Patent Application
20210339778
This patent application claims priority from Italian patent application no. 102020000009592 filed on Apr. 30, 2020, the entire disclosure of which is incorporated herein by reference.
This invention relates to a communication network architecture for trains.
As is well known, the different systems and sub-systems on a train are interconnected through a Train Communication Network (TCN) that enables data exchange between these devices.
Each train function associated with these devices must be distinguished by a Safety Integrity Level (SIL) that can vary from 0 (where the associated function is considered to have no impact on safety) to 4 (which is the maximum level of impact on safety).
The Safety Integrity Level (SIL) is also defined as the level of risk reduction ensured by a Safety Instrumented Function (SIF) as part of Functional Safety Management in the process industry. The requirements associated with a given SIL may change depending on the reference standard. According to the IEC 61508 and IEC 61511 standards of the International Electrotechnical Commission (IEC), 4 possible SIL levels are defined, from SIL1 (least reliable) to SIL4 (most reliable), which are determined by a qualitative or quantitative analysis.
Functions associated with SIL level 0 require an ordinary development, validation, and certification process, while functions distinguished by SIL levels 1-4 require more and more onerous processes.
A large part of the cost of designing the architecture of a communication network lies in the validation and certification of security functions.
For example, European Patent EP-3.388.904 describes a train communication network architecture wherein a first processor (CPU I) is used that processes only data associated with a safety level greater than zero, and a second processor (CPU II) that processes only data associated with a safety level of zero. In this way, secure and non-secure functions are kept separate. The first and the second processors communicate on one side, through an interface that creates separate channels, with Host devices. The first and the second processors also communicate, on a second side, with ports connected with respective Ethernet communication lines, on which data with safety levels and data without safety levels are transmitted separately.
The purpose of this invention is to provide a train communication network architecture wherein the validation and certification operations of the safety functions have a lesser impact in terms of time and cost, using a different and simpler architecture than that of the patent referred to.
The above-mentioned purpose is achieved with this invention in that it relates to a communication network architecture for trains of the type described in claim 1.
For a better understanding of this invention, an embodiment will be provided that is illustrated in the accompanying drawings, which represent a preferred, limiting embodiment thereof wherein:
The number 1 identifies a train communication network architecture produced according to the present invention.
The architecture comprises at least one central processing unit 3 (Main Board) arranged in a train carriage and interconnected via a communication network 5 (of a known type) of the train with a number of peripheral processing units 6 (I/O Collector Board). The communication network 5 extends along the carriages (typically from two to twelve) that form a railway convoy (not illustrated). Each peripheral processing unit 6 is preferably, but not exclusively, arranged on a respective carriage.
The central processing unit 3 is made from a single board 7 comprising:
a main processor 10 designed to process data associated with a zero safety level, SIL 0;
a coprocessor 12 (Safe Function Coprocessor) designed to process only data associated with an SIL 1 or an SIL 2 safety level;
an internal bus 14 built on the board 7 and configured to enable two-way data communication between the processor 10 and the coprocessor 12;
an interface 16 designed to enable connection between the main processor 10 and the external communication network 5 of the train. The external communication network 5 of a known type (e.g. MVB, WTB, Ethernet) is designed to transmit data associated with a SIL 0 safety level and can also be used to transmit data packets encoded with SIL 1 or SIL 2 safety levels, through the known technique of the “black channel”, which consists in using a Standard communication channel to also transmit SIL 1 or SIL 2 data, applying thereon, in the coprocessors (12), the functions for implementing a safety protocol, in the boards (7) of the units (3, 6) at the ends of the “black channel”.
The coprocessor 12 is designed to be programmed in a reconfigurable manner with a software 18 that enables the validation and encoding of data coming from the main processor 10 according to a safety protocol of a known type.
The coprocessor 12 is also configured to transfer the validated and encoded data to the main processor 10 for the subsequent transmission to the external communication network 5.
The architecture 1 highlighted above enables a segregation between data associated with a SIL1-SIL2 safety level and data with a minimum safety level (SIL0 level).
In this way, the validation and certification operations of the SIL 1-SIL 2 safety functions only involve the coprocessor 12. The functions of the main processor 10 may, therefore, be developed with the rules for the required functions with the SIL 0 safety level. The software that is installed on the processor 10 must meet less stringent criteria than the software 18 that is installed on the coprocessor 12. The same goes for the updates thereof. Thus, a hybrid solution is obtained wherein the cost of development and corrective and development maintenance of the board 7 is reduced compared to other known applications wherein all the components of the board must comply with the safety criterion equal to the maximum among those present in the functions.
