Smart Railway Operation Aid System for Facilities With Low-Safety Requirements

Depósito de Investigación de la Universidad de Sevilla https://idus.us.es/ This is an Accepted Manuscript of an article published by IEEE: “A. Torralba et al., "Smart Railway Operation Aid System for Facilities With Low- Safety Requirements," in IEEE Intelligent Transportation Systems Magazine, vol. 13, no. 3, pp. 253-267, Fall 2021, doi: 10.1109/MITS.2019.2962148”. © 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.” > IDENTIFICATION NUMBER: ITSM-19-03-0041 < 1 Abstract— Rail traffic control systems are undergoing an important transformation. ERMTS/ECTS, CBTC, PTC and other train control systems based on radio communication are being deployed in different countries. These systems meet the high safety requirements for passenger traffic, and cover from congested urban areas to high-speed trains. However, there is a set of facilities, such as ports, dry ports, facilities for the repair and maintenance of trains, logistic centers, mines, etc., whose trains, that only carry freight, circulate in a controlled environment at a low speed. These facilities have low safety requirements. For them, present commercial systems become too expensive, so that, in most cases, railway traffic is still handled manually. This paper presents a system to aid in the exploitation of rail traffic for this type of facilities, called SFPS (Seville Ferro- Port System). SFPS presents many of the features of the most advanced traffic control systems, but incorporates innovations based on Information and Communications Technologies to reduce costs. To this end, train location is based on a satellite global positioning system, physical signs are replaced by virtual ones, displayed in an On-Board Unit, and communication is almost entirely wireless. SFPS has been in a trial phase since March 2016, covering part of the railway facilities of the Port Authority of Seville, with satisfactory results. Index Terms—Traffic control, Railway traffic, Port logistics, On-Board Unit, GNSS, Low cost traffic management, Wireless monitoring. I. INTRODUCTION HE European Union has established regulations to control high speed and high density railway transportation systems and infrastructures to preserve passengers’ safety, vehicles’ integrity and tracks’ health. The European Train Control System (ETCS), conducted by the European Union Agency for Railways (ERA) is the core signaling and control A. Torralba ([email protected]), M. García-Castellano ([email protected]), M. Hernández-González (mh[email protected]), J.P. García-Martín ([email protected]), V. Pérez-Mira ([email protected]) and F.J. Gutiérrez- Rumbao ([email protected]) are with the Electronic Engineering Department, Universidad de Sevilla, 41092 Sevilla, Spain. R. Fernández-Sanzo ([email protected]), and A. Jácome-Moreno ([email protected]) are with Thales España. C/ Luis Fuentes Bejarano 60, 3, 41020 Sevilla, Spain. This work was supported by the “Autoridad Portuaria de Sevilla” under contract Tecnoport2025, co-funded by the European Commission through European Regional Development Funds (ERDF/FEDER UE). Submitted _____ component of the European Rail Traffic Management System (ERTMS). It defines three different levels for the railway communication and signaling services. For the operation of an ERTMS based railway, it is necessary that every train includes an On Board Unit (OBU) that complies with the requirements of the ERTMS level of the track. For railways with ERTMS Level 2 (L2), the management of the information in both ways will be carried out by the Radio Block Centers (RBCs), which allow sending orders and indications between interlockers and trains. Each level extends the automation and communication capability between OBUs and the RBC. This regulation mostly applies to railway infrastructures where passengers are transported, including high-speed lines. A high safety environment is required for this kind of traffic, leading to Safety Integrity Level 4 (SIL4) traffic control systems with great redundancy, whose installation, operation and maintenance costs are quite high. However, there are many other facilities with lower safety levels. Consider, for instance, railway transportation in large freight ports where train convoys with no passengers circulate in a controlled environment at low speed (in many cases, only a bit faster than a walking person). In many ports the railway infrastructure is quite complex, covering long distances with several docking areas; there, the operation and control of rail traffic is complex and consumes a lot of human resources. To achieve high logistic efficiency and reduce human failures, the management of this traffic should be automatized, but the only traffic management systems presently available have a high cost, since they were designed for conventional facilities. The same case occurs in repair and maintenance facilities, mines, dry ports, etc. As a consequence, railway