The present invention relates to a system for re-commissioning one or more railway track sections that are each monitored by a respective axle counter control unit, comprising a plurality of re-commissioning devices, a remote server and a mobile device, each re-commissioning device comprising:
- a re-commissioning interface configured to be connected to a respective axle counter control unit;
- communication means configured to communicate with the remote server;
- control means configured to control the re-commissioning interface and to send and receive data via the communication means;
wherein the remote server is configured to define a common re-commissioning command associated with a plurality of railway track sections, each associated with a different axle counter control unit;
wherein the mobile device is configured to:
- receive the common re-commissioning command from the remote server;
- transmit, upon operator input provided in the field and location-verified with respect to the one or more railway track sections to be re-commissioned, an execution signal associated with the common re-commissioning command;
and wherein the control means of each re-commissioning device is configured to:
- initiate, in response to the execution signal, a reset operation via the re-commissioning interface of the respective re-commissioning device, thereby simultaneously re-commissioning a plurality of railway track sections associated with separate axle counter control units.
The present invention generally relates to the field of railway infrastructure safety systems, and more particularly to the field of systems and methods for re-commissioning railway track sections monitored by axle counter systems.
In modern railway systems, train detection is essential for ensuring safe operation, particularly for managing track occupancy, routing, and signalling.
Document JP
Consequently, these existing systems lack a method to safely, coordinately, and efficiently re-commission multiple, physically separated track sections simultaneously, without requiring personnel at multiple fixed locations.
A widely adopted detection method involves the use of axle counter systems, wherein dedicated sensors at section entry and exit points detect passing train axles. These sensors are connected to axle counter control units which maintain a running count of axles within a given track section. When the number of axles detected at the exit equals the number detected at the entry, the track section is considered unoccupied. Axle counter systems are commonly used across both national and regional railway networks, including areas controlled by interlockings, relay buildings, or Radio Block Centres (RBCs), and have become a standard component of safety-critical railway infrastructure.
During scheduled maintenance or emergency works, it is often necessary to temporarily take one or more railway track sections out of operation - a process known as decommissioning. In axle counter-based systems, this typically involves suppressing counting logic or simulating section occupancy to prevent trains from being routed into the affected area. After work is completed, however, the affected sections must be safely brought back into normal operation, a process known as re-commissioning. In current practice, re-commissioning generally requires manual reset of the axle counter control units to clear their internal state and declare the section available for train movement. Due to the safety-critical nature of this operation, such resets may only be carried out by certified personnel, often requiring physical access to the axle counter system or interlocking.
This process presents several challenges in both safety and operational efficiency. First, once a section has been decommissioned, the axle counter cannot independently verify whether the section is physically clear of rolling stock. A reset merely clears the count, based on the assumption that the section is unoccupied - an assumption that, if incorrect, may lead to hazardous situations. Second, the need for physically present, certified personnel creates a labour bottleneck, particularly in large-scale or time-sensitive operations. Third, in complex railway zones such as yards, terminals, or harbour areas, multiple sections managed by separate axle counter systems may need to be re-commissioned in a coordinated manner, yet current systems lack the ability to centrally and securely reset multiple axle counters across different control domains. These limitations lead to increased risk, inefficiencies, and operational delays.
It is therefore a goal of the present invention to provide a more reliable and secure system for re-commissioning railway track sections monitored by axle counter control units, thereby overcoming the above-mentioned disadvantages of the prior art at least in part.
One aspect of the present invention relates to a system for re-commissioning one or more railway track sections that are each monitored by a respective axle counter control unit, comprising a plurality of re-commissioning devices, a remote server and a mobile device, each re-commissioning device comprising:
Another aspect of the present invention relates to a method for re-commissioning one or more railway track sections that are each monitored by a respective axle counter control unit, comprising the steps of:
The second authenticated operator located in the field is to be understood as an operator physically located near the respective railway track sections and authenticated by means of location verification.
A system may be understood as a combination of hardware and/or software components that interact to perform a coordinated function. In the context of the present invention, a system includes distributed physical components such as electronic devices, servers, interfaces, and communication modules, which together perform the function of re-commissioning railway track sections. An example of such a system is a network of embedded field devices installed in relay cabinets, each connected to different railway subsystems, which are centrally coordinated via a cloud-based control platform.
