EP1705095A1

EP1705095A1 - Block system and method with intrinsic safety for low railroad traffic density lines

Info

Publication number: EP1705095A1
Application number: EP05380052A
Authority: EP
Inventors: Sergio De Miguel Sanz; Enric Dominguez Saura; Lluis Candini Gonzales
Original assignee: Sener Ingenieria y Sistemas SA
Current assignee: Sener Ingenieria y Sistemas SA
Priority date: 2005-03-21
Filing date: 2005-03-21
Publication date: 2006-09-27
Anticipated expiration: 2025-03-21
Also published as: DE602005003551D1; EP1705095B1; BRPI0601895A; SI1705095T1; ES2297653T3; PL1705095T3; DK1705095T3; BRPI0601895B1; DE602005003551T2; PT1705095E; AR052951A1; CY1107217T1

Abstract

In a nominal situation, the complete operation of the block system of the invention is as follows: The position of the train (1) is estimated onboard by means of a GNSS system-based locator (11) and other sensors (12). This position of the train will be determined through safety-qualified equipment by means of a data fusion, monitoring and algorithm process. The system preferably incorporates certain redundancy in the hardware to ensure its reliability in an intrinsic safety application. It is necessary to have a digital map of the layout of the track (31) available onboard which can be generated from field data and must be compared with topographical references of the layout. Once the position is qualified as safe, it is transmitted via radio to the centralized traffic control CTC center (100) by means of a safe and preferably encrypted communications protocol specifically designed for this system. The onboard radio equipment (15, 150) sends the information autonomously with a time cadence that can be configured by the user. The system is two-way, allowing train to CTC and CTC to train transmission over the radio channel.

Description

Field of the Invention

The invention is encompassed within safety systems for railroad traffic control in low traffic density lines. This invention is particularly indicated for lines with low railroad traffic density in which a large investment in line signaling is not economically justified.

Backaround of the Invention

In Europe there are many kilometers of railroad lines with no signaling. Using the Spanish railroad system as an example, of the 12,140 kilometers of the conventional system, the 5,510 kilometers of single-track without signaling can be pointed out, out of which 4,763 kilometers of track are managed by means of block signaling by telephone. There are only 3,667 kilometers of signaled single-track in the Spanish railroad system.
Railroad system kilometers can be divided by block signaling type. In the Spanish railroad system, it is worth mentioning the high-performance automatic drive block signaling used in high speed lines (518 km); block signaling in which centralized traffic control is involved (5,352 km); automatic block signaling (1,189 km); electric manual block signaling (743 km); block signaling by telephone (4,763 km) and by radio (57 km).
The low traffic of trains on this type of lines of the conventional railroad system generally does not justify installation and maintenance of signaling systems. For this reason there still exist today systems of block signaling by means of telephone communication, which are less efficient at an operational level.
Block systems came about due to the need to regulate traffic between two collateral stations, particularly on single-tracks. Actually, block signaling is any procedure which is carried out verbally, in writing or by means of technology in order to prevent a head-on collision on a single-track and trains catching up with one another on a double-track.
The most generalized single-track block signaling has been block signaling (BS) by telephone. In this case, the traffic control agents of two stations mutually request authorization to dispatch trains, it being necessary to receive consent and subsequent confirmation of the approach of the train which was dispatched.
To prevent human error in block signaling by telephone, the so-called manual electric block (MEB) system was implemented, whereby exits from two collateral stations towards the track section common to both become incompatible, and it also prevents once the train is on the route, the inability to make any exit towards the same track section until the train reaches the destination station. In this case, the route is completely blocked, the destination station also having to push the complete train arrival acceptance button on its control panel.
More recently, when there were track circuits or axle counters on entire single-tracks between two stations, the so-called automatic block signaling (ABS) in single-tracks was established, being able to have several blocks and an automatic series of trains. An ABS system in single-tracks has been started up between stations with axle counters, which means a significant economic advantage as it prevents the installation of track circuits on the route and other elements such as splitter joints, laying medium-voltage lines for feeding the blocks, etc.
The automatic block system (ABS) used on a double-track ensures that any train found in a section or block limited by a track circuit or axle counter, is protected by the signal located at the entrance of said block which implies an itinerary and which orders any train attempting to enter the block occupied by another train to stop. The block signaling is carried out automatically, since the axles of the train shunt or short-circuit the track, locking the corresponding previous signal. These block signals also allow an increase in line capacity since the blocks are shorter than the space between stations. When the trains can indistinctly travel in the same direction both on the righthand track and the left-hand track, the so-called two-way automatic block signaling (ABS) system allows traveling on both tracks in either direction with a series of trains.
Block systems are based on equipment installed on the track and in the stations (electronic, relay or geographic module interlocking equipment), traffic signals, axle counters, track circuits, switch machines, etc.; these systems allow trains to travel on a single-track for two-way working or a double-track for two-way working or not made two-way, with intrinsic safety without the involvement of any type of personnel. In the case at hand, the block system alternative of the invention is to consider eliminating the system called "block signaling by telephone", consisting of two people located in two stations where the intersection of trains (single-track) is carried out reaching an agreement, through the corresponding instructions stipulated in the Regulations for Transit of the Railroad Administration where said block signaling by telephone is specified, on giving an open track to one of the trains, making certain that the route along which said train is to travel is not occupied by any other train, and placing the train without priority in the intersection station where the other train is stopped.
There are background documents applicable to global navigation satellite systems in the railroad sector. For example, US-A-2004/0015275 , or US-A-2004- 0015276 , or GB-2378302-A disclose railroad applications using global navigation satellite systems for applications in which controls and signals of the vehicle, such as brakes, engine or warning signals, are acted on. US-6641090-B2 discloses a location system based on a Kalman filter using GPS measurements and other sensors.
Today there are also operation aid systems (OAS) based on satellite navigation technology. However, current GPS-based OAS do not constitute a block system with intrinsic safety for lines without signaling. This aspect is fundamental as it has essential implications both at the level of requirements and at the level of defining the system architecture and embodiment method (technical solution). To ensure reliability and safety of the block system, a different solution and a higher level of complexity in the system and method are required.
Signaling facilities with track circuits, axle counters, signals, switch machines and electronic interlocking are expensive to install and maintain.
With the block system proposed by the invention, the aim is to modernize in a cost-effective manner low traffic density railroad lines, even allowing an increase in the line capacity without having to increase the investment in track infrastructure as a result and maintaining safety levels.
This system can also be applied as a redundant system for railroad traffic control should the traffic telecontrol or centralized traffic control (CTC) fail, and through this system control the location of the trains and act in the manner which is thought to be most appropriate through the control post operators.