traffic in most of these facilities is manually operated. This paper presents SFPS (Seville Ferro-Port System), a cost-effective system to aid in the management of railway traffic in facilities with low safety requirements. The proposed system has the same functionality as the conventional ones, but it uses innovative solutions that include: a) train location based on a satellite Global Positioning System (GPS), necessary to maintain a virtual track circuit, b) beacons that detect track occupancy at singular points of the installation, c) virtual signaling with the help of a portable train OBU, and d) wireless communication between the elements of the system, including the Train-Control Center communication. In SFPS, wireless communication combines a short-range Smart Railway Operation Aid System for Facilities with Low-Safety Requirements Antonio Torralba, Senior Member, IEEE, María García-Castellano, Miguel Hernández-González, Juan Pablo García-Martín, Ventura Pérez-Mira, Roberto Fernández-Sanzo, Antonio Jácome-Moreno, and Francisco Javier Gutiérrez-Rumbao T > IDENTIFICATION NUMBER: ITSM-19-03-0041 < 2 Wireless Local Area Network (WLAN) network with a Wireless Metropolitan Area Network (WMAN) backbone network. This solution replaces the conventional voice radio communication still available in ERTMS L1, or the Global System for Mobile Communications (GSM) link of ERTMS L1 and L2. This is possible in our case, since the WMAN is enough to cover the whole facility, like in [1], whose scope of application is railway facilities with a medium/low volume of traffic, or in [2], where GSM for Railways (GSM-R) is replaced by conventional Long Term Evolution (LTE) to achieve an increase in the capacity of the radio link. SFPS also includes new elements to enhance safety, such as train length meters and magnetic track occupancy detectors, which have been specifically designed for this application. SFPS has been designed by the University of Seville and Thales Spain, within the framework of TECNOPORT2025 project. It has been financed by the European Commission using Regional Development Funds (ERDF), under the direction of the Port Authority of Seville. To build SFPS, new control racks, new software and the aforementioned new elements for safety enhancement have been specified and developed. SFPS has been thoroughly tested in a wide area of the Port of Seville, being in operation since the late 2016. With the experience gained in this period, SFPS is presently being revised, extending its functionality and being enlarged to cover the entire railway infrastructure. The paper is organized as follows: A review of recent literature concerning related railway traffic management systems is done in Section II. Section III introduces SFPS, describing its functionalities. Section IV deals with system architecture. The communication network is presented in Section V, and its physical implementation is explained in section VI. Section VII discusses safety issues, while Section VIII highlights SFPS innovations. SFPS has been deployed in the Port of Seville, and Section IX presents some experimental results. In Section X, current status and future developments of SFPS are discussed, and some conclusions are also drawn. II. RELATED WORK Train control and monitoring systems are constantly evolving. Advances in control and communication technology have improved safety, availability, capacity and efficiency in railway systems. Movement of people and goods is of a paramount importance for global development. For this reason, laws are being enacted to reach interoperable solutions in every aspect of railway transportation (signaling/ERTMS, communication, infrastructure, superstructure, rolling stock, etc.). The objectives are interoperability, scalability and flexibility in merging conventional systems without operational disruption. Key components of a railway control system are: 1) communication with the train, and 2) train location. In Europe, ERTMS L3 will change the “fixed block” traditional approach into a “moving block” concept where conventional track circuits are virtualized and remotely configured [3]. In its advanced form, lineside information in ETCS is wirelessly transmitted to the driver inside the cab, giving the foundation for Automatic Train Control (ATC). As a first step towards automation, the Driver Advisory System (DAS) is a tool that helps the driver protect the train against collisions and other potential hazards. This is also the main goal of the Automatic Train Protection (ATP) subsystem, which is one of the three components of ATC. Automatic Train Supervision (ATS) and Automatic Train Operation (ATO) complete the ATC functionality. ATS takes into account other trains that are running and prevents any conflict that may occur. It prepares the necessary actions to be performed on the train and conveys them to its ATO subsystem, if available, or to DAS [4]-[7]. An innovative strategy for ATP and ATS is