A railway track section may be understood as a segment of railway infrastructure delimited by detection points, such as axle counter sensors or insulated joints, and controlled as a unit for signalling and safety purposes. Track sections are typically bounded in a way that allows train presence to be monitored and route occupancy to be managed. An example is a block between two signals on a main line or an individual siding in a shunting yard.
An axle counter control unit may be understood as an electronic or electromechanical device configured to receive signals from axle detection sensors positioned at the boundaries of a railway track section. The control unit maintains a count of entering and exiting train axles and determines the track section's occupancy status. Common commercial examples include Frauscher FAdC (Flexible Axle Counter), Siemens Trackguard Westrace, or Thales Az LM systems. These systems are often housed in interlockings or cabinets near the track.
A re-commissioning device may be understood as an electronic apparatus that is installed locally or near a respective axle counter control unit and configured to perform the task of resetting or otherwise re-enabling the respective axle counter control unit such that the associated railway track section can be returned to normal operation. In practice, such a device could be installed in a signal relay building or junction box adjacent to the section it serves.
A re-commissioning interface may be understood as a hardware and/or software interface capable of establishing a connection to an axle counter control unit and delivering a control signal, such as a reset pulse or digital message, according to the protocol supported by the axle counter system. A re-commissioning interface may comprise galvanic relays, digital outputs (e.g., TTL or 24V logic), or protocol-specific communication modules (e.g., RS485, CAN, Profibus). A real-world example is a module connected to a Frauscher or Siemens reset terminal that mimics a manual reset input.
Communication means may be understood as any module, component or interface capable of exchanging data between two nodes over a wired or wireless communication link. This may include Ethernet ports, cellular radio modules (e.g., 4G, LTE, GSM-R), FRMCS, Wi-Fi modules, or satellite communication interfaces. In the present context, communication means enable the re-commissioning devices to communicate with a remote server or central control application. An example is a GSM-R enabled terminal with a secured APN to the infrastructure provider's server.
A remote server may be understood as a computational platform external to the re-commissioning devices, configured to manage centralised coordination, logging, and issuing of commands. The server may be implemented as a cloud-based service, a centralised railway operations server, or an enterprise server in a control centre. A real-world example is a secure backend system hosted by the national railway infrastructure manager, accessible over VPN by authorised users and systems.
Control means may be understood as one or more processors, microcontrollers, programmable logic controllers (PLCs), or logic devices programmed to perform specific tasks, including managing communication, interpreting commands, handling timing logic, and executing control signals. In the present invention, control means within each re-commissioning device governs local reset actions based on remote inputs. A practical embodiment could include a microcontroller board with internal firmware and safety timer watchdogs.
A common re-commissioning command may be understood as a single digital instruction or message structure issued by the remote server and directed to a set of re-commissioning devices for simultaneous execution. The command may include section identifiers, time windows, and reset authorisations, and is interpreted individually by each device. This command may be formatted according to a proprietary railway protocol or standard industrial communication schema.
A reset operation may be understood as a defined signal or procedure that instructs the axle counter control unit to clear its stored axle count and resume normal detection logic. The operation may require internal consistency checks or authentication, and may vary per axle counter vendor. A real-world example is triggering a 'reset' function in a Frauscher or Siemens unit via digital I/O or serial command.
A dual-component command may be understood as a logical construct that splits the re-commissioning command into two required authorisations: one for preparing the command for execution and another for triggering its execution. This command structure supports the safety principle of "geven en nemen," commonly used in railway maintenance, wherein a first operator (e.g., control centre) prepares the command, and a second operator (e.g., field staff) executes it.
An authorisation signal may be understood as a confirmation input, typically from a back-office or remote operator, indicating that the re-commissioning command is valid and ready to be taken. The signal may be generated through a secure interface, authenticated with user credentials, and logged by the remote server. An example is a dispatcher clicking "prepare" on a GUI to arm a command.
