EP3967569B1

EP3967569B1 - Method and system for controlling a railway vehicle in case of disconnection between obu and rbc subsystems

Info

Publication number: EP3967569B1
Application number: EP20306014.0A
Authority: EP
Inventors: Attilio ERRIQUEZ; Patrick ZOETARDT; Andre RADOMIAK
Original assignee: Alstom Transport Technologies SAS
Current assignee: Alstom Holdings SA
Priority date: 2020-09-11
Filing date: 2020-09-11
Publication date: 2023-05-10
Anticipated expiration: 2040-09-11
Also published as: EP3967569A1; ES2950267T3

Description

The present invention relates to a method and system for controlling a railway vehicle in case of disconnection between the OBU and the RBC subsystems.
An ERTMS/ETCS Level 2 / Level 3 system, which is the system of standards for managing the railway traffic and associated on-board signaling according to European Union's Technical Specifications for Interoperability, relies on the availability of a wireless telecommunication network. The ERTMS/ETCS system is arranged to allow communication between an on board subsystem or unit (OBU) of a railway vehicle and a trackside subsystem named Radio Block Center (RBC) associated to a portion of a railway network.
In particular, in ERTMS/ETCS lines, the on board subsystem OBU receives instructions allowing movement of the railway vehicle (such as Movement Authority, Grant for Shunting or for Reversing or to proceed in Staff Responsible mode, etc.) from a Radio Block Center (RBC), through wireless telecommunication infrastructures. When the radio link is not available, the railway vehicle can only proceed in mode providing limited protection, based on manual procedures with collaboration between the railway vehicle driver and the trackside signaling officer, monitoring authorizations, track clearance, level crossings, point positions, etc. Under this situation, the operational speed of the railway vehicle is kept very low.
If the OBU subsystem is no more connected to the RBC subsystem for several seconds (disconnected railway vehicle), due to network unavailability or failure leading to unavailability of the communication, the railway vehicle is stopped and the railway driver is allowed to continue travelling at limited speed, as long as the radio connection is not restored.
In case of network unavailability, this may lead to important impact on the line operation. Prior art document EP2746131A1 discloses an example of such a system. Prior art document CN110104031A discloses an different solution applied in CBTC system in which trackside devices detect the position of train and communicate this to the ATS in the case where communication is degraded.
To ensure a good quality of service of the wireless telecommunication system, a railway infrastructure manager shall provide adequate network coverage and availability, which is reached by deployment of private radio communication infrastructure. In such a way, the wireless telecommunication system could be deployed according to engineering rules ensuring the required wireless coverage even in case of unavailability of some elements of the infrastructure.
The deployment of a private wireless telecommunication system has an important impact on the overall life cycle cost of the railway system, moreover, the GSM-R technology currently used for such wireless telecommunication services will be discontinued by network suppliers. The railways entities are therefore planning to move to the use of public telecom infrastructures independent from the radio technology allowing to take full advantage of the new and future evolutions such as LTE / 5G, satellite.
Railway infrastructure managers are therefore moving from the current model where they are owner of the network infrastructure, towards a different one, where they lease telecom network infrastructure services from public operators. This model enables to save investments, especially with reference to the networks themselves, where the technology lifespan is getting shorter.
For high speed lines and high-density lines, for which operation is critical, railway managers would generally set agreements with the public operators to secure adequate quality of communication services. The service cost being justified by the operational need of such critical line's operation.
However, for low density lines, there would be the need to decrease the cost of the telecommunication services through reducing to a minimum level the performances required to operate an ERTMS system, while providing a safe and optimized operation of the railway vehicles in case of unavailability of the wireless system by allowing vehicle to proceed at a speed higher than the one currently applied for disconnected railway vehicles (5-15 km/h, varying in different countries).
There is therefore the need to develop an innovative method and system for controlling a railway vehicle in case of disconnection between the OBU and the RBC subsystems, which overcomes the risks related to lower quality of service of the wireless telecommunication network.
This and other objects are fully achieved by a method for controlling a railway vehicle in case of disconnection between the OBU and the RBC subsystems, having the characteristics defined in independent claim 1, and by an associated system having the characteristics defined in independent claim 11.
Preferred embodiments of the invention are specified in the dependent claims, whose subject-matter is to be understood as forming an integral part of the present description.
Further characteristics and advantages of the present invention will become apparent from the following description, provided merely by way of a non-limiting example, with reference to the enclosed drawings, in which:

Figure 1 is a schematic picture of a system 1 comprising a device for controlling a railway vehicle in case of disconnection between the OBU and the RBC subsystems according to the present invention;
Figure 2 shows a schematic picture of an OBU module and a route map database interfaced to perform the method according to the present invention;
Figure 3 is a block diagram of the steps of the method according to the present invention; and
Figure 4 shows a railway vehicle running on a railway track and controlled with a method according to the present invention.

