DE102016206988A1 - Server device operating software for controlling a function of a rail-bound transport security system - Google Patents

Abstract

A server device (1; 30) operating software for controlling a function of a rail-mounted transport securing system, wherein the software (11, 12, 13; 31, 32, 33) comprises at least two processes (11a-11b; 12a-12b; 13a-13b 31a-31c, 32a-32c, 33a-33c), the results of which are compared with each other to make the control of the function, is characterized in that the software (11, 12, 13, 31, 32, 33 in that the server device (1; 30) comprises at least two physically separate server clusters (SC1, SC2, SC3), and in that the software (11, 12, 13; , 32, 33) comprises at least two parts installed on different ones of the at least two server clusters (SC1, SC2, SC3) so that the at least two processes (11a-11b; 12a-12b; 13a-13b; 31a-31c; 32a-32c; 33a-33c) on different ones of the at least two Se rvercluster (SC1, SC2, SC3). The invention provides a server device in which an improved availability of a software application can be ensured while at the same time ensuring high reliability of the train service.

Description

The invention relates to a server device operating software for controlling a function of a rail-bound transport securing system,
wherein the software operates at least two processes physically separate from each other, the results of which are compared with each other to perform the control of the function.

Rail-bound transport safety systems, in particular interlockings and train protection systems, are increasingly being automated by computers. A high degree of reliability, availability, maintainability and personal safety are to be ensured (so-called RAMS requirements, Reliability Availability Maintainability Safety). While software errors (programming errors) can usually be detected and eliminated by suitable planning and testing of test scenarios until they are put into operation, hardware faults (in particular the failure of individual components, such as transistors) can in principle occur at any time during operation. Such hardware errors have to be uncovered in good time, so that there is no danger to people (train drivers, passengers) and preferably also from valuable resources (locomotives, wagons) or cargo when using the rail-bound transport safety device.

For security-relevant applications in transport safety systems, a multi-channel processing and checking of safety-relevant components is therefore usually carried out, cf. for example M. Schäfer, F. Schneider, "Standardized user interfaces for path control systems", Signal + Draht (98), 9/2006, p. 50-52 ,

In multichannel processing, several similar processes are physically separated from one another, ie with different hardware, operated in parallel, and the results are compared with one another. If the results match, it can be assumed that the hardware involved works correctly. If there is an error in a participating hardware, the results will diverge, which can be detected by comparing them. The application can then take appropriate security measures, e.g. For example, as a precaution, set signals to "stop".

Software for rail-mounted transport safety systems is usually installed on individual devices where the physical separation of processes can be ensured. For this purpose, the software and the device architecture are suitably coordinated with each other.

In computers with so-called multicore processors, it is possible to obtain a fixed assignment of individual processes to computer resources by means of suitable programming. When programming under Linux, the use of so-called "cgroups" has proven to be useful, cf. the English Wikipedia entry "cgroups" from 31.3.2016. Correspondingly, for processes whose results need to be compared, different processor cores can be assigned (so-called "core binding"), whereby the physical separation of the processes can be ensured.

Virtualization of applications eliminates the need to deploy individual devices in many cases, and simplifies software development and integration. The virtualization of a train control system is for example in the WO 2015/126529 A1 been proposed.

By virtualizing on a server cluster of several single servers, it is also possible to migrate processes to another single server in case of failure of a single server and thus to improve the availability of an application.

When operating a software on a virtualized operating level of a server cluster, however, individual processes operated by the software can no longer be assigned to specific computer resources; In particular, the individual processes are essentially randomly assigned to one of the individual computers. There is then a (statistically relevant) risk that several processes, the results of which are to be compared to each other, run on the same hardware, so that a hardware error of this hardware generates the same false calculations for these multiple processes, and corresponding to the hardware errors no longer Comparison of the results of the processes can be found. In this case, the operational safety in the rail-bound transport safety system is more guaranteed.

Object of the invention

The invention has for its object to provide a server device in which an improved availability of a software application can be guaranteed at the same time high reliability of train traffic.

