GB2523100A - Railway key token signalling and control system without interconnecting cabling - Google Patents

Abstract

Trackside key token machines use trapped key technology to control the issue of physical key tokens and to signal and control trains through individual railway track sections. Data (e.g. headcount and roll-call data) is communicated between the token machines and a remote central control unit, e.g. by wireless transmission of messages encrypted using TERN technique. The central control unit analyses the data to count and account for key tokens and controls the issue of tokens by the token machines. Drivers may be identified by RFID during token transactions and trains may carry GPS. The central control unit may include a user interface to inform a controller of the status of tokens, track sections and trains. The system requires no fixed infrastructure (e.g. token machines may be portable and need no cables between them); nor does it require trains to carry electronic devices.

Description

Catvvay kcv tc.dcn rair. arid CQuiiiO svstt:.m WitiiOJt U erconnecrng cm[Ing

Description

1. Introduction

2. Background

3. Inventive steps 4. Token exchange sequences: (refer to diagram 1) 5. Route flexibility 6. Methods of ensuring the integrity of the signalling system 7. Methods of assisting the integrity of the signalling system

1.0 Introduction

This patent application is for a key token system of railway signalling and control that enables an overall controller to issue unique and secure physical authorities to railway train drivers allowing safe passage over sections of track without the need for interconnecting cabling. Specially designed token issuing machines are controlled via the user interface of a computer using telecommunications links and software/hardware that is designed to count and account for all physical key token authorities.

2.0 Background.

2.1 Systems of issuing unique physical tokens to train drivers to pass through a section of track have existed since the 1911 century. They are still used on some parts of the national railway network -although only is a few isolated locations nowadays.

They are used extensively on heritage/minor railways because they are simple, reliable and also help to evoke nostalgia.

2.2 In this narrative a token' is the unique authority to proceed in a specific track section and, in this case, will be an engraved plate permanently attached to a key' which locates in a lock in a token (or key token) machine.

The authority to the driver to proceed is the token', the key' is the portion of the key token assembly that locates in a key token machine so locking it, or not, away from use. Keys are specific to a section.

This invention keeps all the advantages of a physical token and despite using modem technology does not require electronic equipment to be located on a locomotive or any other part of a train.

2.3 Key token systems have many advantages, but also some drawbacks including the need for fixed infrastructure. The token machines located at the ends of each section of track are valuable and vulnerable to attack or theft. The majority of systems rely on a cable linking each machine. The cable is needed to link a switch at each machine that is able to change the polarity in the cable cores. It is this polarity that is checked electro-mechanically and which either allows a key to be taken out of a machine if polarities are the same or prevents a key from being withdrawn if the polarities are out of phase. In this latter case this would occur if a key had been taken out of one of the machines.

Cable is expensive to provide, easily damaged and is a target for cable thieves.

This invention addresses these problems by eliminating cabling, Further, the equipment can be completely portable and so can be removed from site in safe keeping when no train service is mnning.

2.5 Existing systems are just a way of ensuring that only one key token is issued for any one section and thus there is only a link between the token machines for this purpose. There is no overall strategic control of a line directly linked to the issuing of individual tokens, The person mnning the train service is one step away from the mechanical process of taking and returning key tokens, In many minor railways, the person miming the train service -the controller -is often involved in other totally unrelated tasks like selling tickets, administrating the car park, dealing with passengers etc and so has many distractions from what is the safety critical task of controlling trains, This invention addresses these issues by providing the controller with an interlocked user interface that always reflects the actual current situation. Further, the controller's unit can be portable and so the railway can be run from any location, 3.0 Inventive steps The inventive steps in this application 3.0.1 Eliminate interconnecting cabling between token machines 3.0.2 Provide secure signalling in accordance with accepted national practice 3.1.3 Provide secure authorities to drivers without the need for any electronics on a locomotive or any part of a train.

3.0.4 Provide direct, and mobile control of an entire railway by a single individual 3.0.5 Provide flexible configurations of a multi-section railway 3.0.6 Provide the option of complete portability of all equipment 3.0.7 Provide the option for an Engineer's portable token machine that displays authorities for any section of the railway on an LCD rather than issuing a physical token.

3.1 These inventive steps are: 3.11 An electronic headcount' and roll call' (counting and accounting) of all the keys in a pair of twinned token machines involved in a section determines the existence or otherwise of a missing token. The headcount and roll cails are conveyed between token machines and the control unit using one or several of the telecommunication opportunities available ranging from instant messaging through to analogue radio or even a hybrid of several systems. This supersedes the traditional polarity check which, in turn, eliminates the need for cabling between machines.

3.1.2 A central computer programme that evaluates the headcount' and roll call' data from each machine to allow a transaction if all tokens can be accounted for, or prevent a transaction if one -or more -tokens are detected as missing. A linked user interface in the controller's unit will provide additional interlocking 3.1.3 The computer program referred to above will frirther enable the recovery of a system in the case of power or other failure.

3.1.4 Balanced checksum checks, governed and secured by the TERN system, that release safety critical commands to a token machine over insecure communications links. TERN -Token Exchange using Random Numbers is a technique of secure message transfer which in itself has already been disclosed in British Railways technical disclosure No. 56 1989. Other encryption methods may be considered.

3. 1.5 The ability or otherwise of a train driver to withdraw a token from a token machine located at each end of a track section is determined by the mechanical state of the key's lock in the machine, A key can only be released if a command is received from the controfler to energise a solenoid associated with each key capture lock. Keys remain trapped/captured in their locks until such a release is given. When a driver returns the key to its lock in a machine, a capture mechanism prevents the key from being withdrawn.