An execution signal may be understood as a confirmation input from a second, independently authenticated operator, typically in the field, indicating that the re-commissioning command is to be executed. Execution may only be possible if the authorisation signal has been received and verified. An example is a foreman confirming on a tablet device with GPS presence verification and a user PIN code.
A graphical user interface may be understood as a visual display system that allows operators to view and interact with system information. It may be deployed on tablets, laptops, control room monitors, or dedicated terminals, and show the layout of sections, command status, and operator inputs. In practice, a COSS (Controller of Site Safety) may see the track layout and colour-coded reset status on a secure tablet application.
A local presence authentication means may be understood as a mechanism to verify that the field operator is physically present at or near the track section being re-commissioned. This may be implemented via GPS geofencing, NFC tag scans, QR code scans on axle counter cabinets, or Bluetooth proximity checks. A real-life example is a worker scanning an NFC badge attached to a relay cabinet to confirm presence.
A failsafe protocol may be understood as a communication or system protocol that defaults to a safe state in the event of communication loss, inconsistent commands, or internal error. This may include timeouts, heartbeat supervision, and redundant paths. In the context of the invention, a failsafe protocol may cause a re-commissioning device to abort or lock out the reset if verification or connectivity is lost.
A lockout state may be understood as a blocked or disabled state in which the re-commissioning device prevents further reset operations until manual intervention or system validation. This ensures safety under ambiguous conditions. For example, if two conflicting reset instructions are received or a counter mismatch is detected, the device may enter a lockout and display a fault indicator.
A simulation input may be understood as a signal emulating the passage of a train axle or a valid detection event, used to test the functionality of an axle counter after re-commissioning. A practical implementation may generate an artificial pulse to verify the reset behaviour of the counter.
An audit log may be understood as a time-stamped, tamper-proof record of system operations, including operator inputs, command transmissions, confirmations, and re-commissioning outcomes. In practice, this may be stored in the remote server or downloaded for inspection by infrastructure safety authorities.
The above-mentioned goal is achieved with a re-commissioning device according to an aspect of the present disclosure.
One aspect of the present invention relates to a system for re-commissioning one or more railway track sections that are each monitored by a respective axle counter control unit. A system may be understood as a combination of interrelated components configured to function as a whole. Re-commissioning may be understood as restoring a railway track section into an operational state after it has been temporarily taken out of service. A railway track section may be understood as a bounded portion of railway infrastructure equipped with train detection and signalling interfaces, and typically delimited by detection points such as axle sensors. An axle counter control unit may be understood as an electronic system configured to receive signals from axle sensors positioned at entry and exit points of a railway track section, maintain a count of axles detected, and determine the occupancy status of the section based on the correspondence of entry and exit counts.
The system comprises a plurality of re-commissioning devices. A re-commissioning device may be understood as an electronic device configured to interact with an axle counter control unit and initiate a reset or similar operation that brings the respective section back into service. The use of a plurality of such devices allows the system to address multiple track sections in parallel. An effect of this arrangement is that it enables distributed re-commissioning across physically separated areas, reducing the need for centralised physical access and improving response times in complex rail environments.
Each re-commissioning device comprises a re-commissioning interface configured to be connected to a respective axle counter control unit. A re-commissioning interface may be understood as a hardware and/or software interface capable of transmitting control signals compatible with the protocol of the axle counter control unit, such as digital reset commands or electrical pulses. This arrangement enables direct actuation of the reset functionality at the control unit level without requiring manual intervention. An effect is that reset operations may be securely automated while remaining compliant with existing safety logic embedded in the axle counter infrastructure.
Each re-commissioning device further comprises communication means configured to communicate with a remote server. Communication means may be understood as a network interface module, such as a modem, radio unit, or Ethernet module, capable of establishing a bidirectional communication channel over public or private networks. A remote server may be understood as a network-connected computing system configured to issue commands and manage status updates from the distributed devices. This arrangement allows central management of the re-commissioning process, including command preparation, distribution, and logging. An effect is that bandwidth usage can be optimised by transmitting only necessary commands and acknowledgements, while processing power at the edge devices can be minimised due to the delegation of orchestration to the remote server.
