EP1686036A1 - System for monitoring and controlling objects - Google Patents

Abstract

The system has a cell control system for each network cell and assigned by a cell processing system of respective cell. The control system monitors super systems for controlling the traffic inside the cell. A wide network acting control station has control places, which processes data received or output from or to the processing system over interfaces (S). A five-layer structure is provided for a common processing system. The structure comprises an interface layer, processing layer, presentation layer, combination layer and a display layer. The common processing system includes the cell processing system and a control station processing system.

Description

The present invention relates to a guidance system for the control and / or monitoring of objects operating on a traffic network subdivided into a number of network cells. In particular, the invention relates to a guidance system for controlling and / or monitoring rail vehicles running on a railway network divided into regional areas.

Railway networks are still subject to the national sovereignty of the state on which this railway network is located. Several regionally effective control centers - hereafter referred to more generally as network cells - are provided for the control of train traffic on such a national railway network. These network cells therefore control the train traffic on their respective assigned geographical areas. As a rule, in the present state of such a dispositive train control, it is still the case that a data exchange between the individual network cells is restricted to the exchange of train numbers at the boundaries between two adjacent network cells. Likewise today it is often the case that the individual systems running on the network cells are proprietary and therefore the respective operating software can differ from network cell to network cell.

Within a network cell, trains are controlled by means of a cell software executed on a cell computer system, that is to say the control technology programs executed on the computer network of the cell, by setting routes and optimizing and optimizing the train runs. For example, if there is an update to the cell software, changes in the railroad regulations can be made and / or in the configuration data, for example due to changes in the track topology, implemented in the network cell and taken over into the operationally active operation.

Due to the known in the prior art division of the network into different geographical areas with each of these areas associated separate control centers, also called remote control center, so far closed the possibility to control the entire traffic across the entire network across cells from one or more supraregional control center and / / or monitor.

The present invention is therefore based on the object to provide a control system of the type mentioned that is constructed in terms of its architecture and task distribution so that the parent control and / or monitoring of the circulating on the network objects is possible.

• a) für jede Netzwerkzelle ein Zellenleitsystem, das mittels eines Zellenrechnersystems der jeweiligen Netzwerkzelle zugeordnete und den Verkehr im wesentlichen innerhalb dieser Netzwerkzelle beeinflussende und/oder überwachende Umsysteme, wie z.B. Stellwerke, Weichen, Signale, Gleisfreimelder, Achszähler, stellt und/oder überwacht, wobei das Zellenrechnersystems über Schnittstellen Daten erhält und/oder ausgibt;
• b) eine netzwerkweit wirksame Leitstelle mit Bedienplätzen, die mittels eines Leitstellenrechnersystems von den Zellenrechnersystemen über die Schnittstellen erhaltene Daten bearbeiten und/oder Daten über die Schnittstellen an die Zellenrechnersysteme ausgeben;
• c) wobei für ein Gesamtrechnersystem, das die Zellenrechnersysteme und das Leitstellenrechnersystem umfasst, ein fünf-schichtiger logischer Aufbau mit einer Schnittstellenschicht, einer Arbeitsschicht, einer Präsentationschicht, einer Vereinigungsschicht und einer Anzeigeschicht vorgesehen ist; wobei
  • c1) die Schnittstellenschicht logischer Bestandteil der jeweiligen Zellenrechnersysteme ist und Daten von den Umsystemen aufnimmt und an die Arbeitsschicht leitet und/oder Daten von der Arbeitsschicht erhält und diese an die Umsysteme ausgibt,
  • c2) die Arbeitsschicht logischer Bestandteil der jeweiligen Zellenrechnersysteme ist und von der Schnittstellenschicht und/oder der Präsentationsschicht erhaltene Daten in einer Zellenlogik zellenspezifisch verarbeitet und an die Schnittstellenschicht und/oder die Arbeitsschicht ausgibt,
  • c3) die Präsentationsschicht logischer Bestandteil der jeweiligen Zellenrechnersysteme ist und von der Arbeitsschicht erhaltene Daten für die Anzeigeschicht aufbereitet und an die Vereinigungsschicht ausgibt und/oder von der Vereinigungsschicht erhaltene Daten für die Arbeitsschicht aufbereitet und an diese ausgibt,
  • c4) die Vereinigungsschicht logischer Bestandteil des Leitstellenrechnersystems ist und die von den Präsentationsschichten der Zellenrechnersysteme erhaltenen Daten vereinigt und zur Darstellung eines vereinigten Datenabbildes für die Anzeigeschicht aufbereitet und/oder von der Anzeigeschicht erhaltene Daten hinsichtlich ihrer Zugehörigkeit zu der Anzahl der Netzwerkzellen auflöst und an die Präsentationsschicht des entsprechenden Zellenrechnersystems ausgibt, und
  • c5) die Anzeigeschicht logischer Bestandteil des Leitstellenrechnersystems ist und von der Vereinigungsschicht erhaltene Daten an den Bedienplätzen darstellt und/oder an den Bedienplätzen erhaltene Daten an die Vereinigungsschicht ausgibt.

