EP1750988B1

EP1750988B1 - Railway signalling system, method and interlocking

Info

Publication number: EP1750988B1
Application number: EP05744829A
Authority: EP
Inventors: Nigel Balfour Beatty Rail Technologies JOHNSON; Stephen Balfour Beatty Rail Technologies COX
Original assignee: Balfour Beatty PLC
Current assignee: Balfour Beatty PLC
Priority date: 2004-05-20
Filing date: 2005-05-17
Publication date: 2008-12-17
Anticipated expiration: 2025-05-17
Also published as: AU2005245171B2; GB2414327B; GB2414327A; ATE417773T1; DE602005011794D1; AU2005245171A1; EP1750988A1; GB0510060D0; GB0411277D0; WO2005113315A1

Abstract

An interlocking for a railway comprises a plurality of integrated circuit processor units which perform the logic operations associated with specific line side equipment. A first interface (24) is provided for communication with a central control and a second interface for communication with the equipment (36). The second interface may comprise an input/output interface to/from the trackside equipment. The trackside equipment may include signals, track circuits, crossovers and points. The interlocking may also comprise an interface allowing the control system to communicate with one or more buses (22) within the interlocking, the buses also being in communication with the processor units. Preferably the buses are arranged as duplicated first and second buses for safety data with a third bus for non safety data. The interlocking may also comprise first and second processing units performing duplicated processing operations. A configuration processor may also be provided in order to configure each processor unit. The configuration processor may be located with the processing units in a rack, the units being configured according to their position in the rack.

Description

This invention relates to railway signalling systems, and more particularly to interlockings used within railway signalling systems.
Within a railway signalling system, the so-called "interlocking" is the logic architecture which ensures that the routing of trains and the signals provided to trains provide safe operation of the rail network. Trains are routed through the infrastructure using points, and are controlled and regulated through the infrastructure using signals. The location of trains is detected using track circuits or axle counters or other devices.
Essentially, the interlocking prevents (i.e. locks) a change to the system configuration unless a number of related parameters have the appropriate settings (for example points detected in the correct place, the absence of trains in certain track sections etc.). In particular, the interlocking has a logic architecture which prevents the controller of the infrastructure from allowing two trains to occupy the same piece of track at the same time and allows the controller to regulate and route trains through the infrastructure.
Originally, the interlocking function was provided by a purely mechanical mechanism, in which levers for controlling the points positions were physically blocked from being moved into other positions if the inputs to the mechanical mechanism did not satisfy the required logic conditions. These systems needed large numbers of signal boxes and could only cover small areas at a time due to mechanical limitations. Electro-mechancal systems were developed to provide electrical relays driving mechanical actuators that move the points, but the same limitations applied.
Many interlockings in the present infrastructure in the UK are so-called "free wired" relay-based systems, and these started to be introduced in the 1950s. In these systems, a logic circuit is specifically designed for a part of the network. This enables the logic circuit to be optimised for its required functionality and removes redundancy. The system operates very quickly and has inherent parallel operation.
One problem with free wired .interlockings is they are time consuming to design, install and test, as they are tailored to the specific track layouts they are to serve. So-called "geographical" relay based interlockings were developed in the 1960s in order to resolve some of the problems with free wired systems. A large proportion of the interlockings in service in the UK (and elsewhere) are geographical relay based interlockings, and the principals behind the operation of such systems will now be described.
Geographical signalling consists of discrete blocks or units that represent the different pieces of signalling equipment. These units contain all of the logic necessary to operate that equipment safely. They are connected together to mimic the geographical layout of the railway. These connections allow electrical signals (or messages) to be passed between units in order to set routes, move points and clear signals. An example layout along with its equivalent geographical representation is given in Figures 1 and 2 respectively.
In Figure 1, signals S1 and S3 protect the set of points 4. If signal S1 is cleared then signal S3, which is interlocked with signal S1, cannot be cleared. If signal S3 is cleared then signal S1 cannot be cleared.
Trains can be held at signal S1 to allow a train between signal S3 and S5 or visa versa. Track circuits A, B, C and D detect the location of a train. As shown in Figure 2, each of the elements of the line side equipment is represented in the geographical interlocking system as a separate logic element, although track circuit C is included in the points unit.
The main advantages of geographical signalling are the ease of design and manufacture due to the use of standard pre-defined logic units. Also if a unit fails then the rest of the system can continue working. The failed unit may then be removed and a new unit of the same type substituted.
Entire signalling systems may be represented using the following geographical unit types:

