Train communication network architecture

Abstract

To provide a communication architecture in which at least one central processing unit arranged in a train carriage is interconnected through a communication network of a train with a plurality of peripheral processing units.SOLUTION: A central processing unit 3 is provided on a single board 7 in a communication architecture 1 of a train. The board 7 includes: a processor 10 designed to process data associated with an SIL 0 safety level; a coprocessor 12 designed to process only data associated with an SIL 1-SIL 2 safety level; an internal bus 14 built on the board 7 and configured to allow a two-way data communication between the processor 10 and the coprocessor 12; an interface 16 for a communication network 5 of the train. The coprocessor 12 is programmed in a reconfigurable manner with a software 18 that allows the validation and encoding of data coming from the processor 10 according to a safety protocol.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] Cross - reference to related applications This patent application claims priority from Italian Patent Application No. 102020000009592, filed on April 30, 2020, the entire disclosure of which is incorporated herein by reference.

[0002] The present invention relates to a communication network architecture for trains.

Background Art

[0003] As is well known, different systems and subsystems of trains are interconnected via a Train Communication Network (TCN) that enables data exchange between these devices.

[0004] Each of the train functions associated with these devices needs to be distinguished by a Safety Integrity Level (SIL) that can vary from 0 (where the associated function is considered not to affect safety) to 4 (the highest level of safety impact).

[0005] The Safety Integrity Level (SIL) is also defined as the level of risk reduction guaranteed by safety instrumentation functions as part of functional safety management in the device industry. The requirements associated with a given SIL can vary according to reference standards. According to IEC61508 and IEC61511 of the International Electrotechnical Commission (IEC), four possible SIL levels are defined, from SIL1 (the lowest reliability), determined qualitatively or by qualitative analysis, to SIL4 (the highest reliability).

[0006] Functions associated with SIL level 0 require normal development, verification, and certification processes, while functions associated with SIL levels 1 - 4 require increasingly cumbersome processes.

[0007] Most of the cost of designing the architecture of the communication network depends on the verification and certification of safety functions.

[0008] For example, European Patent No. 3,388,904 describes a train communication network architecture in which a first processor (CPU I) that processes only data related to a safety level greater than 0 and a first processor (CPU II) that processes only data related to a safety level of 0 are used. In this way, the safety function and the non-secure function are separated. The first processor and the second processor communicate with the host device via an interface that forms an individual channel on the first side. The first processor and the second processor also communicate with a port connected to an individual Ethernet (registered trademark) communication line on the second side, where data with a safety level and data without a safety level are transmitted separately. SUMMARY OF THE INVENTION PROBLEMS TO BE SOLVED BY THE INVENTION

[0009] An object of the present invention is to provide a train communication network architecture that uses an architecture different from and simpler than the architecture of the above patent, thereby reducing the impact on the time and cost of verification work and authentication work for safety functions. MEANS FOR SOLVING THE PROBLEMS

[0010] The above object is achieved by the present invention relating to a train communication network architecture of the type described in claim 1.

[0011] To better understand the present invention, embodiments shown in the accompanying drawings are provided, which represent preferred limiting embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0012]

Figure 1

Figure 2

Figure 3

Figure 4

[0013] Number 1 identifies a train communication network architecture manufactured according to the present invention.

[0014] The architecture includes at least one central processing unit 3 (main board) arranged in a vehicle of the train and interconnected with a plurality of peripheral processing units 6 (I / O collector boards) via a communication network 5 (of a known type) of the train. The communication network 5 extends along vehicles (typically 2 to 12 cars) forming a railway formation (not shown). Each of the peripheral processing units 6 is preferably arranged in each vehicle but is not limited thereto.

[0015] The central processing unit 3 is composed of a single board 7, and the board 7 a processor 10 designed to process data related to the SIL0 safety level, a coprocessor 12 designed to process only data related to the SIL1 - SIL2 safety levels, an internal bus 14 constructed on the board 7 and configured to enable bidirectional data communication between the processor 10 and the coprocessor 12, interface means 16 designed to enable connection between the processor 10 and the external communication network 5 of the train, It is provided with. An external communication network 5 of a known type (e.g., MVB, WTB, Ethernet (registered trademark)) is designed to transmit data related to the SIL0 safety level, and data packets encoded at the SIL1 or SIL2 safety level are transmitted through a "black channel" of a known technique that uses a standard communication channel to also transmit SIL1 or SIL2 data. In the coprocessor (12), a function of executing a safety protocol is applied to the board (7) of the devices (3, 6) at the ends of the "black channel".