Brief description of the invention

This object is achieved by a server device of the type mentioned, which is characterized
that the software is operated on a virtual operating level of the server device,
the server device comprises at least two physically separate server clusters,
and that the software comprises at least two parts installed on different ones of the at least two server clusters so that the at least two processes are run on different ones of the at least two server clusters.

The invention makes available for a software application on the one hand the increased availability in server clusters, but on the other hand ensures that processes whose results must be compared to maintain operational reliability physically separate from each other. For this, the server device used to operate the software is set up with at least two server clusters. Each of the server clusters of the server device comprises at least two individual servers that allow each other to migrate processes in the event of a single server failure (high availability cluster). This ensures high availability (operational readiness). On the other hand, the software is split into at least two parts, which are distributed to the at least two server clusters. One part of the software, and thus one of the processes, is permanently assigned to one of the server clusters. This ensures that the processes whose results are compared to each other run on different server clusters and thus on different hardware. This physical separation of processes ensures that a single hardware failure that causes a false result of a process can be detected by comparison with the result of a similar process computed with other (sound) hardware.

The processes whose results are compared with one another can be special test processes that run in addition to the control function of the software application (such as the calculation of check digits / checksums), or even main processes that are themselves used for the control function (such as the calculation of a track pattern). The processes to be compared carry out the same arithmetic operations in the same order to obtain the respective process result (similar processes). Similar process results generally indicate proper functioning of the server device; Unequal process results generally indicate a disorder.

One of the processes whose results are to be compared is, for example, a master process, and a second process a slave process. If the result of the slave process deviates from the previously determined result of the master process, the status of the software application is set to "unsafe" (for example by the software part of the master process and / or the software part of the software) Slave process and / or another software part for the comparison process), and none of the results of the processes becomes more familiar. In the case of an interlocking application, for example, all affected signals can then be set to "stop" as a precautionary measure.

By comparing the results of the processes reliable operation of the server device or the software application and thus also the controlled operation of the rail-bound transport safety system, such as in an electronic interlocking, can be reliably ensured. Since the processes are strictly assigned to the individual server clusters, the physical separation of the check mechanisms is ensured at all times. Physically separated from each other here means a separation of the computing processes with respect to the hardware used.

Virtualization makes it possible to operate the software largely independent of local, available hardware. In particular, it is easily possible to exchange individual components (such as single servers within one of the server clusters).

Preferred embodiments of the invention

In a preferred embodiment of the server device according to the invention, the software is an interlocking application. Due to the inventive architecture of the server device, a high level of security, as is usually required for interlocking applications, can be guaranteed. Also, the high availability is advantageous to avoid or minimize delays in the operation of train traffic.

Particularly preferred is a development in which the software is an application for operating the user interface of a computer-controlled interlocking, in particular with a functionality for connecting mobile control terminals. For example, the software may be a HIS server application (HIS = human machine interface for interlocking systems), in particular with MPT and / or HHT proxy function (MPT = mobile possession terminal). In this application, the server architecture according to the invention has proven particularly useful. As to be compared processes or their results can here calculated track images that are displayed on operator terminals, in particular mobile operator terminals (such as tablet computers). Since the user can temporarily take responsibility for the release of track sections, a high safety standard should be available here, which the invention can offer.

Also preferred is an embodiment in which the software is a train protection application. Due to the architecture of the server device according to the invention, a high level of security, as is usually required for train protection applications, can be ensured. Train protection applications may include, for example, emergency braking systems when driving over "stop" signals.

Also advantageous is an embodiment in which the software is set up according to safety integrity level 2 (SIL2) or higher. This security level SIL2 is sufficient for many applications of rail-based transport security systems, and is easy to achieve with the server architecture according to the invention, while at the same time an increased availability can be made possible. The Safety Integrity Level (SIL) is according to EN 61508 (especially EN 50128 and EN 50129 ) as amended on 4.4.2016. The software may be, for example, a HIS server application.

