Modular Train Control System menTCS

Editor's Notes

• #2: menTCS is an open and modular railway computer platform based exclusively on standard hardware and software.
• #3: menTCS is the first computer system ever in the history of the railway industry that separates the control electronics – i.e. the computer hardware – from the real control function – the application software. It is based on defined open standards for hardware, software and communication. Its modularity makes it configurable for every control function inside and outside the train. It is certifiable up to SIL 4 in all its single parts and complies completely with the EN 50155 railway standard. Based on COTS products, the heart of the system is the menTCS controller, based on the dual-redundant and SIL 4-certified CompactPCI PlusIO board F75P. The controller can be used stand-alone or can be extended by up to 63 remote I/O boxes with safe I/O cards for binary in- and output.
• #4: menTCS separates the safe parts of the application from the non-vital parts, thus reducing the software certification effort. The non-vital communication and service functions run on standard Linux, guaranteeing that the system is open towards the external world. The safe application runs in a safe kernel of the QNX real-time operating system and can either be directly programmed with standard "C" language, offering POSIX compliant APIs or optionally a safe PLC.
• #5: The menTCS software distinguishes between the safe and the non-vital domain in order to save cost and time for application development and certification. This separation allows the development of non-vital relevant applications separately from safe applications. Non-vital applications cannot influence safe applications because they are executed on a separate processor running a standard Linux operating system. The loss of the I/O processor is not dangerous. Via the FSoE protocol (Fail Safe over EtherCAT) appropriate communication between the safe controller and the safe I/O functions is guaranteed. This method to transport safe data over untrusted communication - called “black channel” – is defined in the EN 50159 standard and ensures end-to-end protection of transmission.
• #6: PACY is a process data application framework that makes the menTCS hardware transparent for the application. It handles the communication between the CPU together with custom-specific application software and the safe I/O cards. Being a transparent abstraction layer PACY takes care of the execution of the application’s commands, providing an API for "C" language programming. Developers can control the I/O through "C" language variables independently of the kind of I/Os that need to be controlled. As a module-based framework PACY opens up all interfaces from the application to the hardware. This allows a flexible extension by individual, custom-specific modules. A SIL 4 certification according to EN 50128 will also be available for PACY, including the corresponding documents PACY is configured by a configuration tool allowing to run the same application, using different menTCS I/O boards.
• #7: The complete menTCS I/O – no matter whether it is part of the MH50C controller or located in the remote I/O boxes – is connected via real-time Ethernet, so that the application can treat all I/O functions in the same way. All remote I/O boxes are connected to the controller in a ring topology, which tolerates single failures. For example, in case of a broken cable, the system is still fully operational, as all I/O boxes can still be reached from the other end of the ring. The data transfer of the inputs and outputs is realized via safe real-time Ethernet. Based again on an industry standard, also the safety of the I/O communication is proven by TÜV SÜD.
• #8: Being a totally open platform concerning software and hardware, menTCS is the first and only railway computer that offers a separation of the rail service from the electronic control system behind. This unique feature allows railway system suppliers to concentrate on their core business. menTCS is well suited for use in new train models as well as for refurbished trains. menTCS is also well suited for use in new interlocking systems or for a soft modernization and automation of older relay interlockings. The guaranteed long-term availability of all parts of the menTCS for a minimum period of 10 years makes it a future-safe, robust and cost-effective solution.