Each re-commissioning device comprises control means configured to control the re-commissioning interface and to send and receive data via the communication means. Control means may be understood as a processor, microcontroller, or logic circuit programmed to coordinate internal operations of the device, including interpreting received commands, managing state transitions, and enforcing timing and authentication protocols. This arrangement enables deterministic and traceable execution of reset operations based on external inputs. An effect is that system integrity is maintained even in distributed deployments, and local decision-making capabilities reduce latency and reliance on continuous connectivity.
The control means of each re-commissioning device is configured to obtain from the remote server a common re-commissioning command associated with a plurality of railway track sections, each associated with a different axle counter control unit. A common re-commissioning command may be understood as a single data structure or instruction transmitted by the server and intended to trigger coordinated reset actions across multiple devices. This arrangement ensures synchronisation of re-commissioning activities across multiple independent control domains. An effect is that the command structure simplifies orchestration and allows for reduced protocol overhead, improving overall system scalability and reducing the likelihood of human error in complex environments.
The control means is further configured to initiate, in response to the obtained command, a reset operation via the re-commissioning interface of the respective re-commissioning device, thereby simultaneously re-commissioning a plurality of railway track sections associated with separate axle counter control units. A reset operation may be understood as a signal or procedure that instructs the axle counter control unit to clear its internal count and transition the track section to a state of availability. Simultaneous re-commissioning may be understood as performing the reset actions in a coordinated manner within a defined operational window. This arrangement enables consistent and time-aligned return to service of multiple sections, even when managed by independent systems. An effect is that service restoration becomes faster and more predictable, while system-wide coordination supports efficient scheduling and improved safety oversight.
Surprisingly, it was found that by equipping each re-commissioning device with control means configured to obtain a common re-commissioning command from a remote server and to initiate, in response to the obtained command, a reset operation via a re-commissioning interface connected to a respective axle counter control unit, an intermediate level of control is achieved that effectively bridges the operational gap between centrally prepared command structures and locally constrained axle counter systems. This arrangement functions as a middleware-like architecture, allowing a plurality of independently operated axle counter control units-each traditionally requiring local handling by a dedicated operator-to be virtually combined into a configurable set of railway track sections. These sections may be flexibly selected in advance of execution, such that one re-commissioning command issued from the remote server can dynamically address a customised combination of track sections. As a result, complex re-commissioning procedures that would typically demand sequential local operations are now reduced to a single coordinated reset action, while preserving the necessary safety and verification measures. This enables scalable, context-sensitive, and operator-verifiable re-commissioning in environments such as railway yards, terminals, and harbour tracks, where conventional systems lack the adaptability and synchronisation required for safe and efficient return to normal operation.
The system comprises a mobile device configured to receive the common re-commissioning command from the remote server and to transmit, upon operator input provided in the field and location-verified with respect to the one or more railway track sections to be re-commissioned, an execution signal associated with the common re-commissioning command. A mobile device may be understood as a portable operator terminal, such as a tablet, smartphone or embedded control unit, capable of secure bidirectional communication with the remote server and/or re-commissioning devices. The operator input may comprise a confirmation action performed by a field-certified user after visual inspection of the track sections, whereas location-verification may be achieved through GPS, QR-scanning, NFC, or proximity-based mechanisms. This arrangement allows the common re-commissioning command-whether pre-defined by the server or dynamically assembled in the field-to be authorised and triggered in real time by a single operator situated near the affected railway track sections.
An effect of this architecture is that the final safety-critical decision to re-commission the track sections remains in the hands of the field operator with situational awareness, while the coordination, timing and execution of the reset operations are centrally managed and synchronised via the remote server. By integrating the mobile device as a control and validation point in the field, the system enables fast, decentralised and operator-verifiable re-commissioning of multiple axle counter-controlled track sections. This reduces the operational delay typically associated with sequential reset procedures, eliminates dependency on backoffice-only workflows, and improves overall safety integrity by ensuring that the command is only executed when the track sections are physically observed to be clear.