Description of the Invention

The invention refers to a system according to claim 1 and a method according to claim 9. Preferred embodiments of the system and of the method are defined in the dependent claims.
The block system with intrinsic safety for railroad lines of the present invention is designed so as to be able to be used as a block system in railroad lines without electrification or signaling, or with electrification but no signaling.
This new system allows that, from a centralized traffic control (CTC), a person in charge may grant the necessary movement authorizations to the engine drivers through the safe information reaching the CTC regarding the situation of the trains on the track.
The system object of the invention therefore allows carrying out the block signaling without needing personnel and it is ensured by an operator in the CTC that, through this system, it is the operator who authorizes the engine drivers when they can leave the stations collateral to the one where the trains intersect. Neither equipment installed on the track (track circuits, axle counters, etc.) nor traffic signals are required.
It must be pointed out that the block system with intrinsic safety object of the present invention is a safe, autonomous and robust tool for aiding in traffic control.
The system of the invention provides improvements in terms of safety, efficiency and flexibility of the railroad infrastructure operation since it provides, among other parameters, the kilometer point of the train, its speed and the track on which it is located. Furthermore, it is economical with respect to other systems in which traffic management depends on telephone communication between the personnel located in the stations where the intersection of trains occurs, or on signaling.
In fact, it has a mixed system of hardware and software in which complementary sensors and processing units are combined with a suitable level of redundancy. Developed on this structure are algorithms for monitoring and deciding on ambiguities in terms of track occupancy which allow for the block function to ensure a safety integrity level of up to SIL 4 in the entire area of operation. As defined in standard EN 50128, this block system may ensure a hazard rate of less than 10^-8 per hour of operation.
The block system of the invention is indicated for trains with a tractor unit or engine and an unlimited number of cars. The system would be installed in all the tractor units.
It can be used both for freight and passenger transport.
In this sense, according to a first aspect for the invention, the latter refers to a train traffic block system on one track of a railroad line.
The block system comprises an onboard block signaling aid unit per vehicle, in turn including:

a global navigation satellite system GNSS receiver providing georeferenced position P_GNSS and/or speed S_GNSS measurements of said train for each time period T_GNSS,
a group of sensors and means of connection with an odometer providing measurements of the angular speed of the vertical axis of the tractor unit ω_z of said train and of the speed S_ODOM of said train,
a data acquisition and reasonability module configured so as to receive said measurements and to compare speed S_GNSS and S_ODOM measurements and to check said measurements with regard to pre-established reasonability criteria,
a module of safety qualification of the position P_GNSS measurement based on a digital database of said track, and configured so as to provide a projection of the safety-qualified position of the train on the track P_Proj,
a navigation and decision module configured to receive said safety-qualified position P_Proj measurement and/or the available speed S_GNSS and/or S_ODOM measurements, both checked by the data acquisition and reasonability module, and to determine the most likely location of said train Pest, and its location in terms of kilometer point P_k, and its estimated speed S_est,
a siding passage and track occupancy detection module configured so as to receive said position Pest and angular speed ω_z measurements, checked by the data acquisition and reasonability module, and configured so as to determine, from a digital track database with the singular siding points, the train status in terms of track occupancy or track status TS (that is, it attempts to determine if the train is in the siding area and, if it is, on which track the train is located, or it determines non-determination if the conditions necessary for determining the location of the train with sufficient safety are not present), and
a two-way radio communication subsystem for sending at least the position P_k of said train and the track occupancy status TS to a centralized traffic control CTC center.

On the other hand, in the system of the invention said centralized traffic control CTC center comprises:

two-way radio communication means for receiving said position P_k of said train and the track occupancy status TS,
data acquisition, processing and display equipment configured so as to extract, among others, said position P_k and the track occupancy status TS, and to graphically represent the occupancy status of the line track sections on a data display screen.