This object is achieved according to the invention by a control system for the control and / or monitoring of objects that run on a traffic network subdivided into a number of network cells, in particular a control system for a regional network subdivided rail network, comprising the following components:

• a) for each network cell, a cell routing system, which by means of a cell computer system of the respective network cell and the traffic substantially within this network cell influencing and / or monitoring Umsysteme, such as interlockings, points, signals, track vacancies, axle, provides, and / or monitors, wherein the cell computer system receives and / or outputs data via interfaces;
• b) a network-wide effective control center with operator stations that edit data received by the cell computer systems via the interfaces by means of a control center computer system and / or output data via the interfaces to the cell computer systems;
• c) wherein for an overall computer system comprising the cell computer systems and the central computer system, a five-layered logical structure with an interface layer, a working layer, a presentation layer, a merging layer and a display layer is provided; in which
  • c1) the interface layer is a logical component of the respective cell computer systems and receives data from the peripheral systems and forwards them to the working layer and / or receives data from the working layer and outputs it to the peripheral systems,
  • c2) the working layer is a logical component of the respective cell computer systems and data received from the interface layer and / or the presentation layer are cell-specifically processed in a cell logic and output to the interface layer and / or the working layer,
  • c3) the presentation layer is a logical component of the respective cell computer systems and prepares data received from the working layer for the display layer and outputs it to the merging layer and / or prepares and outputs data received for the working layer from the merging layer,
  • c4) the merging layer is a logical component of the control center computer system and combines the data received from the presentation layers of the cell computer systems and prepared to display a merged data image for the display layer and / or dissolves data obtained from the display layer in terms of their membership in the number of network cells and to the presentation layer of the corresponding cell computer system, and
  • c5) the display layer is a logical part of the control center computer system and represents data obtained from the merging layer at the operator stations and / or outputs data obtained at the operator stations to the merging layer.

In this way, the control system according to the invention provides the network-wide control and / or monitoring of the circulating objects as well as the peripheral systems required for determining their traffic route. The separation of the tasks of information processing for the control center and representation in the control center allows a complete encapsulation of this representation process of the configuration and operation of the individual network cells. The architecture therefore also permits the process control operation of each network cell for itself if the data connection to the control center and its workstations should be interrupted.

In an advantageous development of the invention, external systems, for example, can also exchange data with the control system in that the merging layer can additionally comprise an interface via which data can be output to other surrounding systems in a manner similar to the display layer and / or via the data of further peripheral systems, Similar to data obtained from the display layer, the corresponding further treatment can be obtained. Such external systems may, for example, be passenger and / or customer information systems, which, for example, evaluate train data that differs from the timetable for display by the passenger and / or customer. However, these can also be external systems acting directly on the productive process, such as maintenance systems, which, for example, cause the control system to temporarily unavailable a traffic route in this way Report maintenance or failure of critical systems.

In order to realize the operator station in as flexible a manner as possible, it may be provided that an aggregator is provided in the merging layer, which is configured identically for all operator stations and can be executed on an operator station computer which is part of the central computer system. This approach allows the software to be built uniformly for the aggregator and executed in units with a clear interface and definable but limited interaction. In particular, the last-mentioned feature makes it possible to work on different tasks in the control center at different workstations, without having to directly exchange data between the operator stations at the level of the operator stations.

In a further development of these aforementioned properties, the aggregator may include a selection logic with which specifically specifiable data groups and / or data derived from specially specifiable peripheral systems can be selected for their processing at the operator stations. In this way, the aggregator allows virtually for each session at an operator station an individual configurability of the functions and data to be executed or evaluated at the operator station. The data group may relate, for example, exclusively to the group of train number data or the data on unoccupied track sections and the like. The specifiable peripheral systems can be any type of components that are relevant in the traffic process for the control and monitoring, such as interlockings, switches, signals, axle counter, track vacancy and so on.

In order to be able to ensure the independent operation of the control center for the entire network and the control system for the individual network cells while at the same time largely decoupling the configuration process, a database with global network data can be provided which exchanges this network data with the merging layer and / or the working layer. In this way, the operator stations use their association layer to access this global data. Regardless, the single network cell can access this global data directly from within its working layer. Typical global data is, for example, the entire network topology data and data that clarifies how data from individual network cells are to be interconnected, e.g. Cross track field tables.