Particularly advantageous is an embodiment in which the software according to security integrity level 4 (SIL4) is set up. Thus, the software meets the highest security requirements. The security level SIL4 can also be easily achieved with the server architecture according to the invention, whereby at the same time increased availability can be made possible. The Safety Integrity Level (SIL) is according to EN 61508 (especially EN 50128 and EN 50129 ) as amended on 4.4.2016. The software can be, for example, an application of a radio link center (RBC) or an electronic interlocking module, and also an SCM application (SCM = safe communication module) or an FEC application (FEC = field element controller). ,

Also advantageous is an embodiment in which the software operates exactly two processes, physically separated, on exactly two different server clusters. Setting up two server clusters for only two processes to be compared with each other during a respective test procedure is comparatively easy to set up, but considerably increases the security while at the same time ensuring high availability.

An alternative, advantageous embodiment provides that the server device comprises three physically separate server clusters, that the software comprises at least three parts that are installed on different server clusters, so that the software operates three processes on different of the three server clusters, and that the Results of the processes are evaluated in the context of a 2-out-of-3 decision for the control of the function of the rail-bound transport safety system. With the 2-out-of-3 decision it is possible to identify correct process results even if one hardware fails (in this case a fault on one of the server clusters), which further increases the availability.

Also preferred is an embodiment in which the server device operates at least one further software for controlling a further function of a rail-bound transport securing system, and that the at least one further software is installed and operated on only one of the server clusters. The respective additional software is not decomposed into different parts that have to be installed on different server clusters; As a result, the operation of the other software is much easier. The other software is typically set up according to SIL0. Typically, in this embodiment, one or more individual, further software applications are installed and operated on each of the server clusters.

• – Fahrplan-Planungs-System, insbesondere Aramis-D;
• – Zugnummernverwaltungs- und Zuglenkungs-System, insbesondere ARAMIS-C;
• – Daten-Analyse- und Metrik-System (Business Intelligence);
• – Zugwartungs-System (Maintenance Centre);
• – Zugdaten Erfassungs- und Kontroll-System (Checkpoint Master Node);
• – Betriebskomponenten Erfassungs- und Auswertungs-System (Service Management Tool). Diese Anwendungen harmonieren in der Praxis gut mit der auf verscheidene Servercluster aufgeteilten Software, insbesondere wenn diese zum Betrieb einer Benutzeroberfläche eines Stellwerks, etwa mit Anbindung für mobile Endgeräte, ausgebildet ist.

In a preferred development of this embodiment, the at least one further software comprises one or more of the following software applications:

• - schedule planning system, in particular Aramis-D;
• - train number management and routing system, in particular ARAMIS-C;
• - Data analysis and metric system (Business Intelligence);
• - Train maintenance system;
• - train data acquisition and control system (Checkpoint Master Node);
• - Operating components Acquisition and evaluation system (Service Management Tool). In practice, these applications harmonize well with the software divided into various server clusters, in particular if it is designed to operate a user interface of a signal box, for example with a connection for mobile terminals.

Further advantages of the invention will become apparent from the description and the drawings. Likewise, according to the invention, the above-mentioned features and those which are still further developed may be used individually or as one or more of them Combinations use find. The embodiments shown and described are not to be understood as exhaustive enumeration, but rather have exemplary character for the description of the invention.

Detailed description of the invention and drawing

The invention is illustrated in the drawing and will be explained in more detail with reference to embodiments. Show it:

1 a schematic overview of the structure of a first embodiment of a server device according to the invention, with two server clusters;

2 a schematic overview of the structure of a second embodiment of a server device according to the invention, with three server clusters.

Overview of the invention

The present invention is based on the distribution of software control processes of a railbound transport protection system in a virtual operating level to different server clusters. As a result, the processes can be migrated to the individual servers of their server cluster to ensure high availability in the event of individual server outages. The processes are similar and the results of the processes are compared for security purposes. Distributing the processes to different server clusters ensures that processes always run on different single servers, so single hardware failures lead to different process results, which can easily be detected during security audits.

HIS application within the scope of the invention

The invention will be described in more detail below using the example of the architecture of a HIS application, in particular with regard to the process distribution.

The HIS (Human Machine Interface for Interlocking Systems) application is a SIL2 (Safety Integrity Level 2) application, especially developed and approved according to the Standard CENELEC EN 50128 , It has essentially the function as a user interface of an electronic interlocking (ESTW) and can be designed for different markets or applications in different forms to take account of particular peculiarities.

