WO2014059487A1

WO2014059487A1 - Supplementary warning system for level crossing activated by train

Info

Publication number: WO2014059487A1
Application number: PCT/AU2013/001212
Authority: WO
Inventors: Dwayne Kenneth ALLAN; Eduardo de Freitas SAORIM; Colin Christopher TAYLOR
Original assignee: Siemens Ltd.
Priority date: 2012-10-18
Filing date: 2013-10-18
Publication date: 2014-04-24

Abstract

Supplementary warning systems (100) for a level crossing adapted for activation by a train comprises wheel sensing devices (112, 114, 116, 118), a module (110) for communicating signals from the wheel sensing devices (112, 114, 116, 118) to a level crossing controller (130) adapted to communicate with the wheel sensing devices (112, 114, 116, 118). Two pairs of wheel sensing devices (112, 114, 116, 118) configured as strike-in and strike-out heads in respect of the level crossing. The level crossing controller (130) comprises: a battery; a solar panel; a programmable logic controller (PLC) for controlling operation of active warning devices positioned at or near the level crossing dependent upon signals received by the PLC from the wheel sensing devices; and a power control module for charging the battery and controlling power to components of the level crossing controller. The solar panel and the battery provide all power to the level crossing controller (130).

Description

SUPPLEMENTARY WARNING SYSTEM FOR

LEVEL CROSSING ACTIVATED BY TRAIN

RELATED APPLICATION

The present patent application claims the benefit of the earlier filing date of Australian Provisional Patent Application No. 2012904562 filed on 18 October 2012 in the name of Siemens Ltd and entitled "Supplementary warning system for level crossing activated by train", which is incorporated by reference in its entirety.

TECHNICAL FIELD

The present invention relates generally to warning systems for level or grade crossings for trains and in particular to an automatic system and method of warning drivers and pedestrians about an approaching train at such a crossing.

BACKGROUND

In many jurisdictions including Australia, there are a large number of railway levels or grade crossings in low traffic areas that do not have active warning protection systems installed. For ease of description herein, the expression "level crossing" is used to include a "level crossing" as that term is used in Australia and the United Kingdom and a "grade crossing" and a "railroad crossing" as those terms are used in the United States. Level crossing refers to the intersection of a railway line or tracks and a road or path on one level, without a bridge or tunnel being used. Most of these locations provide only passive protection via a stop or give- way sign to warn for an approaching train. Passive level crossings do not control access to the level crossing, e.g., such a passive level crossing does not have a track-activated boom gate for blocking traffic like an active level crossing. While active warning devices are already installed at higher- traffic level crossings, the installation and maintenance costs prohibit installation of such active warning devices to all existing level crossings. An alternative to a level crossing would be an underpass or overpass, however, the construction costs of an underpass or overpass are higher than the costs of installing an active warning device. Active level crossings are crossings that automatically provide a warning to drivers and pedestrians of a train approaching the level crossing. The type of warning depends on local practices and the traffic density of the particular level-crossing location. For instance, flashing lights and audible warning (e.g. bells) are used in Australia for active protection. Additionally, boom barrier arms are typically provided at higher traffic areas to provide extra protection. Many locations may also require 'coordination with traffic lights and/or interlocking with the railway signalling system. Additionally, pedestrian crossings with signals and gates are sometimes provided.

Passive level crossings provide protection via Stop or Give- Way signs only. Typically, passive level crossings are used in remote rural locations where there is little or negligible vehicle and pedestrian traffic on the road. Such passive level crossings lack the active components of the active level crossing, including warning lights, audible alarms, and therefore present a hazard to both trains and traffic on the road because people are not warned of the approaching train and may underestimate the risk posed by the passive level crossing. Even if a train is seen, people may misjudge the speed of the train and the distance of the train from the level crossing and not anticipate sufficient proper braking distance to avoid a collision between a vehicle and the train.

To provide active warning to a higher number of level crossings, many authorities around the world have been proposing the development of low cost, level- crossing warning devices.

The currently available level-crossing systems achieve train detection via track circuits, predictors, and axle counters. Low cost solutions have been proposed with different types of train detection technologies, for instance radar, global positioning system (GPS) or another similar positioning system, current loops, and magnetometers. While many systems have been developed and tested, such low-cost level-crossing systems are not being implemented as a solution, because those systems do not achieve the same safety and reliability level, which is provided by currently used systems.

Therefore, to achieve a low cost solution the architectures here proposed aim for a simple system architecture, which allows controlling single line railways and provides active warning to drivers and pedestrians. This is a standalone solution without any interfaces with other level crossing systems, traffic lights or signalling systems. The train detection is based either on the proved reliable axle counter systems or other proved reliable wheel sensor for railway systems. The processing is based on an industrial PLC running in failsafe mode and the communication method varies between cable and wireless communication architectures. These architectures also aim for a low power consumption to minimize costs when solar power supply is used and they are fitted with remote monitoring capability.

SUMMARY

In accordance with an aspect of the invention, there is provided a supplementary warning system for a level crossing adapted for activation by a train. The system comprises: a plurality of wheel sensing devices, each adapted for coupling to a rail of a railway track and detecting the presence of a wheel of a train in proximity to the respective wheel sensing device, two pairs of the wheel sensing devices being configured as strike-in and strike-out heads in respect of the level crossing in opposite directions of travel of a train on the railway track with respect to the level crossing; a module for communicating signals from the wheel sensing devices to a level crossing controller; and a level crossing controller adapted to communicate with the plurality of wheel sensing devices. The level crossing controller comprises: a battery; a solar panel; a programmable logic controller (PLC) for controlling operation of active warning devices positioned at or near the level crossing dependent upon signals received by the PLC from the plurality of wheel sensing devices to indicate a train in proximity to the level crossing; and a power control module coupled to the PLC, the solar panel and the battery for charging the battery and for controlling power to components of the level crossing controller, the power control module, the solar panel and the battery providing all power to the level crossing controller.

The signal communicating module may comprise one or more cables to couple the level crossing controller and the wheel sensing devices functioning as strike-out heads.

The signal communicating module may comprise one or more cables coupled to the level crossing controller and the wheel sensing devices functioning as strike-in heads. The one or more cables may be coupled to a rail of the railway track using a plurality of clips to hold the cables to rails. The level crossing controller may further comprise: an antenna; and a radio communications modem coupled to the antenna, the PLC, and the power control module, the antenna and the radio communications modem adapted for providing wireless communications to and from the level crossing controller; the antenna and the radio communications modem being adapted for long distance communications with a remote monitoring facility to enable remote monitoring and diagnostics of the supplementary warning system. The antenna and the radio communications modem may be adapted for satellite communications.

The PLC may be a failsafe PLC.

The level crossing controller may further comprise a data logger and/or event recorder for investigating operation of the supplementary warning system.

The level crossing controller may further comprise a panel for interfacing with the level crossing controller.

The level crossing controller may further comprise an axle counter coupled to the wheel sensing devices functioning as strike in and strike-out heads and the PLC.

The level crossing controller may further comprise a network communications switch coupled between the PLC and the radio communications modem. The network communications switch may be an Ethernet switch. The supplementary warning system may further comprise an axle counter coupled to the wheel sensing devices functioning as strike-out heads, the PLC, and the network communications switch.

The signal communicating a module may comprise: at least one antenna; and a radio communications modem coupled to the antenna, the PLC, and the power control module; the antenna and the radio communications modem implemented in the level-crossing controller and being adapted for providing short-distance wireless communications between the level crossing controller and a remote device forming part of the supplementary warning system. The antenna may be a directional antenna.

The supplementary warning system may further comprise at least one remote device for use adjacent a strike-in head location. Each remote device comprises: a battery; a solar panel; a module for coupling the remote device and a respective wheel sensing device functioning as a strike-in head; an antenna; a telemetry radio communications modem coupled to the antenna adapted for wireless communications to and from the level crossing controller, the telemetry radio communications modem being powered by the solar panel and the battery, the telemetry radio communications modem wirelessly transmitting to the level crossing controller one or more signals generated by a wheel sensing device functioning as a strike-in head; the antenna and the telemetry radio communications modem implementing the signal communications a module. The coupling module may comprise one or more cables coupled between the telemetry radio communications modem and the wheel sensing devices functioning as a strike-in head. The supplementary warning system may comprise two remote devices each coupled to a respective wheel sensing device functioning as a strike-in head.

The supplementary warning system may further comprise at least one remote device for use adjacent a strike-in head location. Each remote device comprises: a battery; a solar panel; a module for coupling the remote device and a respective wheel sensing device functioning as a strike-in head; a programmable logic controller (PLC) for producing a count signal dependent upon signals from the wheel sensing device functioning as a strike-in head; a power control module coupled to the PLC, the solar panel and the battery for charging the battery and for controlling power to components of the remote device, the power control module, the solar panel and the battery providing all power to the remote device; an antenna; a radio communications modem coupled to the PLC and the antenna adapted for wireless communications to and from the level crossing controller, the radio communications modem being powered by the power control module, the radio communications modem wirelessly transmitting one more signals to the level crossing controller; the antenna and the radio communications modem implementing the signal communications a module.

The coupling module may comprise one or more cables coupled between the PLC and the wheel sensing device functioning as a strike-in head.

The supplementary warning system may comprise two remote devices each coupled to a respective wheel sensing device functioning as a strike-in head.

The supplementary warning system may further comprise at least one remote device for use adjacent a strike-in head location. Each remote device comprises: a battery; a solar panel; a module for coupling the remote device and a respective wheel sensing device functioning as a strike-in head; an axle counter for detecting the presence of a train dependent upon signals from the wheel sensing device functioning as a strike- in head; a power control module coupled to the axle counter, the solar panel and the battery for charging the battery and for controlling power to components of the remote device, the power control module, the solar panel and the battery providing all power to the remote device; an antenna; a radio communications modem coupled to the axle counter and the antenna adapted for wireless communications to and from the level crossing controller, the radio communications modem being powered by the power control module, the radio communications modem wirelessly transmitting one more signals to the level crossing controller; the antenna and the radio communications modem implementing the signal communications a module.

The coupling module may comprise one or more cables coupled between the axle counter and the wheel sensing device functioning as a strike-in head.

The level crossing controller may comprise an interface for communicating with a remote location.

The interface may comprise a telecommunications modem. The

telecommunications modem may be a GSM modem.

The level crossing controller may comprise one or more modules coupled to the

PLC for diagnosing any predefined fault conditions affecting one or more components of the level crossing controller.

The level crossing controller may comprise one or more modules coupled to the

PLC for diagnosing any predefined fault conditions affecting one or more components of each remote station.

The wheel sensing device may comprise: one or more wheel sensor relays

(WSR), one or more wheel sensors single (WSS), and wheel sensor double-electronic (WSD-E).

The PLC may implement functionality to activate/deactivate active warning devices by counting wheels dependent upon signals from the wheel sensing devices .

The PLC may implement functionality to activate/deactivate active warning devices with wheel detection only.

The warning system may comprise active warning devices comprises warning lights. The warning system may comprise active warning devices comprises audible warning alarms.