In an example, the mobile device is further configured to generate the common re-commissioning command locally in the field upon operator input and to transmit the execution signal to the re-commissioning devices via the remote server. It may be provided that the generation of the re-commissioning command occurs entirely on the mobile device operated by a field-authorised person, based on locally available information and/or information obtained through the remote server and real-time visual verification of the affected railway track sections. This feature enables decentralised operation in scenarios where remote connectivity is limited or where operational independence is required, such as in maintenance zones with temporary isolation from central infrastructure. An effect is that the re-commissioning process becomes highly responsive, as the field operator is able to both verify safety conditions and directly trigger the system reset without waiting for remote coordination or approval.
The generation and execution of the common re-commissioning command may be flexibly distributed between the remote server and the mobile device to accommodate different operational requirements, safety protocols, and field conditions. The system may be configured to operate in several distinct modes, including a centralized, a decentralized, and a hybrid mode.
In a first, centralized operational mode, the common re-commissioning command is fully prepared and defined at the remote server, for instance by a central operator such as a dispatcher or a safety coordinator in a control centre. In this mode, the server defines all parameters of the command, including the specific set of railway track sections to be re-commissioned. The mobile device then acts as a secure terminal for receiving the prepared command and for enabling its execution. The field operator's role is to verify the command and the physical state of the track sections in the field, and upon providing a location-verified execution input, to trigger the transmission of the execution signal. This mode enforces a strict dual-operator or "geven en nemen" (give and take) safety principle, where command preparation and execution are performed by separate, authenticated operators.
In a second, decentralized operational mode, the common re-commissioning command is generated locally on the mobile device 230 by an authenticated field operator. This mode is particularly advantageous in scenarios with limited network connectivity or where the field operator possesses primary authority over the re-commissioning task, for instance during specific on-site maintenance activities. The operator uses an interface on the mobile device 230 to select the relevant track sections 110 and define the command. Upon local generation and confirmation, the mobile device 230 transmits the execution signal, which may be routed via the remote server 220 for logging and coordination or transmitted directly to the re-commissioning devices 210 if a direct communication channel is available.
In a further, hybrid operational mode, the command generation is a collaborative process between the central server and the local operator. For example, a command plan or template may be prepared centrally at the remote server 220, defining a proposed set of track sections for a scheduled work package. This command plan is then transmitted to the mobile device 230 in a pending or non-executable state. The field operator may then review, amend, complete, and/or finally approve the command locally. For instance, the operator could amend the plan by deselecting a track section that could not be visually confirmed as clear, or complete the plan by adding a final authorisation. Only after this local validation and final approval by the field operator is the command armed and the execution signal transmitted. This hybrid approach combines the benefits of central planning with the necessity of on-site situational awareness and final verification.
This configurable architecture provides the system with the flexibility to adapt to any combination of these workflows, ensuring that the re-commissioning process can be tailored to the specific risk level, operational context, and prevailing safety regulations.
In an example, the mobile device is further configured to receive the common re-commissioning command prepared at the remote server and to transmit the execution signal only upon operator input confirming validation of the command in the field. It may be provided that the command is composed centrally, for example by a dispatcher or safety coordinator, and is held in a pending state on the mobile device until the operator in the field confirms, based on physical presence and track visibility, that it is safe to proceed. This feature reflects a dual-operator safety model often applied in railway maintenance practices and ensures that re-commissioning is only executed after human validation near the track. An effect is that centralised safety oversight is combined with local situational awareness, thereby reducing the risk of premature or unsafe reset actions in complex or dynamic field environments.
In an example, the system is further configured to determine and display, prior to or during execution of the re-commissioning command, the current operational status of each railway track section associated with the command, including whether the section is presently in a decommissioned state. Such status determination may be performed by the remote server based on feedback signals from the re-commissioning devices, by querying axle counter control units directly, or by evaluating internal flags within the command execution logic. The mobile device may be configured to display this status information to the operator prior to enabling execution, thereby allowing verification that all selected sections are indeed in a non-operational or decommissioned state. An effect of this feature is that the system can prevent re-commissioning of sections that are not currently out of service, reduce the risk of conflicting control inputs, and provide traceable assurance that the preconditions for safe reset have been satisfied. The status may also be updated during or after execution, providing real-time feedback on command progression and reset outcome for each section.
