The strategic concepts for information technology at DB Netz

Dr. Michael Leining (DB Netz) began his presentation by stating that there are elementary differences between DB Netz and companies like Google, Facebook and so on, who are the principal drivers of digitisation. Those trends in digitisation are, however, of only limited relevance for the railway or for signalling systems, but in what direction are they, nonetheless, moving? As long ago as 1942, Joseph Schumpeter described the process of an industrial mutation unstoppably revolutionising the structure of an economy from within, destroy-ing the old structure and creating a new one. The fourth industrial revolution is going to take this process even further still. Here are various theses as far as signalling systems are concerned:

• Digitisation is not the transposition of the analogue world into bits and bytes;
• Big data is not a just a left-over but a critical company asset;
• Automation is only a subset of digital intelligence;
• Digitisation has to be a growth driver, otherwise we do not need it;
• Digitisation must be incorporated in system thinking and not just an offshoot of signalling technology;
• The fundamental idea underlying Industry 4.0 is valid for signalling systems too; and
• We do not need to be afraid of Schumpeter, if we face up to the challenge now.

Digitisation is not limited to technical aspects. The entire business is affected by it. The essential impacts that digitisation has on infra-structure managers are illustrated in Fig. 5. It would, however, be wrong to consider the individual aspects in isolation rather than in a web of interactions. The following examples are given as possible pointers to the direction to be taken:

The essential impacts of digitisation on infrastructure managers (source: DB Netz)

• Very considerable savings through digitisation of the planning processes: The basis for efficiency gains includes a standardised planning model for the exchange of data, a central database for storing the planning data within the operator’s purview and intelligent support with tools in all the planning phases. The benefits to be derived from this are acceleration of the planning processes, improvement of the planning quality, through early detection of errors and avoiding errors at interfaces, and eliminating the need for corrective measures later on.
• Rollout of digital command, control and safety equipment: The systems used are ones with a high degree of redundancy, standard interfaces with a reliable future and integrated operation independent of location. The power supply is kept separate from the transmission of information, but the data networks for the command, control and safety systems and telecommunications are integrated, as are the networks for power supply. That is accompanied by a clear reduction in the number of locations in which technical systems need to be installed.
• Real-time evaluation on the basis of a diagnostic and analytical platform.
• Other projects: These include the use of fibre-optic sensing for various monitoring functions and the establishment of the CYSIS platform for the cybersecurity of safety-critical infrastructures.

New meets old: Challenges regarding training and personnel

Timo Schygulla (DB Netz) began his presentation with a core message: technological change is altering the nature of jobs in command, control and safety systems, making it essential to reconsider qualifications and how to attain them.

The demographic shift in combination with difficulties in succession planning and obtaining qualifications are causing a continuing loss of knowledge as regards the equipment making up the command, control and safety systems, the telecommunication systems and the 50-Hz electrical equipment, and it is crucial to adopt the appropriate countermeasures. One side to this is that DB Netz’s inventory is going to include a high diversity of legacy technologies for many years to come, while the other side is that successive replacement with modern technology is bringing ever more intensive digitisation and the interlinking of technologies. The changed requirements are markedly altering job descriptions. It is already the case today that there is a growing need for qualifications in the fields of information, communication and network technologies, leading to the recruitment of IT experts rather than specialised electrical engineers. IT is also going to grow in significance for the outdoor installations. Employees are now being recruited from a very limited external market and need complex training to bring them up to the required level of qualification (Fig. 6).

A further challenge is arising out of the above-mentioned professions merging into one another organisationally. One effect of this may be a heavier and broader burden on the employees, unless accompanying measures are put in place. The stress due to the additional workload is already evident today in indicators such as state of health, hours of overtime and staffing for on-call stand-by teams – and that is a situation that is going to get worse, unless there is greater integration of the technologies in new maintenance concepts. Here again, job descriptions need to be adapted and accompanied by the means to instil the corresponding qualifications.

There are further challenges needing to be overcome if employees are to reach the necessary level of qualification at all. These begin with ensuring the appropriate basic qualification of job applicants, of recruiting them and then securing their long-term loyalty to the company. This is indispensable especially where it takes a long time to train employees up to the level of “key qualifications”, in other words acquiring and applying relevant local expertise. Such qualifications represent the starting point for them to be eligible for on-call standby duty. Particular attention needs to be paid here to ensuring the availability and quality of the necessary training measures.