BRIEF DESCRIPTION OF DRAWINGS

Embodiments of the invention are described hereinafter with reference to the drawings, in which:

Fig 1 is a system layout illustrating the location of equipment where

communication between strike-in wheel sensors and a central location is via cable;

Fig 2 is a system layout illustrating the location of equipment where

communication between strike-in wheel sensors and a central location is via radio or wireless communications;

Fig 3 is an interconnection diagram illustrating equipment for architecture 1, which is based on an axle counter for train detection and communication via cable;

Fig 4 is an interconnection diagram illustrating equipment for architecture 2, which is based on an axle counter for train detection and radio communication;

Fig 5 is an interconnection diagram illustrating equipment for architecture 3, which is based on a wheel sensor for train detection and communication via cable;

Fig 6 is an interconnection diagram illustrating equipment for architecture 4, which is based on a wheel sensor for train detection and radio communication;

Fig 7 is an interconnection diagram illustrating equipment for architecture 5, which is based on a wheel sensor for train detection and a telemetry system at the strike- in locations;

Figs. 8A and 8B are block diagrams depicting two possible configurations for track vacancy detection sections for axle-counter-based systems;

Fig 9 is a block displaying occupation sequence stages for a level crossing;

Fig. 10 is a flowchart illustrating general processing for a level-crossing system behaviour; and

Fig. 11 illustrates an example of ladder logic designed with Siemens® Step 7 compiler for a low-cost level crossing based on axle counters and the Siemens® ET200S PLC. DETAILED DESCRIPTION

Warning systems for level crossings activated by trains in proximity to the level crossings are described hereinafter. The relevant warning systems are supplementary warning systems. Such systems are proposed for use either as passive or active level railway/road crossings. The term "supplementary" is used herein to differentiate these systems from Simis LC. While Simis LC achieves SIL 4 rating for safety on CENELEC assessment, the systems disclosed herein aim to achieve a maximum of SIL3 rating for safety for the function of providing flashing or steady lights. The systems according to the embodiments of the invention aim for applications at crossings where a lower level of safety is accepted by the railway authority. While a lower level of safety is being provided, additional signage is recommended to warn drivers and pedestrians to look for trains at all times. Different types of lights are also recommended to differentiate this from standard- systems (e.g. use of red or yellow steady lights when practice is red flashing lights). _L

In the following description, numerous specific details, including types of cables, wheel detector sensors, programmable logic controllers, wireless communication distances, modems, and the like are set forth. However, from this disclosure, it will be apparent to those skilled in the art that modifications and/or substitutions may be made without departing from the scope and spirit of the invention. In other circumstances, specific details may be omitted so as not to obscure the invention.

The architectures described hereinafter are a simplification of level crossing systems based on an axle counter, such as the Simis LC Level Crossing protection system from Siemens®.

The architectures with axle counter and cables are capable of providing similar levels of safety to existing systems. When communication via radio is used, safety and particularly reliability of the overall system may decrease.

The drawbacks for the proposed system when compared to Simis LC are the ones listed below, although not all other products would have the same functionality as Simis LC:

• Power supply boards and battery charger are not hardware redundant; Power supply is solar based, which is less available than the traditional mains power with battery backup banks;

Processing redundancy is provided via software and not hardware;

Increased availability is not available as in Simis LC which is 2 out-of-a 3 configuration of processing boards, when one board fails the system still continue to work;

No special control is available for boom barriers and pedestrian gates, although it is viable to be implemented;

No complex controls are available, such as coordination with traffic lights, coordination with other level crossings, etc.

1.0 Introduction

The embodiments of the invention are directed to level-crossing warning system to be installed at either active level crossings or as supplementary lights for passive level crossings. This system is designed for remote locations with limited or no supply of normal mains power. The use of the system will depend on the railway authority as requirements vary.

Passive level crossings are road/rail crossings that are typically only protected by a 'Railway' sign. In addition to the stop (RX-2) or give way (RX-1) passive signage, this system can provide red warning lights that are lit steady when a train is detected approaching the crossing.

The first two system architectures illustrated in Figs. 3 and 4 are based on a proven reliable axle counter system and failsafe PLC's and are likely to be accepted for use in active level-crossing installations.

The embodiments of the invention provide an affordable, active level-crossing protection system, where safety is provided as far as economically practical. This system is based on the Siemens' industrial PLC's and train detection equipment. For train detection, the following Siemens® equipment may be used: the Clearguard ACM 100 axle counting system marketed by Siemens®, Wheel Sensor Relay WSR, Wheel Sensor Single WSS with Anschaltbaugruppe ARS (evaluation board/switching interface module for trains), Radsensor (wheel sensor) RSE with Anschaltbaugruppe ARS, and Wheel Sensor Double Electronic WSD-E. The wheel sensor equipment detects the presence of a train via the same principle of an axle counter system, but most options do not provide the same redundancy and direction of movement information. While the axle counter provides occupancy information for a train inside a section, the wheel sensor only provides a signal, which emits a pulse every time a wheel runs over the sensor. Warning lights are provided for drivers and pedestrians, which can be either flashing lights or steady lights. For instance, Fig. 3 shows the current Australian RX-5 assembly for active level crossing and a proposal for supplementary warning lights for passive level crossings, which could be lit steady to differentiate from the RX-5 assembly.

2.0 System layouts

Figs. 1 and 2 illustrate two system layouts of equipment for a level crossing at which the warning systems proposed may be practiced. The layouts display the location of equipment for two different types of connections of the equipment located at strike-in points and a central PLC. These layouts work for several system architectures, which are described in the next section. For instance, first and third system architectures shown in Figs. 3 and 5 are based on the first layout of Fig. 1 described below, having inter-connections via cables. The remaining system architectures in Figs. 4, 6, and 7 are based on the second layout of Fig. 2 described below have interconnections via radio link.

Typical distances between strike-in heads and island sections vary depending on the maximum train speed, a minimum warning time, and additional system delays. For instance, for a line with a maximum lOOkm/hour allowed speed and a minimum of 25 seconds for warning time, the strike-in head should be positioned at least at a distance D = lOOkm/hour * 25 s = 695 metres.

2.1 Layout with cables to connect to strike in locations

Fig. 1 illustrates the basic system layout 100 for a level crossing protection or warning system at one location based on axle counter or simply wheel sensors for train detection connected to central location via cables. When non-redundant wheel detectors are used, a second wheel detector must be added at the strike in locations to provide redundancy, thus increasing safety for the train detection function. Fig. 1 illustrates a road 102 oriented in one direction and a pair of railroad tracks 104 crossing the road 102, so that there is a level crossing, for which the system layout 100 may be practiced. Strike-in heads 112 and 114 and strike-out heads 116 and 118 are positioned at locations of the rail track 104 and have cables connected to terminals in track disconnection boxes 120, 124, 126 and 122. Cables between the disconnection boxes 120, 124, 126 and 122 and wheel sensors 112, 116, 118 and 114 may be buried, and cables between the disconnection boxes 120, 124, 126 and 122 and the central location may be attached to the rails 104 to save cost with trenching 110. A track disconnection box is a box with terminals where cables from track side equipment and cables to the central location can be connected. As indicated in Fig. 1 by grey and black symbols for the strike-in heads 112, 114, redundant strike-in heads may be practiced.

Other cables connect track disconnection boxes at strike in to the ones in strike out locations. Note that the cables 110 are attached to the rails 104, instead of the traditional method of trenching. The cost of trenching would significantly increase the overall cost of the installation. Cables are connected to the terminals in track disconnection boxes 124 and 126 and routed to the cabinet 130 via conduits 142, 144, 146, 148 and PITs 132 and 134. If both tracks 104 are used for traction return, this method may not be suitable according to the wheel sensor specification. A PIT is usually a concrete box used to route cables and limit the tension on cables when dragging cables along the track for long distances. Cables that pass through PITs can be either directly buried or passed through conduits. Cables from lights and bell 138 are routed to cabinet 130 via the PIT 132, and cables from lights and bell 140 are routed to the cabinet 130 via conduits 142 and 144, and PITs 136, 134 and 132. The central cabinet 130 has a housing and is a level crossing controller.

As the amount of equipment is not excessive, instead of a cabinet 130 installed on the ground, the equipment could be also installed in an enclosure on a mast (not shown in Fig. 1).

Optionally, if supplementary warning lights 138, 140 are used, the lights could be used only in one direction of the road in each mast. Each of Figs. 3 to 7 shows examples of lights for a passive level crossing. For this alternative, lights 138, 140 could be lit steady or flashing, red or yellow, to differ from traditional level crossings. The display used depends on the signalling principles and railway authorities. 2.2 Layout with radio to connect to strike in locations

The system layout 200 of Fig. 2 is used if attaching cables to the rails is not allowed. This layout 200 is similar to the system 100 presented herein before, with the difference that radio is used to connect the equipment at the strike-in points to the central PLC in the cabinet 230. Additional equipment is required at the strike in locations, which include processing hardware (axle counter or PLC), a radio system, and a solar power supply.

Fig. 2 illustrates a road 202 and a track 204 configured in the same manner as the road 102 and the track 104 of Fig. 1. Strike-in heads 212, 214 and strike-out heads

216, 218 are located similarly to the same elements 112, 114, 116, and 118 ofFig. 1.

Track disconnection boxes 224 and 226 are located on opposite sides of the road 202.

On the left side of the road 202, the strike-out head 216 is located adjacent the track 204 and is coupled to the terminals in the box 224 There is a cable coupling the box 224 and the cabinet 230; the cable is routed via conduit 248 and PIT 232. Bells and

flashing/steady lights 238 are coupled to a cabinet 230 with cables routed via PIT 132.

Again, the central cabinet 230 has a housing and is a level crossing controller. Cabinets

230, 250 and 252 are fitted with one or more solar panels and radio equipment.

Similarly, on the other side of the road, the strike-out head 218 cable is coupled to the box 226, and a cable connects box 218 to cabinet 230 routed via conduits 246, 242 and

PITs 234 and 232. The conduit 242 passes under the road 202 to a PIT 234 on the other side of the road 202 in a right angle. Conduit 244 passes under the track 204 on the right side of the road forming a right angle with tracks. Bell and flashing/steady lights

240 are connected to the cabinet 230 with cables routed via conduits 244, 242 and PITs 236, 234 and 232, for traffic approaching on the road in the other direction from that of the lights 238. For the sake of brevity, the description of the like numbered elements is not repeated here.

In this embodiment, there are no cables attached to the rails 204. Instead, radio links are practiced. The remote cabinets 250 and 252 located at the strike-in points are coupled to the strike-in heads 212 and 214, respectively. The remote cabinets 250 and 252 are remote devices used in conjunction with the level crossing controller. Each of the cabinets 250, 252 are solar-powered and have radio links for communicating with the central cabinet 230 using its radio link. Each of the remote cabinets 250, 252 shown in Fig. 2 has an associated antenna and wireless communications module associated with the cabinet 250, 252, which can communicate with the antenna and wireless communications module of the central cabinet 230.

The cabinets 230, 250, 252 may be installed in an enclosure on a mast (not shown in Fig. 2).