In an example, the system is configured such that the remote server issues the re-commissioning command in the form of a dual-component command comprising a first authorisation signal configured to be issued by a first authenticated operator and a second execution signal configured to be issued by a second authenticated operator, and the re-commissioning devices are configured to initiate the reset operation only upon reception of both signals. It may be provided that a dual-component command comprises separate control signals, each independently generated by different authenticated operators with distinct roles. This feature enables a distributed safety mechanism that ensures mutual oversight between remote control and local execution. It may be understood that only after both the authorisation and execution signals are received by the re-commissioning devices is the reset operation triggered. An effect of this configuration is that the operational risk of unauthorised or unintended re-commissioning is significantly reduced, while maintaining operational flexibility and avoiding delays caused by requiring both operators to be co-located. This separation of control paths also enables better allocation of bandwidth and improves command traceability.
In an example, the system is configured such that the first operator is located at a remote control centre and configured to prepare the command for execution without the ability to initiate the reset, and the second operator is located in the field and authorised to execute the reset command without the ability to prepare the command. It may be provided that the preparation and execution of the re-commissioning command are structurally decoupled and assigned to different operators based on their physical location and operational role. This feature reflects a known safe working practice in railway maintenance, known as "geven en nemen," and ensures that the operator who prepares the command cannot execute it, and vice versa. An effect is that both spatial and role-based separation are enforced, improving human factor safety and making errors or misuse less likely. This also simplifies role management and command logging, since permissions can be strictly divided and recorded per operator profile.
In an example, the control means of each re-commissioning device is configured to permit execution of the reset command only upon receiving, from the operator terminal, a field confirmation input authenticated by a role-based access protocol. It may be provided that a role-based access protocol defines different levels of command rights for different user roles, with specific authentication credentials linked to each role. This feature enables controlled authorisation flows and prevents unauthorised users from triggering re-commissioning operations. An effect is that system integrity is maintained across the field network, while only those operators who are appropriately certified and present at the field location can contribute to safety-critical control decisions. This also supports compliance with railway safety standards that require field-level confirmation by accredited personnel.
In a further example, the system is configurable to operate in different safety modes depending on operational requirements or available personnel. In a first mode, the execution of the re-commissioning command is permitted by a single operator using a mobile device, provided that the operator is physically located near the affected railway track sections and authenticated by means of location verification, such as NFC, GPS, or proximity-based scanning. In a second mode, the system enforces a dual-operator procedure in which the re-commissioning command is prepared by a remote operator and must be executed by a separate operator in the field, in accordance with the "geven en nemen" principle. In a third mode, both validation mechanisms may be applied in combination, such that even in the case of a single operator, execution requires both physical presence and confirmation of a centrally prepared command. This configurability allows the system to adapt to the safety protocol in effect, the nature of the track environment, or the risk level associated with the re-commissioning operation. An effect is that the system remains compliant with varying railway safety regulations while maintaining operational flexibility across different deployment contexts.
In an example, the re-commissioning devices are configured to display on a local user interface a graphical representation of the respective railway track section and an indication of whether a re-commissioning command is pending, executed, or blocked and/or the status of the one or more sections, e.g. whether or not they are currently de-commissioned. It may be provided that the local user interface comprises a visual display module, which renders the current command state using graphical symbols, colours, or text. This feature supports immediate situational awareness for the field operator, allowing visual confirmation of the command status without requiring verbal or radio communication with the control centre. An effect is that visualisation reduces the likelihood of operator error and shortens response times, while also improving transparency in the field.
In an example, the remote server comprises a graphical user interface configured to display, in real time, the status of the railway track sections associated with the re-commissioning command. It may be provided that the graphical user interface of the remote server is updated with status messages transmitted from the re-commissioning devices. This feature allows the remote operator to monitor which sections have accepted, are processing, or have completed the reset operation. An effect is that operational coordination is improved without needing to query individual systems manually. Real-time feedback enables proactive fault detection, faster decision-making, and efficient scheduling of further operations.