to implement a dedicated channel for train-to-train (T2T) communication, where wireless communication is preferred. This solution reinforces the balise-based ERTMS [8]. A commercial T2T system, developed by the German Aerospace Center (DLR) [9], enables dynamic train coupling for collision avoidance in both, regional and high-speed railway lines. An advanced ERTMS-compliant railway traffic control system is presented in [10]. Taking punctuality as its main goal, the authors define a decision support system to give each train a flexible time window of arrival. The Operation Control Center (OCC) receives real-time information, manages the train routes, prevents and detects any conflict in the railway network and solves it. Position monitoring is carried out through the data from GPS sensors inside the vehicles. Then, this information is sent using GSM-R. A computational study is performed on two dense areas of the Dutch railway network concluding that the use of advanced optimization tools is more effective than a local dispatch procedure. Other ERTMS systems are introduced in [11]-[14] for integrity and condition monitoring including Wireless Sensor Networks (WSNs). There, a wagon-to-wagon communication link for ATP is employed, similar to the T2T one mentioned above. In [15] a GPS-based solution to support virtual block operations in train control systems is presented. Replacing conventional track circuits and balises with a satellite-based solution is a key challenge to reduce deployment costs in train location. In fact, [16]-[18] deal with the vulnerabilities of balise-based ERTMS train location. The use of Global Navigation Satellite Systems (GNSS) in ETCS is discussed in [15],[19]-[20]. In other regions around the world, a similar evolution can be observed. The Chinese Train Control System (CTCS) will be able, in its most advanced level, to manage moving blocks and to locate vehicles utilizing either, beacons or GNSS. Authors in [21] show a Differential-GPS (D-GPS) positioning implementation in China. In USA, Positive Train Control (PTC) technology has been exploited since 2015. Only GPS location-is available, with no trackside equipment [22][23]. Australia is also pursuing an ATC system based on GNSS location, to be available in 2020 [24]. Regarding communication, T2T and Train-Centric Communication have been already mentioned [8]. For the Train-to-OCC link, GSM-R has been utilized, since its release in 2000, for the mainline in Europe. A new wireless framework for train communications is discussed in the > IDENTIFICATION NUMBER: ITSM-19-03-0041 < 3 Roll2Rail (R2R) project [25]. A different case is found for Mass Transit networks at suburban and urban areas, where Communications-Based Train Control (CBTC) systems are being developed by different suppliers. Despite interoperability is an important issue, the suppliers develop proprietary solutions. There are some publications that review the convergence between mainline and massive railway infrastructures in terms of control [26]-[28], including the proposal of a unified control system [29][30], but further research is still required. Finally, some publications propose CBTC as the path to enhance communications in the mainline or in low-safety facilities, like the ones considered in this article. In [31] communication-based ATOs are analyzed, with emphasis on standardization issues. A case study, based on the IEEE 802.11 standard, is shown. Best practices for CBTC systems are also presented, like the Copenhagen S-train project. Another approach using LTE can be found in [32]; it shows limitations in the overall Quality of Service (QoS), which are dependent on the selection of LTE cell parameters. In [33], the early deployment of a CBTC system in the New York City Transit is presented; some interesting information is also reported about deployment, testing and maintenance tools. Reference [34] proposes a novel multi-objective optimization technique for simulation tools in suburban CBTC systems; a case study in the region of Paris is considered. In [35], the successful implementation of a CBTC system using WSNs at Metro de Medellin is reported. III. SFPS FUNCTIONALITIES A. System Functionalities The objective of this work is to design a railway operation aid system with the following features: 1. Precise location of train composition, from head to tail. 2. Automatic routing of trains throughout the facility: from the entrance to docks, and vice versa. These routes can be launched from the OCC, or by the locomotive driver, if granted by the OCC operator. In each case, the corresponding assignment of the road will be made by sections, with interlocking of the control elements. This assignment: 1) uses the routes defined in the exploitation plan, 2) takes into account the occupation of the tracks by the rest of the trains, according to the current map of incompatibilities, and 3) releases the occupied sections when the train leaves them behind, so that they can be traversed by other trains. 