[0016] The coprocessor 12 is designed to be reconfigurably programmed by software 18 that can verify and encode data from the processor (10) according to a known safety protocol.

[0017] The coprocessor 12 is also configured to transfer the verified and encoded data to the main processor 10 for later transmission to the external communication network 5.

[0018] The above-described architecture 1 enables separation between data related to the SIL1 - SIL2 safety level and data of the minimum safety level (SLI0 level).

[0019] In this way, the verification and authentication operations of the SIL1 - SIL2 safety functions only require the coprocessor 12. Therefore, the functions of the main processor 10 can be developed according to the rules for the functions required for the SLI0 level. The software installed in the processor 10 should conform to less strict criteria than the software 18 installed in the coprocessor 12. This also applies to updates. Thus, a hybrid solution is obtained where the development, modification, and development maintenance costs of the board 7 are reduced compared to other known applications where all components of the board need to conform to a safety standard equal to the highest of the safety standards present in the functions.

[0020] In the example shown in FIG. 1, the peripheral processing device 6 has the same configuration as that of the central processing device 3 and is on a single board 7, a main processor 10 configured to process data related to zero safety level SIL0, a coprocessor 12-p (safety function coprocessor) configured to process only data related to SIL1 or SIL2 safety levels, an internal bus 14-p configured to enable bidirectional data communication between the processor 10-p and the coprocessor 12-p, an interface 16-p designed to enable connection between the main processor 10-p and the processor 10 via the external communication network 5 of the train, and includes.

[0021] The processor 10 of the central processing device 3, when the processor 10 receives data related to one or two safety levels (SIL1 - SIL2) encoded according to a protocol considered to be safe, this data is configured to be sent to the coprocessor 12 without performing data processing. In this way, the data is only transferred from the processor 10 to the coprocessor 12, and the coprocessor 12 verifies the validity of the received data, processes the safety function, packages the data according to the safety protocol, and sends it to the train communication network 5 via the processor (black channel). In the case of a function processed by the processor 10 that includes a command affecting the safety function, the processor 10 transfers the command data to the coprocessor 12, and the coprocessor 12 verifies the safety of the command data, packages the data according to the safety protocol, and sends it to the train communication network 5 via the processor 10 (black channel).

[0022] When the processor 10 processes a command that only affects the function of the SIL0 safety level, such data is directly verified and processed by the processor 10 before being sent to the train communication network 5 without the need to execute the safety protocol.

[0023] The coprocessor 12 is designed to be reconfigurably programmed by software 18 that can verify and encode data from the processor 10 according to a security protocol. Further, the coprocessor 12 is configured to transfer the verified and encoded data to the processor 10 for later transmission to the train communication network 5.

[0024] As can be seen from the example of FIG. 1, an interface 20 for connection to the input / output device 24 via a local bus 22 of a simple configuration (in particular, BUS-CAN) for bidirectional data exchange between the plurality of input / output devices 24 and the coprocessor 12-p is provided in the coprocessor 12-p of the peripheral device 6.

[0025] Preferably, a sensor designed to detect the quantities and parameters detected in each vehicle, and an interface designed for conversion to a format designed for transmission on the local bus 22 of the (digital / analog) signal of the sensor, are provided in the input / output device 24, but are not limited thereto.

[0026] Further, preferably, an actuator designed to perform operation instructions on the electrical quantities and parameters of each vehicle, and an interface designed to convert the information transmitted on the local bus 22 into the (digital / analog) signal of the actuator, are provided in the input / output device 24, but are not limited thereto.

[0027] According to the modification provided in FIG. 2, the peripheral processing device 6 has the same configuration as the peripheral processing device of FIG. 1.

