Axle counter decommissioning system

Abstract

One aspect of the present invention relates to a decommissioning system for decommissioning one or more track sections in a railway network. A decommissioning system may be understood as a system designed to interface with railway signalling systems to simulate track occupancy, thereby preventing train movements in designated sections for safety purposes. The purpose of such systems is to enable maintenance or other work on or around tracks without compromising safety or disrupting broader railway operations.

Description

TECHNICAL FIELD

[0001] The present invention generally relates to the field of railway safety systems, and more particularly to the field of interface devices for axle counter systems enabling remote-controlled decommissioning of railway track sections.BACKGROUND OF THE INVENTION

[0002] Railway safety is of utmost importance in the operation and maintenance of rail networks worldwide. Ensuring the safety of trackworkers and maintenance personnel working in and around railway tracks is a critical aspect of railway operations. A key challenge lies in maintaining high safety standards while minimizing disruptions to regular train schedules. This requires advanced systems that can secure work zones effectively while preserving the efficiency of railway operations.

[0003] To create a safe working environment for trackworkers, sections of track are often taken out of service during maintenance or repair work. This process involves simulating the presence of a train in a designated section, causing the section to be marked as occupied, thereby preventing other trains from entering. Current technologies employed for this purpose include Track Circuit Operating Devices, such as the ZKL 3000 RC, which can simulate train presence by activating the track circuit remotely. These devices rely on smartphone or tablet applications, allowing for remote control and eliminating the need for workers to physically access the track area.

[0004] Axle counter systems are another widely used technology for train detection. These systems detect the presence and movement of trains by counting axles entering and exiting a defined track section. By manipulating axle counter sensors, railway operators can simulate train presence to set a section as occupied, creating a safe working zone. Axle counter systems are advantageous because they can operate in challenging environments, such as tunnels and electrified railways, where traditional track circuits might fail.

[0005] Despite their effectiveness, both technologies have limitations. Track Circuit Operating Devices like the ZKL 3000 RC are only compatible with track circuit systems, limiting their use to isolated track sections or tracks equipped with insulated block joints or similar setups. Their reliance on specific track configurations restricts their versatility.

[0006] Axle counter systems, while versatile and effective, require manual intervention for resetting after maintenance work. This process can lead to operational delays and introduces safety risks associated with human error.

[0007] Moreover, axle counter systems can result in safety risks when in a section the presence of a train is simulated to set a section as occupied, as in such situations in practice a vehicle such as a maintenance train or a mobile crane running on the track section, which enters or leaves the section and passes an axle counter sensor, may influence the axle counter to such extent that the system may consider all trains to have left the section, and removes the occupation signal, setting the section to “free”, even though the maintenance has not ended and / or vehicles are still present in the section.

[0008] In addition to these limitations, axle counter systems, when used to simulate track occupancy, may introduce safety risks when put back into regular service without actual and accurate knowledge of the potential presence of a train in the section since existing methods require altering or resetting the counter state entirely, which may lead to discrepancies in train detection once the maintenance is complete. This flaw in the axle counter's operational integrity further complicates safety and efficiency before, during and after maintenance operations.

[0009] It is therefore a goal of the present invention to provide an improved system that seamlessly integrates with or at least requires minimal modification to existing axle counter systems to enable remote-controlled decommissioning of track sections while minimizing track downtime and reducing safety hazards. As such, it is a goal to overcome the above-mentioned disadvantages of the prior art at least in part, ensuring a safer, more efficient, and cost-effective solution for railway maintenance operations.SUMMARY

[0010] One aspect of the present invention relates to a decommissioning system for decommissioning one or more track sections in a railway network.

[0011] A decommissioning system (210) for decommissioning one or more track sections (110) in a railway network during a decommissioning period, comprising:

[0012] a communication interface (211), configured to connect to a control panel (130) of an axle counter system and operatively transmit signals to the control panel;

[0013] a signal generation unit (212), configured to generate a decommissioning signal indicative of a simulated track occupation (151'), overriding the current track occupancy status communicated by the axle counter system to an interlocking system (140) while maintaining the simulated track occupation status throughout the decommissioning period;

[0014] an activation control unit (213), operatively connected to the signal generation unit, configured to receive control instructions remotely (220) via a secure communication protocol and to activate the signal generation unit in response to the received instructions;

[0015] a power management unit (214), configured to supply power to the decommissioning system and ensure uninterrupted operation during the generation and transmission of the decommissioning signal;

[0016] wherein the decommissioning system (210) is configured to temporarily override the track occupancy status of the axle counter system with the simulated track occupation and ensure that the simulated track occupation is maintained during maintenance operations for safety purposes.

[0017] A decommissioning system may be understood as a system or device designed to interface with existing railway signalling infrastructure to temporarily modify the operational state of a railway track section. Its purpose is to simulate a condition of track occupancy, ensuring that trains are prevented from entering a designated track section for safety purposes during maintenance or other operational needs. This system achieves its functionality by integrating with axle counter systems and interlocking systems to ensure compatibility with existing infrastructure.

[0018] A communication interface may be understood as a physical or logical connection enabling the exchange of data or signals between the decommissioning system and the control panel of an axle counter system. This interface may include standard or proprietary communication protocols, such as Ethernet-based protocols conforming to EN 50159 for safety-critical applications. The communication interface may be configured to implement a communication protocol for safety-critical systems, especially configured to ensure reliable and deterministic data exchange in environments where faults, delays, or external threats may compromise system functionality. Such protocols may incorporate mechanisms for error detection, data integrity, and real-time operation, making them particularly suitable for railway systems such as train decommissioning systems, signalling systems, and other safety-critical subsystems. The communication interface may comply to a protocols designed to conform to EN 50159, which defines requirements for communication in safety-related railway applications. They are applicable to one or both of closed networks (Class 1), where communication is restricted to trusted devices, and open networks (Class 2), where additional security measures such as encryption and authentication are necessary to ensure robust performance.