In order to make the productive transport process largely resistant to failures of data connections between the network cells and the control center, data connections for cross-communication (QK) between network cells are also provided from the working layer. In this way, for example, train number data can be exchanged between adjacent network cells when a train changes from one network cell to another network cell. But even for the operation of the operator stations, this cross-communication can be advantageous if, for example, a connection to a particular network cell, but to fulfill a higher-level task and data from other network cells are needed.

For reasons of better testability of the cell logic executed on the network cells, several self-sufficient cell molecules can temporally execute the tasks of the network cell. In order that an assignment of the data relating to the respective cell molecules can be made, the interface layer can have a Data dispatcher can be provided, which is configurable for the assignment of the data received from the peripheral systems to different cell molecules within a network cell.

Further advantageous embodiments of the invention can be taken from the remaining subclaims.

Figur 1

eine schematische Ansicht der Architektur eines Leitsystems für ein Eisenbahnnetz;

Figur 2

eine detaillierte schematische Ansicht der Architektur des Leitsystems für ein Eisenbahnnetz gemäss Figur 1;

Figur 3

eine detaillierte schematische Ansicht der Architektur des Leitsystems für ein Eisenbahnnetz mit einer Datenbank für globale Daten und mit einer Anbindung externer System; und

Figur 4

eine schematische Darstellung der logischen Verteilung von Rechnersystemen innerhalb des Leitsystems gemäss den Figuren 1 bis 3.

Auführungsbeispiele of the invention are explained below with reference to the drawing. Showing:

FIG. 1

a schematic view of the architecture of a control system for a railway network;

FIG. 2

a detailed schematic view of the architecture of the control system for a railway network according to Figure 1;

FIG. 3

a detailed schematic view of the architecture of the railway system control system with a database for global data and with an external system connection; and

FIG. 4

a schematic representation of the logical distribution of computer systems within the control system according to Figures 1 to 3.

Figure 1 shows a schematic view of the architecture of a control system, hereinafter referred to as network NW, for a railway network. For example, the rail network of the Swiss Federal Railways (SBB) today is divided into approximately 15 isolated control systems. The split is a geographical breakdown in which each system is responsible for a given area. The Communication between these systems in the prior art is limited to the exchange of train numbers at the boundaries between the systems.

In the network NW according to the present invention, a network workstation AP1 to AP3 can communicate with a plurality of network cells NWZ each responsible for a geographical area. This results in the following new architectural elements compared to the large number of former independent control systems:

The workstation AP1 to Apn summarizes the information from the configuration of the individual network cells NWZ and generates an overall view for the user. The network cells NWZ become for the user a single large system of the network NW. The system is transparent to the user, so that the overall system, which consists of several smaller subsystems, behaves in exactly the same way as a single, large-scale control system across the entire rail network.

The elements of the system meet the following requirements, allowing the following architectural goals to be met as desired:

The network NW therefore gives the user the impression that there is only one network control system for the entire rail network. For a part of the control system functions, this can be realized via the integration of the information on the workstation AP1 to AP3. In order to realize this requirement for the other part of the control system functions, the network cells exchange information with one another by way of a cross-communication QK. Examples include the control system tasks train number administrator (ZV), train control (ZL) and overfill prevention (UeV). Thus, the Cross-communication QK between the network cells NWZ the cross-cell functions.

The specific structure of the architecture of the control system according to the invention will now be explained with reference to FIG. It should be noted at the outset that the image of Figure 2 shows only the logical arrangement of each relevant group and no statement about the physical arrangement of data processing means and the physical distribution of the relevant groups on these data processing means.

In the previous guidance systems according to the prior art, a classic three-layer architecture is provided. Information in working objects BO, such as points, signals, balises or trains, is stored in a working layer BL. The processing in this layer, the work logic executed by a business server BS, prepares this information. The origin of the information is an interface layer Layer IL, which primarily represents the interface S to the web process. A display layer converts the work objects BO and their states into a user-friendly representation, such as a magnifying glass image. The display layer VL comprises the entire user interface, which is placed primarily at the work stations AP1 to AP3 for the visual display for the dispatcher Fd1, Fd2 and temporarily also for the examiner P. Of course, other peripherals such as printers, storage media and multimedia devices are included in this interface.