Said sending by radio can be carried out automatically or by request. The two-way radio communication means preferably include a coding and encrypting module.
Blocking of blocks (track sections without signaling) can thus be represented automatically and in quasi-real time in the centralized traffic control CTC center without needing to make telephone contact with the personnel in intersection stations or requiring track infrastructure.
The proposed block system introduces a high degree of autonomy with respect to other existing block systems (e.g. block signaling by telephone), maintaining safety levels. Said safety is achieved with a hardware architecture strong against failure complemented with mathematical algorithms for detecting hardware failures, as well as a formal development process.
The system incorporates means for improving the train location precisions in the cases in which GNSS satellite coverage is lost.
An important base of the invention is the fusion of the data from the different sensors and databases.
A limit of any satellite-based positioning system is the assurance of precision. Even with dual-frequency differential receivers, position precision is in the range of 1 to 5 meters only 95% of the time. For the other 5% of the time, it can be expected that system features are locally out of the range admissible for this application. This is due, for example, to the bouncing of signals from the satellites caused by near-by obstacles (buildings, vegetation, bridges, etc.) or by interferences. Furthermore, it is always necessary to expect the problem of visibility of the satellite, which may be insufficient in many operating situations. In the case at hand, an SBAS type (Satellite Based Augmentation System) aid constellation is relied upon to improve system features in terms of integrity and precision. The SBAS constellation will later be replaced by a Galileo constellation. The problem of concealment in SBAS is frequent since there are few satellites in the SBAS constellation and depending on the geographical location of the application, its elevation on the horizon may be rather low.
On the other hand, in the intersection stations it is necessary to know with a very high integrity not only the kilometer point but also the track on which the train is located. To determine the occupied track with certainty, specific safety qualification and detection mechanisms have been established.
Specifically, a siding passage and track occupancy detection system and method has been conceived which forms part of the system of the invention. This system or module allows determining the location of the train with integrity by deciding between two or more adjacent tracks. The method allows detection of the occupied track with high availability and integrity.
In terms of sensors, this detection module needs, in addition to the GNSS sensor, a sensor measuring angular rotation of the tractor unit on its vertical axis, for example a gyroscope. For greater availability and reliability, the odometer speed measurement can further be used.
This module requires a prior entry of each siding of the line in a singular point database. At least the georeferenced coordinates of each siding should be entered in said database, for example, in the UTM system they would be the UTMX and UTMY coordinates. To ensure detection of the track actually occupied within a broad range of dynamic conditions, the curvature and length of the siding are also entered. These data are stored in a digital singular point database which said module has access to.
The operation of the detection method is preferably as follows. According to the estimated position of the train Pest provided by the navigation and decision module, it identifies if the train is in the area close to a siding. If this is the case, said module is actuated, wherein the evolution of the angular speed of the tractor unit ω_z is analyzed. If this evolution of ω_z indicates a turn in the expected direction of the siding and is an angular speed similar to the estimated instant speed of the train S_est divided by the radius of curvature of entry in the siding, the module determines that the train has been re-routed. It similarly proceeds to detect the entry on the new track. Entry on the destination track generally occurs after a turn in the direction contrary to the previous turn. If the gyroscopes do not detect a turn in the siding area it is interpreted that there was no re-routing. After this analysis, the module determines the track occupancy status TS. TS may be 1, 2 or n, n being the maximum number of tracks in said intersection station. If the turn or absence of turn is not detected with enough clarity, the module does not decide on the track and decrees non-determination.
As will be seen below, the onboard block signaling aid unit is provided with redundant systems. If there is a discrepancy between the primary system and the onboard unit monitoring system, the module can also issue a decision. This may be due to a hardware failure or to other causes.
The lateral acceleration and impact the axis of the tractor unit undergoes when changing tracks can optionally be used as an independent TS detection aid member. That is, the perceived impact can be measured by a medium-precision, single or double axis accelerometer which would corroborate whether or not the track has been changed. Should the decision based on angular speed not coincide, a non-determination would occur which would be reported to the CTC.
For track occupancy detection in stations with more than two parallel tracks, the odometer speed S_ODOM is used to calculate the distance traveled between the first turn (corresponding to exiting the track of origin) and the second turn (corresponding to entering the following track of destination). Once it is calibrated by the navigation and decision filter, the odometer speed provides greater precision than the GPS speed at lower speeds and is insensitive to satellite concealment.
As a general criterion, the siding actuation area is defined as a circumference centered on the UTMX and UTMY coordinates of the siding with a radius at least six times the worst root mean square error expected for this area. Among others, this radius will depend on the presence of obstacles in the area that may reduce the visibility of GNSS or SBAS satellites, and therefore may reduce the precision of locating the train in that area. Of course the radius must be such that it contains a curved section so as to avoid confusing it with a siding.
In any case, if the system cannot estimate with a sufficient assurance the position of the train, non-determination is reported to the CTC, specifically the TS field of the radio message is set to 0.
In a preferred embodiment of the invention the onboard block signaling aid unit includes a module of qualification of the GNSS position in the longitudinal direction of the track. This module is called qualification by reasonable position. In this case, the module calculates a reasonable position of the train P_{reas (n)} from the position and speed previously estimated by the navigation module, respectively P_{est (n)} and S_{est (n-1)}. If the position given by the GNSS receiver P_{GNSS (n)} is more than a qualification distance limit away from P_{reas (n)}, the position P_{GNSS (n)} is found to be erroneous. In this case, the navigation module uses the reasonable position as the best estimation of the position of the train. According to this embodiment, situations in which the position P_GNSS meets the criterion of qualification by projection on the digital track database, but which is potentially erroneous, can be detected.
According to another embodiment of the invention, the data acquisition and reasonability module, configured for comparing the speed measurements provided by the global navigation satellite system (GNSS) receiver and by the odometer of the train, would use the restrictions of the train and of the track also as a criterion for checking the reasonability of said speeds. In fact, the maximum speed that can be reached by each engine and the minimum radii of curvature of each section are known, therefore higher reasonable speed limits can be determined. The change of speed with respect to the previous measurement is also monitored in this embodiment, and it is labeled as not reasonable if it exceeds a maximum acceleration determined by the railroad regulation for this type of line and train.
In a similar way, this data acquisition and reasonability module monitors the reasonability of the angular speed ω_z of the tractor unit.
As a further embodiment, the system can use the difference between the speeds S_GNSS and S_ODOM, already filtered with respect to reasonability, to estimate systematic errors of the odometer. This is carried out by means of a linear recursive filter in which the constant error of the odometer (bias) is estimated continuously and in real time on board the train. This systematic error may be due, for example, to variations of the real radius of the wheel on which the odometer has been installed for each train monitored by this block system. The recursive filter has the basic theory of least squares, and its mathematical formula can be found in the literature. It is an extension of the estimation by least squares for situations in which a filtering of the measurements is to be carried out as the sample increases over time. This optional embodiment allows that when coverage of the satellites of the GNSS or SBAS constellation is lost for a certain time, the error of the estimated position by the navigation and decision filter (from the odometer speed) is much less since the systematic errors can be corrected. This mathematic filter is actuated after a certain minimum speed (e.g. 10 km/h) and it only accepts speeds which have passed the reasonability filter, all this so that the systematic errors of the odometer can be estimated with greater precision and integrity.
According to a second aspect of the present invention, the latter relates to a train traffic block method in a railroad line comprising:

acquiring position P_GNSS and/or speed S_GNSS measurements of said train for each time period T_GNSS,
acquiring measurements of the speed S_ODOM of said train and of the angular speed of the vertical axis of the tractor unit ω_z,
comparing said measurements of the speed S_ODOM of said train and of the angular speed ω_z with the speed S_GNSS measurements and checking all the measurements with respect to pre-established reasonability criteria,
qualifying according to safety the position P_GNSS measurements based on a digital track database, and providing projected position P_Proj measurements of the train on the digital track map,
determining from said safety-qualified position P_Proj measurements and/or from the available speed S_GNSS and/or S_ODOM measurements, both checked by the data acquisition and reasonability module, the estimated location of said train P_est, and its location with regard to a kilometer point P_k, and its estimated speed S_est,
detecting the siding passage and track occupancy in areas with more than one adjacent track based on said Pest and S_est measurements and the angular speed ω_z already checked by the data acquisition and reasonability module, and a digital database with the singular points (i.e. sidings) of the track, and providing information concerning the track occupancy status TS,
transmitting periodically and/or at the passing of singular points, at least said secure position P_k and track occupancy status TS estimations to a centralized traffic control CTC center, using a protocol allowing two-way communication, and in said centralized traffic control center:

extracting the P_k of said train and the track occupancy status TS for said train, and graphically representing the most recent monitored track status on a data display screen.

