RICERCA ITALIANA     

Dependability-oriented design of electric apparatus on board train

Università degli Studi di Padova

Abstract

On board the modern trains there is a lot of electrical apparatus that can be grouped into four systems:
- supply system, composed by a transformer (for ac electrical lines) and by static power converters for voltage regulation on the power line,
- traction drive, composed by ac motors and voltage source inverters for the controlled supply of the motors,
- auxiliary equipment, formed by a variety of devices (illumination circuits, motor-driven compressors, batteries, etc.) and by static power converters for conditioning their supply voltage,
- communication network, which links aboard apparatus and devices for an integrated management of them.
The quality of the service carried out by the train system (and its safety) depends on the correct operation of all the above-mentioned systems. The increasing of the systems complexity, the demand of new functionalities and the more and more wide employment of electronic control units are factors that tend to impair the correctness of the service.
The research program under consideration fits into this scenario of topical relevance and great social and economical interest and intends to consider the design of the electrical apparatus in the light of the increased requirements of safety and quality of service. The theoretical tool by which the topic will be faced is the dependability theory, recently developed in order to set in an organic way the study and the design of safety-critical systems. This theory is therefore directly applicable to the electrical on board-train apparatus, the correct operation of which is mandatory for the safety of passengers as well as for the integrity of the train and of the environment. Its application, however, can be also extended, even if under different requirements, to the other apparatus with the purpose of improving the quality of service.
The program will be carried out by four Research Units, who have agreed with the scientific premise outlined above, by developing research programs focused on the dependable design of electrical apparatus on board train. This design method is completely different from the traditional approach, which is aimed at satisfying the performance requirements, while leaving the achievement of reliability to the selection of the components.
The Research Units and the electrical systems dealt with in the research program are as follows:
- Unit of Pisa deals with the traction drive,
- Unit of Napoli deals with the supply system,
- Unit of Trieste deals with the auxiliary equipment,
- Unit of Padova deals with the communication network.
The program is organized in four stages that, in short, are devoted to:
- the study of global and single dependability of the electrical apparatus on board train,
- the design of the apparatus according to dependability criteria,
- the arrangement of prototypes and/or models for testing the apparatus,
- the evaluation of the achieved dependability degree.
The research outcome will be constituted by procedures and design solutions of the electrical apparatus on board train, carried out according to dependability criteria. Not less important is the deep knowledge that will be acquired by the Units in studying and experimenting dependable electrical systems. A key point of the project is the presence of research collaborators belonging to companies and corporations, including Trenitalia (the Italian company administrating the rolling stock). If, on one hand, this presence is evidence of the applicative interest of the research subject, on the other hand, it will support the Units in transferring the knowledge acquired in the field toward the industrial world. <<<