Common to all characteristics is the basic architecture that a master process carries out calculations which ultimately lead to the so-called illumination (= visual representation on a screen) of states of the interlocking elements. These calculations are also performed simultaneously by one or more (depending on the type) slave process (s) and the results of the calculation are cross-checked against each other, i. H. Both the master process and the slave process (s) compare their own calculation results with those of the other. In the case of non-conformity of the calculation results, the overall system is placed in a so-called "non-safe state" which no longer permits certain safety-relevant operator actions.

A special feature of the HIS application is the so-called HIS server, which essentially serves to supply connected operator terminals with the calculated illuminations or states of the interlocking elements.

To meet the requirements of SIL2 from the Standard EN 50128 In accordance with one feature, the HIS architecture must be such that the master process and a slave process run on different (hardware) processors. For multi-core processors, this can be achieved by firmly binding the processes to specific processor cores (core binding, processor affinity). This ensures that a calculation error of a processor (or a processor core) can never lead to the same, incorrect result in master and slave processes (simultaneous double errors are excluded from the standard).

By porting the server applications to a common virtual platform, it can no longer be guaranteed that the master and slave processes are not running the same processor miscalculation because of the virtual processor to physical processor mapping (-Kern) not so readily given and can be proved.

The inventors have recognized that from server computers (single servers) several so-called server clusters can be formed which offer the advantages of a virtual operating level (high availability, redundancy) and at the same time guarantee a physical separation of processes. With two server clusters each consisting of at least two server computers, the master process can run on one server cluster and the slave process on the other server cluster. Although it can not be predicted which processor (core) in the server cluster is currently being used by a process but it can be ruled out that the processes on the different server clusters will ever use the same processor (kernel).

As a result, the realization of the above-described feature of the HIS architecture can also be realized when using the HIS application on a virtual operating level.

Embodiment of a server device with two server clusters

In 1 is a first embodiment of a server device according to the invention 1 with two server clusters SC1, SC2. The server device 1 is also referred to as a virtual cluster.

To the server device 1 Here include a first server cluster SC1 and a second server cluster SC2, which are spatially separated from each other, which in 1 through a physical limit 2 is illustrated. By "spatially separated" is meant that the server computers (SVR) of the two server clusters SC1, SC2 do not consist of the same hardware but are separate computers. Thus, the spatial separation can be carried out both by setting up the server cluster SC1, SC2 in the same rack in a server room or in different rack frames in the same or different server rooms, as well as at different locations several kilometers away. The limiting factor for the maximum distance between server clusters SC1, SC2 is the speed and latency of the intervening network to synchronize server clusters SC1, SC2. Network connections are in 1 represented by simple connecting lines.

In the first server cluster SC1, at least two server computers (single server) SRV-1-1, SVR-1-2 are clustered. In the second server cluster SC2, at least two server computers (single server) SVR-2-1, SVR-2-2 are also combined into a cluster.

• • HIS-Master 11a (Prozess der HIS Applikation)
• • HIS-Slave 11b (Prozess der HIS Applikation)
• • Stellwerks-Steuerung Prozess-1 12a (Prozess der Stellwerks-Steuerung Applikation) (Interlocking-Control Process-1 = IL-Ctrl Proc-1)
• • Stellwerks-Steuerung Prozess-2 12b (Prozess der Stellwerks-Steuerung Applikation) (Interlocking-Control Process-2 = IL-Ctrl Proc-2)
• • Zugsicherungs-Steuerung Prozess-1 13a (Prozess der Zugsicherungs-Steuerung Applikation) (Train Control-Control Process-1 = TC-Ctrl Proc-1)
• • Zugsicherungs-Steuerung Prozess-2 13b (Prozess der Zugsicherungs-Steuerung Applikation) (Train Control-Control Process-2 = TC-Ctrl Proc-2)
• • Bedienoberfläche A 14 (Human Machine Interface A = HMI A)
• • Anwendung B 15 (Application B = App B)
• • Bedienoberfläche C 16 (Human Machine Interface C = HMI C)
• • Anwendung D 17 (Application D = App D).