(i) Signal: Used to represent all signals including main and shunt signals.
(ii) Track: Used to represent all plain line track circuits or axle counters.
(iii) Crossover: Used to represent all fixed crossings.
(iv) Point: Used to represent ends of points.

In addition, multiple units may be implemented in the same geographical unit. For example, multiple ends of points may be implemented by connecting two point units together or by combining the logic of multiple point ends in the same geographical unit.
Each of these unit types use cables to connect the units together to form a geographical representation of the layout.
Generally each 'geographical' unit operates autonomously, processing inputs and altering outputs accordingly. This means that effectively each unit operates in parallel with all other units. This makes the system very quick as far as the end user is concerned. However some operations require the units to operate sequentially. This sequential operation is achieved by passing messages (or electrical signals) between adjacent units. These units respond to the message and then pass it on to the next adjacent unit. In this way, commands can be sequentially passed very rapidly through the system with a minimum of message processing required.
The basic operations of an interlocking are setting routes, moving points and controlling signals. These operations can again be subdivided into further sub operations. For example, route setting can be divided into:

Call route: This determines which way a route is to set between a defined entrance and exit signal. This ensures that there are no conflicting routes set or point ends that cannot be moved to the position required.
Call points: This calls all points in the route to the position required for the route.
Lock route: This locks all points in the position required for the route and prevents any conflicting routes from being set.
Clear signal: This checks the route has been correctly locked, all points are detected in their correct positions and all tracks which are required are clear between the entrance and exit signal.

Sometimes it may be necessary to pass messages between units that are not physically adjacent to each other. This is done using special connections between the units concerned.
Each unit contains sufficient logic to interact with other units and ensure that the piece of equipment it is controlling or monitoring operates safely. In order to do this it must monitor the state of its inputs continuously. Each unit type has a number of different inputs but there is some commonality which is outlined below:

(i) Train detection: All units may monitor one or more track circuits or axle counter sections. These are used to determine the absence of trains (or track circuit failures) within the system.
(ii) Point detection: All points units monitor the state of the point detection for the set of points they are controlling. This is used to determine the lie of the points and hence whether it is safe to allow a train to pass over them.
(iii) Signal state: Signal units must monitor the state of the signals they are controlling to ensure safe control of trains. Generally the lamps within the signal are monitored to ensure that they are illuminated correctly and also the signals are monitored to check if they are correctly on (showing a stop aspect) or off (showing a proceed aspect).

In addition to monitoring the state of all inputs each unit must have control over any equipment connected to it. Each unit type controls different outputs but again there is some commonality as outlined below:

(i) Point calling: Point units must be able to call the points either normal or reverse. This is to enable points to be moved to the position required for the safe passage of trains.
(ii) Signal aspect: Signal units must be able to control what aspect is being shown by the signal. Depending upon the system a signal unit may simply control a signal to be on or off or may control the individual aspect displayed.

Finally there are a number of states that must be stored internally within each unit. Again states that are common between unit types are shown below:

(i) Route locking: Each unit must record the current state of any route locking affecting the unit. Route locking is directional and is based on the direction of travel through the unit. When a route is locked through the unit in one direction it is not possible to set a route in the other direction through the unit and visa versa.
(ii) Overlap locking: This operates in a similar way to the route locking but this time operates for an overlap. This enables routes to be overset through overlaps and overlaps to be released separately from routes. Again once an overlap has been set in one direction it is not possible to set an overlap in the other direction.

