, or "tag", RFID type. The reader module comprises a reading device L said RFID type reader connected to a reader antenna AL positioned between the rails of a channel V1, where it is desired to detect the possible presence of a wagon W1. The reader antenna AL points to the reference antenna AR suspended from the ceiling of the tunnel T, which is connected to the radio tag TR. A SIL4 level security computer controls the RFID portion of the L-reader, which is of a lower security level (e.g., SILO) or is unsafe. Based on the results he obtains from his requests from the reader L, this calculator CS establishes a data output representing the presence or absence of any wagon W1, in the form of a STOR output information. in "all or nothing", with SIL4 level security. In FIG. 1, the vertical mixed line thus indicates the limit between the elements and information of a lower level of security level (for example SILO) or an unsafe level, and secondly those of level SIL4. At each detection cycle, of a duration of, for example, approximately 250 ms, the security calculator CS commands reader L to: read the identifier of the tag (s) TR; interrogating this or these tags TR, by the interrogation operation detailed below, to check the integrity of the tags, the RFID reading system, and the communication between them, by comparing the response of the tags with the expected answer. If the CS obtains the expected answers, it knows that the tags are read and that the entire RFID chain is intact (no detection failure) and functional (no obstacle in the barrier). -12- The system works in negative logic. The absence of reading passes the output Tout-Ou-Rien ("STOR") in "security" mode, ie putting it to the value indicating the presence of a train, whether it is when the subway is actually present in the detection zone of channel V1 or that is when a malfunction appears in the chain of detection.

FIG. 2 illustrates a basic barrier Be in a version in which the reference module MR comprises a radio tag TR with two chips Rx and Ry programmed with different values from each other. Tests have shown satisfactory operation with commercial RFID readers using the EPC GEN 2 modulations in the 865 MHz band. With RF transmit power in compliance with the standards in force, it is possible to obtain an operating range that can exceed 10 meters. FIG. 3 illustrates a possible assembly of the chips within the reference tag TR.

In the example of FIG. 4, the detection device comprises a redundant barrier B including two elementary barriers Bea and Beb, similar to those of FIG. 2. Each of these elementary barriers Bea and Beb comprises a reading module MLa and respectively MLb including a reader La and Lb respectively, and a reader antenna ALa and respectively ALb. Each also comprises a reference module MRa and MRb, respectively, including a reference antenna ARa and ARb respectively and a reference tag TRa and TRb respectively, each with two chips Rxa, Rya and respectively Rxb, Ryb. As illustrated in FIGURE 5, the two reading antennas ALa, ALb are for example arranged together on the same side of the location of the train W1 to be detected, here fixed on the ground between the rails of the track V1. The two reference modules MRa, MRb are for example arranged on the same support SR fixed to the roof of the tunnel T, above the gauge of the train W1 to be detected. As can be seen in FIG. 5, for each elementary barrier Bea, Beb, the reading module and the reference module are positioned relative to each other so that the detection line each barrier (dashed in the figure) is almost vertical, which keeps a communication distance as low as possible. Preferably, these modules are offset from one another longitudinally to the channel so that the detection line forms a small angle b with the vertical, in order to prevent the detection line from passing into the EW space between two wagons. the same train W1, which could give a false indication of absence of train. The antennas are inclined at the same angle with the horizontal to be in front of each other. Preferably, this angle of inclination is chosen between 10 ° and 30 °. Within the same redundant barrier, the two elementary barriers can be configured to communicate according to the same frequency, but in two polarizations pH, pV different and substantially perpendicular.

Securing process Since RFID uses radio communication, it could have seemed illusory to want to imagine directly implementing a security system from an RFID barrier, in particular because of the many operating and propagation hazards specific to this technology. In addition, existing RFID readers on the market are highly complex equipment whose hardware and software are not designed to calculate and demonstrate any reliability of operation according to numerical probability criteria, which is imperative for a single level. SIL4 security. The invention, in particular through the security method described here, makes it possible to overcome this problem by associating with the insufficiently secure RFID reader L (for example SILO level or unsafe level) a security calculator CS (SIL4) using a safe method for realizing securing the information provided by this reader L. FIGURE 6 illustrates an exemplary embodiment of the security method. In this embodiment, the tag TR comprises non-volatile memory, preprogrammed with all different data. For its part, the security calculator CS knows the table of values that have been preprogrammed in this tag TR.

