intermittent and continuous ATP 101119 - irse.nl

affordable at all. In literature, e.g. [26] SIL levels specified for intermittent systems arequoted as SIL 2.Intermittent Systems.Intermittent systems resemble train stop systems to the extent that information isonly passed “intermittently” from track to train at certain fixed locations. Most systemsof earlier design can therefore only provide intermittent supervision as well, e.g.between distant and main signals and thus will only provide protection against asignal being passed at danger. However as technology evolved they became morecapable and nowadays most modern systems are able to provide continuoussupervision / protection of the train and can even offer (continuous) speedsupervision.Simple ATP systems such as the German INDUSI, or AWS and TPWS in the UKoperate in background mode and no indication is given to the driver, except perhapson system health or when an emergency brake application has occurred. The driverhas to observe the line side signals and react according to their aspects. Only in thecase of a driver driving too fast or SPADding will the system automatically apply theemergency brake. The same safety design philosophy as mentioned above for thetrain stop system are applicable.More sophisticated intermittent ATP systems, for example the British ATPsystems, Dutch ATB NG, Ebicab, or indeed ERTMS/ETCS level 1, are also based onprinciple that the driver is still primarily responsible for observing signals andoperating the train. The ATP still acts as a safety net. However, as newer technologyallows more information to be transmitted, some indications can be given to thedriver, for example target speed and the distance to go, i.e. to the point at which thetrain’s speed must be under the new target speed limit, or the distance to the signalat danger. As wrong indications could mislead the driver and so provoke unsafereactions, the system, or at the very minimum its speed supervision sub-system, hasto be fail-safe in this respect. Data generation, data transmission and data evaluationon board have to have a high level of safety integrity as well, as a failure could causea dangerous situation with a driver relying on the cab display rather than on the lineside signals.In general the in-can signalling allows the driver to optimise his driving andcertainly provides a level of “comfort”, e.g. when driving in adverse weatherconditions affecting visibility of signals.Continuous SystemsContinuous ATP/ATC systems normally provide full cab signalling, which impliesthat the driver must be able to fully rely on the safety of the system. There are twoprinciples in use, which differ in safety philosophy. In France, the TVM system has avital display to the driver, the driver himself is considered fail-safe, therefore there areless technical safety requirements on the implementation of the speed supervisionand emergency brake application functions. In contrary, among others, the DutchATB and German LZB employ a non-vital cab display but implement a vital speedsupervision and access to the emergency brake. In this philosophy the driver isconsidered a non-vital part of the overall train control system and even if he weremisled by the cab signal, the speed supervision and brake application will intervenein a fail-safe manner.4