3. Automatic management of traffic control elements (railroad level crossings and switches), according to the occupation of railway sections and planned routes. 4. Automatic management of railway signaling. 5. Traffic simulation functions, which visualize on a screen the movements of the trains, showing the state of control and signaling elements, with two objectives: a. to explore future situations ("Exploration" function), aimed at optimizing the assignment policies and control algorithms, and at increasing safety, and b. to reproduce past situations ("Moviola" function), aimed at studying those problems that have been found in the operation of the system, and at helping in the investigation of accidents. 6. Other functionalities for management, exploitation and maintenance, such as management of alarms and emergency situations. Fig. 1. Individual train arrival and departure flow chart. B. A Typical Use Case Fig. 1 describes the traffic management actions required by a train arriving at a facility (such as a port or logistics center) for freight loading/unloading. Upon arrival of the train, it is registered to SFPS, and its driver is allowed to check and modify the pre-registered information, if any. At the entry point, the length of the train is also measured. The measured length is compared to the registered data to detect potential conflicts. Once the length has been verified, the Route Planner (RP) determines the destination´s dock and calculates the optimal route, based on the data stored in the database, and accounting for the current state of the system and traffic conditions. The RP proposes this route to the OCC operator, who makes the final decision. Once the decision has been made, the same operator creates the route in the system and establishes the itinerary, which will be reflected both, in the OCC and in the OBU located in the cab locomotive. From that moment, the on-board equipment receives different guidance instructions, and the field elements located on the tracks receive control commands to operate the corresponding actuators until the train arrives at its destination. The OCC operator, or the driver with operator's permission, can, at any time, re-take the manual control; in this case, SFPS only supervises the movement of the train, preventing it from reaching blocked sections of the railroad. At destination, when the loading, unloading, or whatever maneuver the train had to carry out, ends, the OCC operator, or the locomotive driver, selects a new destination and repeats this process. The train is deregistered from SFPS when it reaches the facility exit point. > IDENTIFICATION NUMBER: ITSM-19-03-0041 < 4 (a) Logical architecture (b) Wireless network and physical components Fig. 2. SFPS Architecture IV. SYSTEM ARCHITECTURE A modular solution has been adopted, Fig. 2(a), which consists of: l) the Operation and Control System (OCS), 2) the Advanced System Information Platform (ASIP), 3) the On- Board System (OBS), and 4) the Security Manager (SM). In addition, Fig. 2(b) shows the communication network linking the Operational Control Center (OCC), the train On- Board Unit (OBU), field cabinets, actuators and sensors. A. Operation and Control System (OCS) The OCS integrates the basic functionalities of the operation and control, as well as the system database. It also interfaces with the rest of systems and databases of the Port Authority of Seville. Three subsystems of the OCS require specific attention: the Route Planner (RP), the Automatic Guidance System (AGS), and the Safety System (S2). Based on the information of the railway infrastructure and the hourly forecast for the arrival and departure of trains, the RP uses a route optimization algorithm for an efficient use of the infrastructure. Once the routes are established, the AGS is responsible for guiding the trains through the assigned routes. The AGS acts on the field control cabinets that command railroad switches and level crossings, driving the train along the route using the on-board GPS for train location. The OCS also has an option for manually lock and unlock the track sections, thus preventing the Planner from assigning an itinerary that could go through a section that is not available for whatever reason, such as maintenance or repair work. It also provides tools for the creation and modification of entities that allow updating and expanding the infrastructure. The operator can, at any time, launch the RP with updated information about trains schedule, available track sections and infrastructure elements, and the new generated routes are stored for future use. The S2 uses field sensors to validate the train position, correcting GPS inaccuracies and making decisions concerning security issues in the case of a failure in the SFPS protections or interlocking, or an impairment in communications. In that follows, a description of RP, AGS and S2 is done. The Route Planner (RP) Route