The method preferably comprises estimating from said position P_GNSS and S_est measurements the likely location of said train Pest, and its kilometer point P_k; taking into account the determination of the modules of safety qualification by projection and by reasonable position P_reas (n), understanding that if P_GNSS does not comply with any of the criteria, position Pest estimated in the previous instant will be used as a starting point rather than P_GNSS.
When P_proj is not available, position P_est estimated in the previous instant can be used. Likewise, for each time period S_est can be an average value of S_GNSS and/or S_ODOM once the systematic errors of the odometer have been extracted from S_ODOM by means of a linear recursive filter.
According to an embodiment of the invention, the method further includes:

carrying out a linear recursive filtering to estimate the systematic errors of the measurements of the odometer (bias) and correcting the S_ODOM by subtracting said estimated errors,
determining from S_GNSS and/or from said corrected S_ODOM an estimation of the speed of the train S_est by means of filtering (weighted average) of both measurements.

The information transmitted to the centralized traffic control center is preferably coded and encrypted prior to its transmission and decoded and decrypted in said centralized traffic control center.

Brief Description of the Drawings

A series of drawings will be very briefly described below, the intention of which is to aid in better understanding the invention, and are expressly related to an embodiment of said invention, given as a non-limiting example thereof.

Figure 1 shows a diagram of the complete operation of the block system object of the invention and of the parts making up said system.
Figure 2 shows the functional core of the block method based on the onboard block signaling aid unit.
Figure 3 shows the hardware architecture of the onboard block signaling aid unit.
Figure 4 shows the hardware architecture of the system in the CTC.
Figure 5 shows the concept of safety qualification of position P_GNSS.
Figure 6 shows the concept of qualification by reasonable position of position P_GNSS.
Figure 7 shows the problem of the determination for the track occupancy status TS.
Figure 8 graphically shows the operating concept of the siding passage and track occupancy detection module.
Figure 9 shows a typical operating sequence of the block system as is it would be displayed in the MMI of the CTC- it specifically reflects a scenario in which two trains close to two stations are heading in opposing directions and must travel in an orderly manner through a common single-track section.
Figure 10 shows by way of example a possible radio communications protocol between the onboard unit and the CTC. The CTC to train communications protocol has been omitted.

