This invention relates to the field of transportation, and in particular to a method of controlling driverless guided vehicle movements without the use of an intelligent wayside zone controller. The invention is particularly applicable to trains, but may be used for other forms of guided vehicle.

Background of the Invention

Driverless trains are becoming increasingly common, especially in urban transportation systems. Existing solutions depend on intelligent wayside controllers, such as Zone

Controllers or a Vehicle Control Centre to track all trains, set and lock routes, and authorize train movements. Such solutions are described in IEEE 1474, which relates to

Communications Based Train Control. An example of such a system is the Seltrac™ system manufactured by Thales.

These devices have an expensive project life cycle, are complex to design, install, certify and maintain, and need to be customized with the rules of the operating railway. Failure of a single wayside control device shuts down all automatic operation within the territory governed by that device, Additionally, these devices require access controlled equipment rooms, and these rooms can be expensive to build for this purpose.

Summary of the Invention

According to the present invention there is provided a vehicle management system for guided vehicles running on a guideway, comprising intelligent on-board controllers associated with each vehicle for controlling operation of the vehicle and reserving assets required for the vehicle to safely move along the guideway; wayside devices beside the guideway responsive to commands from the intelligent on-board controllers for controlling system infrastructure; and a data storage system for storing system data; and wherein the on-board controllers are configured to continually communicate with on-board controllers on other vehicles in their vicinity to determine the availability of assets needed for their associated vehicle to move along the guideway, and to reserve these assets by

communicating with the on-board controllers on other vehicles, the wayside devices and the data storage system.

Such a system avoids the need for a safe movement authorization from a wayside-based vital controller or wayside signaling equipment such as interlockings, zone controllers or vehicle control centres.

The guideway may be train tracks, although it could be other forms of guideway such as rails, concrete viaduct, monorails, or roads with all changes in lane or track limited to fixed locations referred to as "switches".

The on-board controllers are in continual communication with each other over a broadband data communication network, such as Wi-Fi, for example. This means that they can be in continuous communication, or update at frequent intervals, for example, once per second. The continual communication should occur sufficiently frequently for them to maintain situational awareness in real time.

The data storage system can be virtual and can be provided by the on-board controllers on the trains. It can also include a physical component for logging new trains into the system.

Embodiments of the invention provide a method to safely authorize and efficiently control automatic/Driverless train movements without the use of an intelligent wayside 'Zone Controller' or 'Interlocking'. Embodiments of the invention also provide a resilient, data communication system that allows implementation of virtual local area networks connecting devices on moving trains and trackside devices. This solution extends the use of such data communication in existing CBTC systems to include direct train-to-train communication.

Advantages of the invention include the elimination of the need for an intelligent Zone Controller, Vehicle Control Centre and/or Interlocking devices on the wayside. Complex wayside controllers are replaced with simpler generic, single point of control devices, which allow the minimization of cabling requirements for command and control.

Embodiments of the invention also allow an increase in throughput due to tighter control loop on movement authorization (eliminating the need for a third party (e.g. Zone Controller) to manage conflicts.)

Embodiments of the invention also provide a method of managing communicating between the components of the system to ensure both a guaranteed safe operation and a quick notification of events, which could impact the safety of the system.

The vehicles may also communicate with a trackside controller, such as such as switch machine controller, platform door controller, track access device controller, etc.

According to another aspect of the invention there is provided a method of managing guided vehicles running on a guideway, comprising providing intelligent on-board controllers on each vehicle for controlling operation of the vehicle; providing wayside devices beside the guideway; and providing a data storage system for storing system data; and wherein the onboard controllers are configured to continually communicate with on-board controllers on other vehicles in their vicinity to determine the availability of assets needed for their associated vehicle to move along the guideway, and to reserve these assets by communicating with the on-board controllers on other vehicles, the wayside devices and the data storage system.

According to a still further aspect of the invention an intelligent on-board controller for guided vehicles running on a guideway, which is configured to continually communicate with onboard controllers on other vehicles in their vicinity to determine the availability of assets needed for their associated vehicle to safely move along the guideway, and to reserve these assets by communicating with the on-board controllers on other vehicles, the wayside devices and the data storage system.

Brief Description of the Drawings

The invention will now be described in more detail, by way of example only, with reference to the accompanying drawings, in which: -

Figure 1 shows a layout of a system in accordance with one embodiment of the invention; Figure 2 shows an exemplary train configuration;

Figure 3 is a state machine representing the switch control function of a wayside device; and

Figure 4 shows an exemplary algorithm for ensuring safe movement of a train when combined with a vital operating platform such as the Thales TAS Platform'.