The units used in electro mechanical geographical interlockings are discrete logic circuits, each performing a limited standard logic operation on the inputs and outputs. A disadvantage of the geographical interlocking design is the large number of components, and the redundancy inherent in the approach, as a result of the logical modelling of each individual part of the line side equipment. The interlockings also take up a significant amount of space.
Computer technology clearly provides an opportunity to integrate all the required logic into integrated circuits and microprocessors, and all major re-signalling schemes in the UK are currently implemented using an electronic signalling system known as Solid State Interlocking (SSI). The internal logic for each interlocking is uniquely designed and tested. One problem with this system is that minor alterations to the interlocking can require a wide area to be shut down.
EP 0473834 discloses a control and monitoring system for a railway message box, in which devices are controlled by two control computers to provide redundancy.
According to the invention, there is provided an interlocking for a railway signalling system as defined in claim 1.
The interlocking of the invention provides an integrated circuit implementation of the logic associated with individual line side equipment units. Thus, the advantages of geographical relay based interlockings can be obtained, of ease of design and installation. The invention enables direct replacement of electro-mechanical relay based systems with solid state electronics, in a modular piecewise manner. The interlocking can be based on standard geographical signalling principles, so that direct replacement of geographical interlockings can be made without the need to re-design signalling circuits. The system can instead replace other types of relay-based system. The interlocking can also interface directly to existing line side signalling circuits. The system can also be used to interface to future train control system protocols, such as ERTMS (Level 1 and Level 2). The invention enables a reduction in redesign cost in the design and installation of a solid state interlocking.
Each processor unit may perform the logic operations associated many line side equipment elements, but only one signal, set of points or fixed crossing (by fixed crossing is meant a crossing without moving points). This means the geographic design principles can be applied. A processor may implement other functions in addition or instead of the logic of a signal, set of points or fixed crossing, such as track circuit logic.
Each processor unit may comprise more than one physical microprocessor, for example for duplication. In this case, each physical microprocessor is still for performing the control of the one or more lineside equipment elements. The processor unit (with one or more microprocessors) is in the form of an independent unit having its own inputs and outputs. Multiple such processor units may be provided on a shared card/circuit board, but they are independent in the sense that any one processor unit is allocated only to the control of the particular lineside equipment elements. Each individual physical microprocessor (of which there may be one or more for each processor unit) is an indivisible unit, and must be replaced in full in the case of repair. In practice, in the case of repair, the full processor unit will be replaced, even if it has more than one microprocessor, only one of which has failed.
Each local integrated circuit processor unit is configurable to perform the logic operations associated each of a signal, a set of points and a fixed crossing, and is configured in use to perform the logic operations associated with at most one of these. The processor units may perform other logic operations, for example there may be a processor configured to implement track circuit logic as its sole purpose. The main logic building blocks in a geographical system can be considered as signals, points and crossings, and each processor implements the logic of only one of these elements, although optionally with additional other logic for example additional non-standard logic functions and/or track circuit logic.
This arrangement enables a single spare part (one of the processor units) to be provided and which can replace any failed other processor unit.
A configuration processor unit is provided for configuring each processor unit thereby to determine the logic operation performed by the processor units. The processor units and the configuration processor may be provided in a rack, and the configuration processor then configures each processor unit in dependence on its position within the rack. For example, the configuration processor can store a model of the lineside equipment layout controlled by the interlocking, and store a mapping of the lineside equipment elements to the rack positions.
The invention enables each processor unit to replicate the function of a single building block of existing geographical interlocking systems. The system can be installed using these processor units, and these can also be easily serviced and replaced if necessary, with minimum disruption to service. The interlocking has a plurality of these processor units.
The line side equipment elements may comprise signals, track circuits, crossovers and points.
An interface processor may be provided for interfacing between the central control system and one or more data buses of the interlocking, the one or more data buses being in communication with the local integrated circuit processor units. For example, the one or more data buses may comprise first and second duplicated data buses for safety critical data and a third data bus for non-safety critical data.
Each local integrated circuit processor unit may comprise first and second processors performing duplicated processing operations.
Multiple interlockings of the invention are preferably used in a railway signalling system which further comprises a plurality of geographical units and a track infrastructure including a plurality of line side equipment elements controlled and monitored by the interlockings.
The invention also provides a method of providing an interlocking function in a railway as claimed in claim 15.
The invention provides a modular system in which each module can be configured to represent different lineside equipment elements. With one module design, a solid state system can be designed using well known geographical signalling design principles.
The invention will now be described in detail with reference to the accompanying drawings, in which:

