Proceedings 2002/2003 - IRSE

60
SIGNALLING CONTROL CENTRES TODAY AND TOMORROW
display of text messages, advisory speed limits, and
updated timetables, and these are defined in a draft
CENELEC standard. However, with the exception of
text messages, these additional features are not
supported in the UNISIG Class 1 standards which
are the current baseline for ETCS specification. The
paring down of features in the Class 1 specifications
is a deliberate policy to limit the scope to those
functions which are essential for safety and interoperability.
This has undoubtedly been a good move
to curtail the debate on specifications and move
ETCS from concept to reality, but it would be
unfortunate if “value added” features can never be
added to the basic system.
In fact, although these messages would appear on
the ETCS DMI, they do not actually need to be part
of the ETCS SIL4 safety critical system, ie the RBC
at the control centre and the EVC (European Vital
Computer) on the train. The DMI in the cab is similar
in many respects to the signaller’s workstation in the
control centre. It is a lower-integrity system
(typically SIL2) which provides the human interface
to the safety system and implements some
additional less critical functions. One of the fundamental
principles of safety critical systems design is
to partition the design to minimise the complexity of
the high-SIL components, so we should be thinking
of architectures which allow the signalling control
centre systems to talk to the DMI as a SIL2-SIL2
interface without adding complexity to the SIL4
ETCS components (see Figure 8). There are a
number of ways in which this could be implemented.
1 Define additional messages at the ETCS
“air-gap” interface, and implement software in
RBC and EVC to pass these through to control
centre and DMI.
2 Use the existing text message facility by defining
special messages which are recognised as an
instruction to update the DMI instead of a genuine
text message direct to the driver – no change
required to RBC and EVC.
3 Establish a direct link between the DMI and the
GSM-R radio on the train, bypassing the EVC, and
a similar link at the signalling control centre
bypassing the RBC – again no change required to
RBC and EVC.
CONCLUSION
The recent report of the UK ERTMS National
Programme Team 5 identified improvements in
network capacity as a possible foundation for a
business case for the investment that will be
required in ETCS. The report showed that to achieve
this requires the adoption of ETCS Level 2 without
lineside signals. This type of signalling system could
Signalling
Control
System
ETCS
trackside
(RBC)
Communication via ETCS SIL4 systems
Communication independently of SIL4
systems
GSM-R communications
Driver
machine
interface
ETCS
trainborne
(EVC)
Figure 8: Architectures for control centre
communications to driver
be controlled from existing signalling control centre
systems with minimal change, but greatest benefits
are likely to come if we establish a traffic management
layer of communications between the control
centre and the cab to complement the safety layer
provided by ETCS. Defining the requirements for
such systems and implementing them in a manner
which achieves interoperability will be a significant
challenge for signalling control systems engineers
and operators.
ACKNOWLEDGEMENT
I would like to thank AEA Technology Rail for
permission to publish this paper, and my colleagues
in AEA Technology Rail and Railtrack who have
supplied information and comments.
REFERENCES
1 Yoker Integrated Electronic Control Centre, R C
Nelson, IRSE Proceedings 1986/7
2 IECC Development, K.Thomas, IRSE News Issue
69, November 2000.
3 IECC Upgrades and SPAD Alarm, T Weston, IRSE
News Issue 78, May 2002.
4 Human Factors and York Signalling Centre, J
Wood, IRSE News Issue 72, May 2001.
5 The ERTMS Programme Team Final Report Issue
to HSC – April 2002, D Waboso, Railway Safety.