In an example, the remote server is further configured to subdivide the re-commissioning command into a plurality of zone-specific subcommands, each associated with one or more re-commissioning devices and requiring confirmation by an authorised field operator located within the corresponding zone. It may be provided that a re-commissioning command can be logically segmented based on spatial or operational zones, with each zone tied to a particular group of devices and field staff. This feature supports decentralised but coordinated re-commissioning across large or complex rail networks. An effect is that each local operator only authorises the re-commissioning of sections within their own oversight area, increasing precision and reducing cognitive load while still enabling a centralised control structure.
In an example, the control means is configured to validate the physical presence of the field operator at or near the respective railway track section using location data from a mobile device or local presence authentication means. It may be provided that such validation is based on GPS geofencing, NFC scans, or QR code checks, depending on the environment. This feature ensures that the operator performing the reset is physically present at the relevant site. An effect is that remote or spoofed execution is prevented, and that safety-critical visibility of the track section is genuinely confirmed before control actions are allowed.
In an example, the communication means comprises a secured bidirectional communication channel configured to communicate with the remote server over a public or private mobile network, and further comprises authentication, encryption, and integrity check mechanisms. It may be provided that the communication means implements secure transport protocols such as VPN, TLS, or similar, combined with digital signatures or hash-based integrity verification. This feature ensures that commands and responses are reliably transmitted and cannot be tampered with or intercepted by unauthorised third parties. An effect is that both confidentiality and system correctness are preserved, which is especially important in systems involving safety operations and mobile networks.
In an example, the re-commissioning interface comprises a control output that generates a reset signal compliant with the protocol of the respective axle counter control unit, and the reset signal is transmitted via a relay interface, digital signal, or safety bus protocol. It may be provided that the control output of the re-commissioning interface includes hardware and logic circuitry capable of producing a signal pattern recognised as valid input by the axle counter control unit. This feature ensures compatibility with existing safety systems without requiring hardware modifications. An effect is that integration is simplified, the solution can be deployed as a retrofit, and reliability is maintained by using existing validated protocols such as relay-based toggling or PROFIBUS-based safety frames.
In an example, the control means is configured to record, for each re-commissioning action, a command identifier, a timestamp, a field operator identifier, the geographical location of the input, and the status of each associated track section, and to transmit this information to the remote server for audit logging. It may be provided that a log record is automatically generated each time a reset action is completed, and that the information is stored in structured form. This feature enables full traceability of control actions, supports post-incident analysis, and satisfies compliance requirements of safety-critical railway operations. An effect is that digital records of operator activity, location, and track status are available for review, allowing infrastructure managers to maintain accountability and transparency.
In an example, each re-commissioning device further comprises a local signal output configured to activate a physical status indicator near the track, such as a light signal or audible alarm, to indicate that the section is being re-commissioned. It may be provided that the signal output energises an external lamp, LED strip, or acoustic horn during re-commissioning actions. This feature enhances the visibility of safety-relevant operations in the physical environment. An effect is that nearby workers and machine operators are made aware of control operations in progress, thereby reducing the likelihood of unexpected track use during transition to operational state.
In an example, the remote server is configured to transmit a warning notification to other systems, including interlockings, scheduling servers, and maintenance logging systems, prior to the execution of the re-commissioning command. It may be provided that this notification is a machine-readable message, pushed to relevant systems on the infrastructure network. This feature ensures that dependent systems are updated on the re-commissioning status and can react accordingly. An effect is that signalling, scheduling, and maintenance systems can synchronise their internal state with the real-world track status, preventing routing errors or operational conflicts.
In an example, the re-commissioning interface is configured to provide a simulation input to the axle counter control unit, simulating passage of a train axle to verify post-reset operation of the axle counter. It may be provided that the simulation input mimics a pulse train or sensor activation sequence typically associated with a real train axle. This feature allows in-situ testing of the axle counter's responsiveness after a reset. An effect is that the operational readiness of the detection logic can be verified without needing an actual train movement, enabling more efficient commissioning and maintenance workflows.