Today's VL according to the prior art includes the Presentations logic as well as the actual View logic. In the new network NW according to the invention, the presentation logic is deliberately strongly dependent on the control system configuration data of the individual network cells NWZ and therefore also remains new in the network cell NWZ. Because the Workplace AP1 to AP3 in the new network according to the invention NW, however, no longer contain precisely this presentation layer PL, these workstations AP1 to AP3 are a so-called "thin client". The software for the network NW thus has a "thin-client" structure, ie the presentation which converts the work objects BO into a view for the user already takes place in the network cell NWZ. The presentation layer PL prepares the information for the display layer VL. This processing depends on the parameters that can be individually selected for each workstation in the display layer VL, such as language, information area, and the configuration data of the network cell NWZ.

Also new is the logical arrangement of a union layer AL on the side of a computer system operating for the control center (in other words: for the entirety of the workplaces AP1 to AP3). The merging layer AL adds the information from the individual network cells NWZ into a whole by means of an aggregator AG and sends them to the view client VC in the display layer VL, which is now no longer logically located within a network cell NWZ but the workstations AP1 to AP3 served. The information from the view client VC to the network cell NWZ, which are issued from the workstations AP1 to AP3 recordable by the Dispatcher Fd1 and Fd2 and the inspector P are divided by the aggregator AG in the union layer AL and forwarded to the corresponding network cells NWZ ,

For example, in presentation layer PL, presentation logic converts the current state of interlocking elements (switches, tracks, etc.) into a geometric representation of a magnifying glass image. The merging layer AL adds the individual geometric representations from the individual network cells NWZ to a comprehensive one geometric representation together, which is displayed in the display layer VL the user as an overview image. The display layer VL does not require any configuration data for this task. The merging layer AL has only the information how the individual geometric representations are combined to form a comprehensive geometric representation.

Since most of the configuration data and as much as possible of the logic are present in the network cells NWZ, on the one hand it is easier to define a release-independent protocol between the network cells NWZ and the network workstations AP1 to AP3 and, on the other hand, can the configuration data be clearly assigned to a network cell NWZ. From which network cells NWZ and in what way the information for the display come, is completely encapsulated by the union layer AL against the display layer VL and thus can be unified. Any knowledge of the display layer VL via the topology of the network cells NWZ behind the merging layer AL and its servers is therefore not necessary for the display layer VL. Due to this architecture of the network NW, therefore, the surfaces of the display layer VL and the presentation layer PL are strictly separated. The actual display (view) is thus separated from the display logic (presentation). The view client VC no longer needs display logic (presentation) and thus has no dependencies on the configuration data of the various network cells NWZ.

The display logic (presentation) is realized by a display server MXVS in the network cell NWZ. The MXVS display server completely processes the view for the View Client VC. So that the View Client VC can communicate with several servers, the Aggregator AG is provided between the View Client VC and the MXVS display server. The View Client VC only communicates with the Aggregator AG via the Aggregator AG corresponding display servers MXVS of multiple network cells NWZ.

Within the presentation layer PL, there are also cases in which a display server MXVS is not absolutely necessary, which is why, in addition to the display server MXVS, there is also the concept of an access point AP. The display server MXVS prepares the information as needed for a View Client VC. From a display server MXVS exists one instance per View Client VC and network cell NWZ. The server of the View Client VC is stateful, i. his condition is dependent on the workstation AP1 to AP3, for which he prepares the data. The MXVS display server is therefore a rebuilt task of the prior art single control systems known in the prior art and mentioned above. The access point AP provides a general interface to the network NW with respect to a function, such as train data and train numbers. In the foreground is to define an interface, which is used by any clients who need the corresponding information. The access point AP is therefore largely stateless in the context of a client, i. its state is independent of the workstations connected to it AP1 to AP3, and stores per client primarily what information this wishes. The access point AP can thus take over part of the display logic (presentation). It thus provides access to a defined set of information which is not specifically prepared for a workstation AP1 to AP3.

The View Client VC, which is logically located in the display layer, exists once per user session. The display server MXVS exists once per user session and network cell NWZ and prepares the information for the corresponding user. The aggregator AG exists individually for each user session, since different information must be assembled for each view client VC.

The access point AP exists once per network cell NWZ, and thereby in two redundant instances to increase the availability.

Many of the information processed by the NWZ network cell is obtained from other systems (Stellwerk STW, Außenanlagen UA1 to Un2)). When the network cell NWZ is started, this information will be obtained from these external systems via a general poll. But there is also information that is stored only in the network cell NWZ and which can not be obtained from an external system. This information must still be present after a restart of the NWZ network cell or individual tasks. Therefore, this information is often stored persistently (in database, files) and / or adjusted between main, mirror and passive running states of the tasks. When a cell molecule pZM is started in the nonoperatively active state, the data managed by the network cell NWZ are obtained from the operatively active cell molecule aZM. The interface with which the data managed by the network cell (i.e., global data accessed by the network cell but not stored in its instance) is matched between the cell molecules is designed to be release-independent.