Figure 1 shows a representation of a simple track layout;
Figure 2 shows a geographical representation of the track layout of Figure 1;
Figure 3 shows a known railway signalling system;
Figure 4 shows an interlocking of the invention;
Figure 5 shows an individual processor card of the interlocking of Figure 4 in more detail;
Figure 6 shows how the processor cards are mounted on racks; .
Figure 7 shows how the interlocking of the invention may be used in parallel with a geographical relay based system; and
Figure 8 shows how the geographical relay based interlocking can be phased out following the parallel operation explained with reference to Figure 7; and
Figure 9 shows in more detail the parallel operation of the system of Figure 7.

Figure 3 shows the overall architecture of a typical area of the rail infrastructure.
The tracks 10 are divided into fairly small regions (for example a multiple track junction), and each of these regions is served by a local interlocking 12. Each interlocking 12 communicates with the line side equipment associated with the sections of track 10 using an interface unit 14 (these define the lineside circuits). The interlocking also communicates with a control station/signal box 16 which covers a wider area, including the three interlockings in the example of Figure 3.
Each interlocking typically covers one region, such as the rail infrastructure associated with one railway station, or a junction at a location between stations.
In a geographical system, each line side unit is controlled and monitored in the interlocking by an associated logic circuit, and the interface signals between the interlocking 12 and the interface units 14 are in a standardised form.
The interface units 14 are typically relay-based units, and these interface between the standard signal format at the output of the interlocking (for example 50V dc line levels) and the signals required to control the lineside equipment, for example 110V or low voltage dc line levels.
The interlocking of the invention passes the same signals between the interlocking and the line side equipment as the conventional geographical system, and thus maintains the same output format to the interface units 14.
The interlocking of the invention also models the required logic operations for each geographical line side equipment element separately. A plurality of local integrated circuit processor units are provided, each performing the logic operations associated with one specific line side equipment element (although track circuit logic may be included in the logic for a switch or signal, for example). The interlocking of the invention thus provides an integrated circuit implementation of the logic associated with individual line side equipment units. This enables direct replacement of electro-mechanical relay based geographical systems with solid state electronics. The interlocking is based on standard geographical signalling principles, so that direct replacement can be made without the need to re-design signalling circuits. Replacement of other types of relay based systems can also be carried out using known geographical design principles.
Figures 4 and 5 show in more detail the architecture of the system of the invention.
The interlocking comprises processor units 20 (one of which is shown in Figure 4), and these carry out the logic functions associated with the individual line side elements, namely representing the functions of the geographical units outlined above.
Preferably, each processor unit has sufficient logic to replicate any of the geographical unit types. At any one time each processor unit will only replicate one geographical unit type.
This is determined by the interlocking configuration, and this configuration function is described further below. On power up the processor unit will check its current configuration and update it if necessary. It will then replicate only the functions required for the particular geographical unit it is representing.
Each processor unit thus carries the required integrated circuit logic to implement control of (at least) each of, a signal, a set of points (single ended or double ended) and a fixed crossing. However, in use, each processor will implement the control logic for at most one of these elements.
The logic implementing the control of a signal or a set of points may also include the logic associated with the handling of the input information received from the track circuits at the sides of the signal or points. The logic associated with each of these different types of line side equipment element may be considered to be standard. In addition, the processor units enable non-standard additional logic functions to be programmed into them. During the configuration operation, additional logic functions can be loaded into the processor units, and the processor units have processing capacity for this purpose.
The processor units communicate using data buses 22 with a configuration card 24 which acts as a central terminal interface unit, and this in turn communicates with the central (i.e. regional) control terminal 26. In particular, the processor units are connected to each other via vital and non-vital buses. The central terminal 26 allows signalling technicians to interact with the interlocking and diagnose faults. It also acts as an event recorder with all messages passed between units being recorded for fault finding, diagnostic purposes and for use as train location, direction and speed information for use in customer and other information systems.
A panel interface unit 30 also links between the buses 22 and the signaller's panel 32. Route requests can be made from this panel, and these are implemented if the interlocking logic allows. A technician's terminal 34 is used for communicating directly with the central terminal 26.
