SA520420235B1 - Train Traffic Control System and Method for Carrying Out Safety Critical Operation - Google Patents

Abstract

A train traffic control system comprising a traffic management system (TMS) for executing safety critical operations, a route and train control system (RTCS), and a command and status adapter (COST), wherein the train traffic control system is adapted to exchange information and commands between the traffic management system (TMS) and the route and train control system (RTCS), wherein the command and status adapter (COST) comprises software components for carrying out functions with basic integrity, wherein the traffic control system further comprises a software component for carrying out a function for controlling safety critical operations, is characterized in that the function for controlling safety critical operations is outsourced from the command and status adapter (COST). The inventive train traffic control system on the one hand realizes a high safety level and on the other hand allows considerable cost reduction. Fig 2A.

Description

Train Traffic Control System and Method for Carrying Out Safety Critical Operations Full Description Background The invention relates to a train traffic control system incorporating a traffic management system management system to perform safety critical operations; A “route and train control system” and a command and status adapter “adapter 5” where the route and train control Jalil system initializes information and commands between the Jalil traffic management system Traffic, track and train control system via command and status converter; Whereas the command and state converter includes software components to perform functions with basic integrity; A traffic control system includes at least one software component to perform the safety-critical process control function. The invention also relates to a method for implementing 1 0 safety critical operations within a train motion control system. An appropriate train motion control system is defined by document [1]. Track and train control systems are configured to safely manage routes and traffic facilities in the railway network for the operation of trains and to control and protect trains from traveling at speed or from moving out of the control of the traffic facilities. Track and train control systems can include an interlocking system, a shortwave center of mass or a Silas system Remote control via operation/traffic control centers is increasingly important for the control of interlocking systems and track and train control systems. A long-term known case in traffic management systems in operation/traffic control centers is that many different (legacy) interlocking systems need to be controlled/supervised at a single remote workplace of an operator. And from

Examples of such a case are systems operating in Finland [1]), subway systems in Munich [2] or German mainline railway systems 08 [3]. Special transformer modules (command and status converter) Jie SAM modules or SCM in [1] or product FLO in [3], which covers all required functions in one system.Different track and train control systems, which must be controlled by an operator on ca, transmit status information to the system Traffic management in the form of specific protocols.COST command and status adapter converts specified protocols into generic protocols and provides track and train control system status for further processing by the traffic management system in normal form.In addition; By converting operational commands into specific format 0 for a track and train control system The traffic management system has a human machine interface for the operation of the track and train control system by a human operator The track and train control system receives commands from the traffic management system for regular operation as well as for Critical safety operations to oversee the approval procedure. Critical safety operations are performed in special operational situations or in the event of disturbances using the 5 Safety and Train Operations Control System. Unlike normal operations which can be checked for acceptance at any time by the train control system, safety critical operations are directed by the operator while bypassing track and train control system elements (eg shortwave center of mass or interlocking system). Safety Critical Operations are the operator's actions; eg safety critical path clearance; change the safety critical point; and so on 0 that; That is, the operator can avoid the safe setup of the system. Given the relevance of safety critical process control to safety; High safety requirements must be met when developing a Gay command switch. (COST) command and status adapter alls for

[1] The COST converter was developed based on fail-safe computer systems (eg Jie SAM or SCM based on Thales' 185-01 [185-01] system and with (ell) this 5 This leads to higher hardware costs for this dedicated computer and also higher development costs

programs, their integration and testing because all these components must be developed according to the safety level (Bale) dle Gg (SIL4 of the EN 50128 standard [4]. Therefore, one of the objectives of the invention is to propose a control system for the movement of the train that achieves the high level of safety required in terms of And it allows a significant cost reduction on the other hand.General description of the invention

This objective is accomplished by providing a train motion control system dg for claim 1 and the method according to claim 11. According to the invention; The safety-critical process control function is outsourced from a command and status adapter (0051). Meaning A ¢ is separated

0 Safety-related functions (Safety-Critical Process Control function) are functionally separate from basic integration functions (but do not have to be installed in separate locations). The aig COST adapter can then be developed for SILO which is much cheaper compared to the known all security COST adapter from the latest technology in the industry; So » the traffic management system

5 in a special form; The safety-critical process control function is integrated into the track and train control system. No need to use another computer. This makes this model particularly cost effective. However; Additional functionality must be integrated into all lane and train control systems to be managed by the traffic management system. In the cdo model the system also includes a console” separate from the command and status converter

(COST) 0 where the safety-critical process control function is integrated into the control unit. The controller is configured to control safety critical operations. No other functions need to be integrated into the track and train control system. From here, a command and case converter can be used for foreign companies.