planning consists of the automatic optimization of the paths to be followed by every vehicle, avoiding possible conflicts in the use of railway resources and minimizing waiting times for the scheduled trains on a journey. The RP receives the arrival timetable of convoys as an input, and it is able to prioritize routes according to user requirements. The route allocation algorithm is based on an iterative application of the backtracking technique, which is widely utilized in loading/unloading planning [36]. A complete explanation of the algorithm used in SFPS can be found in [37]. For each expected inbound convoy different route segments are iteratively allocated or removed according to a given cost function. A decision tree is formed where the scheduled times of arrival and departure are the main requirements to be fulfilled (Fig. 3). If a potential new route crosses a previously assigned segment, this route will be automatically discarded and it will be recomputed in subsequent iterations. Automatic Guidance System (AGS) The AGS is responsible for the management of the routes defined by the RP, once the trains enter the facility. The track strip is divided into virtual sectors in such a way that the exploitation logic is simplified, not allowing simultaneous circulation of trains in opposite direction in the same section. In addition, two logical track circuits must always be free between the adjacent trains that circulate within a sector in the same direction. The train is located with the GPS beacon installed in the OBU. Current train position is sent to the OCS, which maintains the virtual track circuits. There, the track occupancy is estimated based on the length of the train. The central equipment is able to detect the position of the train inside a specific virtual track circuit in milliseconds. The AGS has a table of routes, with their corresponding starting and ending points, and associated movements. The complete list of possible movements is stored in a movement table. In order to launch a route, the Central Operator requests it to the OCS through the console located in the OCC, or the locomotive driver requests it through the OBU. Once the request is made, the AGS analyzes the status of the field > IDENTIFICATION NUMBER: ITSM-19-03-0041 < 5 elements, checks the compatibilities for each route and if the result is positive, the route will be launched, locking the corresponding elements, which are highlighted in blue at the OCC and OBU displays. The virtual sign at the starting point will show a green light when each and every one of the conditions have been met; otherwise, the selected route will be locked, but with a red light, remaining on hold until the required conditions are met. Algorithm. Route planning (backtracking technique) 1: trainsArr /* Get scheduled train arrivals */ 2: For train in trainsArr then 3: currentLayer=1, backwards=0, nextFreeDock=NULL 4: error=0; 5: While 0< currentLayer ≤ MAX_LAYERS do 6: If train.InItinerary[currentLayer] == NULL or backwards==1 then 7: If backwards==1 then 8: releaseItineraries(train, currentLayer); 9: End If 10: nextFreeDock=getNextDock(); 11: If nextFreeDock!=NULL then 12: If criticalPoint(nextFreeDock)==true then 13: setPriority(train, currentLayer, nextFreeDock); 14: End If 15: nextDock(train, currentLayer, nextFreeDock); 16: nextLayer=currentLayer+1; 17: Else 18: nextLayer=currentLayer-1; 19: backwards=1; 20 End If 21: Else 22: If backwards==1 then 23: blockItineraries(train, currentLayer); 24: train.OutItinerary[currentLayer]=NULL; 25: nextLayer=currentLayer-1; 26: Else 27: outputDock=getOutdock(train); 28: If criticalPoint(outputDock)==true then 29: setPriority(train, currentLayer, outputDock); 30: End If 31: assignOutputDock(train, currentLayer); 32: nextLayer=currentLayer+1; 33: releaseDock(train, currentLayer); 34: End If 35: End If 36: currentLayer=nextLayer; 37: End While 38: If nextLayer==0 then 39: error=1; 40: 41: End If End For Fig. 3. Route planning backtracking algorithm. The routes can be configured between contiguous virtual signs, signs in the same sector, or signs from different sectors. Switches associated to a given route are positioned and locked, as well as the affected level crossings, until the train reaches the corresponding track circuits and its presence is detected. For long routes, according to regulation, the corresponding element is locked when the route is selected, but the level crossings are closed (and their related signs are activated) only when the train approaches their position. Itineraries are automatically released when the train passes, In the event that a route is not properly released when the train passes, due to whatever reason (for example, a failure in the GPS location), both, the person in charge in the field and the operator in the OCC, can do it by themselves, as an emergency maneuver. Safety System (S2) Since SFPS lacks a track circuit, the precise location of train composition is calculated from