The invention aims to provide to a known OBU information to protect singularities on route, thus allowing a safe higher operational speed on plain tracks.
In low density line topology, a track between two stations is generally provided with no turnouts, and mostly one railway vehicle at a time, meaning that the railway vehicle must be mostly protected from over-speed, level crossings... The movement authorization could therefore rely on the static information describing a track (static speed profiles, level crossings, ...). This description could therefore be defined in the form of a "default RBC message" belonging to the route over the track (and typically a single route is defined from station to station, in a low density line) connecting two stations.
In case of loss of communication between the RBC and the OBU subsystems, a railway vehicle driver is usually forced to run at a low speed in a degraded mode (Staff Responsible mode) with no information on the track.
The method according to the present invention allows the creation of virtual RBC messages, memorized by the on-board subsystem (for example on a storage memory), comprising a description of the railway track and predetermined travel information such as "Static Speed Profile" and positions of the "Level Crossings", thus giving the possibility for the railway vehicle to run at a higher speed on long single track sections, with protections mostly from over-speeding and collisions with road, vehicles and pedestrians at level crossings.
The virtual RBC message provides restrictive information about the railway track on which the railway vehicle is running, to enable protection of travel as speed profiles, level crossings positions, danger points, end of route, etc. This information is used by the OBU subsystem of a railway vehicle to protect the railway vehicle once the trackside signaling officer has authorized the railway vehicle to proceed (ensuring that a default route is set and confirmed), allowing the railway vehicle to move at a higher speed than the one that would be imposed by the standard method, hence mitigating the traffic disturbance from wireless network potential reduction of service.
Thanks to the proposed method, an ERTMS/ETCS system can be enhanced by introducing a new source of information for the OBU subsystems, namely the route map database.
This new information is provided wirelessly to the railway vehicle and it is memorized in the OBU subsystem of the railway vehicle, which includes a process ensuring that the OBU is always using the applicable definition of the route map database.
The route map database is a topological description of low density line tracks, that is used in combination with odometry and other absolute geographic positioning system (e.g. GNSS) to localize the railway vehicle on a track. The position and orientation of balise devices is indicated in this description to allow positioning of the railway vehicle according to ERTMS principles. Virtual RBC messages are part of the Route map database and associated to balise devices .
The route map database data are distributed to the OBUs in a safe and secured way or sent through packets (e.g. specific Packet 44 or ETCS/ERTMS) included into physical Eurobalises.
If the database is sent via a wireless telecommunication network from a ground database server(s), a FQDN (Fully Qualified Domain Name) or IP address of server(s) for allowing such route map data distribution is a parameter in any OBU subsystem. The OBU subsystem checks, for example, availability of a new version of route map data at the beginning of each mission (power on and/or at each new connection with the RBC subsystem). In case a newer version is available, the OBU subsystem receives the applicable version of route map data, replacing older data previously stored.
The route map data integrity and authenticity are ensured by applying state of the art technics of the domain.
Figure 1 is a schematic picture of a system 1 performing a method for controlling a railway vehicle in case of disconnection between the OBU and the RBC modules according to the present invention.
On the on board side, an OBU subsystem or module 2 refers to known physical balise devices 4. A telecommunication interface device 10 connects the OBU module 2 to wireless telecommunication network(s) 12.
On the trackside side, an RBC subsystem or module 14 is connected to the wireless telecommunication sub-system 12, to allow communication with the on board side. Other standard signaling systems/modules known by people of the domain are denoted with reference 18 and are here not named as not relevant to the method of the present invention.
Figure 2 shows a schematic picture of the OBU module 2 connected to a route map database 20.
Figure 3 is a block diagram of the steps of the method according to the present invention, which is performed by the OBU module 2.
In an initial step 50, the OBU module 2 detects the disconnection with the trackside characterized by the absence of message exchanged with the RBC for more than a time set by the ETCS system parameter, if so, at step 52, the railway vehicle is stopped by the OBU. At a further step 54, the railway driver performs an "override" process in coordination with a trackside signaling operator. This process allows the railway vehicle to move again:

at a predefined speed in degraded mode up to the next signal or marker board; and
under the responsibility of the driver (Staff responsible mode) and trackside signaling operator, without information about the track.