Description of a Preferred Embodiment of the Invention

In a nominal situation, the complete operation of the system is as shown in Figure 1. The position of each train 1 is estimated in the onboard block signaling aid unit 10 located in the front tractor unit 2 of each train, by means of a method based on the GNSS systems and other sensors, which will be explained in more detail below. The position of the train is estimated and qualified according to safety onboard in an automatic manner by means of a data fusion, monitoring and algorithm process. An architecture has been designed and equipment has been chosen that allows qualification and certification following the CENELEC standards, and certification up to the maximum safety integrity level (SIL 4) has been contemplated. The system incorporates redundancy in the hardware to ensure its reliability in a critical safety application.
Figure 2 shows the essence of the concept and flow of information and calculation based on the onboard block signaling aid unit. The onboard block signaling aid unit uses the measurements of the following sensors: a differential global navigation satellite system (GNSS) receiver 11, i.e. with the ability to acquire satellite signals from an SBAS constellation (e.g. OMNISTAR, EGNOS), or from Galileo, which determines the position P_GNSS and/or the speed S_GNSS of a reference point of the train 1 with respect to a georeferenced coordinates system; an odometer 14 measuring the rotation speed of a wheel of the tractor unit 2, a gyroscope 12 (redundant 12') measuring the angular speed of the vertical axis of the tractor unit ω_z with respect to an inertial reference; it may also include at least one accelerometer (not shown and which may also be redundant), and which would measure the linear acceleration of the vertical axis a_z and/or the lateral acceleration a_Y of the engine with respect to an inertial reference.
SBAS (Satellite Based Augmentation System) systems 200 allow improving the quality of the GNSS solution in the integrity and precision aspects provided that the antenna can receive the signals transmitted by the geostationary satellites of said system. Leaving aside that said SBAS systems have not been certified as safe as of today in accordance with the definition of CENELEC, it is provided that the combination of both constellations, GPS and SBAS, remarkably improve the features of the GNSS receiver. However, not even after a possible certification of the GNSS and/or SBAS constellations will the GNSS receiver alone be enough to comply with the safety levels required in a railroad block system. A safety integrity level of more than 10^-7 cannot foreseeably be maintained, and an availability of more than about 90-95% could not be ensured. In any case, there will always be shadow areas in which the GNSS receiver could not provide an integral solution, and at times not even a solution, due to concealment by buildings, tunnels, forests, mountains, etc.
As a result, as previously indicated, the process needs complementary aid methods for ensuring both the availability and integrity of the block aid operation (both insufficient). The SBAS system is highly vulnerable to obstacles present on the terrain since it has few geostationary satellites (typically from 1 to 3).
With regard to data processing, the system is provided with a data acquisition and reasonability module 20 in which basic signal processing tasks (analog-digital filtering and conversion) are carried out, and monitoring of the reasonability of the speed and angular speed measurements of the onboard sensors is carried out. In this module, the differences between the speed measurements of the GNSS receiver and of the odometer are observed, and said measurements are checked with respect to reasonability criteria, to that end having pre-loaded information in the system concerting dynamic restrictions of train and track 21. The range of numerical values which is considered reasonable in the filtering is set based on a range of expected dynamics of the train (speeds, accelerations, etc.), allowing not only for features of the engine, but also the static profiles of the track (radii of curvature, etc.).
If both speeds coincide within an acceptable discrepancy value, it is decided that they are reasonable. The acceptable discrepancy value is adjusted according to speed, given that the precision of both sensors is very different at low and high speeds.
In the preferred embodiment, the odometer is calibrated by means of a linear recursive filter included in the navigation and decision module 40. The onboard block signaling aid unit can continuously estimate the constant error of the odometer, such that when satellite coverage is lost, the effective navigation error is much less. The mathematic recursive filter is actuated after a certain minimum speed (e.g. 10 km/h) and if and only if S_GNSS and S_ODOM are reasonable. The systematic error of the odometer can thus be estimated with greater precision.
As shown in Figure 2, the onboard block signaling aid unit includes a module of qualification 30 of the GNSS position in the longitudinal direction of the track, or module of qualification by reasonable position. This module calculates a reasonable position of the train P_{reas (n)} from the position and speed estimated by the navigation and decision module in the previous instant, respectively Pest _(n-1) and S_{est (n-1)}. If the position given by the GNSS receiver P_{GNSS (n)} is more than a limit qualification distance from P_{reas (n)}, the P_{GNSS (n)} position is determined to be erroneous. In this case, the navigation module uses the reasonable position as the best estimation of the position of the train. According to this embodiment, situations in which the position P_GNSS complies with the criterion of qualification by projection on the digital track map 31 but which is potentially erroneous, can be detected.
On the other hand, as previously indicated, it is necessary to know with integrity in the intersection stations not only the kilometer point but also the track on which the train is located. To that end, the system of the invention includes a siding passage and track occupancy detection module 50. This module allows determining with integrity the location of the train, deciding between two or more adjacent tracks.
In terms of sensors, this detection module needs, in addition to the GNSS sensor, a sensor measuring angular rotation of the tractor unit on its vertical axis. For greater availability and reliability, the speed measurement of an odometer can further be used.
This module requires a prior recording of each siding of the line in a singular point database. At least the georeferenced coordinates of each siding must be introduced in said database, for example in the UTM system these would be the UMTX and UMTY coordinates. To ensure detection of the track actually occupied in a broad range of dynamic conditions, the curvature and length of the siding are also introduced. This data is stored in a digital singular point database 51 which said module has access to.
The system further includes a two-way radio communication subsystem for the automatic sending or sending by request of different data of interest (see Figure 10), including the position in terms of kilometer point Pk of said train and the track occupancy status TS to the centralized traffic control CTC center 100.
This two-way communication system includes a coding and encrypting module 71, as well as a radio reception/transmission module 72.
Figure 3 shows the implementation of the concept set forth previously in Figure 2. The onboard system has a global navigation satellite system GNSS receiver 11 with the corresponding antenna 110 for receiving the signals provided by the GNSS system 300 (see Figure 1). It also has a radio receiver/transmitter 5, also with its corresponding antenna 150 for radio signal reception.
Processing the algorithms previously mentioned and described in Figure 2 is carried out in central processing units. The measurements of the odometer and of the inertial sensors are interpreted, verified and used in the central processing units. To facilitate fast error detection, the interface elements and the inertial sensors are redundant (primary system and monitoring system). The proposed design ensures maximum independence between both systems and minimizes wiring. The speed of the train according to the odometer is obtained from the TTL pulses and from a module implemented in the software which relates the number of pulses received per unit of time with the theoretical speed of the train. This speed derived from the odometer is clearly subject to wheel slippage and wear errors.
The onboard unit has external interfaces with the odometer 14 of the train and with a power supply source 140 feeding the power supply source 130 of the onboard unit. The odometer is a sensor measuring wheel revolutions per unit of time and is used to report the speed of the train to the engineer. The hardware interface element with the odometer consists of three main subelements: an analog filter circuit for filtering the noise from the odometer signal, an impedance adjustment circuit and an optoisolated device converting the filtered odometer signal to digital pulses (usually TTL levels). Each revolution of the wheel of the train in which the odometer has been installed causes a given number of pulses depending on the type of installation. One pulse will usually be generated for each revolution of a wheel of the tractor unit.
The onboard unit has the internal interfaces identified in Figure 3. The element responsible for acquisition of the inertial sensors has the main function of converting the raw data of the sensor into digital format data such that it can be interpreted in the CPU. If low-pass filtering is required, it will be carried out for example by hardware in this interface element system or by software in the CPU. If the inertial sensors have digital output, they can be connected directly to input ports of the processing unit, whereby the input/output I/O function will be included in the CPU.
The processing unit CPU 16 has been repeated (redundant 16') so as to be able to detect processing failures (in the failure detection and identification module 60, see Figure 2) in any of the CPUs and/or failures of the angular speed sensors and/or failures of the I/O interfaces of the gyroscopes and of the odometer. These failures may be due to the hardware or to non-determining factor problems created by the running of the software in real time. Note that both CPUs use the same GNSS receiver but different interface elements with the odometer and gyroscopes.
As previously indicated, the angular rotation measurement sensors have also been repeated, since these are the basis for detecting track changes: gyroscope 12 (redundant 12').
Note that the differences between the primary system and the monitoring system are monitored in real time. Specifically, the values of a series of essential variables (i.e. GNSS position, GNSS speed, odometer speed, angular speed, time and track occupancy status) are checked.
If the main CPU detects that the result of its calculations do not match the result of the calculations of the CPU of the parallel monitoring system, the main CPU will report the problem to the CTC trough the radio link, placing a specific code in the data validity control field DVC (see Figure 10). The code will allow identifying the level at which the error occurred so as to provide a fast maintenance reaction. Similarly, if the monitoring CPU detects that its decision does not qualitatively match the decision of the main CPU, it will decide that there is an error of comparison between both systems and in this case will send a warning message to the CTC making use of the parallel interface with the onboard radio. Should there be qualitative matching, the monitoring CPU will not send a message to the CTC.
Once the position of the train and the track occupancy status have been determined, or the non-determination has been detected, the relevant information is transmitted by radio to the CTC. The onboard radio equipment can send the information autonomously to the CTC and/or by request. That is, the sending of information from the train to the CTC can be carried out with one or with combinations of these three options: 1) with a regular time cadence that can be configured by the user (for example, a report every 2 minutes), and/or 2) by request, upon request of the CTC, and/or 3) by passing a singular point (for example, entering a new track section).
The system is two-way, allowing train to CTC and CTC to train transmission on the radio channel.
In relation to the telecommunications system used in the preferred embodiment, the GSM system is used as it has fewer operating costs, which does not reduce the safety level. Typical GSM delay is a few seconds, although it may reach up to a few minutes. This delay would be unacceptable for a system with real time operating requirements. For this reason the system must use a radiotelephony service ensuring acceptable delay times for the operator. This high-performance radiotelephony service is a commercial service and is already used in some railroad lines.
However, the system can be adapted to the use of other channels of communications.
To ensure service in areas without coverage of the communications network (e.g. GSM), the following is carried out. Given that availability of the block system must be complete in the areas immediately close to train intersections with track changes (intersection stations, etc.), those intersection points which do not have coverage are identified. Said singular points without coverage are equipped with fixed compatible radio equipment so that connection is made with the CTC through an interface with the standard telephone line. All this is automatic. The contents of the packet and its encrypting are identical to that used for open transmission. In any case, the train must remain on the track on which it is located until receiving authorization to move from the traffic authority.
For the purpose of ensuring integrity of the data during train to CTC and CTC to train transmission, a communications protocol that is strong against interferences and other transmission error has been designed. All communications messages include a cyclic redundancy check (CRC) and are encrypted so as to prevent fraudulent use. As shown in Figure 10, the system sends in this order: vehicle identifier VID by means of the registration thereof, message number NUM, CPU (primary or monitoring CPU) number, time of the measurement HH-MM-SS, code for identifying the route of the train RT, kilometer point where the train is located P_k, track where the train is located TS or, where applicable, a non-determination code, speed module SP, direction of movement WM, data validity control flag DVC, and a 32-bit cyclic redundancy check CRC. Similar protocols can optionally be defined for maintenance functions.
Integrity, authenticity and sequence of the message are ensured with this protocol, as is required by standard 03.432.806.1 concerning operation and safety of block signaling for type "B" and "C" Subnetworks using open transmission systems via radio.
This message must be encrypted, as required by said railroad standard and the corresponding European standard (EN 50159-2 of the CENELEC).
The onboard equipment has built-in tests which check that the hardware and software are correctly running in real time.
As shown in Figure 4, the data acquisition and processing equipment located in the centralized traffic control center CTC 100 essentially consists of a multibuffer radio equipment 101 connected to an antenna 102, processing equipment 103 and graphic interface or display screen 104, in addition to an operating console 105 and a power supply source 106. The power supply source 106 is connected to an uninterruptible power supply (UPS). The CTC optionally includes a GPS equipment of the same reference model as the one onboard for synchronizing times.
The data acquisition and processing equipment in the CTC maintains the assurance of integrity initiated in the onboard equipment and in turn maintained by the radio link through the communications protocol. This feature is indispensable for a critical safety application. As in the onboard unit, the equipment in the CTC in turn have built-in tests which check that the hardware and software are behaving in real time in the expected manner. The equipment in the CTC can be redundant (duplicate or triplicate) similar to the onboard unit if the operator requires a greater level of availability and reliability.
The information which the onboard block signaling aid unit sends is decrypted and decoded in the CTC. Then the block aid system (BAS) in the CTC graphically shows the location of the trains and the occupancy status of the monitored blocks on a data display screen 104 which, together with the console 105, forms the man-machine interface (MMI). This allows the person in charge of the CTC to monitor traffic and remotely assign track block occupancy, without needing to contact a station head stationed in situ, as has occurred up until now on low traffic density lines. Other information such as speed can be added on the display screen.
in the operating cases in which the telecommunications system delay is excessive or in which a report on a train has not been received within the expected time, the BAS software in the CTC can be configured such that it anticipates the radio message to determine track occupancy of a block adjacent to another occupied block as "undetermined" and that, according to deterministic kinematic models based on the previously estimated position and speed and static speed profiles and a synchronized time measurement, it allows foreseeing that it has been or may very shortly be occupied. This allows the CTC head to manage traffic with greater information and precaution and avoid problems due to small delays in the communications system. For example, when the train reaches an intersection station, if the following block is free, it could be marked as undetermined since it will foreseeably be occupied very shortly by said train. After giving authorization to said train to pass, if a train coming in the opposite direction requests authorization to enter said block still marked as undetermined due to the communication delay, the head of traffic will know that this block has been or will very shortly be occupied by the first train and will not give authorization to the second train.
The most basic infrastructure in the CTC supports monitoring of up to six trains simultaneously with at least twelve intersection stations.
The man-machine interface display screen shows the information that is necessary and sufficient for allowing the CTC head to safely manage the line. The graphic interface in the CTC complies with the railroad operator standards. The main information provided by this graphic interface is the free/occupied/undetermined status of track blocks, stations and platforms, location of the trains and unmistakable identification thereof with the registration code. The location of the train is indicated with the kilometer point at which the train is located.
In the event of a conflict, for example the BAS detects the presence of more than one train in the same block, the system emits an audible warning signal and identifies the block and trains involved on the display screen.
The maximum delay time from the arrival of a message to the CTC until the presentation of the information on the MMI screen, in the worst of cases (6 simultaneous messages and one radio), must be less than 1 second.
The console 105 is PC type, and non-recognized commands are rejected.
At the time being only one command from the CTC to the onboard unit is contemplated: the establishment of a configuration regarding train to CTC communication transmission. This may be set as a) periodic mode and/or as b) singular point passing mode. In the first mode messages are transmitted periodically, in the second mode, messages are only transmitted when important points for traffic management are passed (e.g. sidings). In any case the traffic controller can at any moment ask a train to send its report (operation by request).
Figure 9 shows as an example a sequence (seq.) in which two trains ID 2775 and ID 0034 approach two stations collateral with unoccupied blocks (seq. 1). Next, at the entrance to each station the corresponding blocks are occupied (seq. 2); priority is given to one of the two trains, specifically to the train identified as ID 2775, to occupy the common track section between the two stations. Thus, the head of the CTC communicates the authorization to move to said train ID 2775, which then occupies the common track section (seq. 3), while he or she communicates to train ID 0034 that it must wait. Train ID 2775 then enters (seq. 4) the following station, in which train ID 0034 is waiting, occupying the free block of said station, and frees the common section between the two stations, with which train ID 0034 may now continue. Both trains ID 2775, ID 0034 are prepared to occupy the next common track section, unoccupied in each case (seq. 5). Finally, train ID 0034 occupies the common track section between collateral stations, while train ID 2775 moves away from the station occupying an unoccupied block (seq. 6).
The display at the CTC center would be substantially the same as the one shown in Figure 9, but with the difference that each new line in the figure would not correspond to a moment in the sequence but to different stations and trains.

