1. Executive Summary & Standards Compliance

The CTC <-> RBC interface connects the dispatcher's Centralised Traffic Control (CTC) / Traffic Management System (TMS) with the Radio Block Centre (RBC) in an ERTMS/ETCS Level 2 railway network.

Primary Responsibilities:

Train Identification & Schedule Integration: Linking commercial train service numbers with ETCS $NID_ENGINE$ identities. Real-Time Traffic Supervision & Telemetry: Streaming high-accuracy position, speed, operating mode, and Movement Authority status to the dispatcher. Temporary Speed Restriction (TSR) Management: Dispatcher-commanded speed restrictions broadcast over radio to trains. Dispatcher Emergency Interventions: Selective or area-wide emergency stop triggering and revocation. System Diagnostics & Redundancy Supervision: Monitoring RBC Primary/Standby states, IXL links, and GSM-R/FRMCS base station health.

Note: Simulation Testbed Status (Simplified Mode): In the current test simulator environment (RBC_Test_Sim_CTC / RBC_Test_Sim_Core), CTC operates as a receive-only observer logging indications (CTC_CONNECTED, CTC_MA_GRANTED, CTC_MA_EXTENDED) as documented in RBC_Test_Env/doc/design/SIM_INTERFACES.dox. This simplified wire protocol maps directly into the formal TMS supervision indications defined below.

2. Interface Protocol Architecture

The communication interface operates as an event-driven, bidirectionally synchronized transport link (TCP/IP or reliable datagram with JSON or packed binary telemetry frames).

sequenceDiagram
    autonumber
    participant CTC as Centralised Traffic Control (TMS)
    participant RBC as Radio Block Centre (RBC)
    participant Train as Train (EVC)

    Note over CTC,RBC: 1. Train Initialization & Timetable Binding
    CTC->>RBC: RBC_CTC_CMD_ASSIGN_TRAIN_DESCRIBER (Train=101, Service="ICE 784", Dest="BERLIN")
    Train->>RBC: Msg 155 / Msg 136 (Connected, D_LRBG = 500m)
    RBC->>CTC: RBC_CTC_IND_TRAIN_CONNECTED (Train=101, Service="ICE 784", Pos=500m)

    Note over CTC,RBC: 2. Continuous Real-Time Supervision
    loop Every Cycle (500ms - 1s)
        RBC->>CTC: RBC_CTC_IND_TRAIN_TELEMETRY (Speed, AllowedSpeed, Mode=FS, EOA=4200m)
    end

    Note over CTC,RBC: 3. Dynamic TSR Injection
    CTC->>RBC: RBC_CTC_CMD_SET_TSR (ID=42, Start=12.5km, Length=1500m, Speed=60km/h)
    RBC->>Train: Msg 24: General Message (Packet 65 TSR)
    Train-->>RBC: Msg 146: Ack
    RBC->>CTC: RBC_CTC_IND_TSR_CONFIRMATION (TSR=42, State=ACTIVE_ONBOARD)

    Note over CTC,RBC: 4. Dispatcher Emergency Intervention
    CTC->>RBC: RBC_CTC_CMD_EMERGENCY_STOP (Scope=ZONE_WEST, Reason="Track Worker Alert")
    RBC->>Train: Msg 16: Unconditional Emergency Stop (UES)
    RBC->>CTC: RBC_CTC_IND_ALARM_EVENT (Severity=CRITICAL, Desc="UES Triggered on Train 101")

3. Protocol Message Catalogue

3.1 CTC $\to$ RBC Commands (Dispatcher Directives)

Command ID	Name	Direction	Payload Structure	Operational Purpose
0x01	Assign Train Describer	CTC $\to$ RBC	nid_engine, service_number[16], destination_id, departure_time, train_length_m, max_speed_kmh	Binds a physical ETCS train engine to its commercial passenger/freight timetable entry.
0x02	Set TSR	CTC $\to$ RBC	nid_tsr, start_section, start_offset_m, length_m, speed_limit_kmh, valid_from, valid_to	Injects a Temporary Speed Restriction due to track maintenance, hot weather, or infrastructure faults.
0x03	Revoke TSR	CTC $\to$ RBC	nid_tsr	Cancels an active TSR once the hazard is cleared.
0x04	Emergency Stop Command	CTC $\to$ RBC	nid_engine ($0 = \text{All trains in area}$), nid_em	Forces immediate emergency brake intervention on target train or entire geographical sector.
0x05	Revoke Emergency Stop	CTC $\to$ RBC	nid_engine, nid_em	Releases emergency stop after situation is safely resolved.
0x06	Query RBC Status	CTC $\to$ RBC	query_mask	Requests a full snapshot of active trains, MA limits, and subsystem health.

3.2 RBC $\to$ CTC Indications (Supervisory Telemetry & Events)

Indication ID	Name	Direction	Payload Structure	Operational Purpose
0x81	Train Connected	RBC $\to$ CTC	nid_engine, nid_lrbg, d_lrbg_m, connection_time_ms	Informs dispatcher that a train has registered with the RBC and established a radio session.
0x82	Train Disconnected	RBC $\to$ CTC	nid_engine, disconnection_time_ms, reason	Informs dispatcher of clean mission termination or unexpected radio loss.
0x83	Train Telemetry	RBC $\to$ CTC	nid_engine, service_number, position_m, speed_kmh, allowed_speed_kmh, etcs_mode, etcs_level, ma_length_m, supervision_state	Real-time tracking vector enabling graphical display on CTC workstation.
0x84	MA Status Update	RBC $\to$ CTC	nid_engine, event (GRANTED, EXTENDED, SHORTENED, REVOKED), ma_seq, ma_length_m, target_speed_kmh	Notifies CTC whenever the train's movement authority changes.
0x85	TSR Confirmation	RBC $\to$ CTC	nid_tsr, status (PLANNED, ACTIVE_ONBOARD, REVOKED)	Confirms that a commanded TSR has been accepted and is currently enforced by onboard trains.
0x86	Alarm Event	RBC $\to$ CTC	alarm_id, severity (INFO, WARNING, CRITICAL), nid_engine, description[64]	Alerts dispatcher to safety-critical events: Emergency Brake intervention, radio loss, balise error, route deviation.
0x87	RBC Health & Heartbeat	RBC $\to$ CTC	nid_rbc, is_primary_active, ixl_link_healthy, connected_train_count, cpu_load_percent	Cyclic diagnostic report verifying RBC 2oo2 primary/standby status and wayside network health.

4. Telemetry Supervision States

The RBC computes a high-level Supervision State for each active train:

NORMAL: Train is running within permitted speed profile under Full Supervision (FS) or On Sight (OS).
WARNING: Train is approaching Limit of Authority (LOA) or exceeding warning speed curve (audible alert on driver DMI).
INTERVENTION: Train exceeded permitted emergency braking curve — onboard EVC has triggered Emergency Brake (EB) application.
COMM_LOST: Train missed radio position reports beyond $T_{NVCONTACT}$ supervision window.
STANDBY: Train is stationary in Standby (SB) mode awaiting route authorization.

5. Security & Availability Principles

**Redundant Telemetry Broadcasting**: Telemetry is reported symmetrically by both 2oo2 channels and validated through voter consensus.
**Zero Impact on SIL 4 Safety**: While the CTC interface carries operator commands, all vital safety constraints (MA length, speed restrictions, interlocking protection) are independently verified and enforced by the SIL 4 RBC kernel before execution.