At this point, in a step 56, the OBU module 2 checks if there is a virtual RBC message (attached to the last encountered reference balise devices and memorized on a storage memory) and if this message is applicable, after validity checks according to the direction of movement of the railway vehicle.
If so, at step 58, the OBU module 2 processes this virtual RBC message as if it were provided by the RBC module 14, this message provides a Movement Authority in "Limited Supervision" mode with track description (authorized speed profile, level crossings, ..) allowing a supervision of the OBU module 2, which can give the possibility to run safely at a higher speed up to a location predefined by the applicable virtual RBC message.
The virtual RBC messages is used by the OBU module 2 as an alternative source for receiving ETCS messages with respect to the standard method (RBC, balises,..).
The OBU module 2 only accepts messages when in ERTMS/ETCS Level 2 or Level 3.
The OBU module 2 applies to virtual RBC messages all message filtering and validity checks as applicable for a RBC messages received by wireless telecommunication from trackside RBC modules, at the exception of the timestamp, which is not present in the virtual RBC messages.
Once the message is accepted, the OBU module 2 processes the Virtual RBC message as other messages received from a RBC.
The virtual RBC message is composed by a header and a payload.
The header is composed by a unique identifier.
Information at least as listed hereafter are used to safely determine if the virtual RBC message is applicable:

balise device identifier (including NID_C), to be compared with last relevant balise group (LRBG);
balise device direction;
railway vehicle orientation;
OBU operating mode(s).

The payload contained in the Virtual RBC message is a standard ERTMS/ETCS message, using the same message and packets structure complying with the ETCS standard specification Subset 026 of the ERTMS/ETCS standard. The virtual RBC message contains information about the railway track that allows generating a predefined "simplified" movement authority when the communication between the OBU and the RBC subsystems is lost.
When a new LRBG is detected or the OBU operating mode or the railway vehicle orientation changes, the respective virtual RBC message from the route map database 20 is processed by the OBU module 2. The message is sent only once, including the case where the mode or the railway vehicle orientation change several times but LRBG remains unchanged.
Figure 4 shows a railway vehicle 100 running on a railway track and controlled with the method according to the present invention. Distance are not relevant to the invention but used as example of application context.
The virtual RBC message can be a Level 2 Movement Authority with mode profile "Limited Supervision" including danger point definition and computation of Release Speed, Static Speed Profile, Level Crossing Information and any other singularity. Therefore, the virtual RBC message comprises in this case at least:

a Movement Authority packet;
a track description composed of track gradient and static speed profile;
a mode profile to force the railway vehicle to run in the "Limited Supervision" mode.

The data packets are configured for most restrictive information (e.g. Level crossing in a non-protected state).
For example, as long as a railway vehicle 100 is running in "Full Supervision" or "On Sight mode" (thus, it is supervised by the RBC module 14 of figure 1), no virtual RBC message is processed, thanks to the message mode filtering (see first zones 102).
In case the radio connection with the RBC module 14 is confirmed lost, the railway vehicle 100 is stopped at point 104 by appropriate reaction (service brake or trip) per se known. The railway driver is then authorized to continue the travel only after explicit authorization from a signaling officer. After the authorization is received, the driver performs the "override" action and the OBU module 2 enters in "Staff Responsible" mode.
If, in this "Staff Responsible" mode, it exists a virtual RBC message memorized and valid for the condition of virtual message injection for the railway vehicle 100, this message is processed by the OBU module 2 and could for instance deliver a movement authority with immediate transition to "Limited Supervision" mode and a full track description up to position 106.
In this situation, the railway driver is still responsible to monitor the track from possible external hazards but his speed and end of authority is supervised by the OBU module 2.This provides significant improvement on safety and operational performances in degraded situation compared to the standard operation in "Staff Responsible" mode. Once the railway driver is in front of the marker board at the end of the movement authority at point 106, a new "override" is needed (after grant received from a signaling officer), but the previous message is not re-processed (each message is processed only once) and the method applies again.
The messages are independent from a punctual location of the railway vehicle position
The protection of route between two stations is not the only possible application of this invention thanks to the flexibility allowed for the ETCS message content.
The solution of the present invention is not against interoperability as it does not prevent railway vehicles not managing the Virtual RBC message to operate on the line. The Virtual RBC message being only known by so fitted trains to provide these with an operational advantage. Railway vehicles not implementing this function will proceed at lower speed in "Staff Responsible" mode in case of unavailability of the wireless telecommunication service.
The OBU module 2 fitted with the virtual RBC message function remains interoperable with lines where there is no RouteMap information.
Clearly, the principle of the invention remaining the same, the embodiments and the details of production can be varied considerably from what has been described and illustrated purely by way of non-limiting example, without departing from the scope of protection of the present invention as defined by the attached claims.