In a server cluster SC1, SC2 run various virtual machines VM, in turn, run the most different applications or their processes. This can be applications whose processes are distributed to the individual server clusters, but only their interaction gives a common functionality, as well as applications that run individually on a server cluster and independent of the other processes and applications provide functionality. Examples of applications and processes of the virtual machines VM are:

• • HIS master 11a (Process of HIS application)
• • HIS slave 11b (Process of HIS application)
• • interlocking control process-1 12a (Process of interlocking control application) (Interlocking-Control Process-1 = IL-Ctrl Proc-1)
• • interlocking control process-2 12b (Process of the interlocking control application) (Interlocking-Control Process-2 = IL-Ctrl Proc-2)
• • Train Control Process-1 13a (Process of train control application) (Train Control-Control Process-1 = TC-Ctrl Proc-1)
• • Train Control Process-2 13b (Process of train control application) (Train Control-Control Process-2 = TC-Ctrl Proc-2)
• • User interface A 14 (Human Machine Interface A = HMI A)
• • Application B 15 (Application B = App B)
• • User interface C 16 (Human Machine Interface C = HMI C)
• • Application D 17 (Application D = App D).

The server device 1 has a common cluster control (cluster control) 18 and a shared storage control (Storage Control) 19 for both server clusters SC1, SC2. Each server cluster SC1, SC2 has its own high availability control (high availability = HA control) 20a . 20b with which the processes of the applications between the individual computers SRV-1-1, SRV-1-2 or SRV-2-1, SRV-2-2 can be moved within the respective server cluster SC1 or SC2, in particular if in a single computer a defect should occur. Furthermore, each server cluster SC1, SC2 each has its own memory (Storage Vol1, Storage Vol2) 21a . 21b which can be used by the individual servers of the respective cluster SC1, SC2.

In the embodiment shown, the HIS server software 11 divided into two parts: The HIS master process 11a is implemented on the first server cluster SC1 and the (to the HIS master process 11a similar) HIS slave process 11b is implemented on the second server cluster SC2. The HIS master process 11a Therefore, it will always run on one of the single servers SRV-1-1 or SRV-1-2 of the first server cluster SC1, but not on the single servers of the second server cluster SC2. Conversely, the HIS slave process 11b always run on one of the individual server SRV-2-1 or SRV-2-2 of the second server cluster SC2, but not on the individual servers of the first server cluster SC1. This ensures that the HIS master process 11a and the HIS slave process 11b always physically separated from each other. If the process results match, the matching process result can be trusted.

Likewise here are the similar processes 12a and 12b the interlocking control software 12 physically separated from each other, and the gel-like processes 13a and 13b the train control software 13 are physically separated from each other; in the case of matching process results, the matching process result can again be trusted in each case. The other software applications 14 . 15 . 16 . 17 or their processes are in each case without a similar counterpart in the other server cluster SC1, SC2, so are only each simply run on one of the server cluster SC1, SC2. This is intended primarily for non-safety applications.

Embodiment with three server clusters

In 2 is an embodiment of a server device according to the invention (Virtual Cluster) 30 which has three server clusters SC1, SC2, SC3. The structure of the server device 30 with three server clusters SC1, SC2, SC3 is similar in design to two server clusters of 1 , so that only the essential differences are explained below.

On the server device 30 With three server clusters SC1, SC2, SC3, applications can run that follow the so-called 2aus3 principle (2 out of 3 = 2oo3). In these applications, three similar processes carry out the same computation algorithms, each resulting in a computational result. These results are compared by a comparator. If at least two of the three computational results match, this matching result is considered correct. If the comparator detects three different results, the system is marked as "not safe". For example, the interlocking application or the train protection application work according to this principle.

A criterion for approval under the Standard EN 50128 For the 2oo3 systems, the individual processes run on different hardware. This can be done by the server device according to the invention 30 (Virtual Cluster), based on three physical boundaries 2 separated server clusters SC1, SC2, SC3. Embedded in each virtual machine VM, for example, the processes of the interlocking application run distributed on the three server clusters and thus never use the same processors or processor cores. With 2oo3 systems, the safety standard according to SIL4 can also be achieved.