[0028] In this case, a second interface 26 for connection to a local bus 22 that directly connects the input / output device 24 to the main processor 10-p is provided in the main processor 10-p.

[0029] The main processor 10-p is configured to receive data having a SIL0 safety level and data having SIL1 and SIL2 safety levels from the input / output device 24 via the local bus 22. The data having SIL1 and SIL2 safety levels is transmitted from the processor 10-p to the coprocessor 12-p without performing data processing. In this way, the data is only transferred from the processor 10-p to the coprocessor 12-p, and the coprocessor (12-p) checks the validity of the received data, verifies it, packages the data according to the safety protocol, and transmits it to the train communication network 5 via the processor 10-p.

[0030] Referring to FIG. 3, the peripheral processing device 6 includes, on a single board 7, a main processor 10-p designed to process data related to the zero safety level SIL0, a coprocessor 12-p (safety function coprocessor) designed to process only data related to the SIL1 or SIL2 safety level, a first internal bus 14-p constructed on the board 7 and configured to enable bidirectional data communication between the main processor 10-p and the coprocessor 12-p, a first interface 16-p designed to enable connection between the main processor 10-p and the external communication network 5 of the train, a second interface 27 designed to enable connection between the main processor 10-p and a second internal bus 28, where the second internal bus 28 communicates with the local bus 22 interconnected to a plurality of input / output devices 24, and the second interface 27, is provided.

[0031] A third interface 29 that communicates with the local bus 22 is provided in the coprocessor 12-p for bidirectional data exchange between the input / output device 24 via the local bus 22 and the coprocessor 12-p.

[0032] The coprocessor 12-p is designed to process data related to safety levels (SIL1, SIL2) that are present on the local bus 22 and encoded according to a protocol considered to be safe. After being processed, this data is transferred to the train communication network 5 via the processor 10-p.

[0033] The processor 10-p is designed to process data related to a safety level of 0 (SLI0) that is present on the local bus 22. After being processed, this data is transferred directly to the train communication network 5.

[0034] Referring to the embodiment of FIG. 4, the peripheral processing device 6 is on a single board 7, a single main processor 10-p configured to process data related to the zero safety level SIL0, a first interface 16-p designed to enable connection between the main processor 10-p and the external communication network 5 of the train, and another interface 30 designed to enable connection between the main processor 10-p and the local bus 22. The local bus 22 is interconnected to a plurality of input / output devices 24, and a second interface 26. comprises.