The springboard for mastering these challenges is to establish transparency as regards what the technology requires of employee training. Starting with the job description and robust personnel development planning, it is then possible to determine the training contents and also all the subsequent training measures.

Measures to ensure the availability of employees (source: DB Netz)

taking the example of electronic interlocking systems

Christoph Jakob (Siemens) began with a reminder that electronic interlocking systems had been in service for some thirty years or so. Deutsche Bahn has now reached its third generation of electronic interlocking systems from Siemens, the Simis-D. A total of more than 300 electronic interlocking units are in operation in Germany, with DB Netz and other railways. The mean age of the electronic interlock-ing units is roughly ten years, and 35% of all switched devices are already operated through them.

The incessant advance in the electronics sector, driven by innovations in semi-conductor technology and by industry-standard compo-nents, is necessitating never-ending adaptations to hardware and software. On top of that comes the need to consider new or amended legal requirements. Given that equipment may remain available for up to fifty years, the network operators’ expectations include maintain-ing the possibility of expanding and converting their system and also a scalable range of functions. Moreover, the interlocking technology ought as far as possible to be based on standard components and/or to satisfy standard interfaces itself.

To meet all these requirements, it is going to be necessary to ensure not only that the knowledge is on hand to guarantee the availability of old technologies for as long as possible but also to develop substitute products through innovative solutions, so that they can replace precisely these technologies or, to put it another way, to migrate. One further decisive factor is to keep obsolescence under control, in other words to guarantee the availability of parts for manufacturing and thus also for the supply of spare parts. Migration solutions are the key to being able to meet precisely these requirements and to extending the service life of installations. The regular migration of electronic interlocking systems and/or their components is, however, necessary not only to guarantee the deliverability of substitute solutions but also to make it possible to implement new functions, and to introduce innovative technologies and improved performance. That makes migration solutions into the key factor for both system upkeep and investment protection, and they thus constitute the link between old and new (Fig. 7).

One example of migration is the FTGS track vacancy indication system. Activity here was triggered by the limited availability of subcon-tractor parts for manufacturing the legacy product. The first stage involved buying up and storing those parts that were still available on the market. In parallel with that, development work commenced on a new replacement product. That made it possible to reduce the operation to partial migration only, keeping the outdoor components and the existing basic circuitry. An additional advantage is that the new product takes up less space.

Migration from legacy interlocking systems of the Simis-C type to a state-of-the-art product ready for the future, including the introduc-tion of standard interfaces, was also achieved in four phases.

Components of migration (source: Siemens)

Field programmable gate arrays

The issue dealt with by Dipl.-Ing. Roland Herzig (Deutsche Bahn) was whether or not the use of field programmable gate arrays (FPGAs) might represent a way out of the obsolescence problem caused by technology cycles. The technical complexity of interlocking systems has inevitably increased with the growing range of functions and centralisation of the operation and installation of computer systems. The move into using off-the-shelf integrated circuits has at the same time meant becoming more dependent on short-lived technology cycles, which did not used to affect command, control and safety systems to that extent in the past. Despite various precautions taken by manufacturers and the railways to guarantee a long service life for interlocking systems, it has to be recognised, in particular, that components for discontinued CPUs have become very costly and labour-intensive and have sometimes even occasioned entirely new developments.

FPGAs are now being considered as a lower-cost alternative. Various applications from the manufacture of signals show that this compo-nent may indeed be helpful. These applications are primarily smallish solutions in subsystems, and their new development and installation has made it possible to replace individual integrated circuits that were no longer available. Examples are:

• replacement of discontinued integrated circuits of the type Motorola MC 146818 in the EBÜT 80 EGL subassembly and the 8085 microprocessor as well as realisation of the ZSB 2000 subassemblies at Scheidt & Bachmann [1],
• use in interface modules for double wheel sensors and in the counting modules of the Pintsch Tiefenbach axle counter,
• use as a chip set in computer subassemblies and as the logic unit in peripheral subassemblies at Siemens, and
• use in various products up to SIL 4 at Thales.

DB Netz is working in cooperation with the SBB and the ÖBB on a project for the partial renewal of the indoor parts of a relay-based in-terlocking system to be based on an “FPGA electronic interlocking unit”. This project is setting out to show:

• that FPGAs are fundamentally suitable as a platform for SlL4 applications;
• that programming or implementation of the protection logic can be done on the basis of the existing relay switches;
• that transformation of relay circuits into FPGA software in an SIL 4 process is possible with FPGA tools; and
• that replacement with next-generation subassemblies can be done at a low cost and with adaptations to the application software and the subassembly design.