A detection cycle 30 comprises one or more iterations of an interrogation operation 300 of the tag TR by the reader L, for example an "inventory operation" in the sense of the "EPC Gent" standard. To constitute the interrogation data 301, the security calculator CS draws a random or pseudo random list of memory addresses from among a list of memory addresses existing within the memory of the tag TR which corresponds to it. The security calculator CS interrogates the reader L, which sends this list of memory addresses 302 to its tag TR. If the communication between reader L and tag TR is functional and is not disturbed by a 30W vehicle presence, the tag 303 receives the list of memory addresses. The tag TR reads the contents of its memory to the addresses in question, and uses this content to form the list of the response data, then issues this list to the reader L.

If the communication between reader L and tag TR is functional and is not disturbed by a 30W vehicle presence, the reader L 306 receives the list of contents of memory addresses, and transmits them to the security calculator CS. The security calculator CS analyzes 307 these response data by comparing them with those it knows, stored for example in a table of TVR response values. During this analysis, it verifies: - that response data have been received, and - that these data correspond with the TVR data that it knows. For a determined number "N" of iterations of the interrogation operation 300, the security calculator CS compiles 309 the results obtained during the different steps 307 for analyzing the responses. For this, it checks whether all these responses were well received and compliant for the total number "N" of iterations 308 of the detection cycle. The security calculator CS is in particular equipped with a "watchdog" type device enabling it to put the system in the security state in the event of nonresponse of the reader L associated with it, in a given time.

The objective is to guarantee a rate (or risk) of false indication of absence of train (feared element), which must be lower than a determined value, being worth 10-9 / h in the case of the SIL 4 level. system architecture, such a false absence indication event can occur only if the reader L responds to the security calculator CS by transmitting a list of response data all compliant during the duration of the detection cycle, while its communication is cut with the tag TR. The RFID reader being insufficiently safe, it is assumed that its response may be random, for example in the case of a failure or lack of communication (presence of train). The probability of randomly obtaining a fully compliant response list can thus be calculated from the number and size of the expected response data. Depending on the memory size available in the tag TR for the response values, and if this is insufficient to obtain the desired security rate, it is possible to choose an "N" number of iterations sufficient to increase the total volume of the data. interrogation, and thus the resulting safety rate. By verifying a total volume of interrogation data and a sufficiently high response, it will be possible to obtain a probability per cycle of unduly obtaining compliant responses that is sufficiently low to satisfy the quantified requirements of a given security level, such as for example the SIL level 4. At the end of a detection cycle of this security method, the security calculator CS calculates the output information STOR "on all or nothing" of presence or absence of train, SIL4 level information referenced "STOR" in the figures. The system operates in negative logic: in the absence of train W1 on channel V1, the tag or tags TR are visible by the reader L and the security calculator CS reads them as indicated above, to guarantee -16- train absence information with the probability required by the level of safety sought. Thus, as soon as an expected memory value is not correctly read in the allotted time, the security calculator CS considers that a train W1 could be present, and it returns a security information W indicating a train presence. In the opposite case, it sends a NW information of absence of train.

Example of implementation In the case where the RFID reader behaves like a random generator, the probability of correctly reading a sequence of memory addresses in the tag would depend on the number of existing memory cells, and the number of memory cells read. successively.

By using tags with a large amount of memory, or several chips for the same tag, it limits the number of boxes to be read successively, and thus limits the duration of the detection cycle. For the constitution of the memory boxes of the tag, it is possible to use also the memory space provided for the EPC code, since each reader interrogates only one tag.

Test tags available on the market have a memory organization in 16-bit words. Their memory has a size of 240 bits for the EPC code and 512 bits of memory, making a total of 32 words of 16 bits in user memory or 47 by counting the EPC memory.

By using reference modules each comprising two RFID chips Rx and Ry for each RFID reader, the method may comprise the following steps: the reader L reads the two RFID chips Rx and Ry and sends their EPC code to the security calculator CS, the security calculator CS randomly chooses a number between 1 and 32 (or 47): RN1 and another value 0 or 1: RN'1, the security calculator CS gives the command to the reader L read a word in the memory (EPC + user memory) of the tags, in Rx if RN'1 = 0 and in Ry if RN'1 = 1 and at the address RN1, - the security calculator CS compares the result with the values of the memory content of the RFID chips he knows. If the result is compliant, the security calculator CS iterates the reading operation a specified number of times N.

At each interrogation, a value is read among the different memory locations that contain the RFID chips Rx and Ry. The number N of readings and the number of stored data then make it possible to make a probability calculation which will make it possible to evaluate the risk of catastrophic failure of the elementary barrier, for example to obtain a risk of less than 10-9 per hour for a level SIL4.

