R H I N O S Railway High Integrity Navigation Overlay System. RHINOS On Board Subsystem Reference Architecture

Transcription

1 R H I N O S Railway High Integrity Navigation Overlay System RHINOS On Board Subsystem Reference Architecture Salvatore Sabina (salvatore.sabina@ansaldo-sts.com, Ansaldo STS) - Rome, June 20th 22nd 2017

2 Outline ERTMS based on Virtual Balises: Architecture Requirements Safety Analysis Design Considerations Conclusions

3 ERTMS Based on Virtual Balises: Architecture To reduce the modifications to the existing ERTMS Standard, the identified solution preserves the existing ERTMS mechanisms to determine the Train Position, i.e. Balises and the related Functions associated with balises. Some physical balises can be replaced by virtual balises. Balise Transmission Module Functions Virtual Balise Reader Functions ETCS On-Board Functions / kernel ETCS On-Board

4 ERTMS Based on Virtual Balises: Architecture

5 ERTMS Based on Virtual Balises: Requirements Description of Other Requirements Response time - The delay between receiving of a balise message and applying the command requested in the balise message or the reaction associated with balise group must be less than 1 s. Management of Faults and Failures - If the On-board Transmission Equipment is not able to detect Balises, this condition must be reported to the ERTMS/ETCS Kernel. Schedule Adherence is the ability of a railway system of complying with the schedule of train running. A train is considered delayed when its delay exceed 1 min. The probability of having delay caused by ERTMS/ETCS failures must not be greater than The allowed average delay per train due to ERTMS/ETCS failures, at the end of an average trip of duration of 90 min., must not be greater than 10 minutes. ERTMS/ETCS Operational Availability Due to all the causes of failure, A 0 < Due to hardware failures and transmission errors, A 0 < Downtime, expressed in hours per year, is equal to (1- A 0 )*8760

6 ERTMS Based on Virtual Balises: Requirements Description of Other Requirements (cont.) Immobilising Failure A Hardware Failure which causes the system to be unable to safely control two or more trains: this is, a failure that causes two or more trains to be switched in on sight mode. MTBF-I ONB < 2.7*10 6 hours MTBF-I TRK < 3.5*10 8 hours. Service Failure - In the ERTMS/ETCS context, Service Failures can be identified as all the ERTMS/ETCS hardware failures which cause the nominal performance of one or more trains to be reduced and/or at most one train to be switched in on sight mode MTBF-S ONB < 3.0*10 5 hours MTBF-S TRK < 4.0*10 7 hours. A Minor Failure is a failure which results in excessive unscheduled maintenance and cannot be classified as Immobilising or Service Failure. MTBF-M ONB < 8.0*10 3 hours MTBF-M TRK < 1.0*10 5 hours.

7 ERTMS Based on Virtual Balises: Safety Analysis THR Onboard = 0.67*10-9 /h Onboard functions: ( trusted parts): 0.67*10-9 /h Onboard Kernel, ODO, TI, DMI, BTM, Onboard EUR, LTM 1.0*10-9 /h Onboard equipment THR Transmission = 0.67*10-9 /h THR Trackside = 0.67*10-9 /h Transmission functions: ( non-trusted parts): Trackside functions: ( trusted parts): 0.33*10-9 /h 0.33*10-9 /h 0.67*10-9 /h BTM, Onboard EUR, LTM EUB, Loop, Trackside EUR RBC Kernel, LEU, Trackside EUR 1.0*10-9 /h Trackside equipment

8 ERTMS Based on Virtual Balises: Safety Analysis The ETCS Hazardous Events associated with such transmission systems are: TRANS-BALISE 1 (Corruption); TRANS-BALISE 2 (Deletion); TRANS-BALISE 3 (Insertion); TRANS-OB/RADIO-1 (Corruption); TRANS-OB/RADIO-2 (Deletion); TRANS-OB/RADIO-3 (Insertion); TRANS-TS/RADIO-1 (Corruption); TRANS-TS/RADIO-2 (Deletion); TRANS-TS/RADIO-3 (Insertion);