The warning lights 238, 240 may be practiced in the same manner as the lights 138, 140 of Fig. 1, the description of which is not repeated here for the sake of brevity only.

For ease of description only, the expressions "central cabinet" and "remote cabinet" are used hereinafter to describe various embodiments. However, these expressions can be used interchangeably with "level crossing controller" and "remote device", respectively. The five system architectures described hereinafter illustrate different mechanisms for communicating signals between the wheel sensing devices, used to detect train wheels, to a level crossing controller. Relevant wheel sensing devices include one or more wheel sensor relays (WSR), one or more wheel sensors single (WSS), and wheel sensor double-electronic (WSD-E).

3.0 Five System Architectures of Level Crossing Warning System

The active warning or supplementary warning system for passive level crossings are solutions based on axle counters/wheel sensors and PLC's manufactured by Siemens®. Such axle counter/wheel sensors are a reliable means of detecting the presence of a train, which is in use worldwide. Five architectures are proposed:

1 ) Train detection via axle counter system connected to a central industrial PLC providing high safety and software redundancy. The cables from the strike in heads are attached to rail with rail clips (see Figs. 1 and 3).

2) Train detection via three axle counter evaluators interconnected via radio and connected to a central industrial PLC providing high safety and software redundancy (see Figs. 2 and 4).

3) Strike-in wheel sensors connected to the central PLC via cables clamped to the rails. Two wheel sensors are used if the respective model does not provide internal redundancy. Only one wheel sensor is used at each strike-out points to clear the warning as soon as the train clears the crossing (see Figs. 1 and 5).

4) Strike-in wheel sensors with a dedicated PLC, which are connected to the central PLC via radio. This embodiment also allows for wheel counting (see Figs. 2 and 6).

5) Strike-in heads directly connected to telemetry equipment, which sends the information to the central PLC via radio. This embodiment allows wheel detection, but not wheel counting (see Figs. 2 and 7).

Train detection is performed among system architectures either with axle counters or wheel sensors only. Axle counters are a reliable, proven way of providing track vacancy detections information. If only wheel sensors are used, a pulse is generated every time a wheel runs over the sensor. The wheel sensors follow a similar concept of the Wheel Detection equipment used for axle counter, although not always providing internal redundancy and direction of travel information. The wheel sensor does not provide the track vacancy detection information. Therefore, a different logic is used for systems based on wheel sensors only, which partially emulates the concept of an axle counter system.

For processing the logic, a Siemens® industrial PLC with failsafe features may be used. The system may be based on the Simatic ET 200S PLC's marketed by Siemens®, for example, but could be upgraded to the Simatic S7 1200, which is expected to provide failsafe functionalities in the future for a lower cost. The ET 200S is a PLC designed to provide a SIL3 level of safety. Additionally, the software can be developed in a failsafe mode, which provides redundancy on the processing thereby increasing the system safety.

Two different layouts 100, 200 shown in Figs. 1 and 2 may be employed in the system architectures of Figs. 3-7. The first system layout 100 is based on a cable to connect the wheel sensors located at the strike-in points 112, 114 to the central cabinet 130. The second system layout 200 is based on radio communication, which adds additional equipment and a cabinet at the strike-in points 212, 214. The solution will differ among the options. Warning lights can be provided in a range of options, which depend on each railway authority. If this system is used for an active level crossing protection in Australia, flashing lights will be provided. If the supplementary warning lights for passive level crossing are approved for use in Australia, another type of indication may be defined. This could be, for example, steady red or yellow lights. Some countries use indications similar to regular traffic lights, which would also be possible. The flashing rate is generated by the failsafe code of the PLC.

Audible warning and switches for manual operation may be implemented if required. The PLC provides failsafe/standard digital inputs and outputs and analog inputs and outputs, which can be programmed for a series of different operation methods, which will vary among railway authorities. For traditional level crossings in Australia a bell is used and fitted on the same mast as the flashing lights 138/238 and or 140/240.

Data-logger functionality can be provided either by the PLC itself or by an extra Panel. The data-logging functionality is described in greater detail in Section 6 hereinafter. If ET 200S is used, an extra panel is recommended, once the logged information cannot be extracted from the PLC without a computer with the Siemens® Step 7 compiler installed. Step 7 is software that can be used to program Siemens' PLCs. This software can be used to design and program the PLC, but it is not necessary for maintenance. A series of panels for industrial applications are available and such panels can be customized according to client requirements.

Remote monitoring may also be practiced. The standard would be providing remote monitoring with a Simatic WinCC SCADA and HMI system from Siemens® running remotely in a PC and communicating with the PLC via a range of protocols available (PDS, OPS server, etc.). Other protocols may be used without departing from the scope of the invention. The communication method of the remote monitoring may vary depending on what is best suited for each location. Radio, GPRS or satellite communication, for example, may be used for the data link.

The embodiments of the invention provide a number of functionalities, including:

• Train detection implemented with WSR;

• Automatic activation and deactivation of warning lights; • Redundant light circuits;

• Battery voltage monitoring;

• Data logging; and

• Remote monitoring interface.

Optional functionalities that may be provided include:

• Control of audible warning equipment;

• Advance warning lights based on radio and solar power; and

• Test switch/ Manual Operation Switch.

These functionalities are further described in the following sections.

Generally, the operation of a level crossing protection system expects that the presence of a train is detected at a point where a minimum warning time is guaranteed to be provided to drivers and pedestrians, before the train arrives at the crossing. For this purpose, a strike-in point is calculated, such as the fastest train allowed to run on that line would allow minimum warning time before reaching the crossing. For axle counter systems, that is the location where the wheel sensors are installed.

Likewise, unnecessary warning should be avoided as far as possible. For this purpose, the train is also detected clearing the crossing at a strike out point next to the crossing. This allows the warning to be switched off as soon as the train clears the crossing.

The five system architectures described hereinafter provide similar warning behaviour for a train that crosses all sections at constant speed without stopping.

However, failure modes and the behaviour with stopping trains does differ among them.

3.1 System architecture 1 based on axle counters with cable connection

This system architecture is based on the layout 100 in Fig. 1 and is a traditional level-crossing protection system layout when axle counters are used for train detection.

Any axle counter may be used, but the Siemens® Clearguard ACM 100 system is proposed here for its compact size, ease to connect with other equipment, and low cost.

However, other axle counters may be practiced without departing from the scope of the invention. To avoid the excessive cost for trenching, the cables are clamped to the track rails. This is allowed for the ACM 100 system as long as the rail used to attach the WSD wheel sensors are not being used for traction return.

Fig. 3 is a block diagram illustrating this architecture. The main system elements 332, 334, 336, 338, 340, 342, 344, 346, and 348 and its connections are displayed in Fig. 3. The PLC 334 and the axle counter evaluator 332 are located in the central cabinet 330 and all wheel sensors 312, 314, 316, 318 are connected to the evaluator 332 directly via cable 350, which includes the ones at the strike-in points.

The apparatus 330 corresponds to the central cabinet with solar panels 130 in Fig. 1. The axle counter 332 is coupled by control cables 350 to the strike-in wheel sensors 312, 314, and strike out wheel sensors 316, 318, corresponding to the strike-ins 112, 114 and strike-outs 116, 118 of Fig. 1. Control cables 350 couple the axle counter 332 to the inputs and outputs of the failsafe PLC 334, which in turn has an output(s) to the warning lights 302 or 304 and the audible warning (optional) 306. One example of a warning light is an RX-5 assembly 302, which has a railroad crossway signing, lights, and a stop on red signal sign. Another one is a supplementary light for passive level crossing 304, which has a stop sign and a sign stating look for train at all times and may have red or yellow steady lights. Control cables 350 connect the devices 302, 304, 306 and the failsafe PLC 334. The Ethernet switch 338 in the apparatus 330 is coupled by Ethernet cables 352 to each of the axle counter 332, the failsafe PLC 334, the panel/data logger 336, the satellite/radio communication modules 348 for remote monitoring and diagnostics. Power is provided from the 24V DC/DC converter 340 by power cables 354 to each of the axle counter 332, the failsafe PLC 334, the panel/data logger 336, and the satellite/radio communication modules 348. The converter 340 is coupled by power cables 354to a solar controller 344, which is coupled to solar panels 346 and to the one or more batteries 342. The wheel sensors 312, 316, 318 and 314 are directly powered from the axle counter device 332.

For the particular configuration shown in Fig. 3, the Ethernet switch 338 interconnects the axle counter 332, PLC 334, panel 336, and radio 348 for remote monitoring. This connection also allows the ACM 100 334 to be remotely monitored.

The PLC 334 directly interfaces with the axle counter evaluator 332, which provides standard track vacancy detection information via two antivalent failsafe outputs channels per track section. The logic executed in the PLC 334 is redundant via software and can be customized to any client requirements. The programming language is ladder logic allowing flexible software customization. More details are described hereinafter in Section 4.0 - Safety.

The solar power supply 342, 344, 346, remote monitoring, panel 336 for data logging and local control, and the warning lights 302, 304, 306 work on the same way throughout architectures and are further described in the following sections.

3.2 System architecture 2 based on axle counters with radio connection

This system architecture is based on the layout illustrated in Fig 2, which requires two additional cabinets 250, 252, one at each of the strike-in points. The central cabinet 230 communicates with the two remote cabinets 250, 252 at the strike-in points via radio communication links.

This alternative is suitable when cables are not allowed to be clamped to the rails either because of trackside interferences or the decision of the railway authority.

Fig. 4 is a block diagram for this system architecture 400. The configuration of the central cabinet 430 of Fig. 4 is essentially identical to the central cabinet 330 of Fig. 3. For the sake of brevity only and to avoid being unduly repetitious, the following description does not repeat the description of the central cabinet 330 of Fig.3. Like numbered elements (3XX in Fig. 3 and 4XX in Fig. 4) have the same structure and configuration unless stated otherwise. For example, the panel/data logger 336 of Fig. 3 and the panel/data logger 436 of Fig. 4 are the same. Internally, the central cabinet 430 of Fig. 4 differs from the cabinet 330 in Fig. 3 in the directional antennas and modem 480 for communicating with respective remote cabinets. The modem 480 is coupled to two directional antennas (up and down locations) and an Ethernet switch 438 for communications. The modem 480 receives power from the 24V DC/DC converter 440. Again, the control cables 450 couple the axle counter 432 to the inputs and outputs of the failsafe PLC 434, which in turn has an output(s) to the warning lights 402, 404 or the audible warning (optional) 406. One example of a warning light is an RX-5 assembly 302, which has a railroad crossway signing, lights, and a stop on red signal sign. The description of the warning indicators 402, 404, and 406 are not repeated here but are the same as those for indicators302, 304, and 306. Control cables 450 connect the devices 402, 404, 406 and the failsafe PLC 434. The axle counter 432 is coupled by control cables to strike-out wheel sensors 416, 418, not to the strike-in wheel sensors 412, 414 as shown in Fig. 4.