Claims

Method for controlling a railway vehicle running on a railway track in case of disconnection between an on board module OBU (2) controlling the movement of the railway vehicle and a radio block centre module RBC (14) of an ERTMS/ETCS system, the method comprising:
- elaborating a virtual RBC message, comprising a description of the railway track and/or predetermined travel information for the railway vehicle,

- memorizing said virtual RBC message on board of the railway vehicle, and

- in case of detection of disconnection between the on board module OBU (2) and the radio block centre module RBC (14), processing of the virtual RBC message by the on board module OBU (2) to control the railway vehicle movement following said disconnection.
The method according to claim 1, wherein the virtual RBC message is:
- distributed wirelessly to the railway vehicle over a railway network (12) by a server, said virtual RBC message being uniquely identified using an RBC ETCS identifier, or

- sent to the railway vehicle by physical beacons, such as Eurobalises (4), installed along the railway track.
The method according to any one of the previous claims, wherein the elaborating step comprises the elaboration of several virtual RBC messages, each message being associated with a reference position on the railway track and comprising a description of the railway track at the reference position and/or predetermined travel information to be followed by the railway vehicle at the reference position.
The method according to claim 3, wherein the railway vehicle comprises a positioning system configured for determining the position of the railway vehicle on the railway track and wherein the processing step comprising a selecting substep wherein the virtual message associated with the reference position corresponding to the position determined by the positioning system is selected to be processed by the on board module OBU (2).
The method according to claim 1 or 2, wherein each virtual RBC message is stored on board of the railway vehicle in a route map database associating to each virtual RBC message a beacon of the railway track or a group of beacons of the railway track and wherein the processing step comprising a selecting substep wherein the virtual message associated with the last beacon or group of beacons detected by the railway vehicle is selected to be processed by the on board module OBU.
The method according to claim 5, further comprising checking for availability of a new version of route map data and, in positive case, downloading said new version of route map data overwriting any other route map data previously stored in the route map database.
The method according to claim 5, further comprising checking route map data integrity and authenticity using digital signature.
The method according to any of the preceding claims, further comprising:
- detecting (50) absence of message exchanged with the RBC module (14) for more than a time set by the ETCS system parameter;

- in positive case, stopping (52) the railway vehicle;

- performing (54) an "override" process in coordination with a trackside operator, thus allowing the railway vehicle to move again;

- checking (56) if there is an applicable virtual RBC message; and

- performing the processing step of the applicable virtual RBC message.
The method according to claim 8, wherein allowing the railway vehicle to move again comprises moving:
- at a predefined speed in degraded mode; and

- in Staff Responsible mode.
The method according to any of the preceding claims, wherein the virtual RBC message comprises a Movement Authority message including all packets required by the ETCS standards to provide a supervision of the train movement.
System for controlling a railway vehicle running on a railway track in case of disconnection between an on board module OBU (2) controlling the movement of the railway vehicle and a radio block centre module RBC (14) of an ERTMS/ETCS system, the system comprising:
- a module for elaborating a virtual RBC message, comprising a description of the railway track and/or predetermined travel information for the railway vehicle,

- memory means for memorizing said virtual RBC message on board of the railway vehicle, wherein, in case of detection of disconnection between the on board module OBU (2) and the radio block centre module RBC (14), the on board module OBU (2) is arranged for processing the virtual RBC message to control the railway vehicle movement following said disconnection.