During the time in which several cell molecules aZM, pZM run, this data must be kept in sync. In the case of printer management, the data is merged so that at the end all log entries of both cell molecules aZM, pZM are present. In the log entries it can be seen from which of the cell molecule aZM and pZM these come.

To adapt the interfaces, it should now be noted that many of the external interfaces are designed so that the external Umsystem with exactly one network cell NWZ communicated. However, if several cell molecules aZM, pZM run in a network cell NWZ, all cell molecules must still be able to communicate with this external system. For this purpose, an interface task has been created which runs in its own interface molecule SM. These interface tasks can be configured in the interface molecule SM and convert the external protocol according to the selected configuration into an internal protocol and distribute the information to the individual cell molecules aZM, pZM. These interface tasks are operated as a separate layer, the interface Dispatcher Layer IDL, but this is logically added to the actual interface layer IL. The Interface Dispatcher Layer itself has almost no configuration data. The interface between the Interface Dispatcher Layer IDL and the cell molecules aZM, pZM is release-independent, so that these two cell molecules aZM, pZM can be operated with different releases.

If certain external systems ES (see Fig. 3) such as passenger information display (FIA), radio center or resource management are connected to the network NW, the architecture is designed so that they do not have to worry about the allocation to network cells NWZ, so this allows to change the allocation into network cells NWZ without affecting the external system. Furthermore, in the external systems, which work with only one network cell NWZ, no cross-cell logic must be installed so that they can work with several network cells NWZ. The network NW already includes in the form of the aggregator AG already the logic to merge data from different network cells NWZ. This logic is also used accordingly for the connection of external cell systems ES, which can be coupled to the aggregator AG via a separate interface SA, which may also include an application adapter.

Furthermore, the network NW provides cross-cell interfaces SA. The interfaces SA to the external systems ES are defined by means of general services. A service represents a defined interface via which a set of information is exchanged bidirectionally between the external systems and the network NW. This ensures that the same service can be used by various external systems. An example is a train number service via which all train number advances are sent to interested external systems or train number operations are accepted by the external systems. These services are specified in the network NW and the external system ES has to implement the interface SA specified by the network NW. Since this is not always possible, the network NW continues to support specific interfaces for certain external systems ES, if an already existing interface should work across cells and / or if the network should support an interface specified by an external system ES.

For both cases special adapters are written to implement a specific interface. The adapter accesses the network NW via the services. Such an interface is connected via a proxy server if the external system is not part of the closed network NW.

• Benutzerdaten, Informationsbereiche, Drucker usw... (von jedem Arbeitsplatz AP1 bis AP3 benötigt)
• Informationen, wie Daten aus einzelnen Netzwerkzellen NWZ zusammengehören, wie z.B. Grenzgleisfeldtabelle (betreffen den Arbeitsplatz AP 1 bis AP3 und die Netzwerkzellen NWZ)
• Definitionen für den Aggregator AG, wie Definition der Übersichtsbilder.

Further, Figure 3 shows the management of various global data GD in the network NW. Here are:

• User data, information areas, printers, etc ... (required from each workstation AP1 to AP3)
• Information on how data from individual network cells NWZ belong together, such as a border track field table (concern workplace AP 1 to AP3 and network cells NWZ)
• Definitions for the aggregator AG, such as definition of the overview screens.

• Globale persistente Netzwerk-Daten:
  • Daten, welche durch das Netzwerk NW selbst verwaltet werden, dass heisst die Netzwerk-Software erzeugt, ändert und löscht diese Daten selbst.
• Globale Konfigurationsdaten
  Diese Daten enthalten globale Konfigurationsinformationen und werden von der Netzwerk-Software nur gelesen.

These global data GD are not assigned to a network cell NWZ, because these global data must be available to each workstation AP1 to AP3 and each network cell NWZ and a split would provide considerable difficulty in data management. The global data GD can be divided into two categories:

• Global persistent network data:
  • Data, which are managed by the network NW itself, that is, the network software generates, changes and deletes this data itself.
• Global configuration data
  These data contain global configuration information and are only read by the network software.

At this point, it should again be explicitly pointed out that the network software must not be confused with the network cell software. For the global persistent data, changes are saved to old statuses, which makes it possible to go back to an old state in the event of a mishandling of an administrator. The global configuration data can be created offline and then imported into the global data GD. Therefore, to allow for soft migration as well as non-disruptive update, various levels of global configuration data are available which result in different cell configurations, i. to different versions of the cell software incl. The required data fit.

