RTE RBC 2oo2 Reference Application 0.1.0 build 0006685
SIL 4 2oo2 Dual-Site Fault-Tolerant ERTMS Radio Block Centre Reference Architecture
Loading...
Searching...
No Matches
Platform_RTE RBC 2oo2 ERTMS Operational Logic Specification

Document Reference**: Platform_RTE-DOC-ERTMS-001
Specification Baseline**: UNISIG Subset-026 (Issue 3.6.0 / Baseline 3) Chapter 3, 5, 7, 8
Safety Integrity Level**: CENELEC EN 50128 SIL 4
Target Application**: RBC_GP Redundant Radio Block Centre

1. Executive Overview

The Platform_RTE RBC reference application (RBC_GP) implements a deterministic, safety-critical subsystem for ERTMS/ETCS Level 2 operations. It executes operational procedures defined in UNISIG Subset-026 Chapter 5 within the redundant, single-threaded Platform_RTE 2oo2 Cyclic Executive architecture.

All message parsing, state evaluation, profile computation, and response formatting strictly adhere to SIL 4 constraints:

  • Zero dynamic memory allocation: All sessions, routes, and packet descriptors are statically allocated at startup.
  • 2oo2 cross-comparison: Both Channel A and Channel B independently evaluate all incoming ERTMS packets and cross-compare their train-session tables every ONLINE cycle; the flat-scheme train, IL and CTC outputs are released only on agreement. ERTMS replies (including the Msg 3 MA) are not yet behind that gate (root ISSUES.dox ISS-048). Details: site redundancy and A/B agreement, section 6.
  • Fail-Safe state handling: Malformed or unverified packets immediately trigger deterministic rejection or emergency stop reactions.

2. ERTMS Procedure Matrix & Code Architecture

┌────────────────────────────────────────────────────────┐
│ EURORADIO Radio In (Gateway C) │
└───────────────────────────┬────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ AB GP ERTMS ENGINE DISPATCHER │
│ (ab_gp_ertms_engine.c) │
├────────────────────────────────┬─────────────────────────────────────────────────┬───────────────────────────────────────┤
│ Procedure Module │ UNISIG Subset-026 Reference │ Primary ETCS Messages & Packets │
├────────────────────────────────┼─────────────────────────────────────────────────┼───────────────────────────────────────┤
│ ab_gp_proc_session.c │ §5.3 Communication Session Management │ Msg 155, Msg 24, Msg 159, Msg 156 │
│ ab_gp_proc_train_data.c │ §5.4 Validated Train Data & Start of Mission │ Msg 129, Msg 8 │
│ ab_gp_proc_ma.c │ §5.5 Movement Authority (MA) & Speed Profiles │ Msg 3, Packet 15, Packet 21, Packet 27│
│ ab_gp_proc_position.c │ §5.6 / §5.8 Position Supervision & Linking │ Msg 136, Packet 0, Packet 1, Packet 5 │
│ ab_gp_proc_emergency_stop.c │ §5.10 Emergency Stop Management │ Msg 15 (CES), Msg 16 (UES), Msg 147 │
│ ab_gp_proc_shunting.c │ §5.11 Shunting Mode Procedure │ Msg 130, Msg 27, Msg 28 │
│ ab_gp_proc_eom.c │ §5.13 End of Mission & Session Termination │ Msg 150, Msg 24, Msg 156 │
└────────────────────────────────┴─────────────────────────────────────────────────┴───────────────────────────────────────┘
│
▼
┌────────────────────────────────────────────────────────┐
│ 2oo2 Consensus Verification │
│ (ab_gp_channel_crosscompare.c) │
└───────────────────────────┬────────────────────────────┘
│
▼
┌────────────────────────────────────────────────────────┐
│ EURORADIO Output Transmission (To Gateway C) │
└────────────────────────────────────────────────────────┘

3. Detailed Procedure Specifications

3.1. Session Management (Subset-026 §5.3)

Source Module: RBC_GP/src/application/AB/GP/ertms_procedures/ab_gp_proc_session.c Workflow:

  1. Train on-board initiates connection by sending Msg 155 (Initiation of a communication session).
  2. RBC validates system compatibility and replies with Msg 24 (General message / System Version Confirmation).
  3. Train acknowledges session establishment via Msg 159 (Session Established).
  4. State machine transitions from AB_GP_ERTMS_SESSION_IDLE $\rightarrow$ INITIATED $\rightarrow$ ESTABLISHED. Verification Test: 08_ertms_session_management_and_som.robot.

3.2. Validated Train Data & Start of Mission (Subset-026 §5.4 & §8.4.2)

Source Module: RBC_GP/src/application/AB/GP/ertms_procedures/ab_gp_proc_train_data.c Workflow:

  1. Train transmits Msg 129 (Validated Train Data) containing:
    • L_TRAIN: Total length of train in meters.
    • V_MAXTRAIN: Maximum operational design speed.
    • M_AXLELOAD: Axle load category.
    • M_LOADINGGAUGE: Loading gauge profile.
    • M_AIRTIGHT: Airtight equipment flag.
  2. RBC performs validity and boundary checks against track engineering limits.
  3. Upon acceptance, RBC transmits Msg 8 (Acknowledgement of Train Data) with timestamp T_TRAIN_DATA_ACK.
  4. State machine transitions to AB_GP_ERTMS_SESSION_DATA_VALIDATED. Verification Test: 08_ertms_session_management_and_som.robot.