Principal Investigator

Giuseppe BUJA Università degli Studi di PADOVA

Research Objectives

In the past, the electric apparatus for railway applications were designed according to simplicity and cost-effectiveness criteria. Many apparatus were used for helping the machine drivers that controlled their operation and, when necessary, directly took care of the possible faults or, generally speaking, of the apparatus malfunctioning. In the last few years, the technological context has radically changed: the electrical apparatus perform an increasing number of complex tasks and often substitute for the operators in doing services critical for the safety and the quality of service. Thus, it has became mandatory to arrange apparatus with prefixed levels of operativeness, commonly obtained by means of a "robust" choice of the components. Such a solution, however, does not make use of the potentialities that an extensive approach to the operativeness of the apparatus could offer, by encompassing their design and by executing the design by help of methods and solutions made available by the recent scientific and technologic advancements. The research program under consideration is aimed at facing this issue, by approaching the design of the apparatus on board train in conformity with criteria based on the dependability theory.
In the railway environment, the dependability theory has been recently used for designing the fixed signalling plants. By the research program under consideration, it will be also applied to the design of the electric apparatus of a train. The program starts by analysing the functionalities of the apparatus on board train, paying particular attention to the faults and their effects on the accomplishment of the service. On the basis of this analysis and with the end of improving the dependability level of the apparatus, the program intends to investigate in the design stage architectural, structural and functional solutions able to cope with the faults and their effects. Successively these studies will be formalized by setting up design procedures and will be applied to the development of prototypal apparatus. The effectiveness of the procedures will be verified by means of fault resilience tests carried out at first by means of computer simulations and then on prototypal layouts or reduced-scale models. The main purpose of the tests is to subject the apparatus to different fault conditions and to demonstrate their ability to react in accordance with the behaviour established in the design stage.
In the research program they will be studied both the on board-train power apparatus (the supply or power system and the traction drive), the so-called auxiliary equipment (but, in practice, necessary for the good running of a train and for the passenger comfort), and the communication network that is mounted on all the modern trains for the exchange of data among the apparatus. Four Research Units will take part in the research program and each of them is in charge of a given apparatus. In detail, the Unit of Pisa will be concerned with the traction drive, the Unit of Napoli with the power system, the Unit of Trieste with the auxiliary equipment and the Unit of Padova with the communication network.
The objective of the research program will be reached through intermediate steps. An important step is a meeting of the Units that is scheduled during the first phase of the project with a twofold purpose: the assessment of a common base of knowledge about the dependability theory and a global analysis of the dependability requirements of the electric apparatus on board train. The target of the analysis is the recognition of the interaction existing among the apparatus in case of fault and the definition of the dependability level of each apparatus.
The final objective of the research program is split into individual objectives for the apparatus dealt with by the various Units. A concise analysis of these objectives is reported below.
The objective of the University of Pisa is the development of an architecture endowed with high dependability level for the traction drive. The objective will be reached by selecting an architecture that lends itself to the implementation of structural solutions and/or of control techniques able to reduce and/or to react successfully to fault situations. The effectiveness of the adopted solutions will be initially examined by simulation. Then the more promising solutions will be designed and the validity of the choice will be verified by means of experimental tests carried out on a scale-reduced prototype.
The objective of the University of Napoli is the analysis of fault-tolerant structures for the static conversion apparatus of the power system on board train. The apparatus deliver energy to both the traction drive and the auxiliary equipment; therefore their capability of rejecting the faults plays a strategic role for the dependability level of the whole train system. They will be considered both structures that, in case of fault, remain totally operative and structures that continue to run with reduced performance. The study will be carried out on the various existing types of power systems (for dc lines, for ac lines and for multi voltage systems) and will take into account the dependability features of the transformer in the systems where it is used.
The objective of the University of Trieste is the improvement of the dependability level of the electric auxiliary equipment. To achieve this goal, they will be studied and developed fault-tolerant techniques tailored with the peculiarities of the considered system. In fact, it can be seen as a distributed system, constituted by several apparatus that interact each other and are distinguished by different critical behaviors. The study will be focused on the converters supplying the auxiliary devices and on the associated electronic control units.
The objective of the Unit of Padova is the analysis and the experimentation of a high-dependability communication network to be applied on board train. The research program plans the analysis of the modern communication protocols on-purpose developed for safety-critical applications and the implementation of a network based on the protocol exhibiting the best performance. The network will be at first tested on a bench and then on a railway demonstrator (H/S emulator of the train devices), set up within this project and aimed at testing the dependability characteristics (and the communication performance) of the network in realistic conditions. The program research also includes the comparison with the today in-use protocol (TCN) both in terms of protocol services and of experimental results.
Other goals of the research project are to share within the Units and to discuss the designing experiences and the results, including the intermediate ones, and to spread the acquired know-how over the scientific and industrial community. The sharing and discussion activity is very important because of the novelty of the demanding tasks of the research; such an activity will foster the exchange of the experiences, previously obtained or in-progress acquired, among the participants and this undoubtedly will be beneficial for the research activities of the project. The spreading of the know-how will take place through presentation and divulgation means (web site, workshop, publications). To manage these activities a technical committee will be constituted, formed by the heads of the Units and the national coordinator and in charge of the exchange of information among the Units and the promotion of the advertising activities. <<<