The memory size and the number N of readings can then be chosen according to the targeted security level. By this method, it is possible to use standard tags without searching for expensive exceptional memory capacities, while allowing the security calculator CS to conclude on the reliability of the reading of the reference tags within the detection cycle itself. . In other embodiments, the specificity of the response data can be obtained in a different way, while remaining in the spirit of the invention. For example, the reference tags may comprise a hardware or software program chosen and arranged to calculate a unique and pseudo-random signature from one or more numbers sent by the reader. Such programs can be for example "hash" programs as used to calculate the digital signature of a computer file.

Each reference tag then receives a pseudo-random series of numbers generated by the reader and forming the interrogation data. Based on its own specific code, each tag then calculates a response data for each of the query data. For its part, the security calculator executes, with the same interrogation data, the same signature program as the interrogated tag, and compares its own results with the data received in response from the interrogated tag.

FIGURE 7, FIGURE 8 and FIGURE 9 illustrate different examples of security system architectures according to the invention, for the part forming the security calculator CS. In the architecture of FIGURE 7, for a redundant barrier B with two elementary barriers Bea, Beb, the security calculator CS comprises two security calculators CSa, CSb which each manage one of the two elementary barriers Bea, Beb, and provide each an STORa, STORb all-or-nothing output. Each of these two computers CSa, CSb is a SIL4 security calculator. Their results are collected by SIL4 level HW security logic equipment, which performs a "vote" to provide an overall STOR indication of all or nothing indicating, for example, a train absence if at least one of the two outputs STORa or STORb provides this same indication (and the presence of a train is characterized by STORa and STORb simultaneously indicating the presence of a train). This architecture has the particular advantage of allowing the use of security calculators of the same or similar type for redundant barrier and for elementary barriers installed in isolation.

It should be noted that the voting function can be performed within the same security computer CS, but can also be performed by hardware separated equipment, for example by the logical equipment already existing in the network. The portion of the security calculator specific to the barrier can then transmit two output information in parallel corresponding to the two outputs STORa and STORb. In the architecture of FIGURE 8, for a basic barrier or a redundant barrier, the security calculator CS comprises two security calculators CS4 and CSV SIL4 level that have roles different from each other: -19- The safe calculator CSL manages the reading of the tags of the two elementary barriers Bea, Beb. If it receives responses from both tags, it transmits on the one hand STORL information indicating an active communication. It then transmits the responses received to another CSV security calculator which compares them with the table of expected results TVR. If the comparison of the CSV calculator indicates that the responses received were compliant, it issues STORV output information indicating this compliance. The results of these two computers CSL and CSV are collected by SIL4 level HW security logic equipment, which makes a "vote" to provide a STOR indication of all or nothing indicating overall absence of train if on the one hand the output STORL indicates active communication, and STORV output indicates compliant responses.

In particular, this architecture has the advantage of making it possible to separate the reading and verification functions more clearly, and to more precisely adapt each of the two CSL and CSV computers to the actual functions it has to fulfill. It should be noted that the voting function can be performed within the same security computer CS, but can also be performed by hardware separated equipment, for example by the logical equipment already existing in the network. The portion of the security calculator specific to the barrier can then transmit two output information in parallel corresponding to the two outputs STORL and STORV.

In the architecture of FIGURE 9, for an elementary barrier or a redundant barrier, the security calculator CS comprises the following two computers: An insecure CL calculator, for example a standard hardware, operates in series with the RFID reader (s) . It manages the generation of the interrogation data and the reading of the tags, and transmits the received DR response data to a SIL level CPS security comparator 4. A SIL 4 level CSV security calculator generates a loop output to the same CPS comparator DV verification data representing the sequence of expected reading results. The SIL4-level CPS comparator makes the vote by comparing the expected DV verification data with the DR response data that is actually read by the CL calculator and generates the STOR security on / off output of the overall barrier B.

In particular, this architecture has the advantage of making it possible to separate the reading and verification functions more clearly, and to limit the need for secure hardware to the function of the verification computer CSV '. The SIL 4 level equipment, the verification computer CSV 'and the comparator CSP, can for example be integrated in an integrated circuit designed in SIL4, for example a programmable circuit such as an FPGA. This set can be synchronized and clocked by write requests from the read calculator CL, with reset commands in the event of errors in CL read sequences, and synchronization commands in FPGA registers.