At the central cabinet 430, only the strike-out wheel sensors 416, 418 are directly connected to the axle counter evaluator 432 and additional axle counter evaluators 470 are located in each strike-in cabinet 460, 462 to connect to the respective wheel sensor 412, 414. The three evaluators 432, 470 communicate via the radio links provided. Each remote station/cabinet 460, 462 is a coupled to a respective strike-in wheel sensor 412, 414 at the strike-in locations. Each remote cabinet 460, 462 comprises one or more solar panels 478 connected to a solar controller 471 in the cabinet 460, 462. The solar controller 471 is coupled to one or more batteries 473 to store electrical energy generated by the solar panels 478. The solar controller 471 is coupled to a 24 DC/DC converter 474, which provides power to an axel counter 470 and a radio communications module 472, comprising a modem and a radio antenna coupled to the radio modem. The axle counter 470 is coupled for communications with the radio communication module 472. Control cables 479 couple the axle counter 470 to a respective one of the strike-in wheel sensor 412, 414.

The three axle counter evaluators 432, 470 communicate via a failsafe protocol, process all data, and provide failsafe outputs with track vacancy detection information. For this particular configuration, only two failsafe outputs are available from the axle counter 432 to interface with the PLC 434. Therefore, two overlapped track vacancy detection sections are used for the level crossing control as shown in Fig. 8B. The limits of each track vacancy detections are between strike-in and strike-out wheel sensors for each of the directions and the overlap is the section between both strike out sections.

The failsafe PLC 434 directly interfaces with the axle-counter evaluator 432 in the central cabinet 430, which interface is used to transmit the track vacancy detection information from axle counter 432 to the PLC 434 via failsafe outputs. The logic executed in the failsafe PLC 434 is redundant via software and can be customized to any client requirements. Details about how safety processing is achieved are described hereinafter in Section 4.0 - Safety.

The solar power supply 440, 442, 444, 446, remote monitoring 448, panel for data logging and local control 436, and the warning lights 402, 404, 406 work on the same way throughout architectures and are further described hereinafter in the following sections. The solar power supply 474, 471, 473, 478 in the strike-in cabinets 460, 462 of Fig. 4 only differs from the one in the central cabinet 430 in respect of solar panels and battery capacity.

3.3 System architecture 3 based on wheel sensors with cable connection

This third system architecture is based on the layout 100 depicted in Fig. 1 and is a traditional level-crossing protection system layout with axle counters for train detection, although wheel sensors, which do not include axle-counter evaluators, are used in this system architecture.

To avoid the excessive cost of trenching, the control cables are clamped to the rails. This is allowed by the Siemens® wheel sensors as long as both rails are not being used for traction return. Some of the models of wheel sensors allow for single wheel resolution, while others only allow for wheel presence detection.

Fig. 5 is a block diagram illustrating this architecture 500. The main system elements and their connections are being displayed in Fig. 5. In this architecture 500, the central cabinet 530 does not have an axle counter evaluator. Control cables 552 directly connect the input of a failsafe PLC 534 and strike-in wheel sensors 512, 514 (up and down directions respectively) and strike out wheel sensors 516, 518. The output of the failsafe PLC 534 is coupled by control cable 555 to the warning lights 502, 504 or the audible warning (optional) 506. One example of a warning light is an RX-5 assembly 502, which has a railroad crossway sign, lights, and a stop on red signal sign. Another one is supplementary lights for passive level crossing 504, which has a stop sign and a sign stating look for train at all times and may have red or yellow steady lights. Control cables 550 connect the devices 502, 504, 506 and the failsafe PLC 534. The Ethernet cable 590 couples the failsafe PLC 534 to: the panel/data logger 536 for communications and the satellite/radio communication module 548 for remote monitoring and diagnostics. The satellite/radio communication module 548 comprises an antenna for remote monitoring and a radio communications modem. Power is provided from the 24V DC/DC converter 540A by power cables 561 A to each of the failsafe PLC 534, the panel/data logger 536, and the satellite/radio communication modules 548. Power is provided separately from another 24V DC/DC converter 540B by power cables 561 B to strike-in wheel sensors 512, 514 and to strike-out wheel sensors 516, 518. The two converters 540A, 540B are coupled by power cables to a solaricontroller 544, which is coupled to one or more solar panels 546 and to the one or more batteries 542.

The failsafe PLC 534 is located in the central cabinet 530 and all wheel sensors

512, 514, 516, 518 are connected to the inputs of the failsafe PLC 534 directly via cable 552, which includes the wheel sensors at the strike-in points. Two wheel sensor modules (only one sensor is shown in Fig. 5) can be used at each strike-in point to provide redundancy if not already provided by the wheel sensor module itself. For instance, the WSR does not provide internal redundancy, but the WSD-E provides internal redundancy.

For the particular configuration shown in Fig. 5, an Ethernet switch is not required if a Siemens® ET200S IM151-8F PN/PD central processing unit (CPU) is used as the failsafe PLC 534. This CPU when used as the failsafe PLC 534 provides three Ethernet ports, which can used to connect to the panel/datalogger 536 and the radio communication module 548 for remote monitoring and diagnostics.

Regarding the PLC 534, a different type of logic is required for this system architecture 500. The logic executed in the PLC 534 is redundant via software and can be customized to any client requirements. More details are described in Section 4.0 - Safety and in Section 5.0 about modes of operation.

The solar power supply 540A, 540B, 542, 544, 546, remote monitoring 548, panel 536 for data logging and local control, and the warning lights 502, 504, 506 work the same way throughout architectures and are further described hereinafter in the following sections.

3.4 System architecture 4 based on wheel sensors with radio connection

The fourth system architecture 600 shown in Fig. 6 is based on the layout 200 in Fig 2, which requires two additional cabinets 660, 662 at each of the strike-in points. The central cabinet 630 communicates with the two cabinets 660, 662 at the strike-in points via radio communication link. The central cabinet 630 has the same elements and configuration as the central cabinet 530 of Fig. 5, except that it contains an additional directions antenna and radio communications module 680 and that the inputs of the failsafe PLC 634 are only connected to the strike-out wheel sensors 616, 618. Like numbered elements (6XX in Fig. 6 and 5XX in Fig. 5) have the same structure and configuration unless stated otherwise. The 24V DC 3C converter 640A also provides power using power cable 661 A to the directional antennas and radio communications module 680 for radio links for up and down links to the remote cabinets 660, 662 at the strike-in sensors 612, 614. The failsafe PLC 634 also communicates via the Ethernet cable 690 to the directional antennas and radio communications module 680. The outputs of the failsafe PLC 634 is also coupled by the control cable 650 to the warning lights 602 or 604, or the audible alarm 606. The second 24V DC/DC converter 640B provides power using power cable 661 B to the strike-out wheel sensors 616, 618.

Each remote station/cabinet 660, 662 is a coupled to a respective strike-in wheel sensor 612, 614 at the strike-in locations. Each remote cabinet 660, 662 comprises one or more solar panels 678 connected to a solar controller 671 in the cabinet 660, 662. The solar controller 671 is coupled to one or more batteries 673 to store electrical energy generated by the solar panels 678. The solar controller 671 is coupled to two 24 DC/DC converters 674A, 674B. The first converter 640A provides power to a radio communications module 672, comprising a modem and a radio antenna coupled to the radio modem and PLC 670. A PLC 670 is coupled for communications with the radio communication module 672. Control cables 679 couple the PLC 670 to a respective one of the strike-in wheel sensor 612, 614. The second DC/DC converter 674B provides power to the strike-in wheel sensor 612, 614.

This architecture 600 is a suitable alternative when cables are not allowed to be clamped to the rails, either because of trackside interferences or the decision of the railway authority.

In Fig. 6, at the central cabinet, only the strike-out wheel sensors 616, 618 are directly connected to the failsafe PLC 634. The strike-in wheel sensors 612, 614 are connected to an additional PLC 670, which is located in each strike-in cabinet 660, 662. The train presence is transmitted to the failsafe PLC 634 in the central location 630 via the radio link. The PLC will process all the level crossing logic according to one of the operation modes described hereinafter. Further details are described in Section 4.0 - Safety. Two wheel sensor modules can be used at each strike-in point to provide redundancy if not already provided by the wheel sensor module (612, 614). For instance, the WSR does not provide internal redundancy, but the WSD-E provides internal redundancy.

The communication protocol used depends on what is available for the particular

PLC used. For instance, the Siemens® ET200S CPU series can communicate with PROFIBUS® or PROFINET® provided by PI if the CPU module is used. Pulse information can be sent for each wheel detected. This helps to differentiate between the detection of a wheel and a failure.

The solar power supply, remote monitoring, panel for data logging and local control, and the warning lights work on the same way throughout architectures and are further described in the following sections. The solar power supply in the strike in cabinets only differs from the one in the central cabinet in relation to the specific solar panels and batteries capacity.

3.5 System architecture 5 based on wheel sensor and with telemetry

A fifth system architecture 700 shown in Fig. 7 follows basically the same concept of the fourth system architecture 600 of Fig. 6, with the difference that in each remote cabinet 760, 762 a telemetry system 774 in Fig. 7 replaces the solar controller 661, the PLC 670 and the radio communications module 672 of Fig. 6, and that single wheel resolution information cannot be sent to the central cabinet 730. The telemetry system 774 is a radio module with digital inputs interface. The model analysed is ELPRO 105U-2 (or 905U-2) radio telemetry modem provided by omni instruments for the remote locations. This module is also capable of solar regulator functionality.

This architecture 700 is based on the layout 200 in Fig 2, which requires two additional cabinets 250, 252, one at each strike-in point. The central cabinet 730 of Fig. 7 communicates with the two remote cabinets 760, 762 at the strike-in points via radio communication links.

The central cabinet 730 has the same elements and configuration as the central cabinet 630 of Fig. 6, except that it contains an additional directional antenna and telemetry communications module 780. Like numbered elements (7XX in Fig. 7 and 6XX in Fig. 6) have the same structure and configuration unless stated otherwise. The 24V DC/DC converter 740 A also provides power using power cable 761 A to the directional antennas and telemetry communications module 780 for radio links for up and down links to the remote cabinets 760, 762 at the strike-in sensors 712, 714. Two ambivalent inputs of the failsafe PLC 734 are coupled by control cables 752 to the telemetry communications module 780 for each remote wheel sensor. The outputs of the failsafe PLC 734 are also coupled by the control cable 750 to the warning lights 702 or 704, or the audible alarm 706. The second 24V DC/DC converter 740B provides power using power cable 76 IB to the strike-out wheel sensors 716, 718.

Each remote station/cabinet 760, 762 is a coupled to a respective strike-in wheel sensor 712, 714 at the strike-in locations. Each remote cabinet 760, 762 comprises one or more solar panels 778 connected to radio telemetry module 774 that implements a telemetry/solar controller, e.g. an ELPRO 105U-3 (or ELPRO 905U-3) telemetry modem. The telemetry/solar controller 774 is coupled to one or more batteries 773 to store electrical energy generated by the solar panels 778. The battery 773 provides power to the strike-in wheel sensors 712, 714. The telemetry/solar controller 774 is coupled to an antenna to implement a radio telemetry link.

The architecture 700 of Fig. 7 is a suitable alternative when cables are not allowed to be clamped to the rails, because of either trackside interference or the decision of the railway authority.