the D-GPS data obtained in the locomotive cabin and the length of the train. However, this calculation is sensitive to inaccuracies in the measurement of the train length and GPS, and to a communication failure. Therefore, for the sake of safety, two additional elements have been included in SFPS: the Train Composition Measurement (TCM) System, and the Redundant Monitoring System (RMS), which are part of the S2. The length of the composition is automatically measured at strategic points of the facility (such as, for example, at the entry points) through the TCM subsystem, whose sensors calculate the length of the composition based on the information coming from axle detectors installed on tracks. In addition, the presence of a convoy in a critical element (railroad switch or level crossing) must be accurately detected. The S2 adds Occupancy Detectors (ODs) located at the input and output of these elements. They use inductive loops that detect the presence of the metallic structure of the convoy. This information is used to validate and correct the estimated train position. The set of ODs deployed in the infrastructure and their associated circuitry constitute the RMS. Finally, the S2 takes also care of safety issues in local mode operation and emergency situation. As an example, in an emergency situation, when the OCS cannot command a given actuator, it has to be locally operated using the manual control board of the corresponding cabinet. Furthermore, every actuator can be operated in local mode even when SFPS is still in normal operation. For safety reasons, the movement of the trains through elements operated in local mode must be authorized by the person in charge, who locally supervises the maneuver and checks that the nearby signs in both directions that protect the element(s) are in red. This person must also authorize, via radio, the overpass of the physical and virtual red signs, as well as the movement of the affected trains. The S2 assists both, system operators and locomotive drivers, in these maneuvers. B. Advanced System Integration Platform (ASIP) The ASIP manages the interfaces with field elements (cabinets, sensors and actuators) and with the central operator. In the OCC, a set of displays show an interactive map where the status of the elements of the system, the location and status of trains, as well as the assignment of track sections made by the RP, and managed by the AGS, are displayed. Specific menus for control, monitoring, alarm handling, updates and maintenance are also part of this interface. The ASIP has been implemented on a FiWare platform [38]. FiWare is the result of an ambitious R&D project > IDENTIFICATION NUMBER: ITSM-19-03-0041 < 6 financed by the European Commission intended to build an open, public and scalable platform for the Internet of the Future. Concerning SFPS, it provides a common data framework where multiple, heterogeneous and independent systems publish data and access information provided by other systems. The Context Broker is the main module that facilitates communication. It allows the user to manage the entire lifecycle of context information regarding updates, queries, registrations and subscriptions. FiWare also provides a security layer for identity management, authorization, privacy and data handling, which is part of the SFPS Security Manager (SM). C. On-Board System (OBS) For a train to be associated with SFPS, its locomotive needs an OBU, which consists of D-GPS terminal and a PPU (Portable Pilot Unit). The OBS is in charge of the applications and services available to the locomotive driver by means of the OBU. Using the OBU, the driver can request to the OCS changes in the registered information, as well as request to launch, cancel or modify a pre-assigned route. Also, through the OBU, the driver receives information from the OCS about the state of infrastructure and traffic. Fig. 4 shows two views of the OBU interface. The first one is the main screen, which shows the speed and position of the train, the selected routes, the maximum speed on the current track and the status of the next virtual sign. This screen also shows other information, such as the status of the communication links and the push / pull operation of the locomotive. The second one displays a view of the track lines in the Port installation, showing the status of the physical and virtual signs. V. SFPS IMPLEMENTATION SFPS is developed with low safety requirements to achieve a considerable reduction of equipment and civil work required by conventional SIL4 systems. The field equipment is reduced to the positioning motors of railroad switches, the protection equipment of level crossings (with or without barriers), and their control cabinets. Some specific equipment is required to the physical implementation of SFPS. In the OCC a dedicated computer hosts the OCS. The ASIP is also located in the OCC and serves not only to SFPS, but also manages the Port database and interfaces