[0019] The safety-conforming protocols may be implemented using specific families of industrial communication standards, each having specific safety features. Examples include PROFINET Safety, Safety over EtherCAT, CANopen Safety, and Safe Ethernet, all of which share common technical features to ensure compliance with EN 50159. For example, PROFINET Safety, an extension of the PROFINET protocol, employs error detection codes to ensure data integrity, and supports safety integrity levels (SIL) up to SIL 3 as defined in IEC 61508. Safety over EtherCAT (FSoE) is another protocol designed for high-speed, deterministic communication in industrial automation, adapted for railway systems. It conforms to EN 50159 by incorporating fail-safe mechanisms such as watchdog timers and data validation to detect and respond to communication errors. Its real-time data exchange capabilities, with cycle times below 1 ms, ensure timely responses in critical systems such as braking and train deceleration mechanisms. Furthermore, FSoE employs encryption and authentication to secure communication in open networks, making it particularly suitable for train decommissioning systems where precise and safe control of hazardous equipment is required. Similarly, CANopen Safety is a safety-enhanced version of the CANopen protocol, widely used in train subsystems. It meets EN 50159 requirements through redundant data transmission to mitigate the risk of data corruption, unique message identifiers for precise targeting of safety-critical devices in complex networks, and compliance with SIL levels up to SIL 3. This makes it highly effective in applications such as train signaling systems, where reliable communication between interlocking systems and trackside equipment is essential. Another example is Safe Ethernet, which extends the standard Ethernet protocol for use in safety-critical environments. It satisfies EN 50159 requirements by incorporating time synchronization mechanisms to ensure consistent data across all nodes in the network, error correction codes for data integrity verification in environments prone to electromagnetic interference, and secure bootstrapping and key management to prevent unauthorized access in open network environments. Safe Ethernet is particularly useful in train decommissioning systems requiring high-speed communication and strong fault tolerance, such as automated disassembly equipment. The communication interface may be implemented as a wired connection, a wireless communication link, or a combination thereof, and may support bidirectional communication to facilitate feedback and monitoring of system status.

[0020] A signal generation unit may be understood as a device or subsystem configured to create and transmit a decommissioning signal that simulates track occupancy by overriding the current axle count status stored in the control panel of the axle counter system. The decommissioning signal may be generated using the type of interlocking compatible signals, programmable logic controllers (PLCs) or similar digital control devices, which dynamically adjust the parameters of the signal based on predefined criteria. The signal generation unit may also incorporate features such as filtering circuits to suppress electrical noise and ensure accurate signal transmission.

[0021] A simulated track occupation may be understood as the artificial representation of a train's presence in a track section, achieved by transmitting a decommissioning signal to the axle counter system. This simulated condition causes the interlocking system to perceive the track section as occupied, thereby preventing train movements into the section. Importantly, the simulation does not alter the actual recorded state of the axle counter system, preserving the integrity of the axle count for subsequent operations.

[0022] An activation control unit may be understood as a component or module that receives control instructions, typically transmitted from a remote server or operator terminal, via a secure communication protocol. The activation control unit processes these instructions and triggers the operation of the signal generation unit. It may also include mechanisms for manual override, allowing operators to directly activate or deactivate the system as needed, and may support multiple communication protocols for compatibility with diverse railway infrastructure.

[0023] A power management unit may be understood as a subsystem responsible for delivering reliable and uninterrupted electrical power to the components of the decommissioning system. This unit may include redundant power supplies with automatic switchover capabilities to ensure continuous operation during power outages or fluctuations. It may also incorporate energy storage elements, such as batteries or capacitors, to provide backup power and maintain system functionality in critical environments.

[0024] An axle counter system may be understood as a railway safety system used to detect and record the presence and movement of train axles entering and exiting a designated track section. It typically consists of axle counters, which are sensors installed at the boundaries of the track section, and a control panel, often referred to as an evaluation unit, which processes the signals from the axle counters to determine the occupancy status of the section. Axle counter systems are particularly advantageous in challenging environments such as tunnels, steel bridges, and electrified tracks.

[0025] An interlocking system may be understood as a safety-critical railway system that coordinates and controls the movement of trains to prevent conflicts and ensure operational safety. Interlocking systems are responsible for managing signals, points (switches), and derails in a manner that prevents conflicting train movements. These systems may be implemented in various forms, including mechanical interlocking, which uses physical levers and linkages; PLC type interlocking, relay-based interlocking, which employs electrical relays to establish logical conditions; solid-state interlocking (SSI), which uses microprocessors and digital logic; and computer-based interlocking (CBI), which relies on advanced software algorithms for highly scalable and efficient operation. Interlocking systems may also include hybrid configurations that combine elements of these technologies. Regardless of the implementation, interlocking systems enforce safety protocols by ensuring that signals, points, and other trackside apparatus operate in a coordinated sequence. For example, a signal will not display a proceed aspect unless the associated points are correctly set and locked for the intended route. Interlocking systems may also include provisions for fail-safe operations, ensuring safety in the event of component failure. These systems are essential for maintaining the safe and efficient movement of trains across railway networks.

[0026] Overall, the decommissioning system integrates with axle counter and interlocking systems through its communication interface, signal generation unit, activation control unit, and power management unit, enabling the temporary override of track occupancy status. This functionality ensures the safety of track sections during maintenance while preserving the operational integrity and reliability of the underlying railway systems.

[0027] A decommissioning system may thus be understood as a system designed to interface with railway signalling systems to simulate track occupancy, thereby preventing train movements in designated sections for safety purposes. The purpose of such systems is to enable maintenance or other work on or around tracks without compromising safety or disrupting broader railway operations.

[0028] The system comprises a communication interface configured to connect to a control panel of an axle counter system and operatively transmit signals to the control panel. A communication interface may be understood as a physical or logical connection enabling the exchange of data between two systems. This arrangement enables the decommissioning system to interact with the axle counter system without requiring direct modification of the interlocking system. An effect of this configuration is improved retrofit compatibility, allowing deployment in existing railway networks without extensive infrastructure changes. By interfacing at the control panel level, this system reduces the complexity associated with regulatory approvals and integration processes required for direct interlocking interfaces.