The command and state switcher can include an integrity level of SIL>4 with =SIL zero. due to the low level of safety; Command and case converters can be provided at low cost. In a highly preferred alternative form; The traffic control system consists of different types of track and train control systems; For example electronic interlocking systems, relay based interlocking systems or interlocking systems produced by different companies. Preferably, software components are provided to carry out the functions with basic integration of the different types of track and train control system within one (same) computer. due to the low level of safety; required for the command and case converter of the present invention; A little force is required to operate the command and status converter. Thus, several functions with basic integration 0 can be provided for different types of track and train control system by the same computer. in highly preferred form; The controller is configured to control the safety critical operations of all types of track and train control systems of the traffic control system. At least one of the functions with basic integration is integrated into the traffic management system. Appropriate software components can be integrated into the operator's workstation. Traffic Management System 5 then includes at least parts of the 0051 switch. If all functions with basic integration are integrated into the traffic management system, a separate PC is not required in the command and status switch. The command and state converter should preferably include a decoder. This allows encrypted messages containing information related to safety-critical operations to be sent via the command and status switch; Which 0 ensures that the command and state switcher cannot inadvertently modify the message. The decoder is preferably arranged at the output side under the command and state converter. Instead of that; Message decoding can be implemented within the track and train control system.

(Sa procedure to encrypt messages inside the console of) found). In this case; Preferred model console includes; Functions with basic integration include the normal operations configuration function, the “Alls” configuration function, and/or the protocol conversion function to be transferred between the track and train control system 3 and the traffic management system.

The invention also relates to a method for implementing safety-critical operations within a train traffic control system incorporating a traffic management system”; track and train control system; command and status converter; The messages are transmitted between the traffic management system and the Gay lane control system. ally of the invention; Safety-critical operations are controlled outside of the command and status converter; ie in a component

0 is intended to implement a safety-critical process control function. Preferably, messages travel through the command and state converter. Only one interface is needed in the track and train control system. In a first alternative form; Safety-critical operations are controlled within the track and train control system.

5 1 in a second alternate form; Safety-critical operations are controlled within a console » separate from the command and status switch. The innovative structural principle of Separation of Integral Components of Integration (SILO) and Safety Related Components (SIL < zero) enables cost-effective control of various types of track and train control systems.

0 Other advantages can be extracted from the description and accompanying drawing. The above features and below Gy of the invention may be used either individually or collectively in any combination. The embodiments mentioned should not be understood as an exhaustive enumeration but should have a typical adjective to describe the invention.

Brief explanation of the drawings The invention is illustrated through drawings. Figure 1 shows the architecture of the Gy traffic control system for the current state of the art in the field. Figure 12 illustrates the architecture of the “Wy traffic control system of the invention” in which the safety-critical process control function is integrated into the track and train control system. Figure 2b shows the structure of the traffic control system according to Figure 12 with several types of track and train control systems. Figure 13 illustrates the architecture of the “Wy traffic control system of the invention” in which the control function 0 in safety-critical operations is integrated into a separate control unit. Figure 3b shows the structure of the traffic control system according to Figure 13 with several types of track and train control systems. Detailed Description: Figure 1 shows the traffic control system architecture to implement Safety Critical Bag operations for the current state 5 state of the art in the industry. A track and train control system is connected A route and train control system (RTCS) is connected to the TMS traffic management system Between the TMS and the train control system track and train. Blas .1405 dla information and commands for incompatibility between the TMS traffic management system and the RTCS track and train control system are exchanged in general 0 Ladd related to the type of dullable protocols A command and state converter is provided COST which It includes functions for protocol conversion, regular operations configuration, RTCS state configuration, safety-critical switch control, and cost status (COST).