with other services and applications of the Port Authority. The OBS is hosted in the OBU, and facilitates the provision of OCS services to the locomotive driver. The OBUS PPU is a commercial ruggedized tablet, with a WiMAX terminal and 3G/4G wireless communication. Field cabinets are commercial control cabinets, which have been adapted to SFPS requirements, with a significant reduction in cost. However, as the highest safety levels are still required in level crossings and switches, they are standard commercial components. The OCC and in-field control cabinets have an Uninterruptible Power Supply (UPS) to guarantee the service under possible mains failures. Fig. 5 shows the arrangement of the physical entities of SFPS. In that figure, two successive switches can be observed, as well as one level crossing located behind one of them. Assuming, without loss of generality, that the direction of movement of the train is from left to right, the sensors of the TCM subsystem, placed before the first switch, measure the length of the train before reaching the first track section controlled by SFPS. Fig. 5 also shows the location of the field control cabinets as well as the sensors of the RMS arranged at each switch and level crossing. A. New Physical Components for Safety Enhancement Two new elements have been especially designed for SFPS: the Train Composition Measurement (TCM) unit and the Occupancy Detector (OD), which will be described next. Train Composition Measurement (TCM) unit The TCM unit uses the detection assembly shown in Fig. 5, which consists of two pedal-type wheel axle sensors. Both detectors are placed at a known distance, being activated when the train axles press one pedal. By storing the passing time of the different axles, the train speed can be calculated, leading to a fairly accurate estimate of the train length. The algorithm for the length calculation is detailed in the Appendix. Occupancy Detector (OD) The objective of the ODs is to enhance the safety of SFPS in critical elements (switches and level crossings). For this purpose, one OD is installed at both ends of these elements. a) b) Fig. 4. Two views of the OBU interface. a) Main screen, b) Auxiliary screen showing track lines and railways signs. > IDENTIFICATION NUMBER: ITSM-19-03-0041 < 7 Fig. 5. Simplified view of a typical SFPS deployment, including one Level Crossing (LC) and two Railroad Switches (RSs). Occupancy detection is carried out by means of inductive loops composed of a ring-shaped cable buried between the two rails of the track (Fig. 6). A pair of wires, from the field cabinet, provides power for the generation of a magnetic field. The variation of the magnetic field that produces the passage of the metallic structure of the convoy is measured, activating a detection signal. This signal is processed in the PU and sent to its field cabinet, which takes the appropriate actions on actuators and signaling devices. Two loops are installed in each level crossing, Fig. 7(a), and three loops in each switch, Fig. 7(b), to control every input and output. The detection of a train causes the locking of the corresponding element. The inductive loops are placed at a safe distance, according to the maximum speed permitted to a train. When the detector stops detecting the train, the locking of the element is maintained for an additional guard time. Fig. 6. Simplified scheme of an Occupancy Detector (OD). B. SFPS Communication Network To eliminate the cost of deploying a wired communication infrastructure in a wide area network, SFPS employs wireless communication. SFPS components can be integrated to the wireless communication backbone (based on WiMAX) through a WiMAX terminal, or through other communication links that access to a set of WiMAX concentrators installed in the control cabinets, and in some specific locations. These concentrators host the coordinator of a low data rate WLAN network (based on the IEEE 802.15.4g standard), also acting as gateway to the WiMAX backbone network, Fig. 2(b). The WiMAX network has 8 point-to-point high-speed (100 Mbps) links that build the network backbone, 5 base stations to connect the field equipment to the backbone, and one lowspeed (45 Mbps) point-to-point link to reach the most distant parts of the facility. Lowest protocol layers use IEEE 802.16 standard in the free 5.4-5.8 GHz frequency band. For the WLAN, a sub-GHz (868 MHz) band has been chosen, as a tradeoff between coverage range and data rate (up to 1 Mbps). In the SFPS terminology, the Processing Unit (PU) is the device in charge of reading and processing the data transmitted through a Wireless Terminal (WT) of the IEEE 802.15.4g network. These data are received in the ASIP through the WiMAX backbone network. Data coming from sensors are refreshed with a 5 seconds period, although alarms are asynchronously transmitted with low latency. Even though SFPS preferably uses this wireless network, the local data exchanged between the field