[0029] The system further comprises a signal generation unit configured to generate a decommissioning signal indicative of a simulated track occupation, overriding the track occupancy status communicated by the axle counter system to an interlocking system while maintaining the simulated track occupation status throughout the decommissioning period. A signal generation unit may be understood as a device or component that creates an electronic or digital signal representing specific information—in this case, a simulated track occupation. An effect of this arrangement is that the axle counter system may remain fully operational and independent of the override during the decommissioning period. After the decommissioning signal is removed, a reset of the axle counter system may restore the system to its normal operations. This reset may be performed remotely through the system, reducing the need for field personnel and minimizing dependency on third parties. By allowing the decommissioning process to be fully managed by the responsible operator, the system enhances control and mitigates risks. Additionally, this approach prevents or reduces potential errors that might arise from resetting due to operational activity, such as interference from maintenance vehicles within the decommissioned area, thereby improving safety and operational reliability.

[0030] The system includes an activation control unit operatively connected to the signal generation unit, configured to remotely receive control instructions via a secure communication protocol and to activate the signal generation unit in response to the received instructions. An activation control unit may be understood as a module or device responsible for managing and executing commands to operate the system's components. An effect of this arrangement is the ability to remotely operate the decommissioning system, minimizing the need for personnel to physically interact with trackside equipment. This enhances safety by reducing exposure to hazardous environments and improves operational efficiency by enabling rapid response and configuration changes.

[0031] The system further includes a power management unit configured to supply power to the decommissioning system and ensure uninterrupted operation during signal transmission. A power management unit may be understood as a system or component that manages the delivery, regulation, and redundancy of electrical power to ensure continuous functionality. An effect of this arrangement is increased reliability of the decommissioning system, particularly in environments prone to power interruptions. By maintaining uninterrupted operation, the system guarantees consistent performance during critical safety operations.

[0032] Additionally, the system may comprise a mounting structure configured to physically attach the system to the existing axle counter equipment without requiring replacement or modification of the axle counter system. A mounting structure may be understood as a mechanical framework or component designed to secure equipment in place. An effect of this arrangement is the preservation of existing axle counter systems, minimizing installation time and costs while ensuring compatibility with diverse railway infrastructures. This design also allows for simplified maintenance and servicing by providing a non-invasive attachment mechanism.

[0033] The decommissioning system is configured to temporarily override the track occupancy status of the axle counter system with the simulated track occupation and ensure that the simulated track occupation is maintained during maintenance operations for safety purposes. An effect of this configuration is the reliable and efficient establishment of a secure working zone for track maintenance personnel. By transmitting and maintain an overridden track occupancy status, the system guarantees that no train movements are allowed in the designated section, thereby mitigating risks and ensuring compliance with safety protocols. This temporary override mechanism enhances the utility of axle counter systems in maintenance operations without necessitating fundamental changes to their functionality or data structures.

[0034] The decommissioning system may employ various technical mechanisms to ensure reliable overriding and maintenance of the simulated track occupation during the decommissioning period. While the current status of the axle counter system prior to maintenance may be stored in the control panel and may be copied into a memory of the decommissioning system such that it can be reinstate once the maintenance period has completed, this step is not essential to the operation of the decommissioning system. Upon completion of the maintenance period, the axle counter system may be reset to a known operational state, rendering the storage of the pre-maintenance status unnecessary, or more preferably to a “zero state” in which the control panel interprets the status as if no train is present in the section. This approach may simplify the system design and avoid discrepancies that could arise from potential changes to the system's state during maintenance.

[0035] The maintenance of the simulated track occupation status may be achieved by generating a continuous series of pulses indicative of train detection by the axle counter sensors. These pulses may be configured to replicate the timing, frequency, and amplitude characteristics of genuine axle counter signals, thereby ensuring compatibility with the control panel. This continuous signal may maintain the perception of track occupation by the interlocking system, preventing any inadvertent clearing of the occupied status during the maintenance period.

[0036] Alternatively, the signal generation unit may include a programmable logic controller (PLC) configured to manage the simulated track occupation signal dynamically. The PLC may periodically transmit signals or updates to the control panel, ensuring that the simulated status remains consistent throughout the decommissioning period. The PLC may also allow for real-time adjustments to signal parameters based on predefined criteria or feedback received from the control panel, enabling greater flexibility in operation.

[0037] In some embodiments, the system may include a redundant power supply within the power management unit to ensure uninterrupted operation during the transmission of the decommissioning signal. This redundancy may be particularly beneficial in environments where power stability cannot be guaranteed, as it would prevent interruptions that could compromise the simulated status.

[0038] Additionally, the decommissioning system may integrate a diagnostic interface configured to continuously monitor the status of the decommissioning signal. The diagnostic interface may provide real-time alerts or status updates, allowing operators to identify and resolve anomalies promptly. In certain embodiments, the system may also include a fail-safe mechanism configured to default the control panel to a safe occupied status in the event of a disruption to the simulated signal, thereby maintaining safety even under adverse conditions.

[0039] The decommissioning system and in particular the signal generation unit, may include a fail-safe mechanism configured to ensure safety in the event of a system failure or disruption in the simulated track occupation signal. This fail-safe mechanism may automatically default the control panel of the axle counter system to a continuously occupied status, regardless of the simulated signal, thereby preventing any unintended clearing of the track section by the interlocking system. Such a mechanism may involve monitoring circuits within the signal generation unit that detect interruptions or anomalies in signal transmission and immediately trigger the fallback state. This implementation may enhance reliability and ensure that the designated track section remains safely isolated during maintenance, even under adverse conditions.

[0040] In an example, the signal generation unit is further configured to set the track occupancy status to return to a non-occupied state. It may be provided that the signal generation unit generates a reset signal that communicates directly with the control panel of the axle counter system, wherein this reset signal overrides any previous simulated track occupation and ensures that the track occupancy status reflects the absence of any train or simulated presence in the section. An effect of this feature is the restoration of the control panel to its default operational state without requiring manual intervention or recalibration, minimizing the risk of errors associated with post-maintenance operations. By enabling automated reset capabilities, this feature may enhance the efficiency and reliability of transitioning back to regular railway operations, conserving both processing resources and human effort.

[0041] In an example, the non-occupied state is obtained by a reset mechanism configured to transmit a reset signal to the control panel of the axle counter system, wherein the reset signal is configured to set the track occupancy status to the non-occupied state. It may be provided that the reset mechanism incorporates a secure communication protocol to ensure the reset signal is accurately delivered and authenticated by the control panel. An effect of this feature is the prevention of unauthorized or erroneous resets, which could otherwise compromise operational safety. The reset mechanism may also support diverse signal configurations, such as single commands, sequences of commands, or continuous signals, allowing for flexibility in implementation across various axle counter systems. By adapting to the specific requirements of different systems, this feature may improve interoperability and scalability, ensuring compatibility with a wide range of railway infrastructure without compromising reliability or safety.

