DK3074293T3

DK3074293T3 - PROCEDURE FOR TROUBLESHOOTING IN A SIGNAL POST COMPUTER SYSTEM AND SIGNAL POST COMPUTER SYSTEM

Info

Publication number: DK3074293T3
Application number: DK15700439.1T
Authority: DK
Inventors: Thomas Gehrke
Original assignee: Siemens Ag
Priority date: 2014-01-29
Filing date: 2015-01-09
Publication date: 2018-04-30
Also published as: WO2015113792A3; DE102014201551A1; EP3074293B1; ES2671422T3; HUE039139T2; NO2696690T3; WO2015113792A2; EP3074293A2

Description

The invention relates to a method for revealing errors in a signal-box computer system having an operating channel, the input signals of which represent state indications of a railway safety system that are secure with regard to signalling and the output signals of which are designed for the operation of at least one element, for example a light signal, of the railway safety system and are visualised on a display, as well as a signal-box computer system for performing the method.

As part of auxiliary operations in the signal-box computer system it must be ensured that the basis for a decision, i.e. the indication view on the display that is shown to the operator, corresponds to the actual status of the railway safety installation. The primary aim of the auxiliary operation is to offer the operator as secure as possible a basis for a decision in critical situations. Display protection in this case is based in principle on the comparison of two images, namely the image on the display that is made available to the operator, and the image of a reference system which generates the same display.

In a known system of this type an operating channel and a reference channel are provided to this end. These computer channels process the information from the railway safety system, which represents a secure indication source, for example an ESTW - electronic interlocking. The operating channel and the reference channel are identical in terms of their input signals and algorithms used. In error-free signal processing the reference image of the reference channel and the status image of the operating channel match. To establish this match, checksums are determined in both channels and are transmitted to the secure indication source for comparison as part of the auxiliary operation.

In this known method the full display image is checked with pixel-precise accuracy. Consequently a significantly larger image region than necessary is checked and possible errors in a less relevant or even irrelevant image region of the display can prevent a command from being released. A disadvantage, in addition to the background test of all pixels, is above all the considerable effort required for the checksum comparison. Very high SIL demands are thereby placed on the individual systems. The SIL safety levels are defined in the CENELEC standard EN50129 from SIL 0 - not safe in terms of signalling - to SIL 4 - high-grade safety in terms of signalling.

Furthermore the screen sizes for status image and reference image must be identical, so that it is not possible to zoom during the auxiliary operation. A method and a system according to the precharacterising clauses of the independent claims are known from document WO 2011 154 343 A2.

The object of the invention is to specify a method and a signal-box computer system of a generic type, which in the event of a high-grade secure disclosure of errors tolerate irrelevant pixel errors and have a higher availability, wherein the aim is to minimise SIL requirements.

According to the invention the object is achieved by the method according to claim 1.

The object is also achieved with an inventive signal-box computer system according to claim 2.

In this way the operator is given a secure basis for decision, in which the safety method is significantly simplified and is tolerant against insignificant pixel errors compared to the known solution involving the complete read-out of the screen contents and the back-calculation into a process map, and the claimed method is significantly simpler, since not the entire screen contents are back-calculated in full, but only the current status changes are transmitted in machine-readable form on an optical path, preferably via QR codes, and as it were are traced.

The system development costs are reduced, since the SIL requirements are largely relocated into the reference system as an autonomous component. In the ideal case only an SIL level of 0 is necessary via the operating channel and for the reference system an SIL level less than 4, depending on the security required for the overall system. Thus a clearer division is achieved between secure and insecure functionality. Furthermore the inventive solution also permits zooming, as the QR code contains status information that is not dependent on the image used.

Since the reference system only evaluates the image portion of the text pixels or graphics pixels that is significant for the element status displayed, the method overall is significantly less prone to pixel errors than the known method. As a result the availability of the signal-box system is increased.

It is further advantageous that the software of the operating channel can be replaced more easily because of the low security level, without jeopardising the system certification. A further advantage is that the function of the workstation need be extended only slightly for the output of the status changes in the form of QR codes. It is however also possible to retain the workstation unchanged and to display the QR code on a separate output device.