4 shows an example of the structure of the overall physical system. Each network cell NWZ has its own Ethernet LAN. Connected to the Ethernet are cell servers, cell-local workplaces L, cell-local printers, terminal servers, ISDN routers to the ILOK and external systems. On this Ethernet LAN, IP, DECnet, and LAT are used as protocols. This set of components, which are logically arranged within a network cell NWZ, forms a cell computer system Z-RS A, Z-RS B. The workstations AP1 to AP3 and printers at a control center location LT and in the regional control center RCC are each at one or connected to several Ethernet LANs. On this workstation LAN only IP is used, so no DECnet and no LAT. This set of components, which are logically assigned to the control center location, forms a control center computer system LT-RS.

Printers, each with its own print server, are used and connected directly to the Ethernet LAN. For simple printers, separate external print servers can be used, and for high-performance printers, mostly internal print servers are available as an option. By doing so, all printers can be reached from all workstations AP1 to AP3 and all network cells NWZ, and there is no central print server either. A cell-local workstation L is configured to operate only with the corresponding network cell NWZ and is used as the last fall-back element in the event of a failure of the network NW. This workstation L is therefore configured so that it can be used as a cell-local workstation L.

In a possible embodiment according to FIG. 4, a plurality of cell LANs and normally a workstation LAN can be present at a control center location LT. The RCC has one or more workstation LANs. The individual sites are connected to an IP network. The routers that are available at each site are redundantly equipped to compensate for failures of such components immediately. The thus formed IP network with all LANs together is a network NW closed according to the railway standard EN50159-1. This requirement makes it possible that the data traffic between the individual network cell NWZ and the control center LT and other components arranged within the network NW need not be encrypted. In order for the software running at the workstations AP1 to AP3 to be able to communicate with the presentation server MXVS and the access points AP, and thus also the lateral communication QK to take place between the network cells NWZ, a communication framework exists in the network NW. As already described, the network NW also offers interfaces SA for external systems ES. These interfaces SA are realized by an interface server. If the external systems ES are located within the closed network NW, they can access the interface server directly. On the other hand, if the external systems ES are outside the closed network NW, this is not possible without further ado.

• Eindringen von sicherheitskritischen Meldungen Grundsätzlich wird jedes Eindringen von sicherheitskritschen Meldungen in das geschlossene Netzwerk NW verhindert, welche sicherheitskritsche Funktionen im Netzwerk NW auslösen könnten. Dabei können sicherheitskritsche Meldungen entweder durch Kommunikationsfehler entstehen, aber auch durch ein bereits kompromittiertes externes System ES. In die Gegenrichtung, d.h. vom Netzwerk NW zum externen System ES, werden keine Einschränkungen bezüglich des Meldungstransports benötigt.
• Intelligente Angriffe durch Hacker, Viren, Würmer, usw. Weiterhin müssen alle Formen von intelligenten Angriffen abgewehrt werden, welche zur Kompromittierung von einzelnen Rechnern innerhalb des geschlossenen Netzwerkes NW führen könnten.

For security reasons, precautions are taken in the following cases:

• Intrusion of safety-critical messages In principle, any intrusion of safety-critical messages into the closed network NW is prevented, which could trigger safety-critical functions in the network NW. Safety-critical messages can arise either through communication errors or through an already compromised external system ES. In the opposite direction, ie from the network NW to the external system ES, no restrictions regarding the message transport are required.
• Intelligent attacks by hackers, viruses, worms, etc. Furthermore, all forms of intelligent attacks have to be defended, which are used to compromise individual computers within the closed network NW could lead.

So that the network NW can continue to be regarded as a closed network NW according to the standard EN50159-1, an additional interface proxy server is provided, which enables communication with the interface server from an insecure network. The interface server is connected to the closed network NW and offers the cross-cell interfaces as universally valid services. Trusted external systems ES, which are located within the closed network NW, can directly access the interface server. In contrast, the interface proxy server is connected to the insecure network. This offers the services of the interface server as a proxy, i. It looks like the interface server to the outside, but only forwards the messages to the interface server. The Proxy Server interface only offers a well-defined subset of the interfaces of the interface server. The interface subset includes only the components that may be used by potentially untrusted external systems.

In addition, the interface server and the proxy server interfaces each include two network cards. In each case a network card connects the interface server with the closed network NW or the interfaces proxy server with the insecure network. The other network card connects the interface server and the proxy server interfaces via a separate Ethernet LAN. The external system ES is connected to the interface proxy server via a firewall. This firewall only releases the absolutely necessary communication services, and only allows connections to known computers.