[0042] Another aspect of the present disclosure relates to a method for operating a decommissioning system for decommissioning one or more track sections in a railway network. A method for operating a decommissioning system may be understood as a series of steps or procedures performed by or within a system to achieve the temporary decommissioning of track sections, ensuring safe conditions for maintenance activities while maintaining operational reliability.

[0043] The method comprises connecting a communication interface of the decommissioning system to a control panel of an axle counter system. A communication interface may be understood as a conduit for transmitting data or signals between components or systems, establishing a link that allows operational instructions and outputs to be exchanged. This step establishes compatibility between the decommissioning system and the axle counter system, ensuring that the system can interact with the axle counter's control mechanisms. An effect of this step is enabling a seamless integration of the decommissioning system into existing railway infrastructure, eliminating the need for direct modifications to the interlocking system.

[0044] The method further comprises receiving remote control instructions at an activation control unit of the decommissioning system via a secure communication protocol. An activation control unit may be understood as a component that processes incoming operational commands and triggers system responses. Secure communication protocols ensure the integrity and confidentiality of transmitted data, preventing unauthorized access or tampering. An effect of this step is enabling precise remote operation of the decommissioning system, reducing the need for personnel to interact physically with trackside equipment and enhancing overall safety.

[0045] The method includes activating a signal generation unit in response to the received instructions. A signal generation unit may be understood as a component that creates output signals based on predefined parameters or received commands. This activation step ensures that the system responds promptly to operational requirements. An effect of this step is the reliable initiation of the decommissioning process, allowing maintenance operations to proceed without unnecessary delays.

[0046] The method also comprises generating a decommissioning signal by the signal generation unit, the decommissioning signal simulating a track occupation to override the current axle count status without altering the actual stored state of the axle counter. A decommissioning signal may be understood as an electronic or digital representation used to modify the perceived state of a track section. This arrangement ensures that the original axle count state is preserved, avoiding disruptions in operational integrity. An effect of this step is that the axle counter can seamlessly transition back to normal operations following maintenance, minimizing potential discrepancies or recalibration needs.

[0047] The method further comprises transmitting the decommissioning signal to the control panel of the axle counter system via the communication interface. Transmitting the signal through the communication interface ensures that the signal reaches its intended destination efficiently and accurately. An effect of this step is enabling the axle counter system to convey an overridden track occupancy status to the interlocking system, providing immediate protection to the designated maintenance zone.

[0048] The method concludes with temporarily overriding the track occupancy status communicated by the axle counter system to an interlocking system, ensuring the track section is considered occupied during maintenance. Temporarily overriding the occupancy status creates a safe and secure work environment by preventing unauthorized train movements within the section. An effect of this step is ensuring high safety standards during maintenance operations while allowing the axle counter system to revert to its original operational mode once maintenance is complete. This temporary override mechanism enhances the applicability of axle counter systems for maintenance purposes, extending their utility without requiring fundamental changes to their design or function.

[0049] The proposed system and method address longstanding challenges associated with decommissioning track sections for maintenance while leveraging the strengths of axle counter systems. By focusing on efficient integration, operational reliability, and safety, the system provides practical solutions to issues that persist in current technologies.

[0050] Conventional axle counter manipulation methods often involve direct modifications to the interlocking system or significant reconfiguration of axle counter components. These approaches introduce regulatory complexities, increase costs, and lengthen deployment timelines. The proposed system integrates seamlessly with the control panel of the axle counter, leaving the interlocking system unaltered. This integration enables rapid retrofitting in diverse railway networks without disrupting existing signaling configurations. The use of a mounting structure ensures physical compatibility with standard axle counter equipment, avoiding the need for custom infrastructure modifications. This arrangement results in a scalable solution that balances technical sophistication with ease of deployment.

[0051] Track safety during maintenance is of critical importance, particularly in environments where human error or technical malfunctions can have severe consequences. The proposed system enhances safety by preserving the original operational state of the axle counter while temporarily overriding its status to simulate track occupancy. This avoids the need for manual resetting of counters, a process prone to errors that could compromise safety. Additionally, the remote activation capability reduces the need for personnel to access hazardous track areas, minimizing exposure to potential risks. This configuration ensures that maintenance zones are effectively isolated from train movements, aligning with high safety standards in railway operations.

[0052] Reliability is a crucial requirement for railway systems, where downtime or inaccuracies can lead to cascading operational delays. Traditional methods for simulating track occupancy in axle counter systems often result in inconsistencies when resetting or recalibrating the counter after maintenance. The proposed system may operate in parallel with the conventional axle counter functionality without modifying or overriding the core detection capabilities of the axle counters. By maintaining the axle counters'ability to detect and record axle movements independently during maintenance, the system ensures that the safety of normal operations is not contingent upon the decommissioning system. This approach eliminates discrepancies in train detection following maintenance activities while preserving the operational integrity of the axle counters. Furthermore, the inclusion of a power management unit further enhances reliability by providing uninterrupted functionality, even in areas with unstable power supply.

[0053] Systems such as the ZKL 3000 RC and RSS 3000 demonstrate the effectiveness of track decommissioning technologies in specific contexts but exhibit inherent limitations. The ZKL 3000 RC is constrained to tracks equipped with insulated block joints and track circuit systems, excluding large portions of modern rail networks that rely on axle counters. The RSS 3000, while capable of simulating occupancy, interfaces directly with the interlocking system, introducing regulatory and integration challenges. The proposed system circumvents these issues by interfacing at the axle counter level, enabling broader applicability across diverse rail infrastructures while maintaining regulatory simplicity. This adaptability ensures compatibility with a wider range of operational scenarios and signalling configurations.

[0054] The ability to remotely activate the system using secure communication protocols significantly reduces track downtime during maintenance operations. Conventional methods often require manual interventions that delay the commencement of maintenance or restoration of normal operations. Remote operation ensures that decommissioning and recommissioning processes are executed swiftly, reducing disruption to regular train schedules. This efficiency translates into higher overall network availability, which is essential for modern railway systems striving to meet increasing demand.