All of the units shown in Figure 4, excluding the terminals 26 and 34, together constitute the interlocking and the processor units 20 communicate with the line side equipment through an input/output interface 36 implemented as an input/output unit. The input/output unit is provided with its own signalling power supply and interface directly to the existing DC or AC line circuits or directly to the lineside equipment via trackside modules. All input/output units are connected to the same duplicated supply, represented as power supply unit (PSU) 38 in Figure 5.
Each interlocking of the invention comprises a number of the processor units, for example plugged into a rack. In a preferred implementation, each processor unit is identical, and has the logic associated with each type of lineside equipment element.
Figure 6 shows in simplified form the rack 50, which has a number of slots 51 (14 in the example of Figure 6). Each of these slots 51 receives one processor unit in the form of a card. One slot is reserved for the configuration unit, in the form of a card 52 (which is the central terminal interface 24 of Figure 4) which carries the configuration information. One slot is also reserved for the panel interface, again in the form of a card 53, which interfaces to the signaller's panel.
Each slot is uniquely identified (i.e. numbered). Using this approach, each slot represents one element of lineside equipment, and the inputs and outputs for the cards in each slot are connected together to implement the desired geographical layout. This connection between cards is implemented as traffic over the data buses, and the configuration card determines how the inputs and outputs of each processor unit are effectively connected together.
The identity of each slot may be implemented by the backplane of the rack, so that when a card is inserted, the identification of the rack number and slot number comes from the pin connections of the card to the backplane. The card can then identify the configuration information which relates to it from the data buses. This means the processor units can be completely identical, as they learn their identity from the backplane into which they are plugged.
Each of the units shown in Figure 2 may be allocated to a particular slot, although the logic for track circuits A, B and D could be implemented as part of the logic of the signals S1, S3 and S5 (respectively).
The configuration card 52 is programmed to define the function of each slot. For example, slot 1 may be a track circuit (track circuit A), slot 2 may be a track circuit (track circuit B), slot 3 may be a signal (signal S1) and so on.
When the system powers up, the configuration card 52 is interrogated, and provides a mapping between the slot number and the type of lineside equipment element. Each processor unit is then configured according to the slot in which it is positioned, and is thereby configured to implement the logic associated with a specific lineside equipment element. This logic is that previously implemented by one geographical relay set in a relay based geographical system. Additional non-standard logic may also be loaded from the configuration card to a processor unit, as a function of the slot in which the processor unit is located. For example, a particular set of points may need to process additional inputs to the standard controlling inputs (for example signals from two or three sections of rail upstream). This non-standard logic requirement can then be loaded to the required processor unit, and is equivalent to the free-wiring within a relay-based geographical system.
The configuration information is equivalent to the physical wire straps in relay-based geographical systems.
There may be many racks in one interlocking. For example, one configuration card may control 10s or 100s of processor units. Each slot is then identified both by the rack number and the slot number within the interlocking.
In addition to setting the initial configuration of each processor unit, the configuration card can also carry out periodic configuration checks, for example providing updates and checking version numbers.
The other parts of the system will now be described in greater detail.

Processor unit

Figure 5 shows the typical architecture of one of the geographical processor units in more detail. It consists of a number of modules which allow the processor unit to perform its safety critical function. There are typically two independent processor channels per unit which are called A and B. These are used to ensure that the interlocking is fail safe by duplication. The preferred design of the processor card is such that it achieves the required safety integrity level. In order for an output to change, both processors, Processor A and Processor B, must send the appropriate signals to the I/O unit(s). If either processing channel does not sent the correct signal then the state of the output will not change to a less restrictive state and will stay or revert to a more restrictive state.
In order to communicate with the other parts of the system, each processor has a number of interfaces. Each processor has an interface to a vital communications ("comms") link. This link is used to carry all safety critical messages between processor units and between the central terminal. There are two vital comms links again called A and B. This is to ensure complete separation of the A and B processing channels. Each processor also has an interface to the non vital comms link. This is used to carry non safety critical messages between the panel processor and each processing unit. These messages are non vital as they can only make requests which the interlocking will only execute if it is safe to do so.
Finally each processor has an interface to the I/O unit 36. This interface isolates the processor unit from the I/O unit for protection from electro magnetic interference (EMI). Each processor unit also has access to a non-volatile memory module that is used to store all of the site specific configuration data required.

