MTCS – Modular Train Control System SIL 4 Railway Computer for Rolling Stock and Wayside Applications

The MTCS Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 » MTCS – Modular Train Control System » Safety Compliance with EN 5012x » Environmental Compliance with EN 50155 » Long-Term Availability MTCS Architecture » Safe MTCS Controller » Safe MTCS Remote I/O Box » Safe MTCS CPU Component » Safe MTCS I/O Components » MTCS Configuration Examples » Safe MTCS Real-Time Ethernet Topology » MTCS Software Architecture » MTCS Safety Guaranteed by TÜV Certificate MTCS Application Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . » Rolling Stock » Wayside MTCS...

The MTCS Approach MTCS is an open and modular railway computer platform based exclusively on standard hardware and software. It is certifiable up to SIL 4 in all its single parts and complies completely with the EN 50155 and EN 50121-4 railway standards. MTCS is designed to operate in rolling-stock applications such as Automatic Train Control (ATO) and Automatic Train Protection (ATP) as well as in wayside applications like interlocking systems. MTCS consists of the safe controller, the safe I/O functions and the communication interfaces to the “outside” world. The final safety level of MTCS...

Safety Compliance with EN 5012x MTCS complies with the requirements of the EN 5012x family of railway standards developed by CENELEC, based on IEC 61508 (Functional Safety of Electrical / Electronic / Programmable Electronic Safety-related Systems): » EN 50126: Railway Applications – The Specification and Demonstration of Reliability, Availability, Maintainability and Safety (RAMS) » EN 50128: Railway Applications – Communications, signaling and processing systems » EN 50129: Railway Applications – Communications, signaling and processing systems – Safety related electronic systems for signaling...

MTCS Architecture The heart of the MEN Train Control System is the MTCS controller which delivers state-of-the art computing performance based on x86 PC technology. The MTCS controller consists of a safe part and what is called an “unsafe” (general purpose) part. The MTCS controller can be used as a standalone device and in combination with up to 63 remote I/O boxes. Safe MTCS Controller The communication inside the MTCS system – between the safe MTCS controller, safe I/O boards and safe remote I/O boxes – is based exclusively on a safe standard real-time Ethernet . Its modular configuration...

Safe MTCS Remote I/O Box Safe MTCS CPU Component The central element of MTCS is the safe CPU board F75P, a standard CompactPCI board that is designed to execute safety-critical applications as well as “unsafe” applications and comes with a dedicated certification package: Each MTCS remote I/O box consists of: In the MTCS standard configuration and as such included in the certification packages available, the two independent control processors run the safe deterministic real-time operating system QNX Neutrino, while the “unsafe” general purpose processor operates under Linux . An extension of...

Safe MTCS I/O Components MTCS Configuration Examples MTCS System Controller: MH50C Configuration Example 1 Option slots populated with safe I/O » 8 digital outputs, SIL 4 (each using 2 pins) » 16 digital inputs, SIL 4 (each using 2 pins) » 8 frequency input channels, SIL 4 The SIL 4 certified safe I/O boards comprise the typical functions required for railway applications and come with dedicated certification packages: » » » » » » K1 – 8 binary outputs K2 – 16 binary inputs K3 – safety relay outputs in preparation K4 – 4 frequency inputs, used to measure the speed of the train via wheel sensors...

Safe MTCS Real-Time Ethernet Topology MTCS Remote I/O Boxes: Configuration of a KT8 providing » 8 SIL 4 outputs (each using 2 pins) + 8 SIL 2 outputs » 16 SIL 4 inputs (each using 2 pins) + 16 SIL 2 inputs » 4 SIL 4 frequency input channels (using 2 separate frequency counters) MTCS Controller Real-Time Ethernet Master BC MTCS Controller Real-Time Ethernet Master BC » 8 SIL4 outputs (each using 2 pins) » 16 SIL2 inputs » 4 SIL2 frequency input channels I/O Boards MTCS System Controller in Combination with Remote I/O Boxes: MTCS Controller The complete MTCS I/O – no matter whether it is part of...

MTCS Software Architecture MTCS Safety Guaranteed by TÜV Certificate Safe Domain (CPU Board) User Safety Application User Safety Application Safety Communication Layer Compare Safety Communication Layer Compare Safe QNX/Safe BSP Safe QNX/Safe BSP Safety Case Safety User Guide Communication (Shared RAM, Virtual Ethernet) I/O Domain (CPU Board) Black Channel None-Safe Application Communication Diagnosis, Services Driver Libraries Linux (Soft Real-Time) QNX Drivers External Interfaces Safe Domain (I/O Board) Safety Communication Layer The MTCS software distinguishes between the safe and the “unsafe”...

MTCS Application Areas Wayside Rolling Stock Gear Control Fuel Control Wheelslip Control Driver Display Driver Cab Controls/Indicators MTCS Controller Valves, Relays, Sensors… MTCS is both well suited for use in new interlocking systems and for a soft modernization and automation of older relay interlockings . Existing outside facilities can be preserved and adapted . The extremely compact inside facility of an interlocking system is clearly separated and forms the safe platform (SIL) for the control and automation layer . MTCS is compact, safe and robust in accordance with EN 50155 and EN 50121-4...

MTCS Benefits Summary Open Hardware Standard Safety Safety levels SIL 4, SIL 3, SIL 2, SIL 1, SIL 0 Flexible configuration of safety levels results in optimum price/performance Provides safety by means of 2 control processors on a single CPU board The system provides the correct service or remains silent . » Safety execution with 2 redundant processors » 1 general purpose processor » Independent supervisors for each block Robust industry-proven backplane and computer board standard Well-known enclosure standard Robust board standard Clustering of hardware components if the system must stay operational...