AI 930 Safe Communication

Slide1 : Case Study: the Eurocab railways signaling Studienfall: die Eurocab-Signalisierung Cas d'etude: signalisation ferroviaire Eurocab (ETCS) Dr. Eschermann ABB Research Center, Baden, Switzerland Industrial Automation Automation Industrielle Industrielle Automation


Overview Dependable Communication : Overview Dependable Communication 9.3.1 Cyclic and Event-Driven Communication (Revisited) 9.3.2 Communication Availability and Safety (Persistency and Integrity) Communication Hazards Transmission Redundancy Error-Detecting and Correcting Codes Time Stamps, Sequence Numbers and Timeouts Source and Sink Identification 9.3.3 Example: Eurocab Safety Protocol


Example: Automatic Train Protection (ATP) : TASK: Train speed £ maximal allowed speed. advance signal main signal train speed braking curve computed by ATP system usual behavior of loco driver emergency braking by ATP system Example: Automatic Train Protection (ATP)


Slide4 : Simplified Structure of an ATP System speed brake e.g. target speed, target distance vital computer • on-board system • track-side devices


Eurocab: Motivation : Eurocab: Motivation


ATP Systems in Western Europe : ATP Systems in Western Europe ASFA: Dimetronic ATB: ACEC Transport AWS: Westinghouse BACC: Ansaldo, SASIB KVB: GEC Alsthom EBICAB: ABB Signal Indusi, LZB: Siemens, SEL SELCAB: Alcatel SEL TBL: ACEC Transport TVM: CS Transport ZUB: Siemens


Eurocab: Bus-Based Structure : Eurocab: Bus-Based Structure


Role of the “Safety” Protocol : Role of the “Safety” Protocol


Protection of Vital Periodic Data : Protection of Vital Periodic Data


Addressing on Bus: Source-Addressed Broadcast : Addressing on Bus: Source-Addressed Broadcast


Safety ID for Vital Data : Safety ID for Vital Data item safety ID example value 0F11 comment name of telegram length periodic/sporadic broadcast/point-to-point source function sink function grace period time stamp interval measured_speed 256 bits periodic broadcast SDM any 3 - 1 ms, + 257 ms for identification data + explicit safety fields producer of the data since data are broadcast number of telegrams that may be lost before safety reaction has to be initiated receiver check accuracy for time stamp characteristics unique value for telegrams with given etc. ...


Implicit and Explicit Data : Implicit and Explicit Data


Time Stamp Characteristics : Time Stamp Characteristics Creation Resolution (¹ accuracy !): 1 ms Range (32 bits implicit+explicit): about 50 days Resolution gives upper bound on accuracy, but maximal accuracy does not have to be utilized today and by all units Checking Sequence check by comparison TS(i) ³ TS(i – 1) Age check by comparison LBTS(i) £ TS(i) £ UBTS(i) Acceptable window [LBTS(i)-TS(i), UBTS(i)-TS(i)] defines accuracy of age check. Window accounts for unknown effects of clock inaccuracy, clock drifts, transmission delays, etc. Can be tuned to exact telegram requirements (specified in Description Table for each Safety ID).


Summary: Eurocab Safety Protocol : Summary: Eurocab Safety Protocol