[0055] The proposed system aligns with evolving standards in rail safety and operational efficiency by addressing key challenges in axle counter technology. It extends the applicability of axle counters to maintenance operations without sacrificing the inherent benefits of these systems in challenging environments such as tunnels, steel bridges, and electrified tracks. By preserving axle counter integrity, ensuring compatibility with existing control panels, and minimizing the need for manual resets, the system enhances the operational versatility of axle counters, making them a more robust solution for modern railways. This comprehensive set of technical effects demonstrates a well-rounded approach to overcoming the challenges outlined, contributing significantly to modern railway safety and operational reliability.

[0056] In an example, the decommissioning system may include a communication interface wherein the interface comprises a secure Ethernet-based interface conforming to EN 50159 for safety-related railway applications and is configured for bidirectional communication between the control panel of the axle counter system and the decommissioning system. A secure Ethernet-based interface may be understood as a network communication standard that ensures safe data exchange in environments requiring high integrity and confidentiality. An effect of this feature is the reliable exchange of control instructions and feedback data, reducing the risk of unauthorized access or data corruption, which enhances overall operational safety in railway signalling systems.

[0057] In an example, the decommissioning system may include a signal generation unit wherein the unit includes a programmable logic controller configured to dynamically adjust the decommissioning signal based on predefined parameters stored in the system memory. A programmable logic controller may be understood as an industrial digital computer designed to control and automate specific processes. An effect of this feature is that it allows for adaptive signal generation tailored to the operational requirements of different axle counter configurations, improving the precision and efficiency of track decommissioning processes.

[0058] In an example, the decommissioning system may further comprise a diagnostic interface configured to continuously monitor the status of the decommissioning system and transmit diagnostic data to a central monitoring system. A diagnostic interface may be understood as a component that facilitates the collection and communication of system health and performance data. An effect of this feature is the proactive identification and resolution of potential system issues, reducing downtime and ensuring the reliability of maintenance operations.

[0059] In an example, the decommissioning system may include an activation control unit wherein the unit is configured to support multiple communication protocols, including Frauscher Safe Ethernet and Modbus, for compatibility with diverse axle counter systems. Multiple communication protocols may be understood as different standardized methods for exchanging data between devices. An effect of this feature is that it ensures interoperability across various railway signalling infrastructures, expanding the applicability of the system to different operational environments.

[0060] In an example, the decommissioning system may further comprise a fail-safe mechanism configured to deactivate the decommissioning signal and restore the axle counter system to its operational state in the event of a system failure. A fail-safe mechanism may be understood as a design feature that ensures system safety during malfunction or unexpected events. An effect of this feature is the prevention of operational disruptions or safety risks, providing additional reliability in critical railway applications.

[0061] In an example, the decommissioning system may include a mounting structure wherein the structure comprises an adjustable clamp mechanism configured to securely attach the system to the control panel of an axle counter without the need for permanent modifications. An adjustable clamp mechanism may be understood as a device that provides flexible and non-invasive attachment. An effect of this feature is simplified installation and maintenance, reducing deployment time and costs while preserving the integrity of existing axle counter systems.

[0062] In an example, the decommissioning system may include a power management unit wherein the unit includes a redundant power supply with automatic switchover to ensure uninterrupted operation during power outages. A redundant power supply may be understood as a backup system that provides continuous power in case of primary source failure. An effect of this feature is enhanced reliability and uninterrupted functionality, which is critical for maintaining safety and operational continuity in railway environments.

[0063] In an example, the decommissioning system may include a communication interface wherein the interface is further configured to log all transmitted signals and status changes in a non-volatile memory for subsequent review and compliance verification. Non-volatile memory may be understood as storage that retains data without requiring continuous power. An effect of this feature is improved traceability and accountability, ensuring that system operations can be reviewed for audit or regulatory purposes.

[0064] In an example, the decommissioning system may include a signal generation unit wherein the unit further comprises a filtering circuit to suppress electrical noise and ensure accurate transmission of the decommissioning signal. A filtering circuit may be understood as an electronic component that reduces interference in signal transmission. An effect of this feature is increased signal reliability, reducing the likelihood of errors in the axle counter system's responses.

[0065] In an example, the decommissioning system may include an activation control unit wherein the unit further comprises a user interface configured for manual override of the decommissioning signal through a secure input mechanism. A user interface may be understood as the hardware and software components enabling user interaction with the system. An effect of this feature is enhanced control and flexibility, allowing operators to intervene directly in the event of unexpected circumstances.

[0066] In an example, the decommissioning system may be configured to interface with axle counters from multiple manufacturers, including Frauscher Advanced Counter systems, through modular configuration settings. Modular configuration settings may be understood as adjustable parameters that allow the system to adapt to different hardware or software environments. An effect of this feature is broader compatibility and reduced complexity in integrating the system into diverse railway infrastructures.

[0067] In an example, the decommissioning system may include a diagnostic interface wherein the interface includes a visual indicator, such as LEDs, to provide real-time status updates of system operations and signal generation. A visual indicator may be understood as a device that displays operational states in a readily understandable format. An effect of this feature is improved situational awareness for operators, reducing the likelihood of operational errors.

[0068] In an example, the decommissioning system may be further configured to integrate with a central railway management system to synchronize decommissioning operations with maintenance schedules. Integration with a central management system may be understood as the alignment of the system's functionality with overarching operational workflows. An effect of this feature is streamlined coordination of maintenance activities, optimizing network efficiency and reducing disruptions.

[0069] In another aspect of the present disclosure, there is provided, a decommissioning system for decommissioning one or more track sections in a railway network during a decommissioning period, the system comprising: a communication interface, configured to connect to a control panel of an axle counter system and operatively transmit signals to the control panel; a signal generation unit, configured to generate a decommissioning signal indicative of a simulated track occupation; an activation control unit, operatively connected to the signal generation unit, configured to receive control instructions remotely via a secure communication protocol and to activate the signal generation unit in response to the received instructions; a power management unit, configured to supply power to the decommissioning system; characterised in that the signal generation unit is configured to transmit the decommissioning signal to the control panel to temporarily override a current track occupancy status communicated by the axle counter system to an interlocking system, wherein the decommissioning system is configured to ensure that the simulated track occupation status is maintained throughout the decommissioning period independently of axle counts detected by the axle counter system during said period, for safety purposes.