[0035] When the processor 10-p receives data related to the SIL1, SIL2 safety levels from the local bus 22, the processor 10-p is configured such that this data is transferred from the processor 10-p to the train communication network 5 and the central processing unit 3. The invention disclosed in this specification includes the following. [Aspect 1] A communication architecture (1) in which at least one central processing unit (3, main board) arranged in a vehicle of a train is interconnected with a plurality of peripheral processing units (6, I / O collector board) via the communication network (5) of the train, wherein the communication network (5) of the train extends along the vehicles forming a railway formation, and the communication network (5) of the train can transmit both data related to SIL1 and SIL2 safety levels and data having a SIL0 safety level. In the communication architecture (1), a single board (7) is provided in the central processing unit (3), and the board (7) has a processor (10) designed to process data related to the SIL0 safety level, a coprocessor (12) designed to process only data related to SIL1 - SIL2 safety levels, an internal bus (14) constructed on the board (7) and configured to enable bidirectional data communication between the processor (10) and the coprocessor (12), interface means (16) designed to enable connection between the processor (10) and the communication network (5) of the train, and the coprocessor (12) is designed to be reprogrammably programmed by software (18) capable of verifying and encoding data from the processor (10) according to a safety protocol, and the coprocessor (12) is also configured to transfer the verified and encoded data to the processor (10) for later transmission to the communication network (5) of the train. The communication architecture (1). [Aspect 2] The processor (10) When the processor (10) receives data related to SIL1 and SIL2 safety levels encoded according to a protocol considered to be safe, this data is transmitted to the coprocessor (12) without performing data processing, and the data is only transferred from the processor (10) to the coprocessor (12). The coprocessor (12) checks the validity of the received data, verifies it, packages the data according to the safety protocol, and transmits it to the train communication network (5) via the processor (10). In the case of a function processed by the processor (10) that includes a command affecting the safety function, the processor (10) transfers the data of the command to the processor (12), and the processor (12) verifies the safety of the data of the command, packages the data according to the safety protocol, and transmits it to the train communication network (5) via the processor (10, black channel). When the processor (10) processes a command that only affects functions at the SIL0 safety level, this data is directly transmitted to the train communication network (5) without the need for verification by the coprocessor (12) or execution of the safety protocol. The communication network architecture (1) according to Aspect 1, configured as described above. [Aspect 3] The peripheral processing device (6) has a configuration similar to that of the central processing device (3) and is on a single board (7). A main processor (10-p) configured to process data related to the zero safety level SIL0. A coprocessor (12-p) configured to process only data related to the SIL1 or SIL2 safety level. An internal bus (14-p) constructed on the board (7) and configured to enable bidirectional data communication between the main processor (10-p) and the coprocessor (12-p). An interface (16-p) designed to enable connection between the main processor (10-p) and the external communication network (5) of the train. The architecture (1) according to Aspect 1 or 2, comprising the above. [Aspect 4] An interface (20) for connection to a local bus (22) for communicating with an input / output device (24) for bidirectional data exchange between a plurality of input / output devices (24) and the coprocessor (12-p) is provided in the coprocessor (12-p) of the peripheral device (6) in the architecture (1) described in Mode 3. [Mode 5] A sensor designed to detect quantities and parameters detected in each vehicle, and an interface designed for conversion of (digital / analog) signals of the sensor into a format designed for transmission on the local bus (22), are provided in the input / output device (24) in the architecture described in Mode 4. [Mode 6] An actuator designed to perform operation instructions on electrical quantities and parameters of each vehicle, and an interface designed to convert information transmitted on the local bus (22) into (digital / analog) signals of the actuator, are provided in the input / output device (24) in the architecture described in Mode 4 or 5. [Mode 7] The peripheral processing device (6) has a configuration similar to that of the central processing device (3) and includes, on a single board (7), a main processor (10-p) configured to process data related to zero safety level SIL0, a coprocessor (12-p, safety function coprocessor) configured to process only data related to SIL1 or SIL2 safety levels, an internal bus (14-p) constructed on the board (7) and configured to enable bidirectional data communication between the main processor (10-p) and the coprocessor (12-p), a first interface (16-p) designed to enable connection between the main processor (10-p) and the external communication network (5) of the train, a second interface (26) designed to enable connection between the main processor (10-p) and a plurality of input / output devices (24) for bidirectional data exchange, and is provided with the architecture described in Mode 1 or 2. [Mode 8] The main processor (10-p) of the peripheral processing device (6) is configured to receive data having a SIL0 safety level and data having SIL1 and SIL2 safety levels from the input / output device (24) via the local bus (22). The data having SIL1 and SIL2 safety levels is transmitted from the processor (10-p) to the coprocessor (12-p) without performing data processing. This data is only transferred from the processor (10-p) to the coprocessor (12-p). The coprocessor (12-p) checks the validity of the received data, processes the safety function, packages the data according to the safety protocol, and transmits it to the train communication network (5) via the processor (10-p). The architecture according to aspect 7. [Aspect 9] The peripheral processing device (6) is on a single board (7), a main processor (10-p) designed to process data related to the zero safety level SIL0, a coprocessor (12-p, safety function coprocessor) designed to process only data related to the SIL1 or SIL2 safety level, a first internal bus (14-p) constructed on the board (7) and configured to enable bidirectional data communication between the main processor (10-p) and the coprocessor (12-p), a first interface (16-p) designed to enable connection between the main processor (10-p) and the external communication network (5) of the train, a second interface (26) designed to enable connection between the main processor (10-p) and a second internal bus (28), wherein the second internal bus (28) communicates with a local bus (22) interconnected to a plurality of input / output devices (24), a second interface (27), comprising A third interface (29) that communicates with the local bus (22) for bidirectional data exchange between the input / output device (24) and the coprocessor (12-p) via the local bus (22) is provided to the coprocessor (12-p). The architecture according to aspect 1 or 2. [Aspect 10] The coprocessor (12-p) is designed to process data related to safety levels (SIL1, SIL2) that exist on the local bus (22) and are encoded according to a protocol considered to be safe. After processing, this data is transferred via the processor (10-p) to the communication network (5) of the train (5). The processor (10-p) is designed to process data related to the SIL0 safety level that exists on the local bus (22). After processing, this data is directly transferred to the communication network (5) of the train (5). The architecture according to aspect 9. [Aspect 11] The peripheral processing device (6) is on a single board (7). A single main processor (10-p) configured to process data related to the zero safety level SIL0. A first interface (16-p) designed to enable connection between the main processor (10-p) and the external communication network (5) of the train. Another interface (30) designed to enable connection between the main processor (10-p) and the local bus (22), where the local bus (22) is interconnected to a plurality of input / output devices (24), and a second interface (26). The architecture according to aspect 1 or 2, comprising. [Aspect 12] The main processor (10-p). When the processor (10-p) receives data related to the SIL1, SIL2 safety levels from the local bus (22), this data is transferred from the processor (10-p) to the train communication network (5) without performing data processing. The communication network architecture (1) according to aspect 11, configured as such.