Detailed Description of the invention

Continual direct train-to-train communication is a key aspect of the present invention. This eliminates the need for the standard wayside-based route setting system and allows trains to be aware not only of their own position and performance but that of neighboring trains so that they can more quickly react to changes in conditions ahead, instead of relying on the wayside device to either warn of pending hazard or advise of clear track ahead. In embodiments of the present invention, wayside devices are simple generic controllers located trackside, which are used to reserve and control devices such as switch machines, platform doors, etc., in response to commands from the on-board controllers.

All intelligence about safe train movement and control is thus located on the train. Each train has an Very intelligent OnBoard Controller (VOBC) configured with the guideway information needed to determine its safe operating environment as a result of

communication with other trains' VOBCs in its vicinity and 'dumb', generic wayside devices. This guideway information includes the running topology as a directed graph, the civil data needed to determine safe speed and braking profiles (including grade and curvature). This arrangement eliminates the need for complex, intelligent wayside infrastructure. A suitable hardware platform for the VOBC for implementing the invention is offered by Thales as part of the Seltrac™ signaling system. The wayside infrastructure can be localized to field devices so that a wayside device failure only impacts the area local to that device. The onboard computer system implements and controls and the safe operational movement of the train.

System initialization and coordination of conflicting movements are handled by a service called the Data Storage System (DSS), which may be implemented as a Virtual machine comprising the on-board controllers. A physical unit may be installed at a convenient wayside location to enable initial system startup. Once there are trains operating in the system, failure of that device will not impact operations as the services provided are redundantly duplicated in all on-board controllers (VOBC).

Each VOBC continually communicates with other VOBCs in the system and generic wayside devices via the communication network. From this communication, each VOBC determines how far it can allow the train to safely travel. Prior to proceeding, the VOBC must 'reserve' this territory with the other VOBCs and wayside devices in its vicinity. The train VOBC must negotiate its movement needs with the other trains VOBC that could be in conflict with its intended movement. It must also ensure that all wayside track devices are set in the proper position and 'locked' to allow safe movement of the train. Figure 4, which will be discussed in more detail below, shows the algorithm for assuring the safe movement of trains.

In order to ensure that train VOBC knows its environment, it must communicate with all trains' VOBCs in the system. The data communication network is established for this purpose. The data communication network should preferably be broadband, but it is not required to provide data security features.

A dumb virtual 'wayside' system DSS detects new trains and logs them into the system. The DSS also logs all reservations and status of wayside devices. The DSS is also used for configuration management to ensure that all trains' VOBCs are operating with the correct application version and the correct track databases. It also registers all temporary changes in operating conditions such as Go Slow Zones, Closed Stations and Closed Tracks. The DSS also acts as a clearing house to log all reservations and status of wayside devices.

A Virtual Data Storage System keeps track of all trains in the system and all system operating parameters and topology. A dedicated machine may be installed to enable system initialization but once VOBCs have entered into the System, the DSS system is distributed in such a way that any of the VOBCs can also supply the services of the physical DSS.

Each VOBC is based on a vital (Cenelec SIL4) operating platform such as the VOBC offered as part of the Seltrac™ system. The Virtual Data Storage System is implemented by running a background process on every vital machine (SIL 4) in the system which listens to communication traffic and collects key data as identified by the configuration profile. Each vital machine is provided with a priority sequence number at start up from the vehicle supervision system. Based on the priority sequence number, the primary DSS server is allocated as well as a secondary DSS server. Both of these servers will share data with the active vehicle management system processes as required. If the primary server fails, the secondary server will become primary and activate the next priority machine as secondary. If the secondary machine fails, the primary server will activate the next secondary server. In the rare event that both servers fail before a new server can be activated, the background process will re-initialize a new primary and secondary server based on the negotiated priority sequence numbers.

The Communication system permits each device to communicate with every other device in the system.

For example, direct communication takes place between vehicles' VOBCs and switch controllers, to reserve move, and lock the switch in the desired position. The switch will only be 'unreserved' and made available for another train when the reserving train VOBC has authorized the release. Figure 3, described in more detail below, shows the simple state machine used to ensure only one train can control a switch at anytime. The switch does not respond to commands from train Y while it is reserved for train X.

Referring now to Figure 1 , each train 10, designated Τ, .,.Τη _, contains a very intelligent on board controller VOBd ...VOBC _n , Each VOBC is based on a vital (Cenelec SIL4) operating platform such as the VOBC offered as part of the Seltrac™ system. These controllers control train motion based on limit of movement authority derived from wayside devices status and reservations from other VOBCs. The VOBC communicates with other trains' VOBCs in the system, the DSS, and wayside devices 11 designated WD _X ...WD _Z in Figure 1 .

The vehicle supervision system 13 provides for the man machine interface to control the operation of the system. The vehicle supervision system 13 communicates with wayside device 12, the DSS 11 and the VOBCs on the trains 10. The vehicle supervision system 13 also determines the service requirements for each train 10.