[0070] A critical aspect of the system's operation is its ability to maintain the simulated track occupation status persistently and independently of the axle counter's own detection logic. This may be understood as the decommissioning system ensuring the track section is continuously reported as “occupied” to the interlocking system, even if maintenance vehicles or other rail traffic enter or leave the decommissioned section, causing the physical axle counters to register axle movements. The signal generation unit may achieve this by continuously or periodically transmitting the decommissioning signal to the control panel, effectively creating a persistent override that is immune to being reset by the axle counter's normal operational logic. An effect of this configuration is the prevention of unsafe conditions where a track section could be inadvertently declared “free” by the axle counter system due to the movement of maintenance equipment, thereby providing a higher level of safety than systems that merely perform a one-time change of the track status.

[0071] The system may further be configured to restore the track occupancy status to a non-occupied state after the decommissioning period. This may be achieved by a reset mechanism configured to transmit a secure reset signal to the control panel of the axle counter system. This automated restoration of the control panel to its default operational state (“free” or “zero state”) eliminates the need for manual intervention, which is prone to human error, and ensures a safe and efficient transition back to normal railway operations. An effect of this feature is enhanced operational safety and reliability, as it prevents unauthorized or erroneous resets and ensures the track section is only returned to service when intended.

[0072] The communication interface and the activation control unit may be configured to implement a communication protocol suitable for safety-critical systems, such as a protocol conforming to the principles and requirements outlined in standards like EN 50159 for safety-related railway applications. Such protocols ensure the integrity, authenticity, and timeliness of control instructions and feedback data exchanged between the remote operator and the decommissioning system. This may involve mechanisms for error detection, data encryption, and secure authentication. An effect of this feature is a robust and secure communication link that minimizes the risk of data corruption or unauthorized access, which is essential for the safe remote control of the decommissioning process.

[0073] To ensure broad applicability across diverse railway infrastructures, the system may be configured to interface with axle counters from multiple manufacturers. This compatibility may be achieved through the use of modular hardware adapters and / or configurable software drivers within the communication interface. These modular configuration settings allow the system to adapt its communication protocol and signal parameters to match the specific requirements of different axle counter control panels, such as those from Frauscher Advanced Counter (FAdC) systems or other vendors. An effect of this feature is improved interoperability and reduced deployment complexity, allowing the system to be retrofitted into a wide variety of existing railway networks without requiring custom-developed interfaces.

[0074] The system's reliability may be further enhanced by incorporating a fail-safe mechanism. This mechanism may be configured to automatically default the control panel to a safe, occupied status in the event of a system failure or a disruption in the decommissioning signal. For instance, if the signal generation unit fails or communication is lost, the fail-safe mechanism ensures the track section remains protected. The signal generation unit may include a programmable logic controller (PLC) to manage this fail-safe logic and dynamically adjust the decommissioning signal. In another embodiment, the fail-safe mechanism may be configured to deactivate the decommissioning signal and restore the axle counter system to its original operational state in a controlled manner upon detecting a system failure, thereby preventing prolonged and unintended track blockages while alerting operators to the malfunction.

[0075] For the purposes of auditing, compliance, and incident analysis, the communication interface may be further configured to log all transmitted signals, received instructions, and system status changes in a non-volatile memory. Non-volatile memory may be understood as storage that retains data without requiring continuous power. An effect of this feature is improved traceability and accountability, as a complete record of all operations related to the decommissioning process is securely stored and available for subsequent review. This ensures that system operations can be verified against maintenance schedules and safety protocols.

[0076] The system may also include features to improve real-time operational awareness and control. The diagnostic interface may include visual indicators, such as LEDs, to provide at-a-glance status updates on power, communication, and signal generation. Furthermore, the activation control unit may comprise a user interface, such as a secure physical switch or a password-protected software interface, allowing for manual override of the decommissioning signal by authorized personnel on-site. This provides an additional layer of control and flexibility in the event of unexpected circumstances or network disruptions.

[0077] Where reference is made in this application to the standard EN 50159, this shall be understood as referring to the EN 50159 standard such as the EN 50159:2025 version, including amendments such as A 1:2020, entitled “Railway applications—Communication, signalling and processing systems—Safety-related communication in transmission systems”. This standard defines requirements and design principles for safety-related communication in railway signalling systems, including measures to ensure data integrity, authenticity, timeliness and fault detection over transmission systems, for both closed and open communication networks, in support of the required safety integrity levels (SIL). Compliance with EN 50159:2025 or EN 50159:2010+A1:2020 ensures that communication used for transmitting control instructions and status information within the decommissioning system meets established railway safety requirements.

[0078] It will be understood that the examples described herein are not limiting and may be applicable to any of the aspects of the present disclosure. Each example illustrates specific features, configurations, or implementations that can be applied to various embodiments of the decommissioning system or the method of operating such a system. The features described in these examples may be combined in any suitable manner to address particular requirements or operational scenarios without departing from the scope of the present disclosure. These examples serve to highlight the flexibility and adaptability of the disclosed system and method across different applications within the railway signalling domain.BRIEF DESCRIPTION OF THE DRAWINGS

[0079] The invention will now be explained in more detail with reference to a number of figures, in which:

[0080] FIG. 1 shows an axle counter system according to the prior art wherein no train is present in a section of a railway network;

[0081] FIG. 2 shows an axle counter system according to the prior art wherein a train is present in the section of a railway network;

[0082] FIG. 3 shows an axle counter system according to an aspect of the present disclosure wherein a train is simulated in a section of a railway network;

[0083] FIG. 4 shows a decommissioning system according to an aspect of the present disclosure for use in an axle counter system;

[0084] FIG. 5 shows the steps of a method of decommissioning a section of a railway network;DETAILED DESCRIPTION

[0085] For a better understanding of the invention, like parts will be indicated by identical numerals in the description of the figures below.