Claims

1. A communication architecture (1) in which at least one central processing unit (3, main board) arranged in a vehicle of a train is interconnected with a plurality of peripheral processing units (6, I / O collector board) via the communication network (5) of the train, wherein the communication network (5) of the train extends along the vehicles forming a railway formation, and the communication network (5) of the train can transmit both data related to the SIL1 or SIL2 safety level and data related to the SIL0 safety level. In the communication architecture (1), a single board (7) is provided in the central processing unit (3), and the board (7) has a processor (10) designed to process data related to the SIL0 safety level, a coprocessor (12) designed to process only data related to the SIL1 or SIL2 safety level, an internal bus (14) constructed on the board (7) and configured to enable bidirectional data communication between the processor (10) and the coprocessor (12), interface means (16) designed to enable connection between the processor (10) and the communication network (5) of the train, and has the processor (10) is configured such that when the processor (10) receives data related to the SIL1 or SIL2 safety level encoded according to a safety protocol, this data is transmitted to the coprocessor (12) without performing data processing, the coprocessor (12) is designed to be reprogrammably programmed by software (18) capable of verifying and encoding data from the processor (10) according to a safety protocol, the coprocessor (12) is also configured to verify and encode data from the processor (10) according to a safety protocol and transmit it to the communication network (5) of the train via the processor (10). The communication architecture (1).

2. The processor (10) is ​ When the processor (10) processes a command that only affects the functions at the SIL0 safety level, this data is configured to be directly transmitted to the communication network (5) of the train without requiring verification by the coprocessor (12) or execution of a safety protocol. The communication architecture (1) according to claim 1.

3. The peripheral processing device (6) has a configuration similar to that of the central processing unit (3) and is on a single board (7). A main processor (10-p) configured to process data related to the SIL0 safety level. A coprocessor (12-p) configured to process only data related to the SIL1 or SIL2 safety level. An internal bus (14-p) constructed on the board (7) and configured to enable bidirectional data communication between the main processor (10-p) and the coprocessor (12-p). An interface (16-p) designed to enable connection between the main processor (10-p) and the communication network (5) of the train. Comprising The main processor (10-p) When the main processor (10-p) receives data related to the SIL1 or SIL2 safety level encoded according to a safety protocol, this data is configured to be transmitted to the coprocessor (12-p) without performing data processing. The coprocessor (12-p) is designed to be reprogrammable by software capable of verifying and encoding data from the main processor (10-p) according to a safety protocol. The coprocessor (12-p) is also configured to verify and encode data from the main processor (10-p) according to a safety protocol and transmit it to the communication network (5) of the train via the main processor (10-p). The communication architecture (1) according to claim 1 or 2.

4. An interface (20) for connection to a local bus (22) for communicating with the input / output device (24) for bidirectional data exchange between the plurality of input / output devices (24) and the coprocessor (12-p) is provided in the coprocessor (12-p) of the peripheral processing device (6). The communication architecture (1) according to claim 3.