In Fig. 7, at the central cabinet 730, only the strike-out wheel sensors 716, 718 are directly connected to the failsafe PLC 734. In each strike-in cabinet 760, 762, the telemetry system 774 (e.g., ELPRO 105U-2 or equivalent) controls the solar power 778, 773, provides radio telemetry communication, and directly interfaces with the wheel sensors 712, 714 via digital inputs. In the central cabinet 730, at the central location, the radio telemetry module 780 (e.g., ELPRO 105U-3 telemetry modem) converts all the information received from the remote cabinets 760, 762, such as train detection and battery status, into digital outputs, which interface with an input module of the failsafe PLC 734. Further details are described hereinafter in Section 4.0 - Safety.

Two wheel sensor modules may be used at each strike-in point 712, 714 to provide redundancy if not already provided by the module 712, 714. For instance, the WSR does not provide internal redundancy, but the WSD-E provides internal redundancy. The solar power supply, remote monitoring, panel for data logging and local control, and the warning lights of the central cabinet work in the same way throughout architectures and are further described in the following sections. The solar power supply in the strike-in cabinets only differs from the one in the central cabinet in respect of the specifics for solar panels and battery capacity.

4.0 Safety

The layouts and architectures described hereinbefore enable a system that provides safety, as far as practical, taking into consideration cost constraints for this type of application. Fail safe principles are implemented for design and installation, as required. Redundancy is provided to ensure a high level of reliability both for hardware and software.

4.1 Hardware

This system implements failsafe principles that are the same or similar to the ones currently used by existing systems. Redundancy is provided for in the following: (1) train detection at the strike-in points, (2) wiring of wheel sensors up to the axle counter or PLC input boards with internal redundancy, and (3) wiring of the light circuits.

All PLCs chosen here are not redundant in hardware, but can provide software processing redundancy, thereby increasing safety.

Generally, the lights for active level-crossing protection in Australia include two masts with two sets of two LED flashing lights, each set facing one direction of the road. The location and position of each light 138, 140, 238, 240 are illustrated in Figs. 1 and 2 on both system layouts 100, 200, respectively, and front views of the masts are illustrated in Figs. 3-7. Two different circuits couple the central cabinet to the lights to provide redundancy for the flashing lights. The LED lights for each set are wired to a different circuit. If one of the circuits fails, one light per set goes dark, but the other in the set continues to flash. This also allows providing an inverse flashing cycle for lights in the same set. Optionally, two different failsafe digital output modules in the PLC may be used to control each of the light circuits, thereby ensuring the lights are lit if the PLC fails. If the preferable failure mode is the opposite of the foregoing, the lights can be extinguished in case of a PLC failure.

The wheel detection function is achieved either with an axle counter or simply with wheel detectors. The Siemens® Clearguard ACM 100 axle counting system may be used for the axle counter option, which ensures Safety Integrity Level (SIL) 4 rating for the train detection function. The wheel detection option can be implemented with a range of options, which generally interface via digital outputs. The Siemens® WSD-E, WSS & ARS, RSE & ARS, and WSR are modules that may be used for this function, while achieving the same result. The WSD-E wheel sensor is the only option among those listed that provides internal redundancy; the other options require the use of two wheel sensors to achieve redundancy for the wheel detection function.

In case of communication failure with any of the remote cabinets at remote locations (strike in), an alarm is sent by the central cabinet for remote monitoring to notify maintenance personnel of the failure. The warning lights can be configured to be either "on" or "off in case of a communication/system failure

4.2 Software

The safety of the Central PLC processing is increased via redundant processing implemented in the Siemens® PLC which allows SIL 3 applications. When the software is compiled, the failsafe blocks and functions generate code containing the same logic in duplicate, this is known as coded-monoprocessing, which runs twice and compares the results.

The Siemens® STEP 7 compiler is used to generate the failsafe software to run in the Siemens® SIMATIC ET 200S PLCs (failsafe module). The F-libraries (VI) of Siemens® SIMATIC S7 Distributed Safety failsafe system provide fail-safe application blocks that can be used in the safety software.

Safety checks are automatically performed and additional fail-safe blocks for error detection and fault reaction are inserted when the safety program is compiled. This ensures that failures and errors are detected and appropriate reactions are triggered to maintain the SIMATIC S7system in the safe state or bring it to a safe state.

In addition to the safety program, a standard user program can be run on the SIMATIC S7-F-CPU. A standard program can coexist with a safety program in a SIMATIC S7-F-CPU, because the safety-related data of the safety program are protected from being affected unintentionally by data of the standard user program.

Data are exchanged between the safety program and the standard user program in the SIMATIC S7-F-CPU by means of bit memory or by accessing the process input and output images.

4.3 Failure modes

The most critical function for a level-crossing protection system is proper operation of warning lights when a train is approaching or going through the level crossing. Therefore, all features of the system that affect this function needs to be analysed. For instance, wheel detection, communication, processing, and operation of warning lights must be analysed.

Wheel detection is one of the most critical subsystems; the failure to detect a train would cause the system to fail to activate the warning lights. All wheel detection systems proposed herein, including the WSD for the Siemens® Clearguard ACM 100 axle counting system, work according to the same principle, which is the deflection of a magnetic field induced by the presence of a train wheel or wheel flange. One possible problem is that a wheel sensor detaches from the rails. If this occurs, the magnetic field is also deflected once the track is no longer in the same position in relation to the sensors. This is a fail-to-safe situation, in which the level-crossing protection system would actuate the warning lights due to a supposed occupation of the tracks, or detection of train presence, which is incorrect. As such a situation will persist, an alarm can be programmed for a prolonged warning activation. Any cable problems would also be promptly detected by the system.

For systems based on radio communication, a failure of the radio link can also be detected once an "Acknowledge" message is sent from time-to-time by the PLCs of remote cabinets. By failing to receive such a message, the level-crossing protection system can be programmed to activate the warning lights after a certain timeout or a number of messages are missed. An alarm to the remote monitoring is issued.

Processing failure is automatically managed and controlled by the Siemens®

SIMATIC failsafe PLCs. The failsafe outputs used to light the flashing lights can be programmed to switch the lights either on or off. The flashing rate is not available if used, but the flashing lights can be lit steadily.

For systems based on wheel sensors only, the direction of travel is not monitored. For this reason, the train presence is not memorised for longer than a timeout. For instance, if a train approaches the strike-in points and stops, after a timeout, the warning is deactivated, but the train is still inside the approach section. This can result in no, or not enough, warning being provided to drivers and pedestrians before arrival of the train at the level crossing. This type of situation is not desired and needs to be addressed and mitigated by the railway operational safe work procedures. This is a limitation of this particular system where single wheel detection is not provided. One possible solution is to prohibit trains to stop in this section where this particular level crossing is installed.

4.4 Remote monitoring

Remote momtoring is a significant function allowing the overall safety of the level-crossing warning system to be ensured. On occurrence of a hardware failure, an alarm is issued, allowing maintenance personnel to fix promptly the level-crossing warning system. This increases the availability of the level-crossing warning system by minimising the period that the level-crossing warning system is unavailable.

The following alarms can be provided to the remote monitoring computer using the satellite/radio communication module of the central cabinet:

Crossing warning active,

ACM 100 - Board error,

ACM 100 - reset restriction,

Power supply - controller health,

Power supply - battery level low,

Power supply - batteries discharging,

Power supply - time discharging > 1 day,

Warning Lights - low or no current - circuit 1,

Warning Lights - low or no current - circuit 2,

PLC errors, and

Panel errors, where "ACM 100" refers to a Siemens® Clearguard ACM 100 axle counting system.

5.0 Modes of operation

A number of different modes of operation can be implemented by the proposed system architectures, which are described in this section. This section starts with a description of the general functionality expected for a level-crossing protection system, and the differences are then outlined for each variation.

5.1 General level crossing protection systems

Generally, a level-crossing protection system is expected to issue a warning to drivers and pedestrians, at least, a predetermined period before the arrival of a train at a level-crossing. This is achieved by defining, for a particular level crossing, where strike-in points are located. The sensors at the strike-in points are used to automatically activate a warning system when a train is detected there. For instance, if the maximum permissible line speed for a train is 120 km/hour and at least 25 seconds of warning are expected before the train arrives at the level-crossing, the strike-in points should be located at least 25 *(l/60*60) * 120 * 1000 = 833 meters from the road kerb or the pedestrian passage (this example does not include system delays).

Another requirement is that the warning system should be deactivated as soon as possible after the train clears the level-crossing. This is achieved by determining an appropriate location for the strike-out point. The strike-out point should be located close to the road kerb or pedestrian passage, but should take into consideration the maximum possible overhang of a train, which adds a few metres.

A side effect of this type of level-crossing protection system is that for slow trains the warning times exceed the minimum designed time. For example, a train running at a speed, which is half of the line speed, would result in twice as much warning time as designed.

5.2 Axle-counter-based systems

Generally, axle-counter-based systems operate as described in Section 5.1 hereinbefore. Such axle-counter-based systems 300 and 400 are shown in Figs. 3 and 4. The differences in behaviour for failures and trains that do not cross all detection sections at constant speed depend on the track vacancy detection configuration, as illustrated in Fig. 8, and ladder logic programmed in the PLC.

Figs. 8A and 8B illustrate first and second axle-counter configurations for track- vacancy-detection sections for axle-counter-based systems. Fig. 8 A shows a configuration with three track vacancy detection sections TVD I , TVD2, and TVD3. Fig. 8B shows a configuration with two track-vacancy-detection sections TVD-UP and TVD-DN. The normal operation for either configuration is the same. What varies is the failure modes and the number of the inputs required in the central PLC (2 or 3). An arrow labelled "Up" extending from left to right horizontally indicates the Up direction, in both Figs. 8A and 8B. Furthermore, Up and Down (Dn) control sections are located to the left a^id right of the island section 810 and 860 in Figs. 8A and 8B, respectively. The Up strike-in sensor 812 and the Dn strike-in sensor 814 are located to the far left and far right of the island section 810 in Fig. 8 A. Similarly, the Up strike-in sensor 862 and the Dn strike-in sensor 864 are located to the far left and far right of the road section 860 in Fig. 8B. The DN strike-out sensor 816 and the Up strike-out sensor 818 are located to the immediate left and immediate right of the island section 810 in Fig. 8A. Similarly, the DN strike-out sensor 866 and the Up strike-out sensor 868 are located to the immediate left and immediate right of the road section 860 in Fig. 8B.

For example, see Fig 9 displaying states during a normal occupation sequence 900 of level crossing sections and indications displayed to road drivers based on active level crossing with flashing lights in Australia. Figs. 9A, 9B, 9C, and 9D illustrate different states during an occupation sequence as the train moves in the up direction relative to the level crossing. To simplify the drawing, only the strike-in and strike-out sensors 912, 914, 916, 918 and warning lights 938, 940 are depicted relative to the tracks 904 and the island (road) 910 of the level crossing.