Criterion of qualification by projection on the digital track map

Figure 5 graphically shows the position in two dimensions set by the GNSS receiver, P_GNSS, and its projection P_proj, on the digital track map. The distance between these two points is defined as distance d₁. The black dots represent the digital track map, and the lines which delimit the lined area at its top and bottom portions represent the limits set as acceptable by the criterion of qualification; the lined area represents the acceptance area. The real position P_real of the train is also shown in this figure.
Distance d₁ is compared to a maximum distance given by the criterion of qualification. If distance d₁ is less than or equal to said maximum distance, this position is qualified as acceptable. However, if distance d₁ is greater than the maximum distance of the criterion of qualification, this position is qualified as unacceptable.
Important discrepancies in position that may occur between the position estimated by the GNSS receiver and the real position of the vehicle may be detected with this criterion of qualification. If the position is declared unacceptable this is not used and the downstream navigation and decision filter will estimate a reasonable position from the odometer reading and the track layout.
The qualification by projection is performed for each new GNSS solution and is typically performed once per second.
This module allows increasing the integrity of the block system. It particularly, protects against GNSS receiver or constellation failures, or simply against situations in which the precision of the GNSS solution is less than that desirable.
As an additional safety measure, the onboard block assistance system emits an explicit caution message to the CTC in the case of many GNSS measurements being rejected, given that if the situation were to continue it could compromise the safety of the service. This situation could indicate a problem related to the GNSS receiver or the installation.

