14-02-2013, 02:11 PM
FPGA Based Design of the Railway's Interlocking Equipments
[attachment=50886]
Abstract
This paper describes the architecture of a safety
system of the railway's interlocking equipment, which has
been developed for Czech railways. The system will be
used for the railway crossing gate. This system is based
on FPGA blocks and has to fulfil the requirements for a
fault tolerant system with a fail-safe function. The dual
logic and TMR principle are used to increase its
dependability. Several self-test and self-diagnostics
features are used, such as an LFSR based built-in selftest,
the FPGA readback and 1 out of 2 error detection
codes. The functional logic uses a majority correction and
the FPGA box reprogramming to precede the failure. The
reliability analyses, models and reliability characteristics
calculations of this system are described. Markov chain
models are used for the reliability analyses. The TMR
principles for fault tolerant system and the Dual-TMR
logic have been used in our design and both attempts are
compared.
Introduction
The electronics blocks are not often used for the
railway's interlocking equipment at this time. The safety
function in the railway's application was always based on
the gravitational attraction (e.g. by relays or mechanical
signals) for the stop-signals and on the mechanical pull or
on the big value of the electrical current for the permit
signal. It is very difficult to prove that the interlocking
equipment with the electronics blocks can be safe. The
railway's operators are afraid of these blocks' unreliability
and dangerousness. This paper shows that the fears of
railway's operators are unjustified.
Since the electronic blocks were successfully used in
the space program, the railway's operators have accepted
to use these blocks in railway's interlocking equipment.
New designed systems usually apply microprocessors,
programmable or ASIC blocks are utilised only rarely. But
the features of the programmable gate arrays (FPGA,
CLPD) predestine these blocks for wide use in the
railway's applications.
Authors of this paper want to show advantageous
features of FPGAs for the design and reliability
calculations of the railway's interlocking equipment. The
design of the safe interlocking equipment is shown.
Various techniques for increasing the dependability are
described. It is the first attempt to design and use the
system with FPGA blocks in a safe railway's application
for Czech railways.
The paper has the following structure: Section 2
defines the basic knowledge for the railway's interlocking
plant and the main principles of our design. The safety in
traffic process problems are described in Section 3. The
architecture of designed interlocking plant is described in
Section 4, Section 5 shows the calculation of reliability
characteristics and its results. Section 6 summarises the
advantage features of FPGA and Section 7 contains
conclusions.
Safety of the railway's traffic process
The railway's traffic system has only one degree of
freedom (as compare with the other traffic systems). The
train can move only forward and rearward. This aspect
makes possible an easy detection of the train on the track.
One degree of freedom of the railway's traffic system
allows to define the safety state for trains. This state is
defined by the stop-signal for all trains in a controlled
area. When the railway control system place an order with
the stop-signal, all traffic must be stopped and can
continue only by the direct orders from the human
operators. After that, the traffic system is controlled by
human operators without any support from the control
system. In this moment, the human operators have all
responsibility for safety of the traffic process.
The probability of a dangerous behaviour is higher for
the human operators than for the railway's interlocking
equipment. Therefore, it is very important for the railway's
control and interlocking system to be highly reliable,
available, maintainable and safe.
[attachment=50886]
Abstract
This paper describes the architecture of a safety
system of the railway's interlocking equipment, which has
been developed for Czech railways. The system will be
used for the railway crossing gate. This system is based
on FPGA blocks and has to fulfil the requirements for a
fault tolerant system with a fail-safe function. The dual
logic and TMR principle are used to increase its
dependability. Several self-test and self-diagnostics
features are used, such as an LFSR based built-in selftest,
the FPGA readback and 1 out of 2 error detection
codes. The functional logic uses a majority correction and
the FPGA box reprogramming to precede the failure. The
reliability analyses, models and reliability characteristics
calculations of this system are described. Markov chain
models are used for the reliability analyses. The TMR
principles for fault tolerant system and the Dual-TMR
logic have been used in our design and both attempts are
compared.
Introduction
The electronics blocks are not often used for the
railway's interlocking equipment at this time. The safety
function in the railway's application was always based on
the gravitational attraction (e.g. by relays or mechanical
signals) for the stop-signals and on the mechanical pull or
on the big value of the electrical current for the permit
signal. It is very difficult to prove that the interlocking
equipment with the electronics blocks can be safe. The
railway's operators are afraid of these blocks' unreliability
and dangerousness. This paper shows that the fears of
railway's operators are unjustified.
Since the electronic blocks were successfully used in
the space program, the railway's operators have accepted
to use these blocks in railway's interlocking equipment.
New designed systems usually apply microprocessors,
programmable or ASIC blocks are utilised only rarely. But
the features of the programmable gate arrays (FPGA,
CLPD) predestine these blocks for wide use in the
railway's applications.
Authors of this paper want to show advantageous
features of FPGAs for the design and reliability
calculations of the railway's interlocking equipment. The
design of the safe interlocking equipment is shown.
Various techniques for increasing the dependability are
described. It is the first attempt to design and use the
system with FPGA blocks in a safe railway's application
for Czech railways.
The paper has the following structure: Section 2
defines the basic knowledge for the railway's interlocking
plant and the main principles of our design. The safety in
traffic process problems are described in Section 3. The
architecture of designed interlocking plant is described in
Section 4, Section 5 shows the calculation of reliability
characteristics and its results. Section 6 summarises the
advantage features of FPGA and Section 7 contains
conclusions.
Safety of the railway's traffic process
The railway's traffic system has only one degree of
freedom (as compare with the other traffic systems). The
train can move only forward and rearward. This aspect
makes possible an easy detection of the train on the track.
One degree of freedom of the railway's traffic system
allows to define the safety state for trains. This state is
defined by the stop-signal for all trains in a controlled
area. When the railway control system place an order with
the stop-signal, all traffic must be stopped and can
continue only by the direct orders from the human
operators. After that, the traffic system is controlled by
human operators without any support from the control
system. In this moment, the human operators have all
responsibility for safety of the traffic process.
The probability of a dangerous behaviour is higher for
the human operators than for the railway's interlocking
equipment. Therefore, it is very important for the railway's
control and interlocking system to be highly reliable,
available, maintainable and safe.