3. 1.6 An interlocked user interface in the controller's unit which gives an overall view of all token machines under control and so the direct regulation of all the movements of trains throughout a network is possible, 3. 1.7 The networking of token machines which allows for variations of token allocation such as the combining of sections at times of reduced traffic.

3.1.8 The networking of token machines which gives opportunities for crosschecking data by all the machines, not just those directly involved in a transaction so widening the verification architecture.

3.1.9 A portaNe signalling system using token machines which can be made with self-contained power supplies that avoids vulnerability to vandalism at times when the railway is unattended, 3.1.10 Integration with portable Engineer's units that can receive authorities for any section of a railway on an LCD display.

3.2 To summarise 3.2. The release of the key -and thus the token -is dependant on a solenoid being energised.

3.2.2 The solenoid is energised if there is a receipt of a specific release authority from the controller's control unit, 3.2.3 The release authority depends on the controller's control unit programme being satisfied that there are no conflicting key movements and also depending on whether the user interface allows a transaction to take place.

3.2.4 The control unit's ability to allow transactions depends on its polling of all involved token machines to check the state of keys held, or not, within them, 4. Token exchange sequences: (refer to diagram 1) 4.1 At the start of train working, all tokens are held captive although they may not necessarily be held equally in each token machine.

The control unit shows no token out and no sections occupied.

4.2 Train number I arives at A and requests authority to proceed to B. With no sections occupied, the user interface enables a transaction to start.

The controller enters the train number, the token machine location (by clicking on the location).

4.3 The driver of train I initiates the process by pressing a button on the machine at A. This timestamps the process and prompts the controller's unit to check the location validity.

4.4 The controller's unit then polls machine at A and receives data relating to the tokens held. It then polls the unit at B and receives data relating to the tokens held..

4.5 Combining the two sets of figures, the control unit can detect whether all tokens are accounted for or whether any are missing.

4.6 If all are available, the controller authorises the release of a token -the computer using the TERN protocol (or any other suitable method) to ensure security.

4.7 The action of authorising a token disables the control interface so far as issuing any further tokens in the section is concerned and shows the section as occupied.

4.8 The token machine indicates that the release authorisation has been received, closes the circuit to the solenoid so allowing the solenoid to pull when the driver presses the release button.

4.9 When the release button is pressed, the token machine will return an indication that a token has gone if polled. The pawl restraining the key is released so that the key may come out of the token machine.

4.10 The key, with the token attached, is taken by the driver who embarks on the journey from A to B. So, at this stage, the token machine has one fewer tokens than before and the control unit will indicate that train number I is proceeding to B. The control unit is unable to enter into any further transactions in relation to section 1.

4. 11 The train arrives at B and the driver, after contacting control, places the key in an available slot in the machine at B. 4.12 Once in, the pawl mechanism captures the key which cannot now be taken out.

4.13 The driver presses a button which initiates a message to the control unit which then polls both A and B to check on the balance of keys. If all is in order, the control unit is re-enabled to conduct transactions between A and B. 4. t4 Trains negotiate the railway according to this process which ensures that only one key per section is allocated at any one time and which also gives an indication to the controller as to the whereabouts of each train.

5. Route flexibility 5. t There are occasions when a long railway is used by only a few trains. In these cases it is advantageous for the railway to be split into long sections, combining some of the passing loops. The advantage of operating this way is that the train can cary on through unused loops without stopping to exchange a token every time.

5.2 This can be achieved by building token machines at the ends of the long sections to have just a few special long-section-Icey positions. These long-section-keys can only be released if ail the sub-section machines involved are polled and they all return a flaIl complement of keys. By selecting long sections, the control unit would disable the sub-section facilities.

5.3 One train working throughout the railway could be introduced by locking out all section machines other than the end machines and by having a single special one-train-key built into the end machines 5.4 The key tokens can be combined with conventional Annetts' keys to allow the secure release/locking of ground frames or signals.

5.5 Rules may be incorporated into the control software to allow for banking (or similar) engines and key token imbalances.

6. l\'Iethods of ensuring the integrity of the signalling system include the following: 6.1 Keys are double detected in their housings by independent mechanisms, which could include optical detection.

6.2 The authority command will be delivered in two or more programme steps using independent calculations and delivering to two or more solenoid circuits.

6.3 The method of detecting the tokens will be by conducting a head count and by a roll call -checking each individual key space for occupancy. (counting and accounting) 6.4 Regular auditing of the system can be carried out by neighbouring token machines which would return independent results to the control unit and/or to each other and/or to an independent monitoring unit.

6.5 The head count/roll call method will be used to validate the system after failure.

6.6 The recording of all conversations and transactions for later examination and audit 7. Methods of assisting the integrity of the signalling system include the following: 7.1 The use of keyfob/rfid technology to identify and record the identity of drivers entering into token transactions.

7.2 The use of GPS technology that tracks trains, frirther enhancing the information displayed in the controller's user interface.

Notes to Diagram I Diagram 1 shows a typical layout of a railway with passing loops in this example the system uses grsm for data communications.

Alternative methods of data communications could be used.

The control unit and all the key token machines are linked to a central server.

Each token machine and the control unit has its own unique identity.

Messages pass between token machines and the control unit via the central server.

The server need not be located anywhere near the railway.

The control unit can be portable and so the controller can be located anywhere and need not be static. -.1

The token machines have specific identified locations.

Token machines may have bespoke solenoid activated, trapped key/lock designs or may use proprietary equipment such as is manufactured by Castelle or Fortress, The diagram shows token machines with capacity of four tokens per short section and two tokens per long section. The number of tokens depends on an individual railway's requirements.