In Fig. 9A, the train 950 approaches the up strike-in sensor 912 in the up direction (from the left to the right), but has not yet reached the up strike-in sensor 912, therefore the warning lights/signs 938, 940 are in an "off' state. In Fig. 9B, the first axle of the train 950 has been detected by the up strike-in sensor 912 and actuates the warning system at the level crossing so that the warning lights/signs 938, 940 are now. in an "on" state (flashing alternatively right and left lamps). In Fig. 9B, the warning lights/signs 938, 940 are flashing and an alarm may be sounded. The warning system remains activated until the last part of the train 950 passes the up strike-out sensor 918 to the right of the island section between strike-out wheel sensors, as shown in Fig. 9C, at which time the warning system is turned off. This is indicated in Fig. 9C by the warning lights 938 no longer flashing. Note that the occupation of the train on the departure section does not cause warning. In Fig. 9D, the train 950 has passed the down strike-in sensor 914 and the system returns to normal state waiting for a next train from any direction.

Fig. 11 provides an example of ladder logic designed with Siemens® Step 7 compiler for a low-cost level crossing based on axle counters and the Siemens® ET200S PLC. The logic implemented is based on relay logic for Australian Rail Track Corporation Ltd (ARTC). The logic presented is only from the track section occupation until the warning activation; therefore, Fig. 11 does not illustrate the full detailed logic of how many lights there are, how the flashing is implemented, and how the audible warning is activated. Fig. 11 A illustrates the ladder logic 1 110 for crossing safe. Fig. 1 IB illustrates the ladder logic 1120 for the up directional stick. Fig. 11C illustrates the ladder logic 1130 for the down directional stick. Fig. 1 ID illustrates the ladder logic 1140 for the down crossing repeater. Fig. 1 IE illustrates the ladder logic 1150 for the up crossing repeater. Fig. 1 IF illustrates the ladder logic 1160 for the island repeater.

Fig. 11 A is the equation for a coil of a logical relay XR 1112, which energizes when the crossing is detected to be clear of trains. This means that the warning is activated upon de-energizing the coil of the relay XR 1112. All relay contacts of this equation but one (Test 1114) have their coils and therefore equations in Figs. 1 IB through 1 IF. The Test 1114 contact is part of a button, which inputs to the central PLC, allowing to activate the warning and test the system. The switch is normally made and once pressed opens the circuits de-energizing the coil XR 1112.

The equivalent logical equation for Fig. 11 A is:

XR 1112= (DXPR 1119 OR UDSR 1111) AND XTPR 1118 AND (UXPR 1116 OR DDSR 1113) AND not-Test 1 114.

For instance, assuming a train is approaching in the Down direction, the behaviour of this equation of Fig. 11A is as follows:

Initially tracks clear (DXPR, XTPR, UXPR energized),

Test switch 1114 not pressed, ' Warning deactivated (XR 1112 energized), and

Directional sticks not memorizing any travel (UDSR 1111 and DDSR 1113 de- energized).

Upon approach of a train, the down track is occupied (DXPR 1119 is de-energized), opening the circuit until the coil XR 1112 and causing the warning to be activated. When the train arrives at the crossing track section, XTPR 1118 de-energizes and the directional stick relay (DDSR 1113) memorizes a train travelling in the down direction by energizing, see Fig. 11C. As the train proceeds, the first two track sections become clear (DXPR 1119 and XTPR 1118). This causes the warning to deactivate via energizing XR 1112 while the departure track (UXPR 1116) is occupied (de-energized) because the DDSR 1113 continues to be energized, thereby completing the circuit. Once the train clears the 3^rd section, the equation returns to the initial (normal) state. This equation behaves similarly for a train approaching in the Up direction.

Fig. 1 IB illustrates the equation for the Up Directional Stick Relay coil UDSR 1122. For the sake of brevity the meaning and states of variables are assumed to be known from the preceding paragraph. The timer block 1124 aims to provide a delay when the relay is de-energizing, thereby mitigating the risk of the XR oscillating as the train clears the track sections. The equation is first energized when a train occupies the Up track section UXPR and the crossing track section XTPR with the Down track section DXPR clear. The relay continues energized through the second part of the equation with crossing section XTPR occupied and a stick contact of the same relay UDSR energized. Upon clearing the crossing track XTPR, the equation remains energized if the train continues to proceed Up direction with the Down track occupied (DXPR de-energized) and the Up track clear (UXPR energized). At this stage, the equation performs the function of deactivating the warning in the equation for XR 1110 as soon as the train clears the crossing section. The EN and ENO interfaces of the timer 1124 refers to Enable and Enable Output for the logical block.

Fig. l lC illustrates the equation for the Down Directional Stick Relay coil DDSR 1132. This equation has the same behaviour as the UDSR 1122 for a train travelling from the opposite direction (Down direction for DDSR 1132 and Up direction for UDSR 1122). For the sake of brevity, reference is made to explanation of Fig. 1 IB hereinbefore, since the logical structure of DDSR 1132 corresponds directly with UDSR 1122 with suitable changes (e.g. DXPR instead of UXPR).

Fig. 1 ID illustrates the repeater variable DXPR 1142 for the input of Down track section DX 1144. The contact for the crossing track section XTPR ensures the track is considered clear provided the crossing track is clear. Once the track is repeated clear through the DXPR, the track only becomes occupied by occupying the Down track section DX 1144.

Fig. 1 IE illustrates the repeater variable UXPR 1152 for the input of Up track section UX 1154. For the sake of brevity, reference is made to Fig. 1 ID, which describes DXPR 1142 having the same behaviour as UXPR 1152 for a different track.

Fig. 11 F illustrates the repeater variable XTPR 1162 for the input of Crossing track section XT 1 164. This is a simple repeater without any additional logic.

Fig. 10 is a general flowchart illustrating operation 1000 of a level-crossing warning system. In the following description of Fig. 10, blocks in the diagram are described as "steps" hereinafter of the process or method 1000. While the term "step" (depicted as a box) is used to describe the process or method that is being carried out, the expressions "process block" or "processing block" can be used instead. The expression "decision block" can be used instead of "decision step" (shown as a diamond). The "block" expressions might be more appropriate where the algorithm shown in Fig. 10 is implemented in hardware, e.g. electronics or FPGA. The steps might be implemented as modules of hardware and/or software. Thus, the term "step" is interchangeable with "block". The first circle 1012 is a start point (turn on). The process 1000 comprises four consecutive stages: start-up/wrong occupation sequence 1010 (steps 1012, 1014, 1016, 1018), 1- waiting first wheel sequence 1020 (steps 1022, 1024), 2- waiting crossing to clear sequence 1030 (steps 1032, 1034, 1036, 1038, 1040), and 3- waiting departure side to clear sequence 1050 (step 1 52). Processing commences at step 1012 when the system is turned on. This causes step 1014 to be carried out, where the warning lights start flashing. After a manual intervention (manual reset sections) in step 1016, the counting heads counters are reset (either axle counter or wheel sensor systems). As the system has just been started up, the system does not know if a train is between the wheel sensors, the manual intervention requires someone to go and visually check if the tracks are clear. By resetting the system, the step 1018 is carried out, in which the lights stop flashing. The system then waits until any train movement is detected.

Upon detection of a first wheel, if detection is counted inside one of the approach sections, this causes the decision step 1022 to process as true ('yes') and start the warning with the flashing lights in step 1024. If a wheel is counted out of any section or in the island section between the strike out wheel sensors, the result of the step 1022 is false ('no') and the processing returns to the error/start up point of the logic just before step 1014.

In the stage 1030 of the process 1000, the correct occupation sequence is verified. Initially, at decision step 1032, a check is made to determine if the island section between strike-out wheel sensors is occupied after the occupation of the first approach section. If decision step 1032 returns true ('yes'), the next expected step is the occupation of the departure section (or opposite approach section) checked in decision step 1034. Otherwise, if decision step 1032 returns false ('no'), the processing returns to step 1016.

In decision step 1034, a check is made to determine if the departure section is occupied. If decision step 1034 returns true ('yes'), processing continues at step 1036. Otherwise, if decision step 1034 returns false ('no'), the processing returns to step 1016.

In decision step 1036, a check is made to determine/confirm if the first approach section, which was occupied, is clear. "Clear" means all axles counted in this section have also been counted out of this section. If decision step 1036 returns true ('yes'), processing continues at step 1038. Otherwise, if decision step 1036 returns false ('no'), the processing returns to step 1016.

In decision step 1038, a check is made to determine/confirm if the island section, which was occupied, is clear. If decision step 1038 returns true ('yes'), processing continues at step 1040. Otherwise, if decision step 1038 returns false ('no'), the processing returns to step 1016.

The correct occupation sequence being verified by steps 1032 to 2036 causes the lights to stop flashing at step 1040. If any difference of the occupation sequence occurs the processing for each of the steps 1032 to 1038 results in false ('no'), returning the processing to a failure/start up state just before step 1016. In a real situation, a wrong occupation sequence can be caused by equipment failure. For example, this might be due to a train that stops and then starts moving in the opposite direction, or a rail vehicle, usually for maintenance (e.g., high rail vehicle), which is introduced within the sections, typically in the island section.

Processing continues from step 1040 to decision step 1052 in the "waiting departure side to clear" stage 1050. In decision step 1052, a check is made to determine if the departure section is clear. If decision step 1052 returns true ('yes'), processing continues at step 1018. If decision step 1052 returns false ('no'), processing continues at step 1014. In stage 1050, the warning (step 1040) has been deactivated, but the train still occupies the departure section, at least initially. Therefore, the logic of stage 1050 waits until all axles have been counted out of the departure section (or opposite approach section) in step 1052. In step 1018, the warning is turned off and the logic stays waiting for the next train to approach in step 1022. If a different train movement is detected at step 1052, the logic returns to step 1014, activating the warning and then the logic waits for a manual reset just before step 1016 in failure state.

5.3. Wheel-sensor-based systems with single- wheel resolution

The behaviour of this level-crossing warning system for a train crossing all sections at constant speed is the same as that described hereinbefore in Section 5.1. For single-wheel resolution, an axle-counter system is emulated by a PLC, with the difference that the direction of travel cannot always be detected depending on the system design details, such as type of wheel sensor. This might result in differences in failure modes for me train detection function.

5.4. Wheel-sensor-based systems with wheel detection only

Depending on the limitations of wheel detection and communication system used, the emulation of an axle-counter system may not be possible, because single- wheel resolution signal is not available when received by the PLC in the central cabinet at the central location. For instance, the WSR can be either of two models: one that generates a pulse of 400 ms width, or another that generates a pulse of 12 ms width every time a wheel is detected. While the 12 ms pulse would enable the train wheels to be differentiated at a speed of up to around 120 km/hour, the 400 ms option would give just a constant signal for a very slow train. Regarding the communication, the fifth sy stem architecture 700 of Fig. 7, which is based on a telemetry system at the strike-in locations, would not be capable communicating fast enough for an adequate counting of wheels.

Different to the use of axle counter or single wheel resolution, this system can only detect that a train is over strike in or strike out points. For the reasons hereinbefore, the operation of such a system needs to be based on timing and rely on the circumstance that the train will not stop in any of the sections. Generally, the system works fairly similar for a normal occupation sequence, with only delays introduced on the deactivation. However, the number of failure modes increases significantly. The Railway's operational safe working procedures must be carefully analysed for this particular type of system as failure modes significantly vary from existing systems.