Timescale

24 months

National and international background

In the modern transportation systems with economic and social relevance, such as the railway system, safety, completion of the expected service, availability of the system, reduced number of reserves are mandatory requirements. The achievement of these objectives is made even more difficult because, for technical and historic reasons, national and international railway networks use different levels of voltage and supply of different type (DC or AC). Furthermore, in the last years European Union is pushing towards the interoperability of the railway transportation systems, i.e. toward the introduction of locomotives able to operate with supply networks having different electrical parameters. Therefore, the apparatus on board train are requested -on one side- to be continuously improved in their functional performance to satisfy the market demand and -on the other side- to be able to carry out more and more complex tasks, such as to be robust against events capable of damaging or deteriorating the functionality of the apparatus, to make the on-line diagnosis of the rolling stock, to provide new on-board auxiliary services that, incidentally, are constantly increasing and absorb a power quantity that is no more negligible compared to that for the traction.
It is obvious that the greater-than-before structural and functional complexity of the apparatus is supposed not to go to the detriment of their reliability and availability. On the contrary, today it is necessary to enhance these parameters because the users require a more and more effective service, besides safety. The problem of the quality of railway service has been faced in several different ways: usage of more robust components, of high-maintainability equipment, of sophisticated diagnostic instruments, redundancy of components and/or equipment, and so on. These solutions cover only partial aspects of the problem: for example, the diagnostics must be associated to adequate fault-tolerance techniques to guarantee acceptable levels of the quality of service, the redundancies solve local problems of availability of a given component and so on. As a conclusion, nowadays there is no a unified approach to the problem of the quality of service and a theoretical frame of reference providing the necessary tools is missing. The participants to the research program are persuaded that the way to overcome this situation consists, on the one hand, in facing the issues posed by the quality of the service from the designing stage of the apparatus and, on the other hand, in using the dependability theory as a tool orienting the design.

The dependability theory provides in an organic way the means for studying and designing systems critical for the safety, for the continuity of the service and so on. After defining the dependability as the reasonable confidence that the service provided by a system meets the expectation, the theory principally deals with:
- the analysis of the causes that impair the dependability; they are the faults that occur in the devices and that propagate in the system producing an incorrect behavior of it (malfunctioning);
- the usage of the well-known measurable quantities: reliability, availability, maintainability and safety to quantify the level of the dependability;
- the arrangement of techniques able to enhance the dependability: the main ones are prevention, tolerance, removal and forecast. The most popular technique is tolerance; it basically consists of three steps (detection of the malfunctioning, its confinement and system reconfiguration), with actions correlated with the level of functionality required for the system under a malfunctioning. The level can be either of operational type (the system goes on operating as usual) or of safe type (the system enters into a safe state) or of silent type (the system sets itself in a state where it does interfere with the other systems). The tolerance techniques usually run by help of additional hardware and/or software resources (redundancy) with the capacity of monitoring the functionality of the system and of substituting partially or totally for it. However, the most effective technique to achieve an high level of dependability is the prevision that is applied from the design. It develops in two stages:
- the analysis of the cause of the faults and of how they propagate to produce a malfunctioning,
- the assessment of design solution suitable either to prevent the malfunctioning or to react to it with the adoption of proper tolerance techniques.

In the research program a train composed by a locomotive and a number of passenger cars will be considered. In the locomotive they are located the supply system, the traction drive, part of the e and some of the nodes of the communication network. The cars, instead, have aboard the remaining part of the electric auxiliary equipment and the other nodes of the network.