To ensure the required safety; The command and state converter must be developed at an integrity <SIL (zero) level. According to the invention; Safety Critical Operations Control functionality is detached/outsourced from (COST) command and status adapter dlls and provided separately. And therefore; Safety-related functions and functions with basic integration are separated. According to the invention, the COST command-and-state converter does not have safety-related functions; However, it includes only functions with basic integration and therefore can be developed at a lower level of safety (SILO). Figure 12 illustrates the architecture of a first prototype of an innovative traffic control system with a command and state transformer rate COST 0. The command and state transformer COST according to the invention includes contains software components in order to implement the function of initializing the regular operations of the track and train control system the function of initializing the state of the track and train control system on the internal data model of the traffic control system; The function of converting protocols of information/commands to be sent from TMS to TMS 4105 from a general protocol to a specific protocol and converting 5 protocols of information to be sent from TMS 1605 to TMS 5 TMS from a specific protocol to a general protocol respectively. The safety-critical process control function is integrated into the RTCS track and train control system (instead of the command and state converter (COST) in other words the software components that control the safety-critical process are moved to the 765). The remaining function of the command converter is no longer COST 0 is safety related.So COST can be developed according to “SILO which greatly reduces cost compared to well known state of the art COST .Figure 2b shows the By architecture of the control system In traffic that includes multiple types of 705” (Type 1;...; Type 0) track and train control systems). There is only one dala to command and COST state converter which includes the required software components (functions to initialize Employment

regular; state initialization and protocol switching) of many types; It is preferred for all types of 765 lane and tow control systems linked to the corresponding TMS. This first model is a particularly interesting Bie for track and train control systems (RTCS) that are built by the same manufacturer as the other components of the traffic control system. in the case of an existing RTCS that cannot be modified (eg because it was built by a third party); A second model of the innovative traffic control system is preferred; As shown in Figure 3a. In this case; An additional computer (CTRL console) is provided and the software component that controls the safety-critical process is integrated into the CTRL 0 console. The CTRL console is connected to the TMS to exchange commands/information in the form of General Protocols The information exchange procedure between the CTRL and the 11/45 traffic management system verifies that the correct SCO has been executed The result of this check i.e. the correct SCO is then transmitted from the CTRL through a converter COST commands and status to Bale RTCS in format 5 encoded so that unintentional modification by the COST command and status converter (that implemented by 510 only) is done by the RTCS Although this does not reduce hardware costs, it does reduce costs for software development, integration, and testing of the 0051 state and command switch components. Figure 3b shows the architecture according to a traffic control system that includes multiple types of 0 track and train control systems RTGS (Type 1;...; Type 7) Similar to Figure 2b, there is only a dala of a COST state and command switch that includes the required software components (functions to initialize regular operation; state initialization and protocol switching) of many types; Thanks to that for all types of track and train control systems 47605 associated with the corresponding 5-way traffic management system. In addition to cdl, only one CTRL controller is needed

— 1 0 —

The safety-critical process control software component of many track and train control systems

.RTCS

in both forms; The remaining functions within the command and status converter are initialized to convey related messages

Only the safety-critical process (rather than transmission and processing). In other words regarding run commands

critical to safety; The COST command and state converter according to the invention operates as a Jie "transparent channel".

Unlike cell, ADL cannot detect any misbehavior in

Required safety integration.

In the event that multiple types of Track and Train Control Systems (RTCS) need to be connected especially

multi-species tangled; Either multiple COST command and state adapters or a COST 0 command and state adapter that has multiple initialization and transformation functions (as shown in Figure 2b and Figure 3b) should

developed and offered 0. Therefore, labor savings (based on innovative SILO development) will be extended by

Factored by the number of types of RTCS for which a process can now be developed

Configure regular operation and status for each type as well as protocol conversion according to SILO

Claims (7)

protection elements 1. The train traffic control system includes: a traffic management system (TMS) to carry out normal operations; where the traffic control system is adapted to check the acceptance of normal operations at any time; RTCS route and train control system and (COST) command and status adapter Cua The train traffic control system is configured to exchange information and commands between the TMS ) traffic management system, route and train control system (RTGS) and train control system via command and “(COST) status adapter 10 where COST is included command and status adapter contains software components to perform functions with basic integration; Cua The TMS traffic management system comprises a human automated interface for operation of the route and train control system by an operating human operator; 5 where the traffic management system (TMS) is configured to perform safety-critical operations; lly avoids the safe setup of a route and train control system (RTCS) and train control system where the traffic management system (TMS) yall is configured to receive safety-critical instructions directed from the mast Operates with bypassing 0 elements of a route and train control system (“(RTCS) route and train control system) where the traffic control system also includes at least one software component to implement a safety-critical process control function; outsourced For the safety-critical operation control function from the (COST) command and status adapter, the SILO has a security level (COST) command and status adapter 5 — 2 1 — The Gag Traffic control system for Protection 1 has the advantage of integrating the safety-critical operation control function with the track and train control system. .(RTCS) and train control system ?. Gg Traffic control system for security element 1 where it is ashy also includes a separate (CTRL) control system from the COST command and status adapter where the Safety Critical Control Unit (CTRL) control system function 10 4. Gag Traffic control system for protection element 0 is characterized as a traffic control system that includes track and train control systems Traffic control system according to the protection element Coa of 5. It is characterized by the software components to implement the functions with basic safety for the different types (nce) of the traffic control system. Track and train control system (RTCS) route and train control system available within one computer. 7. Gi, Traffic control system for the protection element? or; or 20 *. Where it is distinguished that the control unit is configured to control the safety-critical operations of all types (from P0 route and train control system (RTCS) to the traffic control system. LV traffic control system Gay Traffic control system of Cua 5 has the advantage that at least one of the functions with basic integration is integrated into the traffic management system (TMS) A Gag Traffic control system for protection element 0 featuring a COST command and status adapter including a decrypter 1.5 Gag Traffic control system of protection element 1; features that basic safety functions include normal operations initialization and/or (RTCS) route and train status initialization function control system and/or the function of transferring the protocols to be transferred between the 1810 route and (RTCS) control system and the traffic management system (TMS) 0 . A method to perform normal and safety critical operations within a train traffic control system comprising: a traffic management system (TMS) to perform normal operations; route and train control system (105m); COST command and status adapter includes software components to perform functions with a basic integrity and security level (SILO) where information and messages are transferred between the TMS traffic management system and the track and train control system (RTCS) route and train control system via (COST) command and status adapter 0 where the traffic management system (TMS) includes a human-machine interface to operate the track and train control system route and train control system by a human operator in operation wherein the traffic control system also includes at least one software component to perform a safety-critical operation control function 5 wherein the traffic control system is adapted to check acceptance of normal operations in any time; — 4 1 — Where safety-critical operations are performed by the traffic Ally management system (TMS) management system avoids the safe setup of the ang (RTGS) route and train control system controlled outside a transformer Commands and Status (COST) command and status adapter The 5/5460 (TMS) traffic management receives safety-critical operations instructions that are routed from the operator bypassing track and train control system elements. (RTCS) route and train control system 1. The method according to claim 01, where it is characterized by the fact that messages are transmitted through the command adapter 0 and the status (COST) command and status adapter VY. The method is Gg for claim 01 or OY, where it is characterized Critical safety operations are controlled within the route and train control system (RTCS) NY method Gg of protection element 01 or OY) having the advantage that safety critical operations are controlled within a control system (CTRL) separate from the command and status switch .(COST) command and status adapter [ (ess) 705 000 [ zero ) y > SIL)COST , ose A W000 regular A Adee |] oud campaign |] {in| BESTS | 01 1 Figure (fe=SI)TMS |] SIL) COST | = zero) F initialize | | M. E. 1 H 8765 _)|operation |e | IEEE RT RTCS | Control (ha<SIL) | | safety operation)) Fig. by SIL) COST 0 | = zero) z BN we | | show | [me || Be ‎dee] DAS] regular 1 aunt 1 || imi operation (SIL) Ricsones | > zero) |0 .| Madq 6003 > zero) z to control the || z = 1 safety operation | | Critical Safety Process | z = shape?” b —_ 1 8 —_ (a5 #zero)_ TMS 0 public_protocol - ) ( zero = SILICOST 1 CIRL #Symmetrics {hoor > SHY 3 San ِِْ Haig | 1 TTC at l oH da ee EI Her FN PN il . public_protocol | z { ea = SHLCOST CTRL ro SE ] — py | Clap BIL) a TH fii TE || Control 1 for ie Lee: Aa Int. Ben: >! pub 1 58 Ma Cv HH RICS for “Lon iL RIGS J on screen 1_Protocon Transformation D | Protocol conversion | Aad IS { oben BIL IRTOS from 1 Al-Dhukh | cin {kes SELLY 87638 sell and from ow ay the form is august The Saudi Authority for Intellectual Property Sweden Authority for Intellectual Property pW RE .¥ + \ A 0 § Um 5 + < Ne ge “Benaj > Aye Ki Jada Li Days TEE Bbha Nase eg + Ed - 2 - 3 .++ .* provided that the annual financial fee is paid for the patent and that it is not null and void due to its violation of any of the provisions of the patent system, layout designs of integrated circuits, plant varieties and industrial designs or its implementing regulations. »> Issued by + BB 0.B Saudi Authority for Intellectual Property > > > “+ PO Box 1011 .| for ria 1*1 uo ; Kingdom | Arabic | For Saudi Arabia, SAIP@SAIP.GOV.SA