6.0 Functionalities

In this section, the functionalities for the level-crossing warning system are described hereinafter. The functionalities are generally the same among all system architectures.

6.1 Standard functionalities

Set out hereinafter are the functionalities expected to be delivered for all implementations.

6.1.1 Data logging

Data logging can be implemented with the PLC itself. However, the amount of data and the method to extract the data are limited. Consequently, an additional panel for data logging may be used. The Siemens® portfolio has a range of products available to implement this functionality, with different capacities and costs to suit to any specification. For example, dependent upon the particular application, the module may be implemented using the Siemens® SIMATIC KTP400 panel. Such panels are readily integrated with the Siemens® PLCs and communicate via one of the available protocols, e.g., PG/OP communication, PROFINET IO/CBA, TCP/UDP, or web server and S7 communication. Local control and data logging are available from this panel. The remote monitoring interface can also be implemented via the same panel. For data extraction, a computer with an Ethernet port can be connected directly to the panel, or via a Ethernet switch if available.

6.1.2 Remote monitoring and alarms

The remote monitoring can be implemented via Siemens® WinCC HMI system running on a PC. Other types of systems and protocol may also be practice to implement similar functionality.

6.1.3 Current monitoring for warning lights

To implement current-monitoring functionality, a 1-Ohm resistor in series with each light circuit and an analog input is used. The PLC measures the current drawn by the circuit via an analog input connected in parallel with the series resistor.

6.1.4 Battery voltage monitoring

An analogue input is used to monitor the voltage level of the battery bank.

6.1.5 Axle counter reset

Axle-counter systems require reset procedures, which involve a visual inspection of the rail tracks and pressing a reset button. To perform this reset functionality, the system provides push-button interfaces via digital inputs.

Alternatively, the interface for the reset functionality can be implemented using the panel, noted in Section 6.1.1. This panel is also located in the central cabinet, but is not processed with redundancy as in the failsafe software of the central PLC. Therefore, a lower level of safety is provided if this method is used.

This functionality may also be available via remote monitoring. This can be implemented via a PC communicating to the central PLC via serial/Ethernet protocol or interfaced to a telemetry system via digital outputs and inputs of the central PLC.

6.1.6 Surge Protection

Surge protection is required for all electrical cables leaving the cabinet for a significant distance or connected to equipment prone to electrical inductance. Interfaces requiring protection include power supply, antennas, solar panels and wheel sensors. The respective Railways' type approved surge protection can be used if adequate for the respective interfaces.

6.2 Optional functionalities

Set out hereinafter are extra optional functionalities, which are not expected to be supplied in all installations, but can be implemented if required.

6.2.1 Audible warning

A digital output can be used to switch on and off an audible warning device. This is not usually required to be failsafe functionality, and therefore a simple output may be used. Additional controls can be implemented, such as switching off the audible warning at night.

6.2.2 Advance warning lights

Some complex layouts may require advance warning lights to be installed. This functionality is not likely to be required in systems installed in country or rural areas, but is a functionality that can be implemented.

6.2.3 Test switches

A test switch, such as may be required by Australian or other authorities, can be implemented using push buttons and processed by the failsafe application.

7.0 Subsystems and components

The basic requirements for each subsystem and component essential for correct functioning of the overall warning system are described hereinafter. Most of the components are the same among various system architectures.

7.1 Train detection

The train detection function can be performed by two different types of subsystems: (1) an axle counter (system architectures 1 and 2), and (2) more simply, a wheel sensor without an evaluator (system architectures 3 to 5). Axle counter systems, in general, provide the same interface with other systems. However, wheel sensors have a range of models with different interfaces, which can result in a different result for the overall operation.

7.1.1 Axle counters

Axle counter systems are one form of providing the train detection function for level crossings and signalling systems. For redundancy, two digital outputs provide occupation clear information. Additional inputs and outputs are used for reset procedures and to indicate the status of the equipment. 7.1.2 Wheel Sensors /

Siemens® supplies a few types of wheel sensors available, which can be used for safe train detection. One of such wheel sensor, the WSD-E, provides internal redundancy for failsafe systems. Other models, such as WSR, WSS +ARS, and RSE+ARS, require use of two units at the strike-in location to provide redundancy for the warning activation function. More details about suitable components are described hereinafter in Section 8.2.

7.2 Central processing / PLC

The central processing implemented in the central cabinet can be provided by basically any PLC. If a high level of safety is required, failsafe PLCs such as the Siemens® SIMATIC ET200S IM151-8F PN/PD CPU may be used.

7.3. Connection method with strike in

Two different layouts for connection of equipment in the strike-in and central location can be practiced.

7.3.1 Connection via cable

If cables can be clamped to rails because both the railway authority permits this and the particular section is not electrified, the use of this connection method is advantageous both in cost and availability. See Fig. 1 for System layout. 7.3.2 Connection via radio

If cables are not allowed to be attached to rails, the communication via radio link can be more advantageous: see Fig. 2 for System layout. Radio communication links may be implemented using a 900 MHz frequency-hopping spread-spectrum radio, which does not require a radio license to operate. However, other frequencies and radio techniques may be practiced. One of the minimum requirements for the radio communication is to provide protection against interference and undesirable access, such as cryptography and/or spread spectrum. The radio communications technique also has to comply with the local authority's frequency ranges and the bandwidth required for the application.

The second and fourth system architectures 400 and 600 of Figs. 4 and 6, respectively, require a radio modem with a significant bandwidth to reliably and accurately transfer the single-wheel detection data. This radio communication modem typically interfaces with an Ethernet connection. Modems with serial interfaces may be used and can compromise functions such as single wheel detection / axle counter.

7.3.3 Connection via telemetry

For example, with reference to the system layout 200 shown in Fig. 2 and the fifth system architecture 700 shown in Fig 7, the telemetry radio modules and the radio module (e.g., 680 and 672 in Fig. 6 and 780 and 774 of Fig. 7) may be implemented using ELPRO 905U-D radio modems, which are only compatible with similar units. The spread spectrum feature provides adequate protection against other radios using the same frequency band. The interference and noise of other systems may be measured during installation to ensure reliable and available communication for the installed system. Different system and group addresses are used to avoid reading the message of the wrong modem. The wheel detection function can be implemented, but with a significant delay and without the possibility of counting detected wheels.

7.4 Data Logger / Event recorder

A datalogger/event recorder functionality is generally required to provide the possibility of investigation in case of an accident. This functionality is provided only in the central cabinet and can be performed by either the PLC or a separate panel. 7.4.1 Logging via PLC

The PLC has an internal memory that can be used to implement logging functionality. If additional memory is necessary, an additional panel module can be used to expand the capacity, which can also be used to access information and execute commands locally.

7.4.2 Logging via Panel

There is a large range of Siemens® industrial PLC panels, which can be used for this logging function. The PLC contains internal memory for data logging, which is dimensioned according to the railway requirements and needs to be compatible with the PLC in use in the central cabinet at the central location.

7.5 Warning equipment

Typical warning equipment includes warning lights, audible warning, boom barriers, and gates for pedestrian crossings. As the proposed system is targeted to remote location with low traffic, warning lights and audible warning are the most likely type of warning to be used. 7.5.1 Warning lights

Warning lights are required in the level-crossing warning system to display a warning to pedestrians and drivers. The type and behaviour of warning lights used depends on the railway authority.

For instance, if the system is used for active level-crossing protection in Australia, two red flashing lights per mast per road direction must be used. The flashing lights are assembled on a crossbuck and flash alternately, once the warning lights are activated.

The warning lights are oriented in a first direction for traffic approaching the level crossing (down 138 in Fig. 1), and the other warning lights are oriented in the opposite direction for traffic approaching the level crossing in the opposite direction (up 140 in Fig. 1). The warning lights may be positioned at a variety of positions relative to the level crossing, so as to warn traffic at a safe distance in advance of the level crossing. The warning lights may be positioned within several meters of a level crossing where there is good visibility of the level crossing for a significant distance on either side in relation to the rail tracks. 7.5.2 Audible warning

A digital interface of the failsafe PLC in the central cabinet is used to activate any type of audible warning. If a failsafe output is used, the failsafe output can be configured to be either on or off in case of a PLC failure. 7.6 Remote Monitoring

Remote monitoring is an essential function; this enables maintenance staff to head to the location promptly, once the failure is detected. To provide the remote monitoring functionality, either the chosen panel or the PLC must be able connect to a computer in a remote location. A remote communication link can be implemented with technology adequate for the particular location. For instance, GSM modems are the least power consuming. Radio or satellite links may alternatively be used.

7.7 Surge protection

Surge protection is required for all electrical interfaces prone to interferences or connected at long distances (more than 100 metres) from the cabinet, including wheel detectors and antennas.

7.8 Power Supply

This type of system is likely to be installed in remote locations where either power cannot be available or is expensive for making it available. Therefore most of the installations are likely to be based on solar power supply. However mains power can also be used to power this system.

All systems proposed here requires a low power consumption when compared to most systems currently installed. 7.9 Housing or cabinets

The equipment can be installed in a small cabinet, which can be assembled on a mast. Alternatively, a cabinet can be installed on the ground. 8. Details of critical equipment and construction

8.1 Axle Counter

The Siemens® Clearguard ACM 100 axle counting system may be used as the axle counter system for the first and second architectures 300 and 400 in Figs. 3 and 4. 8.2 Wheel Sensor

The Siemens® wheel sensors herein described can be used for the third, fourth, and fifth architectures 500, 600, and 700 of Figs. 5, 6, and 7, respectively. The WSD-E is preferably used as the wheel sensor, because the WSD-E provides redundancy, which is required at strike-in points. The WSR and WSS can also be used, although they need to be doubled at the strike in locations.

8.2.1 Wheel Sensor Double Electronic (WSD-E^')

The Siemens® WSD-E (Wheel Sensor Double Electronic) Double Wheel Detector is an electronic switch, which detects wheel flanges. This wheel detector comprises two electronic proximity sensors mounted with a certain displacement in the direction of travel. The WSD-E can be interfaced with the Anschaltbaugruppe fur Radsensoren und Naherungsinitiatoren ASNI (interface board module for wheel sensors and approach switch), and ASNI-M interface boards. These boards provide a digital output, which produces a pulse width proportional to the train speed. Each wheel detected result in a pulse being transmitted by this digital output.

The WSD-E is suitable for all switching, indication and counting functions demanding a direction criterion. The WSD-E Double Wheel Detector is compatible with the NAMUR interface, which is the main interface in the field of shunting operations and industrial railways.

The WSD-E Double Wheel Detector has been integrated into SIMATIC rail automation systems as part of the "Az S7" Track Vacancy Detection System. The maximum transversal speed is 80 km hour or so. The WSD-E has been developed and assessed in accordance to CENELEC standards.