In a particularly preferable embodiment according to claim 3 it is provided that the readback channel is designed to output first checksums and the logic channel is designed to output second checksums. The two checksums are transferred by the reference system in the normal manner for the command release process to the secure indication source, for example an ESTW -Electronic Interlocking - or an ETCS - European Train Control System - in order to be compared with one another there.

The invention is explained in greater detail below based on a figurative representation. The figure shows essential modules of an inventive signal-box computer system.

Instead of the known, essentially identical computer channels, a workstation computer acting as an operating channel 1 and a reference system 2 are provided, that use very different algorithms for very different tasks.

The operating channel 1 generates a process image 4 from messages of a railway safety system 3 that are secure with regard to signalling by means of a projected signal-box logic, said process image 4 being conditioned to visualise a corresponding text display and/or graphics display on a display 5. The operation, in order e.g. to set a light signal from STOP to PROCEED, must be embodied as an auxiliary operation, because otherwise the signal box would violate its safety rules. The auxiliary operation is sent by the operating channel 1 to the signal box.

Simultaneously with the initiation of the operation the colour display shown on the display 5 is checked by the reference system 2 in respect of pixel errors and errors during signal processing in the operating channel 1. To this end the operation-specific state changes are initially generated as QR - Quick Response - codes and are read by a QR code reader 7 of a readback channel 8 of the reference system 2. The corresponding image pixels are converted in a computer 9 into a machine-readable second process map 10, which enables the formation of checksums.

In a logic channel 11 of the reference system 2 a second checksum is formed by way of a process image 12 of said logic channel 11. The process image 12 is - as is the process image 4 in the case of the operating channel - formed directly from the projected signal-box logic and thus directly from the state indications of the railway safety system 3 that are secure with regard to signalling.

The checksums of the readback channel 8 and of the logic channel 11 are compared with one another by a comparator 13, which is preferably part of the region of the signal-box system that is secure with regard to signalling. Only if the two checksums match can it be assumed that the signal processing in the operating channel 1 has been executed without error and the display 5 in the relevant pixel regions is error-free, so that the release of the command can take place. In this safety method the pixel regions of the display 5 that are not needed for current operations handling are ignored, thereby resulting in a very high availability of the overall system.

The interplay of operating channel 1 and reference system 2 with the two independent channels 8 and 11 for the pixel evaluation and for the process evaluation results in high safety that is secure with regard to signalling, wherein the operating channel 1 secured by the reference system 2 can have a safety level SIL 0. As a result the functional scope with SIL greater than 0 is restricted to the reference system 2 and can be significantly reduced - in respect of the overall system - compared to the known embodiment.

Claims

A method of debugging a signal mail computer system with an operating channel (1), whose input signals represent signal-safe state messages from an iron child restraint system (3) and whose output signals are designed to operate at least one element, e.g. a light signal, from the railway safety system (3) and visualized on a display (5), characterized in that when an operation of the element is initiated, only operation-specific state changes are generated as optically encoded, especially QR - Quick Response encoded, element-specific pixel data on the display (5) and read by a read-back channel (8) and compared with element-specific data from a process image (12) by the signal-safe state messages.

An error message signal computer computer system, wherein the signal mail computer system has an operating channel (1) whose input signals represent signal-safe state messages from a railway safety system (3) and whose output signals are designed to operate at least one element, e.g. a light signal, from a railway safety system (3), and a display on which the output signals of the operating channel (1) are visualized, a comparator (13) and a reference system (2), characterized in that the signal post computer system is designed for when operation of a the element, only to generate operation-specific state changes such as optically encoded element specific pixel data on the display (5), and the reference system (2) has a read-back channel (8) for reading optically encoded, in particular QR - Quick Response encoded element specific pixel data on the display (5) and a logic channel (11) for generating a process image (12) of the signal-technically safe state messages from the rail safety system (2), wherein the read-back channel (8) and logic channel (11) are connected to the comparator (13).

Signal mail computer system according to claim 2, characterized in that the read-back channel (8) is designed to deliver the first check sum and the logic channel (11) is designed to give the second check sum.