REVIEWThe processing results from <strong>the</strong> two systems are comparedand in case <strong>the</strong>y are not identical, <strong>the</strong> comparing function itselfand <strong>the</strong> next safety action must redirect <strong>the</strong> system into a safe-sideposition. This concept is possible with <strong>the</strong> configur<strong>at</strong>ions ‘2 out <strong>of</strong>2’ and ‘2 out <strong>of</strong> 3’.These are <strong>the</strong> main problems th<strong>at</strong> every system must solveand <strong>the</strong> ‘internal mechanisms’ th<strong>at</strong> must achieve <strong>the</strong> above failsafebehavior:• Every single failure must be identified and must result in a safetyreaction <strong>of</strong> <strong>the</strong> system;• Double or multiple failures cannot happen if <strong>the</strong> safety concept<strong>of</strong> <strong>the</strong> system enables full comparison <strong>of</strong> results (during <strong>the</strong>entire course <strong>of</strong> <strong>the</strong> processing, and not only <strong>at</strong> its end) andcondition <strong>of</strong> both channels, including memories;• Not a single failure in one channel can have a similar effecton <strong>the</strong> o<strong>the</strong>r channel. The channels must be independent fromeach o<strong>the</strong>r;• Both channels and <strong>the</strong> whole module must be completely testedand with no mistakes in ei<strong>the</strong>r hardware or s<strong>of</strong>tware beforereleasing <strong>the</strong> system into work. In o<strong>the</strong>r words, <strong>the</strong> systemmust be guaranteed as mistake-free before starting up <strong>the</strong>system.So, this obviously shows th<strong>at</strong> <strong>the</strong> work <strong>of</strong> both processors andall <strong>the</strong> activities th<strong>at</strong> are rel<strong>at</strong>ed to fur<strong>the</strong>r process oper<strong>at</strong>ion arecontrolled in <strong>the</strong> earliest phase <strong>of</strong> every tact.This early control, as an internal mechanism for identifyingmistakes even in <strong>the</strong> earliest phase, is supported by a special additionalchecking program, which periodically checks <strong>the</strong> completest<strong>at</strong>us <strong>of</strong> <strong>the</strong> system. Also, all <strong>the</strong> inside d<strong>at</strong>a, before <strong>the</strong>ir entryinto <strong>the</strong> memory, are subject to autom<strong>at</strong>ic comparison and correction.It is clear th<strong>at</strong> this kind <strong>of</strong> safety concept assumes safety functions<strong>of</strong> <strong>the</strong> tact-giver and <strong>the</strong> compar<strong>at</strong>or, implying th<strong>at</strong> <strong>the</strong>y mustbe ‘fail-safe’ designed, i.e. th<strong>at</strong> every mistake on one <strong>of</strong> <strong>the</strong> elements<strong>of</strong> <strong>the</strong>se modules must be reflected in <strong>the</strong> ultim<strong>at</strong>e instancein <strong>the</strong> content <strong>of</strong> <strong>the</strong> BUS signal.Fig. 1 shows an illustr<strong>at</strong>ive example <strong>of</strong> a basic two-channelconfigur<strong>at</strong>ion <strong>of</strong> <strong>the</strong> safety microcomputer by Siemens Company.This configur<strong>at</strong>ion is safe-designed so th<strong>at</strong> <strong>the</strong> two identical microcomputerswork in synchrony with <strong>the</strong>ir:• Central processing units CPU 1 and CPU 2;• Belonging memories for entering and reading <strong>of</strong> <strong>the</strong> RAM 1and RAM 2 d<strong>at</strong>a;• Memories which are programmed for fixed values th<strong>at</strong> can bereprogrammed as needed, EPROM 1 and EPROM 2;• The configur<strong>at</strong>ion contains common ingoing and outgoingmodules;• Reception (1) and Release (2) which establish connection with<strong>the</strong> exterior elements; <strong>the</strong> system has one common tact-giverto synchronize <strong>the</strong> work <strong>of</strong> <strong>the</strong> two identical channels.The system checks if <strong>the</strong> signals from both channels are identicalin every tact step, in <strong>the</strong> following way: <strong>the</strong> tact-giver turns onboth processors (TACT 1 and TACT 2) and a compar<strong>at</strong>or (‘C’ signal– control in Fig. 1) The compar<strong>at</strong>or checks <strong>the</strong> content <strong>of</strong> <strong>the</strong> collectorsin both microcomputers (BUS 1 and BUS 2) and compares<strong>the</strong>m. Only in case th<strong>at</strong> <strong>the</strong> compar<strong>at</strong>or (in every tact)establishes <strong>the</strong> identical st<strong>at</strong>us <strong>of</strong> both channels, it gener<strong>at</strong>es <strong>the</strong>signals “OK” (no mistake) on its exit, which triggers <strong>the</strong> nextworking cycle <strong>of</strong> <strong>the</strong> tact-giver.O<strong>the</strong>rwise, in case <strong>the</strong>re is any discrepancy in <strong>the</strong> signalscoming from Channel 1 and Channel 2, which is transparentlyshown on BUS 1 and BUS 2, or in case <strong>of</strong> any mistake on <strong>the</strong>compar<strong>at</strong>or, <strong>the</strong> compar<strong>at</strong>or ‘chokes’ <strong>the</strong> ‘OK’ (no mistake) signaldriving <strong>the</strong> tact-giver into rest, which ultim<strong>at</strong>ely means stopping<strong>the</strong> process: <strong>the</strong> whole configur<strong>at</strong>ion (module) stops its work directing<strong>the</strong> system to <strong>the</strong> ‘safe side’.Fig. 1 Basic structure <strong>of</strong> <strong>the</strong> two-channel safety microcomputer2. Principles <strong>of</strong> safety in <strong>the</strong> <strong>railway</strong> signalling systemsThe signalling systems are not immune from failure and,<strong>the</strong>refore, due to <strong>the</strong>ir specific role, <strong>the</strong>y must be designed andconstructed so th<strong>at</strong> even in case <strong>of</strong> disturbance and failure <strong>the</strong>y donot endanger <strong>the</strong> safety <strong>of</strong> <strong>the</strong> traffic, which implies th<strong>at</strong> <strong>the</strong>y mustbe signal-safe and technically-safe.This ‘fail-safe’ behavior is achieved by implement<strong>at</strong>ion <strong>of</strong> <strong>the</strong>signalling principles and safety criteria and using highly reliabledevices regardless <strong>of</strong> <strong>the</strong> technology.As a defined measure <strong>of</strong> safety, <strong>the</strong> intern<strong>at</strong>ional <strong>railway</strong> organiz<strong>at</strong>ionUIC, i.e. its committee ORE, has defined in its recommend<strong>at</strong>ionson <strong>the</strong> basis <strong>of</strong> so far experience and <strong>the</strong> achievedlevel <strong>of</strong> technical development ‘<strong>the</strong> mean time between two dangerousfailures’ – ‘MTBF’, as a reliability measure in between two58 ● COMMUNICATIONS 3/2008
REVIEWfailures. For example, for an electronic signal box this means,respectively:• Th<strong>at</strong> <strong>the</strong> mean time between two dangerous failures (MTBF)must not be closer than 100 years;• Th<strong>at</strong> <strong>the</strong> mean time between two failures (MTBF) must not becloser than 4 months (2880 hours).2.1. The purpose and <strong>the</strong> functioning principle <strong>of</strong> <strong>the</strong>signalling/safety devicesFig. 2 illustr<strong>at</strong>es <strong>the</strong> role <strong>of</strong> <strong>the</strong> system <strong>of</strong> <strong>railway</strong> signalliz<strong>at</strong>ionwith modalities <strong>of</strong> implement<strong>at</strong>ion <strong>of</strong> <strong>the</strong> safety principles.Fig. 2 The role <strong>of</strong> <strong>the</strong> <strong>railway</strong> signalliz<strong>at</strong>ion system with modalities <strong>of</strong> implement<strong>at</strong>ion <strong>of</strong> <strong>the</strong> safety principlesCOMMUNICATIONS 3/2008 ●59