[0086] FIG. 1 illustrates a schematic representation of a conventional axle counter system 100 used in railway networks to monitor the occupancy status of track sections 110. The system consists of axle counters 121 and 122, which are strategically positioned at opposite ends of the track section 110. Axle counters 121 and 122 are sensors designed to detect the presence and movement of train axles as they pass through their detection zones. These counters are connected to a control panel 130, commonly referred to as an evaluation unit, which processes the signals received from the axle counters. The control panel 130 is further connected to an interlocking system 140, which serves as the central safety system responsible for controlling train movements. In this configuration, when no train is present in the section 110, the axle counters register no detections, resulting in the control panel maintaining a count of “0.” This status is then communicated to the interlocking system 140, indicating that the section is clear for train operations.

[0087] FIG. 2 demonstrates the operation of the conventional axle counter system 100 when a train 150 occupies the track section 110. As the train enters the section, it is detected by one of the axle counters, either 121 or 122, depending on the direction of travel. The axle counter sends a signal to the control panel 130, which updates its recorded count to “2,” reflecting the presence of a train in the section. This information is subsequently transmitted to the interlocking system 140, which marks the section as occupied and prevents additional trains from entering, thereby ensuring safe operations. This process showcases the fundamental functionality of axle counter systems in monitoring and controlling track occupancy.

[0088] FIG. 3 introduces the decommissioning system 210, which enhances the conventional axle counter system 200 by enabling remote-controlled decommissioning of track sections 110 during maintenance or other operational needs. The decommissioning system 210 is a device designed to integrate with the control panel 130 of the axle counter system. This integration can be achieved through a wired connection or, preferably, a wireless communication interface. The decommissioning system 210 is also configured to communicate wirelessly with a remote server 220, which allows for the transmission of control instructions via a secure communication protocol. These instructions are received by the activation control unit of the decommissioning system, which then triggers the signal generation unit 212 to produce a decommissioning signal.

[0089] The decommissioning signal generated by the signal generation unit 212 is indicative of a simulated track occupation 150′. This signal overrides the current axle count status stored in the control panel 130 and overrides the current state of the axle counter, which may be recorded or stored for later reinstate. For example, even if the control panel's count is “0,” the decommissioning signal causes the system to report the section as occupied to the interlocking system 140 while retaining the original count. The original status may be stored, which allows for the axle counter's operational state to be reinstated seamlessly after the decommissioning signal is removed, however more preferably, the proposed decommissioning system 210 may operates in parallel with the conventional axle counter functionality without modifying or overriding core detection capabilities of the classic axle counters. By maintaining the axle counters'ability to detect and record axle movements independently during maintenance, the system ensures that the safety of normal operations is not contingent upon the decommissioning system. This approach eliminates discrepancies in train detection following maintenance activities while preserving the operational integrity of the axle counters. The simulated occupation status effectively prevents any train movements in the designated section, creating a safe environment for maintenance activities. More preferably however, the previous, original status may be deleted permanently since during the maintenance period a signal indicative of a simulated track occupation is generated and communicated to the control panel of the axle counter system, which signal is maintained during maintenance operations for safety purposes, whereas, once the maintenance period ended, the control panel of the axle counter system may be controlled to overwrite any previous simulated track occupation and ensures that the track occupancy status reflects the absence of any train or simulated presence in the section. Hence, this can be done by forcing a “zero” or “0” into the counter of the control system, or by communicating a reset signal for example.

[0090] FIG. 4 provides a detailed view of the components of the decommissioning system 210, which includes a communication interface 211, a signal generation unit 212, an activation control unit 213, and a power management unit 214. The communication interface 211 is configured to establish a connection with the control panel 130 of the axle counter system, facilitating the transmission of signals between the decommissioning system and the control panel. This interface may utilize standard communication protocols such as Ethernet or proprietary protocols like Frauscher Safe Ethernet (FSE) for railway applications. The communication interface also supports bidirectional data exchange, enabling the decommissioning system to receive feedback from the control panel.

[0091] The signal generation unit 212 is responsible for creating the decommissioning signal, which simulates track occupancy. This unit may include a programmable logic controller (PLC) that dynamically adjusts the parameters of the signal based on predefined settings stored in the system's memory. By allowing such adjustments, the signal generation unit ensures compatibility with various axle counter configurations and operational scenarios. Additionally, the signal generation unit may incorporate filtering circuits to suppress electrical noise and ensure the accuracy of the transmitted signals.

[0092] The activation control unit 213 receives control instructions from the remote server 220 via a secure communication protocol. These instructions may be transmitted over wireless networks using encryption standards that comply with EN 50159, ensuring data integrity and preventing unauthorized access. Upon receiving the instructions, the activation control unit activates the signal generation unit to produce the decommissioning signal. The activation control unit may also include a user interface for manual override, providing flexibility for operators to manage the system in the event of network disruptions or other anomalies.

[0093] The power management unit 214 ensures the uninterrupted operation of the decommissioning system by supplying consistent power to its components. This unit may include redundant power supplies with automatic switchover capabilities to maintain functionality during power outages. The power management unit is particularly critical in maintaining the reliability of the decommissioning system in environments with unstable power supplies.

[0094] FIG. 5 outlines the method 300 for operating the decommissioning system 210, as defined in claim 15. The method begins with step 301, where the communication interface of the decommissioning system is connected to the control panel 130 of the axle counter system. This connection establishes the necessary link for transmitting control signals and receiving feedback. Step 302 involves receiving remote control instructions at the activation control unit 213 via a secure communication protocol. These instructions, transmitted from the remote server 220, specify the operational commands for the decommissioning system.

[0095] In step 303, the activation control unit processes the received instructions and activates the signal generation unit 212. The signal generation unit then executes step 304, generating a decommissioning signal that simulates track occupancy. This signal overrides the current axle count status stored in the control panel while the axle counter system remains fully operational and independent of the override during the decommissioning period. Step 305 involves transmitting the decommissioning signal to the control panel via the communication interface 211. The control panel processes this signal and updates the interlocking system 140 with a simulated occupied status for the track section 110.

[0096] Finally, step 306 ensures the temporary override of the track occupancy status communicated by the axle counter system to the interlocking system. This override designates the track section as occupied, thereby preventing train movements and enabling safe maintenance activities. Once the decommissioning period is complete, the method includes the removal of the decommissioning signal, allowing the axle counter system to revert to its original operational state. Preferably, the system communicates before, during the process and / or after completion of the process, the status change back to the activation control unit 213, which transmits this information to the central monitoring system 220 and subsequently to the users. This ensures that all relevant entities are or can be informed of the system's operational state in real time, enhancing control and operational transparency.

