For eight months now, the COPPILOT system has controlled the opening and closing of the semi-full height platform doors on each of the following three platforms of Line 13 in the Paris subway system.
- The two platforms at the St-Lazare station (platforms 1 and 2)
- The Invalides station in the St-Denis direction (platform 1)
- First Operational System in Service :may 2008
- Trains equipped : 73
- Platforms : 3
- Station : Paris Chatillon line 13
Documents and ISA* Certification
The main functions of the system were to
- Safely detect the presence of a train at the platform
- Order the opening and closing of the platform doors at the same time as the train doors.
- Safely detect the train’s movements and departure.
COPPILOT had no mechanical contact with the train and did not carry any specific equipment onboard the rolling stock.
The COPP system is a revised version of the COPPILOT system. Since May, it is being installed at the Porte de Châtillon station. This station will be equipped with platform doors to secure the track area and allow for an automatic return system to be put in place. A COPP system is dedicated to a single platform and only controls the opening and closing of the platform doors for the relevant platform, in other words, only for the trains travelling on the relevant tracks. The COPP system is being replaced by the COPP2 system to improve reliability and availability by removing sensors.
COPP system
The COPP system controls the opening and closing of platform doors. This is managed independently from the train’s automatic driving mechanisms. COPP, thanks to sensors, observes a portion of the track area and analyzes the behaviour of trains travelling through stations. When appropriate conditions are present, it then orders the platform doors to open or close.
More specifically, the COPP system:
- Detects the absence of the train on the track under observation
- Detects a moving train on the track under observation
- Detects that the train, in the area where it stops at the platform, is moving at a speed lower than 0.5 km/h (which speed is considered null).
- Detects that a train is present at the platform and located in the nominal loading area, i.e. Loading Point +/- 1.10 metres.
Analytical function for train behaviour
The COPP system processes and analyses the observation data obtained via its sensors. In particular, it conducts the following operations on the track under observation:
- Detects the absence of the train on the track under observation
- Detects a moving train
- Detects that the train has stopped in the loading area and is moving at a speed lower than 0.5 km/h, which speed is considered null. >Detects the proper positioning of the train at the platform.
- Detects the proper positioning of the train at the platform.
The COPP system detects that a train is present at the platform and located in the nominal loading area, i.e. Loading Point +/- 1.10 metres. It tolerates an uncertain measurement in the range of +/- 3 cm. The management of this uncertainty is described in the diagram below. If the train is located in the uncertainty zone, the COPP system may either consider that the train is properly positioned or not properly positioned.
The COPP system detects that a train is present at the platform and located in the nominal loading area.
- Detects the proper positioning of the train at the platform.
- Acquire and provide information supplied by the train on the opening and closing of the doors, provide this information to the train by the ground and process this information.
- Not acquire information from the train stopped on the adjacent track.
Automatically control the opening of the platform
The COPP system orders the opening of the platform doors once the functions described above have allowed for the following events to be observed, successively and in this order.
A moving train enters the station, The train decelerates to reach a speed that is lower than 0.5 km/h. The train stops and is positioned correctly in its nominal loading zone. The train doors open. The command to open the platform doors is maintained for a period to be defined and that can be configured. By default, this period ranges between 2.5 and 6 seconds.
If the COPP system receives information that the platform doors are completely opened, it stops the command if the command time exceeds 2.5 seconds.
Automatically control the closing of the platform
The COPP system controls the closing of the platform doors once the functions described above have allowed for the following events to be observed, successively and in this order.
Automatically order the platform doors to close without detecting the closure of the train doors
The system orders the closing of the platform doors once the functions described above have allowed for the following events to be observed, successively and in this order.
When the last system command is to open the doors, After the 40 second time period triggered at the end of the command to open. The laser range-finder measures the distances that correspond to the absence of a train.
Automatically order the platform doors to close without detecting the closure of the train doors
The COPP system must also order the opening of the platform doors after the following events and behaviours have been observed, successively and in this order:
An open/close cycle for the platform doors has ended, The train stops and is positioned correctly in its nominal loading zone. The train doors have been completely closed. The train doors have started opening again.
COPP system safety level
The COPP system is developed for the RATP
The COPP system is developed for the RATP (autonomous Parisian transport system). The development of the COPP system complies with standards EN50129, IEC61508, EN50126, EN50128 and uses the Formal B method
The development process involves a CLEARSY safety team that is separate from the development team.
The development process involves a CLEARSY safety team that is separate from the development team. The RATP has had the system verified by an independent body (EOQA). The system has been qualified as Level SIL3, but is not certified. The levels achieved are as follows:
- The opening command is Level SIL3
- The sign flashing command is Level SIL 0
- The authorization to open the platform doors is Level SIL3
The safety guarantee relates to the presence and correct positioning of the train in a stopped position at the platform.
Communication between the train and the ground is not SIL3. The safety guarantee relates to the presence and correct positioning of the train in a stopped position at the platform.
The safety level for each component is determined so that the entire system achieves Level SIL3, taking the following items into consideration.
- The automaton is SIL 3
- The automaton program is at least Level SIL 3.
- Information from a single sensor is never used to command the safety exits.
The safety guarantee depends on the location of the antennas and mats on the tracks and the platform/ground height. The COPP system controls the opening and closing of platform doors. This is managed independently from the train’s automatic driving mechanisms. COPP, thanks to sensors, observes a portion of the track area and analyzes the behaviour of trains travelling through stations. When appropriate conditions are present, it then orders the platform doors to open or close.
Link to this référence
Linked to this référence