The data storage system, DSS 1 1 , is the depository for the system data including topography, wayside device status and reservation vehicle position, temporary speed restrictions, closed stations, and closed tracks.

The DSS 11 communicates with the vehicle supervision system 13, wayside devices 12, and the VOBCs, and is used to 'protect' entry into the system by unauthorized/un-protected trains. The DSS 11 is implemented as a 'cloud' service. A single device provides for normal and startup operations, but in case of failure the service can be provided by any other VOBC on-Board unit in the system.

The wayside devices 12 are single point of control devices (redundant or non redundant) that control a wayside device e.g. switch, passenger emergency stop buttons, platform door controller etc. Each wayside 12 device communicates continuously with the DSS 11 and the trains' VOBCs 10 when polled. In addition, if there is an uncommand change in state to a 'reserved' device, the wayside device will push an alarm to the reserving train allowing for a minimal response time to crisis events.

In order to assure diversity in the execution of control in the system, the system provides a diverse path for the control and reservation of wayside devices 12. This assures that the safety of the system is maintained in the event of wayside devices and communication failure.

The diverse control path operates on the principle that any request for a more permissive move must be confirmed via a diverse path between the trains VOBC, the wayside device, other train VOBC's, and the DSS (11). This is achieved by the wayside device 12 logging and confirming the clearance request first with the DSS 12 and then confirming the clearance with the Train VOBC. The train VOBC from its side independently verifies the clearance with the wayside device 12 and the DSS 11 in order to assure that clearance request is persistence from two independent sources (wayside device and DSS).

If the device is already reserved the train VOBC need only to communicate with the wayside device 12 to confirm that the device is already reserved.

Once the train VOBC has consumed its reservation the train VOBC releases the reservation independently to the DSS 1 1 and the wayside device 12. The wayside device does not clear the reservation until confirmed by the DSS that the reservation is clear via the persistent diverse path.

The trains' VOBC also communicate their location and other status of the train subsystems to the DSS 1 1 on a cyclic basis via communication network. The DSS 11 updates the train position once the position of the train is consistently received and reports it to the vehicle supervision system 13. wayside devices 12 that only provide status (axle counters, track circuits passenger emergency stop buttons etc.) communicate their status to the DSS 11 on a cyclic basis and when interrogated (via the communication network) by a train VOBC.

In an exemplary embodiment, the system operates as follows: On entry to the system from dark territory not covered by the system, a particular train's VOBC communicates with the DSS 1 1 to obtain a status of all the trains in the system (location travel direction etc.). From the received status the train VOBC determines special locations where it may interact with its immediate neighbors.

In addition the train's VOBC obtains the reservation status for wayside devices in its immediate surroundings and the status of the guideway, for example, temporary speed restriction, closed track etc.

The train VOBC obtains its destination from commands from the vehicle supervision system 13 and uses the information to command and control its movements along the guideway.

The detailed algorithm is shown in Figure 4. At the start 401 a train is stationary. On a trigger event to move to the next destination a determination is made at step 402 of all trains in conflict. Communication is effected with each train in potential conflict at step 403. A step 404 a determination is made as to whether an actual conflict exists. If not the route is set to the destination at step 405 to permit the train to proceed to the destination 406.

If a conflict exists a determination is made at step 407 whether there are any switches before the conflicting train 407. If not a determination is made as to the point of conflict and the route set to the point of conflict 409.

If there is a switch before the potentially conflicting train, a determination is made as to whether the switch can be reserved the conflict 410. If yes the switch is reserved to avoid the conflict at step 411.

A typical timing sequence for the safe clearing of reservations for a device using a diverse path is as follows:

At time TO , Switch X is reserved for Vehicle A. At time T1 , Vehicle A determines that Switch X reservation is no longer required to ensure safe operation.

At time 12, Vehicle A sends message to WD for Switch X to clear reservation.

At time T3 , Vehicle A sends message to DSS that Reservation of Switch X is no longer required.

At time T4 , Data Storage Systems sends message to WD for that Train X does not require reservation of Switch X.

At time TO , WD has consistent information that Vehicle A does not require reservation of switch X so reservation is released.

Various functions need to be performed by the VOBCs as follows:

Determination of Limit of Authority

The VOBC on a train communicates with the other trains' VOBCs in its vicinity to obtain the reservation associated with each of the other trains.

By determining its commanded destination the VOBC determines the sections of track it will need to get permission to enter and occupy. If none of the required tracks are occupied or reserved by another VOBC or the DSS, the VOBC reserves the tracks with the DSS and other trains VOBCs and all wayside devices along the section. In parallel the wayside devices 12 then register their reservation status with the DSS 1 1 prior to communicating the information to the reserving train VOBCs. Once the reservations have been confirmed the train VOBC advances its limit of authority into the reserved direction.