Input / Output unit

This unit is used to interface directly to the line side signalling circuits. Each processor unit can control a single or plurality of I/O units. Each card has the ability to monitor a plurality of input pairs and control a plurality of output pairs. Each input pair can monitor either a uni-polar or bi-polar signalling circuit. Each input places the same load on the circuit as a conventional relay and hence can be used directly in place of relay circuitry. It is possible to remove each input in turn in order to test the operation of the input circuitry.
Each output pair can drive either a uni-polar or bi-polar signalling circuit. All outputs on a single card are fed from a single externally provided signalling supply. It is possible to remove each output in turn in order to test the operation of the output circuit. If any part of the output circuitry fails then it is still possible to remove the output by removing either leg of the signalling supply.

Panel interface unit

This unit is used to interface the interlocking with the signallers panel. It also handles all non safety critical parts of the route setting process such as the Push Button Interface (PB1). The panel interface communicates with each processor unit in turn via the non vital bus. This allows all of the panel indications to be updated on a periodic basis. When a signaller wishes to change the state of a control then the panel interface unit converts this request into a standard format and then sends it to the relevant processor units The panel interface unit interfaces to the panel via the I/O interface. This can either talk directly to a time division multiplexer or can drive further interface circuitry to communicate directly with a panel.
Thus, there are a number of ways the system can be connected to an existing signaller's panel. The panel interface 30 can connect to a conventional field end TDM (time division multiplex) system, or else the field end TDM system can be replaced and incorporated into the system, so that the system communicates directly with the office end TDM system. The system may instead replace both the office and field end TDM systems, and the system may then have a direct interface with the signaller's panel 32.
The panel interface unit may be duplicated (not shown).

Central terminal interface unit (the configuration card)

This unit interfaces the interlocking to the central terminal. It has connections to both the A and B vital comms links and the non vital comms link. It continually monitors these links and records all messages passing between the processor unit on the vital link and all messages passing between the panel interface unit and the processor unit on the non vital comms link. Each message is stored with a time stamp of when it was received. If there is a discrepancy between the messages on the A and B vital comms links then this is recorded and an alarm generated. There are two processors within the central terminal interface unit. The first receives messages from the vital and non vital comms links, time stamps them and stores them. It also responds to requests made by either the processor units or the panel interface unit. The second processor deals with the communication with the central terminal. In this way, the recording of messages on the communication links is not interrupted by the need to communicate with the central terminal. When a message needs to be passed between the two processors the initiating processor requests that a transfer of data takes place then the other processor responds to that request when it is available. The second purpose of the central terminal interface unit is to allow technicians to apply controls to the interlocking (such as temporary approach control). The final purpose of the central terminal interface unit is to check and update each processor units site specific configuration. This information is requested by each processor via the vital bus each time it is reset.
The configuration card may also be duplicated (not shown).

Vital comms link

This is used to pass all vital messages between processor units and between the processor units and the central terminal. It has built in error checking which ensures that messages are correctly transmitted between units. It also incorporates a method of allocating each message a priority. This ensures that messages of high importance override messages of a lower importance on the comms link.

Non Vital comms link

This is used to pass all non vital messages between the panel and the processor units. It has built in error checking which ensures that messages are correctly transmitted between units.

Central terminal

The central terminal consists of a rack mounted PC that acts as a central data store for the system. It logs all messages that are passed between the various part of the interlocking system. It also stores the configuration for each of the processor units. This is used to check that each unit is correctly configured and to update the configuration if necessary. It also allows the technicians access to the all logged data and allows controls to be applied.