9 ERTMS Based on Virtual Balises: Safety Analysis ETCS CORE HAZARD, THR=2.0*10-9 / h Transmission Hazards, THR Transmission =0.67*10-9 / h On-board Hazards, THR Onboard =0.67*10-9 / h Trackside Hazards, THR Trackside =0.67*10-9 / h Eurobalise Transmission System Hazard, THR BTX Radio Transmission System Hazard, THR RTX negligible Corruption Insertion Deletion

10 ERTMS Based on Virtual Balises: Safety Analysis Based on the Standard Reference Mission Profile and on the following assumptions: No Cold Movement Detector; A balise group, which contains information that if it is missed could lead to a hazardous consequence, consists of a minimum of two balises. When reliance is placed on the detection of unlinked balise groups for the announcement of Temporary Speed Restrictions, it is required that two separate balise groups are used each with a minimum of two balises. In addition, the analysis has assumed that TSRs will be set by RBC only.

11 ERTMS Based on Virtual Balises: Safety Analysis THR TRANS-BALISE-2 R NoLinking = (2 * 0,001) * (24l IP + l ONB ) 3.3 * h -1 = 2*10-3 * (24l IP + l ONB ) 1.6 * 10-7 h -1 = (24l IP + l ONB ) R NoLinking = (1.6 * 1) * (24l IP l ONB ) 3.3 * h -1 = 1.6 * (24l IP l ONB ) 2 * h -1 = (24l IP l ONB ) R NoLinking = (2 * 0.001) * (24l IP + l ONB ) 3.3 * h -1 = 2*10-3 * (24l IP + l ONB ) Operational Considerations Operational moves prior to the establishment of linking Non-linked balise groups in a generally linked network Moves which negate linking Note The scenario about the entry into an ETCS area from an unfitted area assumes that unfitted area has no ATP. This is a very conservative scenario. The worst case is for conventional lines. This high demanding THR can be avoided in Level 2 by managing TSRs via RBC only. 1,6 * 10-7 h -1 = (24l IP + l ONB )

12 ERTMS Based on Virtual Balises: Safety Analysis Main Conclusions RBC Additional Functional Block Virtual Balise Reader Functional Block Target for RBC Confirms Incorrect Along-Track Position of Train The THR for confirmation of the Along-Track Position of the Train is: THR = 0.5 * 10-9 dangerous failures per hour Target for RBC Confirms Incorrect Track The THR for confirmation of the track by the RBC is: THR = 0.5 * 10-9 dangerous failures per hour Target for Virtual Balise Group Detected at Erroneous Location The overall THR for virtual balise group detected at erroneous location (unbounded along-track positioning error) is: THR = 0.5 * 10-9 dangerous failures per hour

13 Virtual Balise Reader: Design Considerations Virtual Balise Reader ODO Info GNSS Antenna GNSS RX GNSS Algo Railways RAIM Application SW & FSM Virtual Balise Detection LDS Mng Augmentation Integrity Balise Telegram (user Bits) & ERTMS/ETC S (EVC, Odometry, Radio Mng) On Board Constituent

14 Virtual Balise Reader: Design Considerations GNSS Algo, Railways RAIM and Virtual Balise Detection must be implemented on a CENELEC Safe Platform; A smart and efficient VBD implementation leads to the deletion of some conservative assumptions as well as the reduction of the probability of BTM-H1 (on-board deletion); The use of the Cold Movement Detector leads to the reduction of the number of SoMs with Position Unknown or Invalid; Some Trackside information about the train path available on-board leads to the reduction of the probability of cross-talk hazardous events; Smart and Effective Railways RAIM & Odometry Cross Checks allows the detection & exclusion of wrong GNSS PVT.

15 Conclusions The development of the new functional blocks (i.e. Virtual Balises Reader on On-Board, Augmentation and Position Verification on RBC) based on CMD, Advanced Railway RAIM, Odometry Cross Checks, Trackside Signaling information can relax THRs associated with GNSS; Track Discrimination is still a critical feature that requires the support of other signaling technologies; Virtual Balise Reader (inclusive of GNSS Algo and Advanced Railway RAIM) must be implemented on a CENELEC Safe Platform.