Qualification by reasonable position method

Figure 6 graphically shows the concept of qualification of the position in the longitudinal direction of the track with the reasonable position method. The black dots represent the digital track map; the circle which delimits the lined area represents the limit set as acceptable by this criterion of qualification, and said lined area represents the acceptance area. Point P_{est (n-1)} represents the last position estimated by the navigation and decision filter; point P_{proj (n)} represents the current position given by the GNSS receiver projected on the digital track map, and finally point P_{reas (n)} represents the position considered to be reasonable for the current instant. Position P_{reas (n)} is calculated from the spread of the last position P_{est (n-1)} estimated by the navigation and decision filter taking into account the estimated and verified speed for this interval.
The distance between P_{reas (n)} and P_proj (n), defined as distance d₂, is compared with a maximum distance given by a new criterion of qualification. If this distance d₂ is less than or equal to said maximum distance, this position is qualified as acceptable. If, in contrast, this distance d₂ is greater than the criterion of qualification, this position is qualified as unacceptable. The criterion of qualification must be sufficiently strict as to detect excessive errors in the longitudinal axis of the track early, and sufficiently broad as to accept slight errors within the system performance.
Note that with this criterion position errors are detected which comply with the criterion of qualification by projection on the digital track map, but which are not reasonable in the longitudinal direction of the track and potentially erroneous.

The problem of non-determination of track occupancy

In intersection stations, adjacent tracks may be separated by only 2 meters. Solutions based solely on GNSS cannot determine the track which is effectively occupied, and are therefore subject to non-determination. Therefore, a specific module has been implemented to detect track occupancy. This method can decide on which track the vehicle is located with extremely high availability and integrity, or, where applicable, decide the incapacity of the system to determine it with the required integrity.
Figure 7 graphically shows the problem of non-determination in track occupancy which occurs in the absence of a track occupancy detection method. The solid lines represent the tracks and the dots represent different positions of the train given by the GNSS receiver; d₁ and d₂ represent the minimum distances to two adjacent track sections for a same position. Two scenarios of great importance for a railroad block system have been represented. The first scenario corresponds to position A, and the second scenario to position B.
Scenario A represents a train in an environment close to a siding. The position set by the GNSS receiver, position A, gives rise to a non-determination. It cannot be ensured that the vehicle has entered the siding or not, or which path it has followed, because distances d₁ and d₂ are within the precision range of the GNSS system. An independent method must therefore be defined which ensures the position of the vehicle in such a reduced environment as is a siding.
Scenario B represents the environment of a double track. As in scenario A, the position set by the GNSS receiver, position B, gives rise to a non-determination. It cannot be ensured that the vehicle is on one or the other track of the double track section because distances d₁ and d₂ are not sufficiently significant so as to define a criterion that ensures the position of the vehicle in such a reduced environment as is the separation between tracks. This non-determination, as in the previous case, entails an unacceptable risk for a railroad block system as this is a system that affects the safety of people and materials.

Siding passage and track occupancy detection method

A specific method has been designed for the purpose of detecting without ambiguity the track on which the vehicle is located. Figure 8 graphically shows the operating concept.
The siding passage and track occupancy detection module forms part of the onboard block aiding system. The object of the module is to determine with certainty the track occupancy in situations in which the train may take more than one path, for example in intersection stations. This module is necessary to complement the locating solution given that the GNSS sensors do not ensure the necessary precision with a sufficient degree of confidence. In short, the module produces an increase in the block system integrity in intersection scenarios.
This module, constituted by hardware and software elements, detects the passage of a vehicle through a siding and decides the route followed by this vehicle with a high level of integrity. This advantage is achieved by the certain detection of a sustained turn of the tractor unit as it takes the turn for the siding and the expected turn of the tractor unit on exiting the siding and entering the new track. The expected direction of the turn is information which is available a priori and which is introduced in the singular point database in order to check the detected turn direction with the expected turn.
Furthermore, an accelerometer can be used to detect the characteristic impact and lateral acceleration which occurs in the vehicle during a turn when passing through a switch turnout. In order to detect these events the inertial measurements given by the gyroscope 12, and optionally those given by an accelerometer (not shown in the figure), are used.
As previously mentioned, these turn and acceleration measuring elements are repeated as an additional safety measure in order to detect inconsistencies started by hardware failure. If so desired, the inertial sensors can be triplicated in order to ensure the continuity of the service in case of malfunction of one of said sensors, allowing safe traffic until the next maintenance station.
In the case of sidings in which on entering a siding the train may choose to take different adjacent exit tracks, the system uses the odometer reading to determine the distance covered along the siding and decide track occupancy without ambiguity.
When vehicle 1 is far from a siding, the siding passage detection module is in standby mode (standby phase). When the vehicle approaches a siding, the detection module is actuated with sufficient time (actuation phase). An actuation area is defined (as a circumference with its center on the UTMX and UTMY coordinates of the siding with a radius of at least 6 times the worst root mean square error to be expected in that area), inside of which the module shall be active (shown in Figure 8 by the circle of greater radius). It is therefore necessary to have the position of the sidings onboard in database 51. The time with which the detection module is actuated in advance is that which is sufficient to avoid the situation in which the train effectively passes through a siding and the module is in standby. This could occur due to precision problems in determining the position of the vehicle.
Once the module is actuated, computers 16 and 16' of the onboard system acquire the measurements from the gyroscopes and from the accelerometers if present. This is performed in an independent manner, on the one hand with a primary set of equipment, processor and inertial sensors, and on the other hand with a set of redundant monitoring equipment to improve the integrity of the detection. When the vehicle effectively passes through the siding (detection phase) and occupies a track (case A: the route continues or case B: the route is detoured), the module emits a decision which reports on the track occupied. If it cannot determine this with sufficient certainty, the module reports a "non-determination". This information is transmitted to a CTC in order to block the corresponding track block or mark the blocks as "non-determined" status.