However, if the problem arises that the external system ES can not work directly with the interfaces offered by the network NW, another adapter is created. This adapter is realized on the external system ES. Furthermore, a message filter is used between the interface proxy and the actual interface. This message filter understands the meaning of the messages, leaving only messages classified as non-hazardous. Which messages are classified as harmless, is freely configurable. Every occurrence of a potentially dangerous message is logged. The message filter is implemented both in the interface server and in the interface proxy server. The message filter is the same in both servers, and both servers monitor each other for the correct functioning of the message filter. In this case, it is provided in the present exemplary embodiment that any errors in the message filter which have occurred are disclosed within a publication exposure time of one hour.

• Jeder Server sendet einen Prüfauftrag mit einer eindeutigen Transaktions-ID an seinen Partner. Der Empfänger des Prüfauftrages ermittelt aus den Programm- und Konfigurations-Dateien des Meldungsfilters eindeutige Prüfsummen. Die berechneten Prüfsummen werden zusammen mit der empfangenen Transaktions-ID an den Sender des Prüfauftrages zurückgeschickt. Der Sender des Prüfauftrages berechnet ebenfalls eindeutige Prüfsummen über die Programm- und Konfigurations-Dateien seines Meldungsfilters. Der Sender vergleicht die selbstberechneten Prüfsummen mit den empfangenen Prüfsummen. Die Prüfzyklen werden jeweils auf dem Schnittstellen Proxy Server und dem Schnittstellen Server unabhängig voneinander gesteuert und regelmässig wiederholt. Auf dem Schnittstellen Proxy Server und dem Schnittstellenserver wird jeweils ein Ausfalloffenbarungs-Timer gestartet, welcher unter folgenden Bedingungen wieder neu gestartet wird:
  • Die selbstberechneten Prüfsummen müssen identisch mit den empfangenen Prüfsummen sein. Nach dem letzten Neustart des Ausfalloffenbarungs-Timers muss mindestens ein Prüfauftrag von dem anderen Server empfangen worden sein. Um nicht erfolgreiche Prüfzyklen wiederholen zu können, werden die Prüfzyklen in der Zeitdauer des Ausfalloffenbarungs-Timers mehrmals wiederholt. Falls der Ausfalloffenbarungs-Timer auf einem Server abläuft, wird dies protokolliert und der Server stellt sich sofort ab. Damit kann dann auch der andere Server seine Prüfzyklen nicht mehr erfolgreich abschliessen, und wird sich nach Ablauf seines Ausfalloffenbarungs-Timers auch abstellen. Die Server lassen sich automatisch nicht wieder starten, sondern müssen manuell wieder neu gestartet werden.

For the mutual monitoring of interfaces server and interfaces proxy server the following procedure is used:

• Each server sends an audit job with a unique transaction ID to its partner. The receiver of the test job determines unique checksums from the program and configuration files of the message filter. The calculated checksums are sent back together with the received transaction ID to the sender of the inspection order. The sender of the test job also calculates unique checksums via the program and configuration files of its message filter. The transmitter compares the self-calculated checksums with the received checksums. The test cycles are controlled independently on the interface proxy server and the interface server and repeated regularly. Each of the Interfaces Proxy Server and the Interface Server becomes a Discovery Discovery Timer which is restarted under the following conditions:
  • The self-calculated checksums must be identical to the received checksums. At least one audit job must have been received from the other server after the restart of the failure disclosure timer. In order to be able to repeat unsuccessful test cycles, the test cycles are repeated several times in the period of the exposure disclosure timer. If the Disclosure Timer runs on a server, it will be logged and the server will shut down immediately. In this way, the other server can no longer successfully conclude its test cycles, and it will also switch off after expiration of its interrupt disclosure timer. The servers can not be restarted automatically, but must be manually restarted.

For communication between the interface proxy server and the interface server, only the absolutely necessary communication services are released, all other services are blocked. If a communication attempt is detected on a service that has not been released, it will be logged and the server will be shut down immediately. An additional firewall is switched between the interface server and the interface proxy server. This firewall only releases the essential communication services, and only allows connections between the two servers. If either the interface server or the proxy server interfaces detect an attempted intrusion into a shared communications service, it will be logged and the server will be shut down immediately.

In this way, the high safety requirements, which apply, for example, always when there is danger to humans (this is basically always the case in the railway engineering environment), are sufficiently taken into account.

The network NW and / or its architecture described above for a network-wide railway control system and the various logical groupings and methods for secure data exchange implemented within the architecture, in particular with external systems ES arranged outside the secure network NW, can also be found in the fields of telecommunications, Use network control technology in energy distribution and in road and air traffic as well as all more complex processes to control the overall process.

