1. PROLAN Process Control Co. ELPULT INTEGRATED RAILWAY TRAFFIC CONTROL SYSTEM Péter Lantos Head of SCADA development dep.

2. 2 Establishment: 1990 Owners: Hungarian private shareholders Staff: 98 people (80% engineers) Annual income: approx. 20 m EUR PROLAN Co.

3. 3 Target markets Electric power industry Railway industry Energy management, smart metering

4. Target of ELPULT Remote control system – building CTCs Different interlocking systems Extending the life-cycle and the functionality of the relay- based interlocking equipment High level of safety and availability 4

5. Safety requirement 5 Tarnai G., Sághi B., I. Krbilová: Quantitative hazard and risk analysis. Advances in Electrical and Electronic Engineering Žilina, No 1-2 Vol 5/2006. 2006. pp. 169-170. Tarnai G., Sághi B.: Hazard and Risk Analysis of Human-Machine Interfaces of Railway Interlocking Systems. 7th World Congress on Railway Research. 2006. jún. 4-8., Montréal, Canada.

6. Safety requirement II 6 Fail-safe: where safety states are: Inhibition of control If there is not indicators – detection by system/ operator

7. 2oo2 = 2-channel: JIF „g” relay + control check of RTU = fail-safe comparator JIF checked by MMI Alternated picture from both channel Differences between channel detected by MMI PC and operator Diversity of addressing Duplicated for RAM Safety architecture 7

8. Software development THR level for each subsystem SIL level for design MMI run on Linux = COTS -> SIL 2 RR11 - Preliminary assessment of Linux for safety related systems (http://www.hse.gov.uk/research/rrhtm/rr011.htm)http://www.hse.gov.uk/research/rrhtm/rr011.htm Kernel and IO function for process independence Not for reliability (see safety state)! Special critical control mode? Processed in more phases and also on diverse threads 8

9. Special critical control 9

10. Software assessment Development according EN 50128 Generic product + special parameterized application 2 design level 7 test level (4 for generic + 3 for application) functional white and black box, performance/stress testing, safety req. testing Communication (between processes and subsystems too) EN 50159-1 Fault analysis – fault categories for Linux processes + SWFMEA 10

11. Applications CTC – south part of Lake Balaton CTM – train tracking, time-distance diagram, automatic passenger information system run in one channel (minimalizes safety relevant core) CTC – automatized train routing Start 2011. jun Other: GySev; MAV 13-15 station 11 FONYÓD CTC Szabadbattyán Kiscséripuszta Lepsény Siófok Balatonaliga Balatonszabadi - Sóstó Zamárdi felső Szántód - Kőröshegy Balatonszárszó Balatonszemes Balatonlelle felső Balatonboglár Balatonfenyves Balatonmáriafürdő Balatonszent györgy Sávoly Zalakomár Nagyrécse Nagykanizsa Zalaszentjakab

12. Next step: Prosigma 12

13. SIL4 Safety Signal Transiver 2 out of 3 architecture. Asymmetric design ( the number of the inputs and outputs not necessarily the same ) Object elaboration Hardware and the software Designed according to SIL 4 standards IP based communication - 50159-2 standard (possible to use in open(!) network) extended temperature range ( -25- 70℃ environment, 105 ℃) 100V input tolerant, (300V input tolerant for 1 sec) 10mA constant current sink, to clean the contacts. Scalable outputs: fault tolerant outputs. In case of 1 fault, the system works fail safe output. In case of 1 fault, the system stop working SIL4 data acquisition for RBC, ELPULT… 13

14. 14 Thank you for your attention

15. 15 Onboard system for locomotives Central Unit GPS - GSM Fuel and energy supervisory GPS based localization Engine diagnostics

16. 16 Inbuilt display of onboard system