5. A sensor designed to detect the quantities and parameters detected in each vehicle, and an interface designed for conversion into a format designed for transmission on the local bus (22) of the (digital / analog) signal of the sensor, provided in the input / output device (24), the communication architecture (1) according to claim 4.

6. An actuator designed to perform operation instructions on the electrical quantities and parameters of each vehicle, and an interface designed to convert the information transmitted on the local bus (22) into the (digital / analog) signal of the actuator, provided in the input / output device (24), the communication architecture (1) according to claim 4 or 5.

7. The peripheral processing device (6) has a configuration similar to that of the central processing device (3) and is on a single board (7). A main processor (10-p) configured to process data related to the SIL0 safety level. A coprocessor (12-p, safety function coprocessor) configured to process only data related to the SIL1 or SIL2 safety level. An internal bus (14-p) constructed on the board (7) and configured to enable bidirectional data communication between the main processor (10-p) and the coprocessor (12-p). A first interface (16-p) designed to enable connection between the main processor (10-p) and the communication network (5) of the train. A second interface (26) designed to enable connection between the main processor (10-p) and a plurality of input / output devices (24) for bidirectional data exchange. Comprising The main processor (10-p) When the main processor (10-p) receives data related to the SIL1 or SIL2 safety level encoded according to a safety protocol, this data is configured to be transmitted to the coprocessor (12-p) without performing data processing. The coprocessor (12-p) is designed to be reprogrammably programmed by software capable of verifying and encoding data from the main processor (10-p) according to a safety protocol. The coprocessor (12-p) is also configured to verify and encode data from the main processor (10-p) according to a security protocol and transmit it to the communication network (5) of the train via the main processor (10-p). The communication architecture (1) according to claim 1 or 2.

8. The main processor (10-p) receives data related to the SIL0 safety level and data related to the SIL1 or SIL2 safety level from the input / output device (24) via a local bus (22) that communicates with the input / output device (24) for bidirectional data exchange between the input / output device (24) and the coprocessor (12-p). The communication architecture (1) according to claim 7.

9. The peripheral processing device (6) is on a single board (7), a main processor (10-p) designed to process data related to the SIL0 safety level, a coprocessor (12-p, safety function coprocessor) designed to process only data related to the SIL1 or SIL2 safety level, a first internal bus (14-p) constructed on the board (7) and configured to enable bidirectional data communication between the main processor (10-p) and the coprocessor (12-p), a first interface (16-p) designed to enable connection between the main processor (10-p) and the communication network (5) of the train, a second interface (26) designed to enable connection between the main processor (10-p) and a second internal bus (28), where the second internal bus (28) communicates with a local bus (22) interconnected to a plurality of input / output devices (24), and a second interface (27), comprising A third interface (29) that communicates with the local bus (22) for bidirectional data exchange between the input / output device (24) and the coprocessor (12-p) via the local bus (22) is provided to the coprocessor (12-p). The main processor (10-p) is When the main processor (10-p) receives data related to the SIL1 or SIL2 safety level encoded according to the safety protocol, this data is configured to be transmitted to the coprocessor (12-p) without performing data processing. The coprocessor (12-p) is designed to be reprogrammable by software capable of verifying and encoding data from the main processor (10-p) according to the safety protocol. The communication architecture (1) according to claim 1 or 2, wherein the coprocessor (12-p) is also configured to verify and encode data from the main processor (10-p) according to the safety protocol and transmit it to the communication network (5) of the train via the main processor (10-p).

10. The peripheral processing device (6) is on a single board (7). A single main processor (10-p) configured to process data related to the SIL0 safety level. A first interface (16-p) designed to enable connection between the main processor (10-p) and the communication network (5) of the train. Another interface (30) designed to enable connection between the main processor (10-p) and the local bus (22), wherein the local bus (22) is interconnected with a plurality of input / output devices (24), and another interface (26). Comprising. The main processor (10-p) is. The communication architecture (1) according to claim 1 or 2, wherein when the main processor (10-p) receives data related to the SIL1 or SIL2 safety level from the local bus (22), this data is configured to be transferred from the main processor (10-p) to the communication network (5) of the train without performing data processing.

Images