FIG. 10 illustrates, in plan view, an exemplary configuration comprising three redundant detection barriers B1, B2, B3 distributed over several adjacent parallel paths V1, V2, V3. The set of detectors can operate on the same frequency to avoid generating by intermodulation of order 3 (IP3) stray lines that may impact other radio systems of the surrounding rail network. On the first channel V1, because of the inclination b of the detection lines, the antennas of the reference modules ARai, ARb1 of the barrier B1 are arranged at a distance d2 in a first direction DX with respect to their reader antennas respective ALai, ALbi. On the second channel V2, because of the inclination b of the detection lines, the reference module antennas ARa2, ARb2 of the barrier B2 are arranged at a distance d2, relative to their respective reader antennas ALa2, ALb2 in a second direction DY opposite to the first direction D1. On the third channel V3, because of the inclination b of the detection lines, the antennas of reference modules ARa3, ARb3 of the barrier B3 are arranged at a distance d2, relative to their respective reader antennas ALa3, ALb3, in the same first direction DX as the first channel V1 and therefore in the direction opposite to the direction DY of the second channel V2. This arrangement alternately in opposite directions DX, DY makes it possible to reduce or even eliminate the risks of interferences of co-interference between the barriers of the different channels. Preferably, the reading antennas of each channel (for example ALa2, ALb2 for V2) are furthermore shifted by a certain distance di with respect to the reading antennas (ALai, ALbi, and ALa3, ALb3) of the adjacent channels V1 and V2, in the same direction (DY for V2) as its reference antennas (ARa2, ARb2 for V2). To limit parasitic coupling between two barriers, directional antennas are preferably chosen. However, this characteristic often leads to a larger footprint.

For a given directivity, as a function of the distance d2 (imposed by the ceiling height and by the angle b retained) and as a function of the difference and / or possibly the angle existing between adjacent channels V1 and V2, or V2 and V3, it will then be possible to obtain by calculation or tests a value of the distance di which is sufficient for the parasitic coupling between two adjacent barriers B1 and B2, or B2 and B3, to be less than a determined co-disturbance threshold. . An example configuration is given here for antennas with an aperture of about 37 ° to -3 dB and 90 ° to -20 dB, installed on adjacent channels spaced apart by 2.20 m or more, and with a height between readers and tags of the order of 5m and an angle b of about 15 °. Within the framework of these constraints, it is possible to obtain a good operation of the system, without the reader ALai of the barrier B1 of the channel V1 being able to read or disturb the tag ARa2 of the barrier B2 of the adjacent channel V2, when this tag ARa2 forms with the main direction D1 this antenna ALai an angle 81 = (ARa1, ALa1, ARa2) of at least 40 °, value obtained when di is greater than or equal to 40cm. Of course, the invention is not limited to the examples which have just been described and many adjustments can be made to these examples without departing from the scope of the invention.

Claims (16)