Technicians terminal

The technicians terminal allows the technicians to apply controls to the interlocking and to view data from the interlocking.
The system of the invention enables the interlocking to be designed using existing geographical signalling principles (and hence competency). The system interfaces directly to existing line side circuits, so that no external alterations are required.
The system can be installed within the existing accommodation hence removing the requirement for new buildings, and with minimal site specific wiring required. The system can also easily be tested prior to commissioning. The implementation of different geographical units as different processor units results in no common point of failure, so that it is possible to route trains around failed units.
In a preferred implementation, a single processor unit can be used to replace all geographical unit types. Each standard processor unit will then carry sufficient logic to represent all of the unit types, but will be configured to perform the logic operations of one such unit or a number. The system thus has minimal spares requirements, and the units are interchangeable and hot swappable without powering down the system.
Whilst the system of the invention is developed to provide a cost effective and safe replacement of a geographical system, it can also be used to upgrade existing free-wired systems. In this case, the infrastructure covered by the free wired system is re-modelled using geographical principals.
The system of the invention can be interfaced to ERTMS systems. ERTMS is a signalling standard which has been developed to provide interoperability of the trans-Europe rail network. ERTMS is an electronic based system, which is therefore not inherently compatible with the electro-mechanical relays of geographical systems. By providing an electronic based replacement for geographical interlockings, the invention enables geographical interlockings to be interfaced to ERTMS.
Additionally, the resulting system type, i.e. electronic, represents a technology with obsolescence benefit over electro-mechanical systems.
As shown in Figure 7, the system of the invention 60 can be run in parallel with an existing interlocking 62 prior to commissioning. For approval purposes, after testing the system, first level approval would be obtained to run the system in parallel with an existing interlocking. The parallel running could run for a period with the existing interlocking making the decisions, and with continuous monitoring, using the monitoring arrangement 64, of the decision made by the new system, in order to detect any differences in decisions made. After this parallel running period, approval would be obtained to control the network using the existing interlocking, and control could then be passed between the two systems. Finally control would transferred to the new system, although the existing interlocking could be retained for a further period, with continued monitoring, before eventual decommissioning of the existing interlocking. This eventual decommissioning is shown in Figure 8.
The parallel operation of the system is shown in more detail in Figure 9, and this shows a shadow running mode.
Figure 9 shows the lineside circuits 14 as a unit 90, and the standard interface which the system of the invention is designed to use is shown as 92, and these include control signals and feedback "indication" signals. The existing interlocking is shown as 94 and the interlocking communicates with the signal box through a TDM system 96.
The system of the invention is shown at 98, and this receives tapped signals from the lineside circuits (shown dotted).
Coloured links are used indicate which relay lineside circuits are currently coupled to the existing interlocking. Different coloured links indicate which relay lineside input circuits are currently coupled to the CGI system.
Only the lineside inputs to the system of the invention are connected (the "indications"), and not the control signals for the lineside circuits. The inputs from the lineside circuits are linked to the system of the invention by plugging in the system and inserting additional links. These inputs are opto-isolated and suitably current limited.
The outputs from the system are connected to a set of lineside test relays 100 which simulate the operation of the lineside relays in the location cases. These relays 100 are monitored using data loggers 102 monitoring spare contacts, and a data logger 95 is also provided for the existing interlocking 94.
The inputs and outputs to and from the TDM system 96 are monitored using a software logger 104. This records all changes in the TDM inputs and outputs from both the existing interlocking and the system of the invention. It also provides the system of the invention with a copy of all TDM outputs. The input to the software logger is suitably opto-isolated and current limited and is only be able to listen to the TDM transmit and receive lines.
A subsequent stage of the implementation process can consist of a series of "over and back" trials (where there is handover between the new and old systems).
A duplicate TDM system can be provided to aid quick transfer between the existing interlocking and the system of the invention. The TDM system can be interfaced to the CGI system via a panel interface relays.
One example of implementation of the invention has been described above. Some variations will be outlined below, although numerous other variations will be apparent to those skilled in the art.
The interface 14 between the lineside equipment and the interlocking can remain standard when implementing the invention, in other words remain relay-based. These interfaces also implement the logic associated with signal and track circuits for straight line track sections. However, these lineside circuits could also be replaced with integrated circuit implementations.
In the preferred implementation described above, the processor units/cards may all be identical, and they are then configured to implement one desired logic function. However, there may instead be a number of different cards, each for a different type of lineside equipment element. This diminishes the modular benefits of the system to a limited extent, but does give the additional advantage that the system can verify that the correct types of processor unit have been placed into the different slots. This provides an additional level of protection in the design and implementation of the system.
The implementation above duplicates the buses and processors. However, this may not be required, or else triplication may even be desired, with a two-out-of-three trust requirement.