The supply system, made up of power converters and, if any, of a transformer, is somewhat complex for the multi-voltage locomotives. In the actual situation (EN 50163) there are supply power lines in AC, single phase at 25 kV/50 Hz and at 15 kV/16,67 Hz, and DC lines at 3 kV and at 1,5 kV. The basic solutions today used for the power converters of the supply system are: multi-level choppers for DC supply lines and transformers with multi-secondary windings cascaded with four-quadrant rectifiers for AC lines. Both typologies co-exist in multi-voltage locomotives. Semiconductor devices with nominal voltage and commutation frequency higher than in the past are nowadays available. This makes it possible to simplify the conversion structures arranged for DC lines and suggests the adoption of innovative configurations in the case of AC lines. For the latter ones, for instance, it is under evaluation the convenience of using a solution adopting a multi-level AC/AC converter directly connected to the supply voltage and of connecting the transformer at the output of the converter. By this solution the transformer operates at a frequency higher than that of the line and its size can be greatly reduced. In cascade to the supply system there is the traction drive. This is equipped with a chopper when DC traction motors are used or with a three-phase (two- or multi-level) inverter when the traction motors are induction machines. Various devices are also connected to the intermediate DC link for voltage smoothing (capacitors), for harmonic filtering (LC circuits) and for protecting the subsequent stages from overvoltages and/or failures of the supply system (crowbar). From the scientific literature it emerges that almost all the research efforts on the supply system and the traction drive are addressed to the optimization the performance of the apparatus while there is poor attention to the analysis of circuit topologies and control techniques that are inherently fault tolerant. Only recently a few papers have appeared that face this issue by proposing the adoption of multi-level structures, sometime with a number of levels greater than the needed one to sustain the working voltages. In fact, the increased overall number of devices is counterbalanced not only by the reduction of Joule losses and the improvement of electromagnetic compatibility but also by the intrinsic redundancy of the configurations that allow the generation of the same level of voltage by using different commutation states. If properly utilized, such a feature may lead to power converter with a great capacity of tolerating the faults.
The electrical auxiliary equipment of a train is a complex system constituted by many subsystems (simply termed as auxiliaries). The main auxiliaries are: circuits for remote control of all on board devices, circuits for internal lighting and external signalling (lamps), motor-driven compressors, accumulator batteries and battery-chargers, air-fans for cooling the power apparatus, systems for heating, air ventilation and conditioning, and so on. Each auxiliary (or a group of them) is fed (directly or indirectly) with a static converter (shortly designated with auxiliary converter), distinguished by power and voltage ratings much lower than the converters incorporated in the supply system or in the traction drive. In principle, the usage of two converters, one in reserve for the other, guarantees the operation of the associated auxiliary also in case that a converter fails. However, for cost and space reasons, solutions are adopted that limit themselves to guarantee the essential services. For instance, under a converter fault, control and lighting circuits are connected to the battery of accumulators. Another solution consists in adopting two auxiliary converters of power size lower than the needed one. One converter is devoted to the supply of auxiliaries that are critical for the train operation while the other one is connected to the non-critical auxiliaries. If the converter feeding the critical loads fails, the surviving converter is switched on the critical loads and the non-critical loads are no more supplied. From these considerations it turns out that the electrical auxiliary equipment is a complex system of apparatus of distributed type and with a tight operational interaction. Therefore its correct functioning requires the application of techniques for managing the energy flows, with a specific plan of the dependability levels. In this equipment the faults are often due to the electronic units that control the converters and hence the fault-tolerant techniques for levels of functionality of operational type must rely on the redundancy of the hardware and software of the units.
The growing number of apparatus and devices placed in modern trains and the need of an integrated management of them has imposed the use of a communication network for their connection. On the network vital information arte conveyed, not only for the passenger safety but also for the integrity of the train and the surrounding environment. As a consequence the communication network must be dependable. With regard to the hardware, the requirement is satisfied by using robust components and by redounding the most crucial ones. With regard to the protocol, it must be endowed with communication services able to assure the correctness of the communications, the detection of the malfunctioning and the uninterruptibility of the critical transmissions. The communication network used in european trains implements the TCN (Train Communication Network) protocol, developed in the 90's and based on a master-slave communication model. One peculiarity of TCN, obligatory for railway vehicle applications, is its ability of automatic reconfiguration when a car is connected or disconnected. TCN network, however, does behave effective services neither for the detection nor for the management of the network malfunctioning; therefore, it does not guarantee the operativeness of the network even under an overriding malfunctioning, with the loss of data that can be useful for the quality of service or, if they are critical, with the stop of the train and the reduction of the availability of the railway service. In the last years, new communication protocols have been conceived (time-triggered protocols) for safety-critical applications. Their peculiarity is the dependability, essentially due to the communication services implemented in the protocol (method of bus access, sharing between the nodes of the information on the network status, mechanisms for identifying a malfunctioning, management of the redundancies). The time-triggered protocols available are TTP/C, TTCAN and FlexRay. FlexRay, developed for the automotive environment, is not composable and then is not suited to railway applications. The other two protocols will be subject of study. In addition to them, the FlexCAN protocol will be also considered; although it is not a time-triggered protocol, FlexCAN has very good dependability proprieties because it has been arranged for managing redounded nodes with an arbitrary redundancy level.

Four Universities participate in the Research Program, each of them with theoretical and applicative research competences, acquired through university research programs and research contracts with private companies, on the matter of:
- operation, design and control of traction drives (Pisa);
- design and experimentation of supply systems and power converters (Napoli),
- design and experimentation of microprocessor units and control of low-middle power converters (Trieste),
- experimental characterisation and application of industrial communication networks (Padova).
In the research activities an industrial partner takes part (TTControl srl, a subsidiary of TTTech, the company that developed and applied the first time-triggered communication networks), specialists from the industry and engineers of railway companies.

On the basis of the state of the art illustrated above and taking into account the scientific expertise of the participants in the project, the coordinator believes that there are the technological conditions and the professional capacities for facing and successfully completing the described research program. <<<