control cabinets, the actuators of critical elements (i.e., switches and level crossings) and their associated signs, use conventional wires, meeting the strictest safety requirements. Furthermore, the communication between the OBU of the train and the OCC uses the public network (GSM/LTE) of a telecommunication operator as a redundant communication link, in case of a failure of the SFPS wireless networks. VI. SAFETY ISSUES As SFPS is a SIL0 system, safety issues have been of especial concern in both, the architectural design and the physical implementation of SFPS. To this end, the S2 in the OCS deals with safety issues in the logical level, while the TCM unit and the ODs contribute to safety enhancement in the physical level. A thorough Safety Study has been carried out by a group of experts, rising up to 32 potential hazards. For each hazard, the study provides a complete description, including causes, potential consequences, initial Frequency, Severity and Risk- (F/S/R-classification), mitigation by design, other mitigation activities, final F/S/R-classification, and recommendations for SFPS application and use. The results of this study have led to changes in the initial logical and physical implementation of SFPS, to satisfy regulatory s requirements. Table I shows a simplified example of the description of one of the Hazards in the Safety Study. When a failure is detected in train location (reported by the > IDENTIFICATION NUMBER: ITSM-19-03-0041 < 8 locomotive driver, or detected by the ODs deployed along the infrastructure), a field actuator does not work, or a field element cannot communicate with the OCC, then, the SFPS blocks the concerned elements, preventing trains from crossing the affected sectors. As far as the failure persists, trains can only cross those sectors with elements in local mode, authorized by the person in charge, and assisted by the S2. VII. SYSTEM INNOVATIONS SFPS introduces a set of innovative solutions based on Information and Communication Technologies (ICTs), in order to significantly reduce acquisition, installation, operation and maintenance costs, which are related to train monitoring and control in Table II. To mention: 1. Train location by D-GPS, which eliminates the high cost of conventional track circuits. The GPS information is complemented with the measurement of the train length, to accurately locate the entire train in its itinerary. 2. Virtual track circuits based on geo-coordinates. Tracks are split into sections following the same criteria used in standard track circuits. No physical infrastructure, hardware, cables or civil work is required which leads to a significant reduction in cost. 3. Virtual signaling. With the exception of some critical elements (railroad switches and level crossings), which comply with the highest safety requirements (SIL4), the rest of traffic signaling is controlled from the OCC and offered to the locomotive driver in a virtual way, through an OBU. The OBU displays useful information for the locomotive driver, including the train identifier, its length and speed, the sections of the railroad of interest, the status of the control elements and their associated signaling, and the planned routes. When compared to a conventional system, the OBU includes a DAS. a) Level crossing (LC) b) Railroad switch (RS) Fig. 7. RMS elements: Location of occupancy detectors. TABLE I EXAMPLE OF POTENTIAL HAZARD ENTRY CONSIDERED IN THE SFPS SAFETY STUDY ID Hazard Hazard Causes Potential Consequences Mitigations by design Additional Mitigations Initial F/S/R Final F/S/R HZ-001 The Route Planner (RP) determines 2 incompatible routes An error in the RP logic Trains Collision The set of incompatible movements is stored in the Exploitation Program There will be, at least, 2 free virtual track sections between trains that travel in the same direction There will be, at least, one free virtual track section between simultaneous routes in the same track sector Field tests will be carried out to check correct functioning of the RP CA-01: Previous exploitation rules are maintained. To mention: maximum speed of trains in the facility is limited to 30 km/h Frequency: (D) It is possible one occurrence in the system lifecycle Severity: Critical Risk Classification: Non-Desirable Frequency: (E) An occurrence in the lifecycle has a very low probability Severity: Critical Risk Classification: Tolerable TABLE II SFPS FEATURES IN TRAIN MONITORING AND CONTROL AUTOMATIC TRAIN CONTROL (ATC) TRAIN LOCATION COMMUNICATIONS Automatic Train Protection (ATP) Automatic Train Supervision (ATS) Automatic Train Operation (ATO) DAS incorporated at OBU Automatic braking not required ODs to prevent collisions Remote control of level crossings and switches Operation and Control System (OCS) Not implemented Virtual track circuits and sectors D-GPS + TCM WLAN: IEEE 802.15.4g network Backbone: WiMAX. Two ways for train-OCC: WiMAX and Mobile Operator (GSM, LTE) T2T comm. not implemented