The aim is to replicate the indoor part of the equipment with the same functions and thereby to modernise the technology of the interlocking kernel without needing to make changes to either the control console or the outdoor part of the installation (Fig. 8). In later stages, it might be possible to extend the use of FPGAs for the indoor equipment and introduce a new operator’s workstation and new outdoor equipment using NeuPro technology.

Migration from a relay-based interlocking system to an FPGA one (source: DB Netz)

Comments from the audience: It is difficult to emulate the non-volatile states of relays with FPGAs in a current-less state. Relay circuits are, however, very much based on such properties. Roland Herzig’s reply was that that problem had been solved.

Cyber-Security

New legislation creates the role of registered inspector in the railway industry

Hubert Emmerich (DB Netz), Joachim Stutzbach (VDB) and Katja Schmid (VDB) made a joint presentation on the new function, which closes a gap perceived in the necessary testing and assessment activities. Hubert Emmerich presented the point of view of a railway infrastructure manager, while Joachim Stutzbach dealt with the manufacturers’ standpoint. Finally, Katja Schmid discussed the legal angle. The European Union defines the various roles involved in testing and assessment in the railway sector as follows:

• Notified bodies for performing tests in accordance with TSIs,
• Designated bodies for performing tests in accordance with notified documents, and
• Assessment bodies for assessing risk-management procedures.

These do not, however, cover the entire gamut of testing. For that reason, Germany has created a new role called “registered inspector” (“Prüfsachverständiger)”. This is a person who performs all the testing activities concerning the infrastructure except for those contained in the TSIs and possibly in notified documents. He or she also assesses changes rated as not significant according to the CSM risk assessment.

In future, the activities, rights and duties of registered inspectors as well as their appointment are going to be governed by an ordinance, which already exists in the form of a draft. It lays down that recognition of the profession and the examination linked to that are to be a task for the Federal Railway Authority (EBA). A transitional arrangement makes it possible for recognised experts to continue to do their work. There are two points to which it is particularly worth drawing attention:

• The maximum age for registered inspectors is 68 years. This same limit has so far been indicated in an EBA administrative regulation. It has now become more difficult to authorise exceptions through ordinances. The effect of that might be that the existing bottlenecks in the inspection of installations could deteriorate further.
• The results presented by registered inspectors are being upgraded. The draft ordinance lays down that a “rebuttable presumption of substantive correctness” applies to the outcome of the examination performed by registered inspectors. That releases the EBA from the duty to consider all aspects of a case ex officio, so that it is to become admissible for it to adopt the results of expert inspectors for its administrative acts without verifying them.

One question that arises in particular in the legal appraisal of the draft ordinance is whether, if adopted, it would have implications for the personal liability of future registered inspectors:

• Liability under civil law for harm to persons and damage to property (Fig. 13): Here fault-based tortious liability is fundamentally possible, but of virtually no relevance in practice. The current view is that the presumption of correctness will not lead to any shift to the disadvantage of the registered inspector.
• Liability under criminal law: Here it would be possible to imagine negligent bodily injury or homicide. Once again, there is no indication that there would be any change resulting from the assumption of correctness.

Who can file claims against whom? (Source: VDB)

Comments from the audience: In risk assessments, the probability of human failure is taken to be 10-3. If such an instance really does occur, it will be called negligence. Negligence presupposes that the person concerned objectively violated his or her obligation of due diligence. The Austrian Railway Act too used to contain a passage on rebuttable presumption of correctness, but the administrative court struck it out, because decisions that would of necessity have to be taken by authorities were shifted to the private space.

Distributed power provision (DPP) – Flexible power supply as an important element in a decentralised interlocking technology archi-tecture

Oliver Schwehn (Thales Germany) began by examining what sort of power supply would be required by the distributed element. A classical power supply had to fulfil the following functions:

• Power distribution: Getting power to all components in the necessary voltage form.
• Power production: If an uninterrupted power supply is to be guaranteed, batteries, diesel generators and transformers are all of importance. In the distributed structure, photovoltaics and fuel cells are gaining in importance.
• Electrical safety: This heading includes not only the protection of people and installations but also ensuring that there is no feedback affecting the signalling.
• Monitoring: Keeping within the operational parameters calls for monitoring and control. For that reason, diagnostic tools are being increasingly used.

