Pragmatic fault tolerance for railway control and safety protection of the channel tunnel

Abstract

Following the obsolescence of the fault tolerant computer of the Rail Traffic Management control system, the Channel Tunnel operator, Eurotunnel, needed to implement a new fault tolerant system onto which the existing application could be ported. The control system’s functionality had recently been upgraded to provide safety protection functions in the event of fire incidents. With the original hardware manufacturer not providing a transparent upgrade path, Eurotunnel undertook a project to engineer both a new fault tolerant architecture and new error recovery system to handle all types of faults on the existing application. The real-time nature of the system, interfacing with a train protection and signalling system, imposed numerous constraints. This Practical Experience Report describes the project, its design constraints, discusses various implementation options and describes the new system architecture with the existing application. The paper also gives an overview of the European norms, and their application in high integrity railway systems. 1. Channel Tunnel overview The Channel Tunnel is a railway link operating between Folkestone, in the United Kingdom, and Coquelles in France. The railway consists of two terminals, and two single line railway tunnels, running for 50 km under the English Channel. There is also a service tunnel to allow for maintenance and emergency evacuation. The tunnel operator, Eurotunnel, operates a mix of rail traffic and has a nominal capacity of 20 trains per tunnel per hour. Tunnel capacity is utilised by Eurotunnel’s own Shuttle trains; Tourist Shuttles, for cars and coaches, and Heavy Goods Vehicle carrying trains (HGV Shuttles) for trucks. Tunnel capacity is also sold to the national rail networks of UK and France, for the operation of Eurostar trains between London and Paris/Brussels and for freight trains. Eurotunnel’s mix of frequency, size and weight of trains, makes the Channel Tunnel one of the most heavily utilised transport systems in Europe. To achieve this capacity, fully automatic rail regulation is required. With the exception of the HGV Shuttles, all trains are regulated in an equal manner. The HGV Shuttles have to operate with an additional distance between themselves and the following train. This is referred to as HGV Protection and is imposed so that, in the event of a fire on-board an HGV-carrying Shuttle, the following trains have time to stop and evacuate before any smoke from the incident train presents any hazard.