• • Bedien Prozess-1 31a (Prozess der Bedienoberfläche) (Operation Control Process-1 = OC Proc-1)
• • Bedien Prozess-2 31b (Prozess der Bedienoberfläche) (Operation Control Process-2 = OC Proc-2)
• • Bedien Prozess-3 31c (Prozess der Bedienoberfläche) (Operation Control Process-3 = OC Proc-3)
• • Stellwerks Prozess-1 32a (Prozess der Stellwerks Applikation) (Interlocking Process-1 = IL Proc-1)
• • Stellwerks Prozess-2 32b (Prozess der Stellwerks Applikation) (Interlocking Process-2 = IL Proc-2)
• • Stellwerks Prozess-3 32c (Prozess der Stellwerks Applikation) (Interlocking Process-3 = IL Proc-3)
• • Zugsicherungs Prozess-1 33a (Prozess der Zugsicherungs Applikation) (Train Control Process-1 = TC Proc-1)
• • Zugsicherungs Prozess-2 33b (Prozess der Zugsicherungs Applikation) (Train Control Process-2 = TC Proc-2)
• • Zugsicherungs Prozess-3 33c (Prozess der Zugsicherungs Applikation) (Train Control Process-3 = TC Proc-3)

Typical applications of 2oo3 systems or their processes are:

• • Operation process 1 31a (Operator Interface Process) (Operation Control Process-1 = OC Proc-1)
• • Operation Process 2 31b (Operator Interface Process) (Operation Control Process-2 = OC Proc-2)
• • Operation Process 3 31c (Process of the user interface) (Operation Control Process-3 = OC Proc-3)
• • interlocking process-1 32a (Process of the interlocking application) (Interlocking Process-1 = IL Proc-1)
• • interlocking process-2 32b (Process of the interlocking application) (Interlocking Process-2 = IL Proc-2)
• • interlocking process-3 32c (Process of the interlocking application) (Interlocking Process-3 = IL Proc-3)
• • train protection process-1 33a (Process of Train Control Application) (Train Control Process-1 = TC Proc-1)
• • train protection process-2 33b (Process of train protection application) (Train Control Process-2 = TC Proc-2)
• • Train Control Process-3 33c (Process of train protection application) (Train Control Process-3 = TC Proc-3)

Here are the similar processes 31a . 31b . 31c or associated parts of the operating software 31 distributed to the three server clusters SC1, SC2, SC3, so that the processes 31a . 31b . 31c never run on the same processor or hardware, and thus their process results can not be equally wrong by a single hardware failure. The same applies to the processes 32a . 32b . 32c the interlocking software 32 and continue the processes 33a . 33b . 33c the train protection software 33 , Also in a virtual cluster or a server setup 30 With three server clusters SC1, SC2, SC3, further, individual applications or other processes can run, which are independent of the 2oo3 systems, in this case the further software applications HMI A. 34 , App B 35 , HMI C 36 , App D 37 , HMI E 38 , App F 39 ,

LIST OF REFERENCE NUMBERS

1

server facility

2

physical limit

11a, 11b

similar processes

11

Software (HIS server)

12a, 12b

similar processes

12

Software (interlocking control)

13a, 13b

similar processes

13

Software (train control)

14-17

further software

18

Cluster Control

19

Memory control

20a-20c

High-availability control

21a-21c

Storage

30

server facility

31a-31c

similar processes

31

Software (operation)

32a-32c

similar processes

32

Software (signal box)

33a-33c

similar processes

33

Software (train protection)

34-39

further software

SC1-SC3

server cluster

SRV 1-1

Server computer (single server)

SRV 1-2

Server computer (single server)

SRV 2-1

Server computer (single server)

SRV 2-2

Server computer (single server)

SRV 3-1

Server computer (single server)

SRV 3-2

Server computer (single server)

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• WO 2015/126529 A1 [0007]