In the example illustrated in
a main processor 10 designed to process data associated with a zero safety level;
a coprocessor 12-p (Safe Function Coprocessor) designed to process only data associated with an SIL 1 or an SIL 2 safety level;
an internal bus 14-p built on the board 7 and configured to enable two-way data communication between the processor 10-p and the coprocessor 12-p;
an interface 16-p designed to enable the connection between the main processor 10-p and the processor 10 through the external communication 5 of the train.
The processor 10 of the central communication unit 3 is configured so that:
if the processor 10 receives data associated with a safety level of 1, or even 2, encoded within a protocol defined as safe (SIL 1, SIL 2), this data is transmitted to the coprocessor 12 without any processing of said data. In this way, the data is only transferred from the processor 10 to the coprocessor 12, which verifies the validity of the received data, processes the safety functions, packages the data within a safety protocol, and transmits it to the train communication network 5 via the processor 10 (black channel). In the case of functions processed by the processor 10 that contain commands that impact the safety functions, the processor 10 transfers the command data to the coprocessor 12, which validates the command data safely, packages the data within a safety protocol and transmits it to the train communication network 5 via the processor 10 (black channel).
If the processor 10 processes commands that only impact on the functions with SIL 0 safety level, such data is directly validated and processed by the processor 10 before being transmitted to the communication network 5, without the need to implement a safety protocol.
The coprocessor 12 is designed to be programmed in a reconfigurable manner with the software 18 that enables the validation and encoding of data coming from the processor 10 according to a safe protocol. In addition, the coprocessor 12 is configured to transfer the validated and encoded data to the processor 10 for the subsequent transmission on the train communication network 5.
As can be seen in the example of
The INPUT/OUTPUT units 24 are preferably, but not exclusively, provided with sensors designed to detect quantities and parameters detected on a respective carriage and are provided with an interface designed to transform the (digital/analogue) signal of the sensor into a format designed to be transmitted on the local bus 22.
In addition, the INPUT/OUTPUT units 24 are preferably, but not exclusively, provided with actuators designed to command electrical quantities and parameters on a respective carriage and are provided with an interface designed to transform the information transmitted on the local bus 22 into the (digital/analogue) signal of the actuator.
According to the variant provided in
In this case, the main processor 10-p is provided with a second interface 26 for connection to the local bus 22 that, in this way, directly connects the INPUT/OUTPUT units 24 with the main processor 10-p.
The main processor 10-p is configured to receive data with the safety levels SIL0 and SIL1 SIL2 from the INPUT/OUTPUT 24 units via the local bus 22. The data with the SIL1 SIL 2 safety levels is transmitted from the processor 10-p to the coprocessor 12-p without processing the data itself. In this way, the data is only transferred from the processor 10-p to the coprocessor 12-p, which checks the validity of the received data, validates it, packages the data within a secure protocol, and transmits it to the train communication network 5 through the processor 10-p.
With reference to
a main processor 10-p designed to process data associated with a zero safety level, SIL0;
a coprocessor 12-p (Safe Function Coprocessor) designed to process only data associated with an SIL 1 or an SIL 2 safety level;
a first internal bus 14-p built on the board 7 and configured to enable two-way data communication between the main processor 10-p and the coprocessor 12-p;
a first interface 16-p designed to enable the connection between the main processor 10-p and the external communication network 5 of the train;
a second interface 27 designed to enable the connection between the main processor 10-p and a second internal bus 28 communicating with a local bus 22 interconnected with a plurality of INPUT/OUTPUT units 24.
The coprocessor 12-p is provided with a third interface 29 communicating with the local bus 22 for two-way data exchange between the INPUT/OUTPUT units 24 and the coprocessor 12-p via the local bus 22.
The coprocessor 12-p is designed to process the data present on the local bus 22 and associated with an SIL1 or SIL2 safety level, encoded within a protocol defined as safe (SIL 1, SIL 2); this data, after its processing, is transferred via the processor 10-p to the train communication network 5.
The processor 10-p is designed to process the data present on the local bus 22 associated with a 0 safety level (SIL 0); this data, after its processing, is transferred directly to the train communication network 5.
With reference to the embodiment in
a single main processor 10-p designed to process data associated with a zero safety level, SIL0;
a first interface 16-p designed to enable the connection between the main processor 10-p and the external communication network 5 of the train;
a further interface 30 designed to enable the connection between the main processor 10-p and a local bus 22 interconnected with a plurality of INPUT/OUTPUT units 24.
The processor 10-p is configured so that if it receives data associated with an SIL 1, SIL 2 safety level coming from the local bus 22, this data is transferred from the processor 10-p to the train communication network 5 and, thus, to the central processing unit 3.
| Number | Date | Country | Kind |
|---|---|---|---|
| 102020000009592 | Apr 2020 | IT | national |