Claims (7)

Guidance system (NW) for the control and / or monitoring of objects operating on a network of transport subdivided into a number of network cells (NWZ), in particular a control system for a regional network of railway networks, comprising the following components: a) for each network cell (NWZ) a cell routing system, the by means of a cell computer system (Z-RS A, Z-RS B) of the respective network cell (NWZ) associated and the traffic substantially within this network cell (NWZ) influencing and / or monitoring Umsysteme (STW A to STW n, UA1 to Un1, UA2 to Un2), such as interlockings, switches, signals, track vacancies, axle counter, provides and / or monitored, the cell computer system (Z-RS A, Z-RS B) via interfaces (S) receives and / or issues data; b) a network-wide effective control center (LT) with operator stations (AP1 to AP3), the data obtained by means of a control center computer system (LT-RS) from the cell computer systems (Z-RS A, Z-RS B) via the interfaces (S) processed data and / or output data via the interfaces (S) to the cell computer systems (Z-RS A, Z-RS B); c) wherein for a total computer system comprising the cell computer systems (Z-RS A, Z-RS B) and the control center computer system (LT-RS), a five-layered logical structure with an interface layer (IL, IDL), a working layer (BL ), a presentation layer (PL), a merging layer (AL) and a display layer (VL); in which c1) the interface layer (IL, IDL) is a logical component of the respective cell computer systems (Z-RS A, Z-RS B) and receives data from the peripheral systems (STW A to STW n, UA1 to Un1, UA2 to Un2) and to the Working layer (BL) directs and / or receives data from the working layer (BL) and outputs it to the peripheral systems (STW A to STW n, UA1 to Un1, UA2 to Un2), c2) the working layer (BL) is a logical component of the respective cell computer systems (Z-RS A, Z-RS B) and data received from the interface layer (IL, IDL) and / or the presentation layer (PL) are cell-specific processed and cell-specific data outputs the interface layer (IL, IDL) and / or the working layer (BL), c3) the presentation layer (PL) is a logical component of the respective cell computer systems (Z-RS A, Z-RS B) and prepares data received from the working layer (BL) for the display layer (VL) and outputs it to the merging layer (AL) and / or processing data obtained from the combining layer (AL) for the working layer (BL) and output to it, c4) the unification layer (AL) is a logical component of the control center computer system (LT-RS) and combines the data received from the presentation layers (PL) of the cell computer systems (Z-RS A, Z-RS B) and to display a unified data image for the display layer (VL) prepared and / or from the display layer (VL) data obtained in terms of their membership in the number of network cells (NWZ) dissolves and outputs to the presentation layer (PL) of the corresponding cell computer system (Z-RS A, Z-RS B), and c5) the display layer (VL) is a logical component of the control center computer system (LT-RS) and data obtained by the merging layer (AL) at the operator stations (AP1 to AP3) and / or data obtained at the operator stations (AP1 to AP3) Unification layer (AL) outputs. Control system according to claim 1,
characterized in that
the combining layer (AL) additionally comprises an interface via which data can be output to other surrounding systems (STW A to STW n, UA1 to Un1, UA2 to Un2) in a manner similar to the display layer and / or via the data of further peripheral systems (STW A to STW n, UA1 to Un1, UA2 to Un2), similar to the data obtained from the display layer, for the corresponding further treatment are obtainable. Guide system according to claim 1 or 2,
characterized in that
in the union layer (AL) an aggregator (AG) is provided, which is configured the same for all operator stations (AP1 to AP3) and on an operator station computer, which is part of the control center computer system, executable. Control system according to claim 3,
characterized in that
the aggregator (AG) comprises a selection logic, with the specially specifiable data groups and / or from specially specifiable peripheral systems (STW A to STW n, UA1 to Un1, UA2 to Un2) derived data for their preparation at the operator stations (AP1 to AP3) selectable are. Guidance system according to one of claims 1 to 4,
characterized in that
a database of global network data is provided, which exchanges this network data with the merging layer (AL) and / or the working layer (BL). Guidance system according to one of claims 1 to 5,
characterized in that
from the working layer (BL) data connections for the purpose of cross-communication (QK) between network cells (NWZ A to NWZ n) are provided. Guide system according to one of claims 1 to 6,
characterized in that
in the interface layer (IL) a data dispatcher (SM) is provided, which is used to assign the data received from the peripheral systems (STW A to STW n, UA1 to Un1, UA2 to Un2) to different cell molecules (aZM, pZM) within a network cell ( NWZ A) is configurable.

Images