Cited non-patent literature

• M. Schäfer, F. Schneider, "Standardized user interfaces for path control systems", Signal + Draht (98), 9/2006, pp. 50-52 [0003]
• EN 61508 [0020]
• EN 50128 [0020]
• EN 50129 [0020]
• EN 61508 [0021]
• EN 50128 [0021]
• EN 50129 [0021]
• Standard CENELEC EN 50128 [0032]
• Standard EN 50128 [0035]
• Standard EN 50128 [0048]

Claims (10)

Server device ( 1 ; 30 ) operating software for controlling a function of a rail transport safety system, the software ( 11 . 12 . 13 ; 31 . 32 . 33 ) at least two processes ( 11a - 11b ; 12a - 12b ; 13a - 13b ; 31a - 31c ; 32a - 32c ; 33a - 33c ) are physically separated from each other, the results of which are compared with one another in order to carry out the control of the function, characterized in that the software ( 11 . 12 . 13 ; 31 . 32 . 33 ) on a virtual operating level of the server device ( 1 ; 30 ), that the server device ( 1 ; 30 ) comprises at least two physically separate server clusters (SC1, SC2, SC3) and that the software ( 11 . 12 . 13 ; 31 . 32 . 33 ) comprises at least two parts installed on different ones of the at least two server clusters (SC1, SC2, SC3) so that the at least two processes ( 11a - 11b ; 12a - 12b ; 13a - 13b ; 31a - 31c ; 32a - 32c ; 33a - 33c ) are operated on different ones of the at least two server clusters (SC1, SC2, SC3). Server device ( 1 ; 30 ) according to claim 1, characterized in that the software ( 11 . 12 . 13 ; 31 . 32 . 33 ) is an interlocking application. Server device ( 1 ; 30 ) according to claim 2, characterized in that the software ( 11 . 12 . 13 ; 31 . 32 . 33 ) is an application for operating the user interface of a computer-controlled interlocking, in particular with a functionality for connecting mobile control terminals. Server device ( 1 ; 30 ) according to claim 1, characterized in that the software ( 11 . 12 . 13 ; 31 . 32 . 33 ) is a train protection application. Server device ( 1 ; 30 ) according to one of the preceding claims, characterized in that the software ( 11 . 12 . 13 ; 31 . 32 . 33 ) is set to Safety Integrity Level 2 (SIL2) or higher. Server device ( 1 ; 30 ) according to one of the preceding claims, characterized in that the software ( 11 . 12 . 13 ; 31 . 32 . 33 ) is set to Security Integrity Level 4 (SIL4). Server device ( 1 ; 30 ) according to one of claims 1 to 6, characterized in that the software ( 11 . 12 . 13 ) exactly two processes ( 11a - 11b ; 12a - 12b ; 13a - 13b ), physically separated from each other, operates on exactly two different server clusters (SC1, SC2). Server device ( 1 ; 30 ) According to one of claims 1 to 7, characterized in that the server means ( 30 ) comprises three physically separate server clusters (SC1, SC2, SC3) that the software ( 31 . 32 . 33 ) comprises at least three parts installed on different ones of the server clusters (SC1, SC2, SC3) so that the software ( 31 . 32 . 33 ) three processes ( 31a - 31c ; 32a - 32c ; 33a - 33c ) on different of the three server clusters (SC1, SC2, SC3) and that the results of the processes ( 31a - 31c ; 32a - 32c ; 33a - 33c ) are evaluated as part of a 2-out-of-3 decision to control the function of the rail-based transport safety system. Server device ( 1 ; 30 ) according to one of the preceding claims, characterized in that the server device ( 1 ; 30 ) at least one additional software ( 14 - 17 ; 34 - 39 ) for controlling a further function of a rail-bound transport securing system, and that the at least one further software ( 14 - 17 ; 34 - 39 ) is installed and operated on only one server cluster (SC1, SC2, SC3). Server device ( 1 ; 30 ) according to claim 9, characterized in that the at least one further software ( 14 - 17 ; 34 - 39 ) comprises one or more of the following software applications: - schedule planning system, in particular Aramis-D; - train number management and routing system, in particular ARAMIS-C - data analysis and metric system (Business Intelligence); - Train maintenance system; - train data acquisition and control system (Checkpoint Master Node); - Operating components Acquisition and evaluation system (Service Management Tool).

Images