Claims

A block system for train (1) traffic on a single-track line of a railroad line comprising:
- an onboard block signaling aid unit (10), one in each tractor unit of the train, in turn including:
- a global navigation satellite system (GNSS) receiver (11) providing georeferenced position P_GNSS and/or speed S_GNSS measurements of said train for each time period T_GNSS,

- a group of sensors (12) and means of connection with an odometer (14) providing measurements of angular speed ω_z of the vertical axis of the tractor unit (2) of said train and of the speed S_ODOM of said train,

- a data acquisition and reasonability module (20) configured so as to receive said measurements and to compare speed measurements S_GNSS and S_ODOM and to check said measurements with regard to pre-established reasonability criteria,

- a module of safety qualification (30) of the position P_GNSS measurement based on a digital database of said track (31), and configured so as to provide a projection of the safety-qualified position P_Proj of the train on the track,

- a navigation and decision module (40) configured so as to receive said safety-qualified position P_Proj measurement and/or the available speed S_GNSS and/or S_ODOM measurements, both checked by the data acquisition and reasonability module, and to determine the estimated location of said train Pest, and its location in terms of kilometer point P_k, and its estimated speed S_est,

- a siding passage and track occupancy detection module (50) configured so as to receive said position Pest and angular speed ω_z measurements, checked by the data acquisition and reasonability module, and configured so as to determine, from a digital track database with the singular siding points (51), the train status in terms of track occupancy TS, and

- a two-way radio communication subsystem (15, 150) for sending at least the position P_k of said train and the track occupancy status TS to a centralized traffic control CTC (100) center, and said system comprises in the centralized traffic control CTC (100) center:

- two-way radio communication means (101, 102) for receiving at least said position P_k of said train and the track occupancy status TS,

- data acquisition, processing and display equipment (103, 104, 105) configured so as to extract at least position P_k and track occupancy status TS for said train, and to graphically represent the occupancy status of the line track sections on a data display screen (104).
A block system according to claim 1, characterized in that in that said onboard block signaling aid unit further includes in said module of qualification of the position P_GNSS a qualification module based on the reasonable position P_{reas (n)} of the train, calculated from the spread of the last position Pest _(n-1) estimated by the navigation and decision module, taking into account the speed that is estimated and verified for this interval.
A block system according to any of the previous claims, characterized in that the onboard block signaling aid unit (10) further includes in the navigation and decision module means of calibrating the odometer speed by means of a linear mathematical recursive filter which observes the difference between the speed S_GNSS value provided by the global navigation satellite system (GNSS) receiver and the speed S_ODOM value provided by the odometer (14).
A system according to any of the previous claims, characterized in that the onboard block signaling aid unit includes at least one accelerometer to check the siding passage by measuring the impact occurring when changing tracks and/or the lateral acceleration.
A system according to any of the previous claims, characterized in that said pre-established reasonability criteria are based on dynamic track and train restrictions.
A system according to any of the previous claims, characterized in that the onboard block signaling aid unit includes a coding and encrypting module (71).
A system according to any of the previous claims, characterized in that some or all of the hardware elements of the onboard unit are redundant (duplicate or triplicate) so as to increase integrity, reliability and availability of the onboard unit.
A system according to any of the previous claims, characterized in that the centralized traffic control CTC center (100) means are redundant (duplicate or triplicate) for either monitoring a larger number of trains and/or for increasing the integrity, reliability and availability of the system located in the CTC.
A block method for train traffic (1) on a single-track railroad line comprising:
- acquiring position P_GNSS and/or speed S_GNSS measurements of said train for each time period T_GNSS,

- acquiring measurements of speed S_ODOM of said train and of the angular speed ω_Z of the vertical axis of the tractor unit,

- comparing said measurements of speed S_ODOM of said train and of the angular speed ω_z with the speed S_GNSS measurements and checking all the measurements with respect to pre-established reasonability criteria,

- qualifying in safety said position P_GNSS measurements based on a digital track database (31), and providing projected train position P_Proj measurements on the digital track map,

- determining from said safety-qualified position P_Proj measurements and/or from the available speed S_GNSS and/or S_GNSS measurements, both checked by the data acquisition and reasonability module, the estimated location of said train Pest, and its location with regard to a kilometer point P_k, and its estimated speed S_est,

- detecting the siding passage and track occupancy in areas with more than one adjacent track based on said position P_est and speed S_est measurements and the already checked angular speed ω_z, and a digital database with the singular points or sidings of the track (51), and providing information concerning the track occupancy status TS,

- transmitting periodically and/or when singular points are passed over, at least said certain position P_k and track occupancy status TS estimations to a centralized traffic control CTC center (100), using a protocol allowing two-way communication (72), and
in said centralized traffic control center (100):

- extracting position P_k of said train and the track occupancy status TS for said train, and graphically representing the most recent monitored track status on a data display screen.
A method according to claim 9, characterized in that it further comprises estimating from said position P_GNSS and S_est measurements the likely location of said train Pest and its kilometer point P_k, taking into account the decision of the modules of safety qualification by projection and by reasonable position P_reas (n), understanding that if P_GNSS does not comply with one of the criteria position Pest estimated in the previous instant will be used as a starting point rather than P_GNSS.
A method according to any of claims 9-10, characterized in that when P_proj is not available, position Pest estimated in the previous instant is used.
A method according to any of claims 9-11, characterized in that it further comprises:
- carrying out a linear recursive filtering so as to estimate the systematic errors for the odometer measurements (bias) and correct the S_ODOM by subtracting said estimated errors,

- determining from S_GNSS and/or from said corrected S_ODOM a train speed S_est by means of filtering of both measurements.
A method according to any of claims 9-12, characterized in that S_est for each time period is an average of S_GNSS and/or S_ODOM once the systematic odometer errors have been subtracted from the S_ODOM by means of linear recursive filtering.
A method according to any of claims 9-13, characterized in that the information transmitted to the centralized traffic control center (100) is coded and encrypted.