Train Traffic Control Display With Independent SIL-Safe State Indication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current train traffic control systems face high costs and limited flexibility due to the need for high safety integrity levels (SIL) in operator workstations, which are inflexible and do not support non-safety related functionalities or mobile operation, especially during safety-critical operations that bypass interlocking systems.
Innovation Solution
A train traffic control system with a basic integrity indication component at SIL0 and a functionally independent safe state indication component at SIL>0, using a safe channel for transmitting safety-related information, allowing for cost reduction and flexibility by separating safety-critical operations from non-safety related functions and enabling web-based user interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If high safety integrity level (SIL>0) is implemented in operator workstation for safe state indication, then safety reliability is improved, but hardware costs and software development costs increase
Solution Approach 1:
The system divides the operator workstation into two independent parts: a SIL0 basic integrity indication component for general display functions and a separate SIL>0 safe state indication component for safety-critical display functions. This segmentation allows each component to be developed and certified at its appropriate safety level, reducing overall costs while maintaining required safety reliability.
Solution Approach 2:
The safe state indication component is extracted from the operator workstation as a separate functional unit. This extracted component can be independently developed, tested, and certified at SIL>0 level, while the main workstation operates at lower SIL0 level, significantly reducing hardware and software development costs.
2Reliability
If high safety integrity level (SIL>0) is implemented in operator workstation, then safety reliability is improved, but flexibility and adaptability deteriorate
Solution Approach 1:
By segmenting the display system into SIL0 basic integrity indication and SIL>0 safe state indication components, the system enables the SIL0 portion to be highly flexible and adaptable (supporting web-based interfaces, mobile devices, additional non-safety functions) while the SIL>0 portion maintains strict safety requirements only where needed.
Solution Approach 2:
The SIL0 basic integrity indication component is designed with universal functionality to support multiple display types (web-based interfaces, mobile devices, traditional displays) and additional non-safety related functions, while the SIL>0 safe state indication component provides dedicated safety-critical display capabilities.
3Ease of manufacture
If SIL0 components are integrated in operator workstation, then cost reduction is achieved, but ensuring non-intrusive behavior to SIL>0 environment increases complexity
Solution Approach 1:
The SIL>0 safe state indication component is extracted as a separate independent unit with its own processing and display capabilities. This extraction eliminates the need for complex integration measures to ensure non-intrusive behavior, as the SIL0 components simply display information provided by the independent SIL>0 component without interfering with its safety-critical operations.
Solution Approach 2:
The system introduces an intermediary communication interface between the SIL0 basic integrity indication component and the SIL>0 safe state indication component. This intermediary layer ensures proper data exchange while maintaining safety boundaries, simplifying the integration process by providing clear interfaces and communication protocols.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The inventive train traffic control system comprises a route and train control system (RTCS), an operator workstation (OW) with a display (D), wherein the operator workstation (OW) comprises at least one basic integrity indication component (BIC) with safety level SIL0 for indicating information with a basic integrity on the display (D), and a safe state indication component (SSC) with safety level SIL>0, in particular SIL4, for indicating safety-related information concerning the state of elements of the route and train control system (RTCS) on the display of the operator workstation (OW), wherein the safe state indication component (SSC) is functionally independent of the operator workstation (OW), and a safe channel (C) connecting the safe state indication component (SSC) and the display (D) for safe transmission of safety-related information about the state of elements of the route train control system (RTCS). The inventive train traffic control system realizes the required high safety level for safe state indication and allows considerable cost reduction and flexibility.