[0097] The decommissioning system 210 and its associated method address key challenges in railway operations by enhancing the functionality of existing axle counter systems. The integration of a secure communication interface, a dynamically adjustable signal generation unit, and robust power management capabilities ensures the system's reliability and adaptability across diverse operational scenarios. The ability to simulate track occupancy without altering the recorded axle count state preserves the integrity of the axle counter system, minimizing the risk of errors during transitions between maintenance and normal operations.

[0098] The use of secure communication protocols and remote control capabilities reduces the need for manual interventions, enhancing safety and efficiency in railway maintenance activities. By enabling seamless integration with existing axle counter systems and interlocking systems, the decommissioning system provides a practical and cost-effective solution for improving railway safety and operational reliability. Each feature and step described in the drawings contributes to the comprehensive functionality of the decommissioning system, demonstrating its applicability and effectiveness in modern railway networks.

Claims

1. A decommissioning system for decommissioning one or more track sections in a railway network during a decommissioning period, comprising:a communication interface, configured to connect to a control panel of an axle counter system and operatively transmit signals to the control panel;a signal generation unit, configured to generate a decommissioning signal indicative of a simulated track occupation, overriding the current track occupancy status communicated by the axle counter system to an interlocking system while maintaining the simulated track occupation status throughout the decommissioning period;an activation control unit operatively connected to the signal generation unit, configured to receive control instructions remotely via a secure communication protocol and to activate the signal generation unit in response to the received instructions;a power management unit, configured to supply power to the decommissioning system and ensure uninterrupted operation during the generation and transmission of the decommissioning signal;wherein the decommissioning system is configured to temporarily override the track occupancy status of the axle counter system with the simulated track occupation and ensure that the simulated track occupation is maintained during maintenance operations for safety purposes.

2. The decommissioning system of claim 1, wherein the signal generation unit is further configured to set the track occupancy status return to a non-occupied state.

3. The decommissioning system of claim 2, wherein the non-occupied state is obtained by a reset mechanism configured to transmit a reset signal to the control panel of the axle counter system, wherein the reset signal is configured to set the track occupancy status to the non-occupied state.

4. The decommissioning system of claim 1, wherein the communication interface comprises:a secure Ethernet-based interface conforming to EN 50159 for safety-related railway applications, configured for bidirectional communication between the control panel of the axle counter system and the decommissioning system.

5. The decommissioning system of claim 1, wherein the signal generation unit includes:a programmable logic controller (PLC) configured to dynamically adjust the decommissioning signal based on predefined parameters stored in the system memory.

6. The decommissioning system of claim 1, further comprising:a diagnostic interface configured to continuously monitor the status of the decommissioning system and transmit diagnostic data to a central monitoring system.

7. The decommissioning system of claim 1, wherein the activation control unit is configured to:support one or more of multiple communication protocols confirming to EN 50159, for compatibility with diverse axle counter systems.

8. The decommissioning system of claim 1, further comprising:a fail-safe mechanism configured to deactivate the decommissioning signal and restore the axle counter system to its operational state in the event of a system failure.

9. The decommissioning system of claim 1, wherein system further comprises:a mounting structure, configured to physically attach the system to the existing axle counter equipment without requiring replacement or modification of the axle counter system and preferably wherein the mounting structure comprises:an adjustable clamp mechanism configured to securely attach the system to the control panel of an axle counter without the need for permanent modifications.

10. The decommissioning system of claim 1, wherein the power management unit includes:a redundant power supply with automatic switchover to ensure uninterrupted operation during power outages.

11. The decommissioning system of claim 1, wherein the communication interface is further configured to:log all transmitted signals and status changes in a non-volatile memory for subsequent review and compliance verification.

12. The decommissioning system of claim 1, wherein the signal generation unit further comprises:a filtering circuit to suppress electrical noise and ensure accurate transmission of the decommissioning signal.

13. The decommissioning system of claim 1, wherein the activation control unit further comprises:a user interface configured for manual override of the decommissioning signal through a secure input mechanism.

14. The decommissioning system of claim 1, wherein the system is configured to:interface with axle counters from multiple manufacturers, including Frauscher Advanced Counter (FAdC) systems, through modular configuration settings.

15. The decommissioning system of claim 1, wherein the diagnostic interface includes:a visual indicator, such as LEDs, to provide real-time status updates of system operations and signal generation.

16. The decommissioning system of claim 1, further configured to:integrate with a central railway management system to synchronize decommissioning operations with maintenance schedules.

17. A method for operating a decommissioning system for decommissioning one or more track sections in a railway network during a decommissioning period, the method comprising the steps of:connecting a communication interface of the decommissioning system to a control panel of an axle counter system;receiving remote control instructions at an activation control unit of the decommissioning system via a secure communication protocol;activating a signal generation unit in response to the received instructions;generating a decommissioning signal by the signal generation unit, the decommissioning signal simulating a track occupation to temporarily override the current track occupancy status communicated by the axle counter system to an interlocking system while maintaining the simulated track occupation status throughout the decommissioning period;transmitting the decommissioning signal to the control panel of the axle counter system via the communication interface;temporarily overriding the current track occupancy status of the axle counter system with the simulated track occupation and ensuring that the simulated track occupation is maintained during maintenance operations for safety purposes.

18. The method of claim 17, further comprising the step of setting the track occupancy status to a non-occupied state after the decommissioning period by generating and transmitting a reset signal to the control panel of the axle counter system.

19. The method of claim 18, wherein the reset signal is configured to override the simulated track occupation and set the track occupancy status of the axle counter system to a non-occupied state, ensuring that the interlocking system reflects the absence of any train or simulated presence in the section.

20. The method of claim 17, further comprising the step of:transmitting status updates, before, during and / or after the decommissioning period, from the activation control unit to a central monitoring system, the updates including information on the current operational state of the decommissioning system, wherein the central monitoring system subsequently relays the status updates to authorized users in real time to enhance operational transparency and control.

Images