In an example, the re-commissioning device is installed in a housing selected from: a signal equipment building, a relay cabinet, a Radio Block Centre, or a junction box adjacent to the railway track. It may be provided that the housing is tailored to railway environment requirements, such as IP-rated enclosures and vibration resistance. This feature allows the system to be deployed in existing railway infrastructure spaces without introducing new civil engineering requirements. An effect is that installation costs and deployment time are reduced, and the device benefits from proximity to the axle counter wiring and trackside power.
In an example, the communication means comprises a mobile radio module selected from: GSM-R, LTE, 4G, 5G, or FRMCS-compatible radio modules. It may be provided that the radio module supports protocols used in railway operations, including current and next-generation railway communication standards. This feature ensures broad coverage and long-term compatibility with evolving infrastructure standards. An effect is that the system can maintain reliable communication even in remote areas, and future-proof connectivity is supported for migration to FRMCS networks.
In an example, each re-commissioning device is powered by an integrated uninterruptible power supply (UPS) charged by a trackside power source and operable for at least a defined fallback duration in case of power loss. It may be provided that the UPS comprises a rechargeable battery and charging circuit, dimensioned for sustained operation. This feature ensures that the re-commissioning device can complete time-critical operations or enter a safe state during power disruptions. An effect is that power-related faults do not compromise the integrity of safety logic, and autonomous operation is supported in degraded power conditions.
In an example, the re-commissioning device is further configured to enter a lockout state if inconsistent reset instructions are received or if conflicting occupancy indications are detected by the axle counter control unit. It may be provided that a logic condition is evaluated based on signal coherence, and that a lockout inhibits further control actions until a manual or supervised reset is performed. This feature adds a secondary layer of safety in the event of system ambiguity. An effect is that misconfigurations, transient communication errors, or conflicting operator inputs do not result in unsafe track conditions, and fault isolation is simplified for maintenance teams.
In an example of the other aspect, the common re-commissioning command is generated and transmitted from a mobile device located in the field upon operator input of the second operator.
In an example of the other aspect, the common re-commissioning command is generated at the remote server and transmitted to the mobile device in the field, and wherein the execution of the command is performed only upon validation input from the second operator at the mobile device.
The invention will now be explained in more detail with reference to a number of figures, in which:
For a better understanding of the invention, like parts will be indicated by identical numerals in the description of the figures below.
The remote server 220 is configured to define a common re-commissioning command associated with a plurality of railway track sections. The mobile device of the operator 160, which is physically located in the field near the track sections to be re-commissioned, is configured to connect to the remote server, typically by logging into an application or accessing an embedded website interface, where the re-commissioning command is made available and maintained in a ready state. Upon operator input confirming that the conditions for safe re-commissioning are met, optionally verified through location-based mechanisms such as GPS, NFC, or QR code scanning, the mobile device transmits an execution signal to the re-commissioning devices 210, typically via the remote server 220. In a specific example, this may also be done via a direct local connection between the mobile device and the re-commissioning device 210, but typically this is done through the remote server. In response to this execution signal, the control means of each re-commissioning device initiates a reset operation to simultaneously re-commission the associated track sections, thereby transitioning them from a decommissioned to an operational state. The mobile device used by the operator may be a dedicated device specifically configured to interact with the system according to the invention. Preferably, however, it is a conventional mobile (smart)phone on which a secure application, web-based interface or service is used to access the server and perform re-commissioning operations.
Depending on system configuration, the command may be prepared entirely in the field (e.g. wherein the mobile device is further configured to generate and/or execute the common re-commissioning command locally in the field upon operator input and to transmit or execute the execution signal to the re-commissioning devices), or centrally by a remote operator and only validated and triggered by the field operator (e.g. wherein the mobile device is further configured to receive the common re-commissioning command prepared at the remote server and to transmit the execution signal only upon operator input confirming validation of the command in the field). The mobile device 230 plays a crucial role in enabling operator-verifiable and location-aware control, ensuring that re-commissioning is only executed when the track sections are physically confirmed to be clear.
This approach significantly reduces the time between decommissioning and re-commissioning, eliminates the need for sequential resets, and avoids scenarios where the track state may change during a prolonged reset process. It also supports real-time updates and feedback to the central server regarding section status before, during, and after the re-commissioning process.
This list of references cited by the applicant is for the reader's convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard.