DK2804798T3

DK2804798T3 - A method for controlling, securing and / or monitor the rail-traffic and operations management

Info

Publication number: DK2804798T3
Application number: DK12708513.2T
Authority: DK
Inventors: Jens Braband
Original assignee: Siemens Ag
Priority date: 2012-02-23
Filing date: 2012-02-23
Publication date: 2016-07-25
Also published as: RU2014138244A; EP2804798B1; RU2603708C2; ES2573777T3; CN104203714A; CN104203714B; WO2013123989A1; EP2804798A1

Description

Method for operating, securing and/or monitoring rail-bound traffic, and operation control system

The invention relates to a method for operating, securing and/or monitoring rail-bound traffic, wherein a signal box is controlled remotely in a first operating mode by an operation control system.

Such a method is for example known from the corporate publication "Efficient rail transport with the Vicos OC operations control system family - Cost-effective operations management" order number A19100-V100-B874-V1-7600, Siemens AG 2008. This describes an operation control system to which different types of signal boxes can be connected and then remotely controlled or operated by means of the operation control system. A method of the type cited in the introduction is additionally known from the technical article by Bernhard Antweiler "Vernetzte Leittechnik fur sicherheitskritische Anwendungen am Beispiel Schweiz" [Networked control technology for safety-critical applications, using the example of Switzerland], Signal + Draht (99) 3/2007.

The object of the present invention is to specify a method of the type cited in the introduction, by which the safety of rail-bound traffic can be further increased.

This object is inventively achieved by a method for operating, securing and/or monitoring rail-bound traffic, wherein a signal box is controlled remotely in a first operating mode by an operation control system, a disruption of the signal box or a disruption of the communication between the operation control system and the signal box is established, the operation control system is switched to a second operating mode upon establishment of the disruption and a limited signal box functionality is provided by the operation control system in the second operating mode.

The invention is based on the knowledge that operation necessary following a (partial) failure of the technical safety systems at a fail-back level is considerably more hazardous in the region of the rail-bound vehicle than technically safeguarded normal operation. In consequence, in highly developed railway systems accidents normally occur almost exclusively at the fail-back level, in which the responsibility for safety is largely borne by humans. Although in this situation it would be conceivable to increase the availability of the overall system still further, in practice this runs up against both technical and financial limits.

Based on the foregoing considerations, the inventive method is characterised in that starting from a first operating mode in which a signal box is remotely controlled by an operation control system, a disruption of the signal box or a disruption of the communication between the operation control system and the signal box is established. One possible response to this would be to switch the operation control system off, since operation and monitoring of the signal box by the operations control system is not possible in the situation in question, or else is no longer possible to a sufficient extent.

In the context of the inventive method the operation control system is however in this situation switched to a second operating mode in which a limited signal box functionality is provided by the operation control system itself. Preferably the identification of the disruption and the switching of the operation control system to the second operating mode is effected in this case by the operation control system itself, wherein switching to the second operating mode can be triggered where appropriate by a corresponding operating action, for example in the form of a confirmation of the switching.

The provision of the limited signal box functionality can take place in the context of the inventive method, such that a non-fail-safe signal box logic reduced to the requirement necessary or expedient for the fail-back level runs on the operation control system. Whereas in the first operating mode, i.e. in the undisrupted state, a corresponding signal box functionality is provided on the part of the signal box without restriction, in the second operating mode, i.e. in the disrupted state, this is effected in a functionally restricted manner by the operation control system itself. As a result, still automated support in the context of operating, securing and/or monitoring the system, i.e. in particular the rail vehicles located on the track, is provided to the operating personnel of the operation control system despite the disruption which is present. Thanks to corresponding support or at least partial automation of the operation at the fallback level, i.e. in the disrupted state of the signal box in question or of the communication between the operation control system and the signal box in question, it is to be expected that the number of accidents can be considerably reduced at the fall-back level. As a result, the safety of the rail-bound traffic therefore advantageously significantly increases overall once again, wherein on the basis of corresponding investigations in this respect a factor in the order of 10 appears not to be unrealistic.

It should be noted that in practice generally several signal boxes will be connected to the operation control system for the purpose of remote control of said signal boxes by the operation control system, wherein the signal boxes in question can be signal boxes of any design, in particular electronic signal boxes. Switching the operation control system from the first to the second operating mode is, where several signal boxes are connected to the operation control system, preferably possible specifically for the respective signal box. This means that the operation control system can be switched to the second operating mode in respect of a first, disrupted signal box, whereas in respect of a second, undisrupted signal box it remains in the first operating mode.

As a function of the respective circumstances it is in principle also possible for the operation control system to be used for the control or operation of just one signal box. In this case in particular the situation is conceivable whereby the operation control system - unlike in the normal situation - is arranged in the immediate spatial vicinity of the signal box .

In respect of the operation control system it should be further noted that in addition to the (remote) control or (remote) operation of the signal box or of several signal boxes it can of course also have further functions. Thus the operation control system can for example additionally comprise an integrated train number system, integrated automatic train routing and/or a dispatching centre.

According to a particularly preferred development the inventive method is embodied such that the limited signal box functionality is provided by the operation control system in the second operating mode based on status information transmitted by the signal box prior to the disruption. This preferred embodiment of the inventive method takes advantage of the fact that all significant status information of the signal box is known to the operation control system generally up until the occurrence of the respective disruption, since it for example displays the statuses of the signal box or of the components of the outdoor equipment on operator consoles. The status information in question can now be used in the second operating mode as a starting point for the limited signal box functionality of the operation control system. The advantage of this is that at least in respect of the initial status at the time of the disruption a visualisation along with operation, securing and/or monitoring by the operation control system can take place, or at least with the assistance thereof.

Preferably the inventive method can also be executed such that manual inputs relating to at least one track section, in particular in the form of inhibit tags or releases, are captured by the operation control system in the second operating mode. This is advantageous, since an operator is hereby enabled to input status information obtained from the field into the operation control system, which can check this information for possible conflicts and hazards. It is in this case for example conceivable for the operator in question to obtain status information by telephone, by visual inspection or also by video monitoring and to input it manually, i.e. in non-automated form, into the operation control system. In this case corresponding manual inputs can on the one hand relate for example to inhibit tags for track sections for which the operator has issued driving instructions. On the other hand the manual inputs can for example relate to releases or track vacancy detection indications for track sections resulting from corresponding feedback from a locomotive driver.

According to a further particularly preferred embodiment of the inventive method status messages are received from rail vehicles by the operation control system in the second operating mode and/or driving instructions are assigned to rail vehicles. To this end failsafe or else non-failsafe assistance systems can be installed in the locomotives for example, which automatically communicate information such as location and speed of the vehicle to the operation control system. These status messages can for example be used to check feedback from the respective locomotive driver for plausibility or else to issue driving instructions for the rail vehicle in question or for other rail vehicles. Where corresponding assistance systems - for instance in the form of ATP (Automatic Train Protection System) vehicle devices - are already present, the status messages can for example be transmitted in the usual manner from the respective ATP vehicle device to an ATP track device, and from this to the operation control system.

Preferably the inventive method can also be developed such that a warning message is issued by the operation control system, where a conflict situation is identified based on the limited signal box functionality. Preferably in this case for example conflicting driving instructions, which can result in hazards or accidents, are identified on the basis of the limited signal box functionality by the operation control system and are signalled by outputting the warning message.

The warning message can firstly be output directly to the operating personnel of the operation control system, wherein this can take place in any form, i.e. for example acoustically or visually. Secondly it is for example also conceivable for the warning message to be transmitted alternatively or additionally to a rail vehicle and to be output in the driver's cab thereof.

The invention further relates to an operation control system which in a first operating mode is designed to remotely control a signal box.

Such an operation control system is likewise known from the corporate publication cited in the introduction.

In respect of the operation control system the object of the present invention is to specify an operation control system by which the safety of rail-bound traffic can be further increased.

This object is inventively achieved by an operation control system which in a first operating mode is designed to remotely control a signal box, wherein the operation control system can be switched to a second operating mode upon establishment of a disruption of the signal box or a disruption of the communication between the operation control system and the signal box, and the operation control system provides a limited signal box functionality in the second operating mode.

The advantages of the inventive operation control system correspond to those of the inventive method, so that in this respect reference can be made to the corresponding explanations above. The same applies regarding the preferred developments of the inventive operation control system cited below in respect of the corresponding preferred developments of the inventive method, so that in this respect too reference is made to the respective corresponding explanations above.

According to a particularly preferred development the inventive operation control system is designed to provide the limited signal box functionality in the second operating mode on the basis of status information transmitted by the signal box prior to the disruption.

Preferably the inventive operation control system can also be embodied such that it is designed to capture manual inputs relating to at least one track section, in particular in the form of inhibit tags or releases, in the second operating mode.

According to a further particularly preferred embodiment the inventive operation control system is designed in the second operating mode to receive status messages from rail vehicles and/or to assign driving instructions to rail vehicles.

Preferably the inventive operation control system can also be embodied such that it is designed to issue a warning message, where a conflict situation is identified based on the limited signal box functionality.

In the following the invention is explained in greater detail on the basis of exemplary embodiments. To this end the

Figure shows a schematic sketch of a signal box and an operation control system in order to explain an exemplary embodiment of the inventive method and an exemplary embodiment of the inventive operation control system.

The figure shows, in schematic form, a signal box 10 and an operation control system 20. For better understanding an operating device 30 is additional shown separately, which however could itself likewise be assigned to the operation control system 20.

According to the illustration in the figure the signal box 10, which may for example be an electronic signal box, is connected to the operation control system 20 via a communication link 40. In addition the operating device 30 is also connected to the operation control system 20 via a communication link 50. It should be noted that the communication links 40 and 50 will generally be embodied as redundant and in high-availability form.

In the normal operating status of the system illustrated the signal box 10 is remotely controlled by the operation control system 20 in a first operating mode, for example by corresponding inputs on the operating device 30. This means that detailed and overview images can for example be displayed on the operating device 30, which display the status of track elements, i.e. for example signal aspects, points facilities or track vacancy detection statuses. The status information in question is transmitted from the signal box 10 via the communication link 40 to the operating control system 20.

Based on this status information an operator, who may for example be a signalman, now has the opportunity to operate or control the signal box 10 by means of the operating device 30 or the operation control system 20. In addition the operation control system 20 can provide additional automatic functions, such as for example an integrated train number system, integrated automatic train routing and/or dispatching centre functions. As a function of the respective functional scope the operation control system 20 - or in the illustration of the figure the totality of the operation control system 20 and the operating device 30 - can thus be executed as a remote control centre, as an operation control centre and/or as a dispatching centre.

In practice the situation can now arise, despite all efforts to ensure availability of the whole system at all times, for example by redundant embodiment of the components, whereby because of a disruption to the signal box 10 or the communication between the operation control system 20 and the signal box 10 a fail-safe normal operation, i.e. the first operating mode, cannot be maintained. A corresponding disruption is indicated in the figure by a lightning bolt and is provided with the reference character 60.

In this situation emergency operation would normally now be necessary so that the control, securing and/or monitoring of the rail-bound traffic, i.e. of the rail vehicles in question, would take place by the operating personnel essentially without technical support.

In fundamental distinction to this, in the context of the inventive method the operation control system 20 is switched to a second operating mode upon establishment of the disruption 60, which second operating mode thus implements a fail-back level. In the second operating mode a limited signal box functionality is provided by the operation control system 20. This means that instead of essentially switching off the operation control system 20 in the event of a failure or a partial failure of the signal box 10 or of the communication link 40, a non-fail-safe signal box logic reduced to the necessary requirement of the fail-back level is for example advantageously provided or executed by the operation control system 20.

In connection with the provision of the limited signal box functionality, the operation control system 20 preferably takes account of the status information which was transmitted by the signal box 10 prior to the disruption. Because the operation control system 20 displays the statuses of the signal box 10 or of the components of the outdoor equipment for example on the operating device 30, it is aware in principle of at least the essential status information of the signal box 10. Based on this status information it is possible by means of the limited signal box functionality to provide at least some basic functionalities of a signal box, in order even in the disrupted status to enable at least semi-automated operation .

In the second operating mode the operation control system 20 can, for instance thanks to a corresponding input on the operating device 30, capture manual inputs relating to at least one track section. This means it is possible for an operative, i.e. an operator who is characterised in the figure by the reference character 70, to input such status information for example into the operation control system 20 which he has obtained by means of a communication device 80, for instance in the form of a telephone, via another communication link 90 from a trackside communication device 100 or a person 110 using the trackside communication device in the region of the outdoor equipment. It is for example conceivable here for the person 110 to read off the status of a light signal 120 and to transmit it to the operator 70. In addition it is possible for status information, for instance in the form of the location and speed of the rail vehicle 130, also to be received from a rail vehicle 130 by the operator 70 or directly by the operation control system 20. The corresponding transmission can take place for example by means of a radio antenna 140 of the rail vehicle 130. Such a -preferably automated - transmission of status information from the outdoor equipment to the operation control system 20 thus advantageously enables at least partially automated operation even in the second operating mode.

Based on the foregoing information it is possible for the operator 70 to input inhibit tags relating to at least one track section into the operation control system 20 by means of the operating device 30. The inhibit tags in this case relate to those track sections for which the operator 70 has issued driving instructions. On completion of a journey, i.e. for example following feedback from the locomotive driver in question, a corresponding release can additionally be issued by the operation control system 20 for at least one corresponding track section. This means the limited signal box functionality of the operation control system 20 is enabled to identify hazard situations, for instance in the form of conflicting driving instructions, and where necessary to issue a warning message to this effect to the operating personnel.

According to the foregoing explanations the inventive method and the inventive operation control system or the previously described embodiments thereof in particular offer the advantage that even at the fail-back level implemented by the second operating mode essentially seamless support for the operating personnel is enabled, wherein preferably the status information which has been transmitted at an earlier point in time by the signal box in question is used or evaluated.

Thanks to the support provided by this or at least partial automation of the operation at the fail-back level, i.e. by inserting an additional technical safety loop, the safety of the rail-bound traffic is advantageously further increased, so that it can be assumed that as a result the probability of the occurrence of accidents at the fail-back level can be significantly reduced.

Claims

A method of controlling, securing and / or monitoring the rail traffic in which - a fuse system (10) is remotely controlled by an operating control system (20) in a first mode of operation, characterized in that - a fault is detected in the fuse system (10) or an error in communication between the operating control system (20) and the fuse system (10), - the operating control system (20) is switched to another operating mode when the fault is detected, and - a diminished fuse system functionality is provided by the operating control system (20) in the second operating mode.

A method according to claim 1, characterized in that the degraded security system functionality is provided by the operating control system (20) in the second operating mode on the basis of state information transmitted by the security system (10) before the failure.

Method according to claim 1 or 2, characterized in that manual readings relating to at least one track section, in particular in the form of blocking messages or releases, are recorded by the operating control system (20) in the second operating mode.

Method according to one of the preceding claims, characterized in that the operating control system (20) in the second operating mode receives state messages from rail vehicles (130) and / or provides driving instructors to rail vehicles (130).

Method according to one of the preceding claims, characterized in that a warning message is issued by the operating control system (20) if a conflict situation is detected on the basis of the limited security system functionality.

An operating control system (20), which in a first operating mode is designed to remotely control a fuse system (10), characterized in that - the operating control system (20) can be switched to another operating mode when a fault is detected in the fuse system (10) or an error in communication between the operating control system (20) and the fuse system (10); and - the operating control system (20) in the second operating mode provides a reduced fuse system functionality.

The operating control system according to claim 6, characterized in that the operating control system (20) is configured to provide the reduced security system functionality in the second operating mode on the basis of state information transmitted by the fault system (10).

The operating control system according to claim 6 or 7, characterized in that the operating control system (20) is designed to record, in the second operating mode, manual readings relating to at least one track section, in particular in the form of blocking messages or releases.

The operating control system according to one of claims 6 to 8, characterized in that the operating control system (20) is designed to receive state messages from rail vehicles (130) and / or to provide driving instructions for rail vehicles (130) in the second operating mode.

The operating control system according to one of claims 6 to 9, characterized in that the operating control system (20) is designed to send out a warning message if a conflict situation is detected on the basis of the restricted security system functionality.