In the conventional architecture, power is fed in centrally. Distributing it to the location of the load and guaranteeing the electrical safety is then the job of the interlocking system.

As a consequence of modularisation, the installation of controller units in the track area is causing a gap to arise in the power distribution between the source and the controller. This is where the concept of “distributed power provision” (DPP) comes in for a supply structure without interruptions. In addition to that, if there is no supply structure, it creates the possibility for power provision that is a perfect fit.

The realisation of protection equipment constitutes a design challenge, given the greater distances involved. The devices usually used today are of only limited suitability. Given that only correctly designed protective equipment is able to guarantee the desired availability, it also has a direct impact on the availability of the entire interlocking installation. Another factor on top of that is that the railway-specific normative requirements applicable along the railway lines are not absolutely essential for equipment inside interlocking buildings. With DPP, it is Thales’s intention to offer a comprehensive concept for supplying power to field elements.

Currently, one field test is being prepared, namely in Hinwil, within the SBB’s infrastructure. The test is being configured with two networks and real cables right next to the track. There are two power feeds. The distribution points provide the connection to the devices needing power (several coloured-light signals and a switch-and-crossing simulator). In addition, there is a bus coupler connecting the two networks. A fault simulator makes it possible to simulate various disruptions.

Demonstration setup for the field test in Hinwil

Comments from the audience: Given the large number of switched-mode power supplies distributed throughout the network with their negative characteristic curves, there is a danger of chaotic conditions affecting the power supply. This issue took the discussion back to the question of security. In order to provide protection against attacks coming, for instance, from the diagnostic network, it would presumably be necessary to have recourse to the approaches used in the other parts of the command, control and safety systems.

Fibre-optic sensor systems in the railway environment – opportunities and challenges

The content of this presentation by Max Schubert (DB Netz) was the subject of a recent contribution in SIGNAL+DRAHT. There is thus no need to report on it here.

Concluding remarks

It has to be admitted that the topics of “challenges” and “new meets old” have already been dealt with at various SIGNAL+DRAHT con-gresses. Nonetheless, the presentations contained within this block on this occasion shed new light on a number of interesting aspects. Once again, the challenges appear in the rollout of ETCS (and CBTC too), but at the same time practical experience is playing an increasing role in equipping entire networks. Denmark is an example that is frequently quoted in this respect. A similar situation applies for the modernisation and modularisation of safety equipment. One interesting point to emerge was that, by keeping the “aging relay technology” going through installing FPGAs, it might be possible to create a little more leeway in renewing relay-based interlocking systems no longer supported by their manufacturers. The feasibility of doing that in practice has, however, not yet been demonstrated.

It is interesting to observe that IT security had never been a topic at a previous SIGNAL+DRAHT congress. The explanation for that is most certainly not that there is no IT in command, control and safety systems. Nor is it an issue that is unknown in this sector. The reason for the sudden intense concern with this matter, at least in Germany, is to be found in the new Federal Act on IT Security, which forces the infrastructure operators (and not just them) to take cognisance of the threat and to react to it. Protection through proprietary technology and the use of closed networks is more and more losing its effectiveness with off-the-self components, networks and operating systems making their way into command, control and safety equipment and with the networking of subsystems moving threateningly close to the internet. That dangers lurk in places that would never have been regarded as possible was demonstrated impressively through the live hacking demonstration, although presumably, what the presenter showed was at times no more than a simulation. HoneyTrain too (even if considered to be in bad taste) shows that there are those who are looking for weaknesses. It may well be that the Federal Act on IT Security is going to be an expensive, labour-intensive and time-consuming matter for the operators, but there would be a dramatically higher price to pay if ever there were to be a successful attack on the IT system of a command, control and safety installation, which would have a widespread public impact and attract many imitators.

The real “innovation firework” came right at the end – not the first time that has happened at a SIGNAL+DRAHT congress: fibre-optic sensing. Actually, fibre-acoustic sensing would be a more accurate term, since it is after all acoustic effects that come into play here. The number of possible applications would appear to be unlimited, and it is merely a problem of the appropriate exploitation of the data captured. Just how fascinating the audience found this presentation can perhaps be gauged by the large number of people who queued up to speak to the presenter in person afterwards – a very unusual occurrence for the end of a congress. The really exciting question is: which applications will make their way into practical use and how compatible will they be with the many different variants of railway network?

Thanks to all supporters

16th Signal + draht congress

10.-11.11.2016 in Fulda