REVENDICATIONS1. Safe method for detecting the presence of a vehicle in a determined portion of a traffic lane (V1, VG) by negative detection, using a device comprising at least one electronic reference module (MR) and an electronic reader module (ML) arranged on the one hand and other of said track portion and cooperating with each other to maintain an active communication which is interrupted or disturbed in the presence of a vehicle (W1), said maintenance of an active communication comprising at least one iteration of a so-called operation interrogator (300) comprising the following steps: - constitution (301) by a security calculator (CS) of one or more data called interrogation; transmitting (302) said interrogation data by a reader module (ML) to said reference module (MR); in the event of reception (303) of said interrogation data by said reference module (MR), elaboration (304) of response data dependent on said interrogation data and according to a method specific to said reference module; transmitting (305) said response data by said reference module (MR) to said reader module (ML); in the case of reception (305) of said response data by the reader module (ML), analysis (307) of said response data by the security calculator (CS) to determine whether the received data correspond to the expected response data of the share of said reference module (MR); in function (310) of the results of said analysis (307), transmission or storage of information representing a presence (W) or absence (NW) of a vehicle within the barrier (Be) formed by said modules (MR, ML). 2. Method according to the preceding claim, characterized in that: - the interrogation data are chosen (301) by pseudo-random selection within a list representing a plurality of memory addresses within a table; response comprising a predetermined content which is stored in a non-volatile memory of the reference module (MR); the reference module (MR) obtains the response data corresponding to these read interrogation data (304) of data stored in said memory addresses; and the analysis step (307) by the security calculator (CS) comprises a comparison between, on the one hand, said received response data and, on the other hand, control data stored in a control table (TVR). corresponding to the response table of said reference module (MR). 3. Method according to any one of the preceding claims, characterized in that: the reference module (MR) obtains (304) the response data corresponding to these interrogation data by at least one pseudo-random calculation using said data. interrogation as a pseudo-random germ; and - the analysis step (307) by the security calculator comprises a comparison between, on the one hand, said received response data and, on the other hand, control data calculated independently of the reader by a pseudo-random calculation from said interrogation data, or stored in a control table corresponding to the response table of said reference module (MR). 4. Method according to any one of the preceding claims, characterized in that it comprises, within a detection cycle, a repetition (308) of the interrogation operation (300) in a number of iterations. (N) selected according to the number and the size of the data of the response table so that the probability that a reading (304) within said response table, assuming it would be random, is lower for said number of iterations to a predetermined value corresponding to a predetermined security level, and in particular less than 10-9 / h, for a level SIL4. 2971473 -25- 5. Method according to any one of the preceding claims, characterized in that the reader electronic module (ML, MLa and MLb respectively) comprises at least one reader (M, La and 5 respectively Lb) communicating with at least one radio-tag (TR, TRa and TRb respectively) included in said reference electronic module. 6. Safe system for detecting the presence of a vehicle in a given portion of a traffic lane, characterized in that it comprises a so-called computer security calculator (CS), chosen and programmed according to a method of a safe level targeted, in particular of SIL4 level, and arranged to provide a safe detection of presence (W, NW) of said vehicle (W1) by implementing a method according to any one of claims 1 to 5. 7. System according to the preceding claim, characterized in that the security calculator (CS) is programmed to provide information of absence of vehicle (NW) of a safe level, including SIL4, strictly greater than the security level, in particular SILO, of the detection device (B) which it controls. 8. System according to any one of claims 6 to 7, characterized in that it comprises a detection device (B, B1, B2, B3) 25 communicating with the security calculator (CS) to provide information of absence of a vehicle (NW) of a targeted safety level, said detection device comprising at least two electronic modules (ML, MR) arranged on either side of the track portion (V1, VG) and cooperating with each other for to provide a negative detection by keeping between them an active communication which is interrupted or disturbed in the presence of a vehicle (W1), thus realizing a so-called elementary barrier (Be), said two electronic modules comprising at least: a module called reference (MR) including at least one electronic chip tag (TR), and a reader module (ML) including at least one reader (L) adapted to communicate remotely with said radio tag (TR) ) by radio waves. 9. System according to the preceding claim, characterized in that the reference module (MR, Mra, Mrb) comprises one or more passive radio tags (TR, TRa, TRb) including means of permanent memory. 10. System according to any one of claims 8 to 9, characterized in that the reference module (MR) comprises a radio-tag (TR) with at least two chips (Rx, Ry). 11. System according to any one of claims 8 to 10, characterized in that at least one (ML) of the two electronic modules of at least one elementary barrier (Be) is disposed under the position of the vehicle to be detected. (W1), the other (MR) electronic module being disposed in a position above said vehicle (W1). 12. System according to any one of claims 8 to 11, characterized in that the two modules (ML, MR) are located in a substantially vertical plane longitudinally to the taxiway (V1, V2, V3, V4), and form in this plane a non-zero angle (b) with the vertical, ranging between 10 ° and 30 °. 13. System according to any one of claims 8 to 12, characterized in that it comprises at least two elementary barriers (Bea and Beb respectively) using the same frequency or the same channel, arranged to detect the presence of the same vehicle (W1) located on the same track (V1), the reference modules (MRa and MRb respectively) of said elementary barriers being arranged on the same side of the vehicle position (W1) and their reading modules (MLa and respectively MLb) being located on the same other side of said position, said reader modules being each configured to communicate with its respective reference module by radio transmission according to a determined polarization (pH and respectively pV), said polarizations being selected crossed to make between them an angle of between 85 ° and 90 °. 14. System according to any one of claims 12 to 13, characterized in that it comprises at least two barriers (B1, B2, B3) disposed within the same portion of the overall path (VG) of no more than 20m or not more than 3m, so as to detect the presence of vehicles located on two adjacent lanes (V1 and V2, V2 and V3), the antennas (ARai, ARbi, ARa3, ARb3 and ARa2 respectively, ARb2) of reference modules of said barriers (B1, B3 and B2 respectively) being located in two directions (DX and respectively DY) opposite to the antennas (ALai, ALbi, ALa3, ALb3 and ALa2 respectively ALb2) of their respective reader modules, said antennas of the reader modules being arranged at right angles to each other or spaced apart from each other in the direction (DX, DY) of its respective reference module. 15. System according to any one of claims 8 to 14, characterized in that one or more reference modules (MR, MRa, MRb) are attached to the wall or ceiling of a tunnel (T) surrounding one or several traffic lanes (V1, VG) underground rail transport. 16. Application to the detection of vehicles on a railway track (V1, VG) of a method according to any one of claims 1 to 5, or a system according to any one of claims 6 to 15.