Compatible interface boards ASKF, ASNI, and ASNI-M.

are:

Static switching behaviour: Switching state continuous occupied state for stationary wheel per system

System offset: 120 mm ± 2 mm

Dynamic switching behaviour: Output signals pulse length proportional to speed

8.2.2 Wheel Sensor Relay (WSR) & Wheel Sensor Single (WSS)

The Siemens® WSR (Wheel Sensor Relay) and WSS (Wheel Sensor Single)

Wheel Detectors are electronic switches, which respond contactlessly to wheel flanges.

As redundancy is not provided, to achieve the desired safety requirements, two sensors for the same function and location are required.

The nominal operating voltages are 18V to 60V (DC), or 24V to 60V (AC). The WSR directly provides a relay contact interface, whereas the WSS requires an interface board (e.g. Anschaltbaugruppe ARS - evaluation board) to interface with the PLC.

The maximum traversal speed is 450 km/hour (< 80km/h for wheel diameter > 300mm).

Both WSR and WSS have been developed and assessed in accordance to

CENELEC standards.

The ARS 1 (ARS 2, ARS 4) evaluator interface board is the link between the wheel detector and the series-connected evaluation equipment. One, two, or four WSS Wheel Detectors can be connected to the ARS evaluator interface board. The wheel detector is powered via the two wires from the interface board.

Siemens® WSRs and WSSs are practiced in the embodiments of the invention. See "WSR and WSS Wheel Detectors: Contactless Switching Indication", Siemens AG, Transportation Systems, Rail Automation, 2006, pp. 1-6, Braunschweig, Germany, PGPlll 311855 PA01071.0, Order No. A19100-V100-B824-V1-7600). The WSRs are electronic switches that are coupled to a rail and respond contactlessly to wheel flanges of a passing train. The electronics of the WSR is accommodated in a plastic housing. The wheel detector has a factory-mounted connecting cable, with six cores in the case of the WSR. A pre-mounted flexible tube protects the cable against physical damage. The cores of the connecting cable are terminated at the terminal block of the trackside connection box or cable distribution box. The cores of the outgoing cable are connected at me terminal block to the relevant wires of the WSR. The WSR may be mounted to the rail using existing drill holes in the rait using an adapter plate, or can be fixed using a clamp at the rail base, which avoids the need for drilling holes in the rail web. 8.3 Warning lights

Traditional flashing lights for level crossings are being proposed for use in embodiments of the invention.

8.4 Cabinet

Enclosures may be selected according to the approved suppliers for each railway authority. The size of the enclosures varies depending on the railway requirements. For example, if maintenance personnel can promptly respond to a power failure, the amount of batteries will depend only on the solar power supply requirements. However, if the maintenance personnel may take one or several days to fix the problem, a significantly higher amount of batteries will be required. This can more than double the required cabinet size.

For the first case with lower amount of batteries, a cabinet could be assembled on a mast, either for the locations at the crossing and strike in points. For a higher amount of batteries a cabinet assembled on the ground might be required.

9. How to make

The construction details for a level-crossing warning system follows the same standards of traditional level-crossing protection systems, such as the Siemens® Simis LC level crossing protection system. The railway authority's principles and standards are also taken into account.

The equipment to be used is either designed for railway environments or harsh industrial environments. 10. How to use

The use of a level-crossing warning system, as disclosed herein, follows similar principles to those currently used by railway authorities for level crossmg protection systems.

Solar power supplies, axle counters, cables and radio are currently used and the use depends on each railway authority. The PLC, remote monitoring, data logger and other pieces of equipment provides similar functionalities to the currently used and are only new types of equipment with different features.

Claims

CLAIMS:

1. A supplementary warning system for a level crossing adapted for activation by a train, said system comprising:

a plurality of wheel sensing devices, each adapted for coupling to a rail of a railway track and detecting the presence of a wheel of a train in proximity to the respective wheel sensing device, two pairs of said wheel sensing devices being configured as strike-in and strike-out heads in respect of the level crossing in opposite directions of travel of a train on said railway track with respect to the level crossing; means for communicating signals from said wheel sensing devices to a level crossing controller; and

a level crossing controller adapted to communicate with said plurality of wheel sensing devices, comprising:

a battery;

a solar panel;

a programmable logic controller (PLC) for controlling operation of active warning devices positioned at or near the level crossing dependent upon signals received by said PLC from said plurality of wheel sensing devices to indicate a train in proximity to the level crossing; and

a power control module coupled to said PLC, said solar panel and said battery for charging said battery and for controlling power to

components of said level crossing controller, said power control module, said solar panel and said battery providing all power to said level crossing controller.

2. The supplementary warning system as claimed in claim 1, wherein said signal communicating means comprises one or more cables to couple said level crossing controller and the wheel sensing devices functioning as strike-out heads.

3. The supplementary warning system as claimed in claim 1 , wherein said signal communicating means comprises one or more cables coupled to said level crossing controller and the wheel sensing devices functioning as strike-in heads.

4. The supplementary warning system as claimed in claim 3, wherein said one or more cables are coupled to a rail of said railway track using a plurality of clips to hold said cables to rails.

5. The supplementary warning system as claimed in claim 1, wherein said level crossing controller further comprises:

an antenna; and

a radio communications modem coupled to said antenna, said PLC, and said power control module, said antenna and said radio communications modem adapted for providing wireless communications to and from said level crossing controller;

said antenna and said radio communications modem being adapted for long distance communications with a remote monitoring facility to enable remote monitoring and diagnostics of the supplementary warning system.

6. The supplementary warning system as claimed in claim 5, wherein said antenna and said radio communications modem are adapted for satellite

communications.

7. The supplementary warning system as claimed in claim 1 , wherein said

PLC is a failsafe PLC.

8. The supplementary warning system as claimed in claim 1, wherein said level crossing controller further comprises a data logger and/or event recorder for investigating operation of said supplementary warning system.

9. The supplementary warning system as claimed in claim 1, wherein said level crossing controller further comprises a panel for interfacing with said level crossing controller.

10. The supplementary warning system as claimed in claim 1, wherein said level crossing controller further comprises an axle counter coupled to said wheel sensing devices functioning as strike in and strike-out heads and said PLC.

11. The supplementary warning system as claimed in claim I , wherein said level crossing controller further comprises a network communications switch coupled between said PLC and said radio communications modem.

12. The supplementary warning system as claimed in claim 11 , wherein said network communications switch is an Ethernet switch.

13. The supplementary warning system as claimed in claim 11 further comprising an axle counter coupled to said wheel sensing devices functioning as strikeout heads, said PLC, and said network communications switch.

14. The supplementary warning system as claimed in claim 1, wherein said signal communicating means comprises:

at least one antenna; and

a radio communications modem coupled to said antenna, said PLC, and said power control module;

said antenna and said radio communications modem implemented in said level-crossing controller and being adapted for providing short-distance wireless communications between said level crossing controller and a remote device forming part of said supplementary warning system.

15. The supplementary warning system as claimed in claim 14, wherein said antenna is a directional antenna.

16. The supplementary warning system as claimed in claim 14, further comprising at least one remote device for use adjacent a strike-in head location, each remote device comprising:

a battery; a solar panel;

means for coupling said remote device and a respective wheel sensing device functioning as a strike-in head;

an antenna;

a telemetry radio communications modem coupled to said antenna adapted for wireless communications to and from said level crossing

controller, said telemetry radio communications modem being powered by said solar panel and said battery, said telemetry radio communications modem wirelessly transmitting to said level crossing controller one or more signals generated by a wheel sensing device functioning as a strike- in head;

said antenna and said telemetry radio communications modem implementing said signal communications means.

17. The supplementary warning system as claimed in claim 16, wherein said coupling means comprises one or more cables coupled between said telemetry radio communications modem and said wheel sensing devices functioning as a strike-in head.

18. The supplementary warning system as claimed in claim 16, comprising two remote devices each coupled to a respective wheel sensing device functioning as a strike-in head.

19. The supplementary warning system as claimed in claim 14, further comprising at least one remote device for use adjacent a strike-in head location, each remote device comprising:

a battery;

a solar panel;

means for coupling said remote device and a respective wheel sensing device functioning as a strike-in head; a programmable logic controller (PLC) for producing a count signal dependent upon signals from said wheel sensing device functioning as a strike-in head;

components of said remote device, said power control module, said solar panel and said battery providing all power to said remote device;

an antenna;

a radio communications modem coupled to said PLC and said antenna adapted for wireless communications to and from said level crossing controller, said radio communications modem being powered by said power control module, said radio communications modem wirelessly transmitting one more signals to said level crossing controller;

said antenna and said radio communications modem implementing said signal communications means.

20. The supplementary warning system as claimed in claim 19, wherein said coupling means comprises one or more cables coupled between said PLC and said wheel sensing device functioning as a strike-in head.

21. The supplementary warning system as claimed in claim 19, comprising two remote devices each coupled to a respective wheel sensing device functioning as a strike-in head.

22. The supplementary warning system as claimed in claim 14, further comprising at least one remote device for use adjacent a strike-in head location, each remote device comprising:

a battery ;

a solar panel;

means for coupling said remote device and a respective wheel sensing device functioning as a strike-in head; an axle counter for detecting the presence of a train dependent upon signals from said wheel sensing device functioning as a strike-in head;

a power control module coupled to said axle counter, said solar panel and said battery for charging said battery and for controlling power to components of said remote device, said power control module, said solar panel and said battery providing all power to said remote device;

an antenna;

a radio communications modem coupled to said axle counter and said antenna adapted for wireless communications to and from said level crossing controller, said radio communications modem being powered by said power control module, said radio communications modem wirelessly transmitting one more signals to said level crossing controller;

23. The supplementary warning system as claimed in claim 22, wherein said coupling means comprises one or more cables coupled between said axle counter and said wheel sensing device functioning as a strike-in head.

24. The supplementary warning system as claimed in claim 22, comprising two remote devices each coupled to a respective wheel sensing device functioning as a strike-in head.

25. The supplementary warning system as claimed in claim 1 , wherein said level crossing controller comprises an interface for communicating with a remote location.

26. The supplementary warning system as claimed in claim 25, wherein said interface comprises a telecommunications modem.

27. The supplementary warning system as claimed in claim 26, wherein said telecommunications modem is a GSM modem.

28. The supplementary warning system as claimed in claim 1 , wherein said level crossing controller comprises one or more modules coupled to said PLC for diagnosing any predefined fault conditions affecting one or more components of said level crossing controller.

29. The supplementary warning system as claimed in claim 1 , wherein said level crossing controller comprises one or more modules coupled to said PLC for diagnosing any predefined fault conditions affecting one or more components of each remote station.

30. The warning system as claimed in claim 1 , wherein said wheel sensing device comprises:

one or more wheel sensor relays (WSR),

one or more wheel sensors single (WSS), and

wheel sensor double-electronic (WSD-E).

31. The warning system as claimed in claim 1 , wherein said PLC implements functionality to activate/deactivate active warning devices by counting wheels dependent upon signals from said wheel sensing devices .

32. The warning system as claimed in claim 1 , wherein said PLC implements functionality to activate/deactivate active warning devices with wheel detection only.

33. The warning system as claimed in claim 1 , further comprising active warning devices comprises warning lights.

34. The warning system as claimed in claim 1 , further comprising active warning devices comprises audible warning alarms.