Claims

An interlocking for a railway signalling system, comprising:
a first interface for communication between the interlocking and a central control and monitoring system (26);

a plurality of local integrated circuit processor units (20), each local processor unit adapted to perform the logic operations associated with one or more specific line side equipment elements (14), wherein each processor unit is adapted to perform the logic operations associated with at most one of a signal, a set of points and a fixed crossing; and

a second interface (36) between the integrated circuit processor units (20) and the line side equipment elements (14),
characterised in that each local integrated circuit processor unit (20) is configurable to perform the logic operations associated with each of a signal, a set of points and a fixed crossing, and is configured in use to perform the logic operations associated with at most one of a signal, a set of points and a fixed crossing,
and wherein the interlocking further comprises a configuration processor (24), for configuring each processor unit thereby to determine the logic operation performed by the processor units.
An interlocking as claimed in claim 1, wherein at least one of the processor units (20) performs the logic operations associated with one of a signal, a set of points and a fixed crossing, and additionally the logic associated with at least one track circuit.
An interlocking as claimed in claim 1 or 2, wherein the processor units (20) and the configuration processor (24) are provided in a rack (50), and wherein the configuration processor configures each processor unit in dependence on its position within the rack.
An interlocking as claimed in claim 3, further comprising a panel interface controller (30), and which is also provided in the rack.
An interlocking as claimed in any preceding claim, wherein the configuration processor (24) stores a model of the lineside equipment layout controlled by the interlocking, and stores a mapping of the lineside equipment elements to the rack positions.
An interlocking as claimed in any preceding claim, wherein one or more of the processor units (20) are provided on a processor card.
An interlocking as claimed in claim 6, comprising a plurality of processor cards.
An interlocking as claimed in any preceding claim, wherein the line side equipment elements (14) comprise signals, train detection circuits, fixed crossings and points.
An interlocking as claimed in claim 8, wherein the train detection circuits comprise track circuits and/or axle counters.
An interlocking as claimed in any preceding claim, further comprising an interface processor for interfacing between the central control system (26) and one or more data buses (22) of the interlocking, the one or more data buses being in communication with the local integrated circuit processor units (20).
An interlocking as claimed in claim 10, wherein the one or more data buses (22) comprise first and second duplicated data buses for safety critical data and a third data bus for non-safety critical data.
An interlocking as claimed in any preceding claim, wherein each local integrated circuit processor unit (20) comprises first and second processors performing duplicated processing operations.
An interlocking as claimed in any preceding claim, wherein the second interface (36) comprises an input/output unit for interface with the line side equipment elements.
A railway signalling system comprising:
a central monitoring and control system (26);

a plurality of interlockings as claimed in any preceding claim;

a track infrastructure (10) including a plurality of line side equipment elements (14) controlled and monitored by the interlockings.
A method of providing an interlocking function in a railway, characterised in that the method comprises:
configuring a plurality of local integrated processor units (20) using a configuration processor (24) thereby determining the logic operation performed by the processor units, so that each processor unit performs the logic operations associated with one or more specific line side equipment elements including at most one of a signal, a set of points and a fixed crossing, wherein each local integrated circuit processor unit is configurable to perform the logic operations associated with each of a signal, a set of points and a fixed crossing;

combining the logic functions of the different processor units to provide the interlocking functionality; and

using the processor units to control the line side equipment elements (14).