3.3. Movement Authority (MA) & Profile Generation (Subset-026 §5.5)

Source Module: RBC_GP/src/application/AB/GP/ertms_procedures/ab_gp_proc_ma.c Workflow:

  1. Interlocking assigns and locks route(s) for the train.
  2. RBC MA generator calculates route path from current train position to End of Authority (EOA).
  3. Generates Msg 3 (Movement Authority) containing:
    • Packet 15 (Level 2/3 Movement Authority): Section lengths, EOA location, Limit of Authority (LOA) target speed, and section timers.
    • Packet 21 (Gradient Profile): Slope gradients and distances along the path.
    • Packet 27 (Static Speed Profile - SSP): Speed limits for all track sections.
  4. State machine transitions to AB_GP_ERTMS_SESSION_FS (Full Supervision). Verification Tests: 02_il_grants_a_movement_authority.robot, 03_il_extends_the_movement_authority.robot, 09_ertms_movement_authority_and_speed_profile.robot.

3.4. Train Position Supervision & Balise Linking (Subset-026 §5.6 & §5.8)

Source Module: RBC_GP/src/application/AB/GP/ertms_procedures/ab_gp_proc_position.c Workflow:

  1. Train periodically sends Msg 136 (Position Report) containing Packet 0 (or Packet 1):
    • NID_LRBG: Last Relevant Balise Group identity.
    • D_LRBG: Distance from LRBG to front of train.
    • Q_DIRLRBG: Direction of movement relative to balise group.
    • V_TRAIN: Current train velocity.
  2. RBC updates topological position in the internal database and validates track occupancy.
  3. If balise linking is configured, RBC responds with Packet 5 (Linking Information) announcing upcoming balise sequence and tolerances.
  4. RBC reports TrainPositionInRoute to Interlocking for route release tracking. Verification Tests: 01_train_connects_and_reports_position.robot, 04_second_train_connects_and_reports_position.robot, 07_il_receives_train_position_in_route.robot, 10_ertms_position_supervision_and_balise_linking.robot.

3.5. Emergency Stop Management (Subset-026 §5.10)

Source Module: RBC_GP/src/application/AB/GP/ertms_procedures/ab_gp_proc_emergency_stop.c Workflow:

  1. Triggered on:
    • Interlocking route emergency cancellation.
    • Unsafe track boundary overrun or position discrepancy.
    • Manual operator intervention from CTC.
  2. RBC transmits Msg 16 (Unconditional Emergency Stop - UES) or Msg 15 (Conditional Emergency Stop - CES).
  3. Train applies emergency braking and replies with Msg 147 (Emergency Stop Acknowledged).
  4. State machine enters AB_GP_ERTMS_SESSION_EMERGENCY_STOP. Verification Test: 11_ertms_emergency_stop_management.robot.

3.6. Shunting Mode Procedure (Subset-026 §5.11)

Source Module: RBC_GP/src/application/AB/GP/ertms_procedures/ab_gp_proc_shunting.c Workflow:

  1. Train at standstill requests shunting permission via Msg 130 (Request for Shunting).
  2. RBC consults Interlocking / CTC shunting authorization zone.
  3. If allowed, RBC sends Msg 27 (SH Authorised); if refused, sends Msg 28 (SH Refused).
  4. Upon authorization, session transitions to AB_GP_ERTMS_SESSION_SHUNTING. Verification Test: 12_ertms_shunting_mode_procedure.robot.

3.7. End of Mission & Session Close (Subset-026 §5.13)

Source Module: RBC_GP/src/application/AB/GP/ertms_procedures/ab_gp_proc_eom.c Workflow:

  1. Driver selects End of Mission (or train arrives at destination siding).
  2. Train transmits Msg 150 (End of Mission).
  3. RBC acknowledges via Msg 24 and transmits Msg 156 (Communication Session Termination).
  4. Session cleanly transitions to AB_GP_ERTMS_SESSION_IDLE and track allocations are released. Verification Test: 13_ertms_end_of_mission_and_session_close.robot.

4. Redundancy & Failover Behavior

  1. Intra-Site 2oo2 Synchronization:
    • Every ONLINE cycle, the 19-byte session slot of each train (in_use, train_id, cycle, d_lrbg, granted_length, ma_seq, ma_acked) is cross-compared between Channel A and Channel B (ab_gp_channel_crosscompare.c). Train data records, MA packets and the route database are not compared (ISS-048).
    • On agreement both channels stage their outputs and the Gateway forwards the first copy; ERTMS replies are staged without waiting for the agreement (ISS-048).
  2. Hot Standby State Retention:
    • The ONLINE site sends its train-session table and route database to the STANDBY site in every inter-site frame (cold and warm standby; independent hot computation is not built).
    • When the ONLINE site announces FAULTED before its reboot, the STANDBY site promotes itself to ONLINE and takes over the sessions and route allocations (14_hot_standby_failover_retains_routes.robot). A silent ONLINE site (node or link failure without a FAULTED notice) is not taken over automatically: the STANDBY site waits for an authenticated dispatcher confirmation. Rules: site redundancy and A/B agreement, section 5.
  3. Cold Switch Safety:
    • On a full cold restart of active nodes, routes in RBC memory are cleared safely; Interlocking re-evaluates the track layout and re-grants routes (15_cold_standby_clears_routes.robot).