As the train traverses the section it releases the reservation to the DSS 1 1 , the wayside devices 12 and the other trains VOBCs. This process repeats itself until the train arrives at its destination. As the train VOBC continuously communicates with other trains' VBOCs, the wayside devices 12 and the DSS 11 , should an abnormal event occur that may impact or violate the train's safety operating envelope or the reservation (switch becoming out of correspondence), the VOBC pulls back its limit of authority and if necessary operates the Emergency Brake.

Reservation of Wayside Device

The train VOBC identifies the wayside device that is required to be reserved in a particular state to enable the train to continue safely on its intended journey.

The VOBC receives confirmation from DSS 1 1 that a particular wayside device is reserved for the train's use. (If not, the VOBC(1) will ensure the train stops safely in front of the device).

The train VOBC receives confirmation from the wayside device that it is locked in correct state and reserved for it.

The train VOBC advances its limit of authority.

When the rear of train has cleared the device, the VOBC sends a release message to the wayside device and the DSS.

Reservation of Open Tracks

The train's VOBC identifies the area of track that is required for the next leg of its assignment and requests a reservation of that area from the DSS 11.

The DSS 11 identifies to the requesting train VOBC all VOBCs that also require part of that section of track. The train VOBC receives information from the other VOBCs regarding the state of their reservation and sets its limit of authority based on the area it is able to safely reserve after confirmation with the DSS.

VOBC Communications

The train VOBC maintains continuous communication with the DSS 11 over the

communications network. The train VOBC communicates with each train VOBC in its vicinity ('connected' trains if the railway network is treated as a graph) once per second.

The train VOBC communicates with all other trains VOBCs in the system cyclically to monitor health of the system

In the example shown in Figure 2, VOBC1 must reserve and lock the switch wd1 in the correct position by communicating with wd1 , it must ensure the platform doors in the station are locked closed by communicating with wd2, and it must ensure the proceeding train with VOBC2 has moved sufficiently out of the platform and unreserved the area to allow safe ingress before it can extend its movement authority into the station area and dock the train.

Once docked, VOBCI communicates with WD2 to synchronize the opening of the train and platform doors.

Handling of Conflicting Reservation Requests

In general, the vehicle supervision system pre-sets reservations for trains based on the operational priorities of the schedule so that, when a train requests a reservation, it is either 'pre-approved' or rejected due to an existing conflict. In the event of failure of the vehicle supervision system, it is possible that a race condition may be created between conflicted routes and the system reacts safely. In this case, the DSS 1 1 allocates the reservation to the track or device on a first-come-first-served basis.

Handling of On-board Failures

There are two classes of failure of on-board equipment: failures that prevent communication and failures that prevent continued safe operation of the train. It should be noted that the train installation would normally include fully redundant controllers and redundant radios so that failure of a single component should not result in loss of control or communication capability

Failures that prevent continued safe operation of the train by the train VOBC will cause the train to come to a stop on the track and will require manual intervention to safely move the train to a location where it can either be repaired or removed from service. To enable this movement with minimal impact to the rest of the system, the vehicle supervision system 13 can reserve the track and devices for the required train movement and release the route once the train has been taken out of service via the DSS 11.

Failures that prevent communication will also result in the train coming to a stop at the limit of its previously authorized movement authority. If communication cannot be reestablished, it will be necessary to manually move the train using the ATS to set and reserve the route for the train via the DSS 1 1.

A train may use its 'safe braking model' algorithms, as already implemented in existing SelTrac solutions, to determine if it can safely extend its existing train movement without infringing on another train movement. This includes both the normal, expected train braking profile and the emergency braking profile associated with the vehicle failures that impact normal train movement such as propulsion failure, common mode brake failures, and power failures,

Embodiments of the invention thus permit a vital wayside control device with no knowledge of the train control or route locking requirements of the system to be used to ensure safe movement of trains across and in the vicinity of the controlled device.

The trains preferably employ a data communication system that allows high quality train to train communication and train to track device communication to connect safe operating platforms (hardware and operating system) on board moving vehicles constrained in movement by fixed guideways such as rails, concrete viaduct, monorail, or road with all changes in lane or track limited to fixed locations called 'switches'. However, it is not required to provide security or safety functionality.

The bandwidth requirements of the data communication system used to implement a communication-based train control system can be minimized while providing the necessary, real time data to each vehicle to ensure safe operation.

The vital computer platform may be used to provide system initialization data. This then becomes part of the Data Storage System co-located on intelligent vital devices throughout the system to ensure operational availability of the ability to move vehicles even in the event of multiple failures.