DE102023101842A1 - Traffic tunnel control system with modular PLC program - Google Patents

Abstract

The invention relates to a traffic tunnel control system (100) for a traffic tunnel (124), the traffic tunnel control system comprising:- a programmable logic controller (101); and- a plurality of automation devices (126-138),wherein the programmable logic controller is configured to capture an input image and to generate an output image by executing a program (120),wherein the program consists of a sequence of program modules,wherein at least a first of the program modules is assigned to an address range of an intermediate result memory (114) in order to store an intermediate result there, andwherein at least a second of the program modules is assigned to the same address range in order to further process the intermediate result from there in the same cycle.

Description

Technical area

The present presentations concern the control of traffic tunnels such as road or railway tunnels or ship tunnels as well as corresponding automation systems.

State of the art

Traffic tunnels are equipped with a variety of sensors and other equipment to ensure that operations are as safe and reliable as possible. Various control methods are used to enable precise orchestration of the equipment contained in a tunnel. For example, road tunnels with their diverse safety equipment can be monitored, operated and controlled using automation technology.

The tunnel control programs are usually created individually for each tunnel. This can easily lead to errors that are difficult to detect, since, given the large number of sensors and actuators in a tunnel, it is hardly possible to test all conceivable state combinations and possible boundary conditions before the control software is actually used. This can represent a safety risk, since the extremely limited testing options compared to the combinatorially possible case constellations mean that risky situations and dangers for tunnel users can never be completely ruled out.

Technical problem and basic solutions

Against this background, there is a need for improved systems for controlling traffic tunnels.

The objects underlying the invention are each achieved with the features of the independent patent claims. Embodiments of the invention are specified in the dependent claims. The embodiments and examples listed below can be freely combined with one another, provided they do not exclude one another.

In one aspect, the invention relates to a traffic tunnel control system for a traffic tunnel. The tunnel can be designed in particular as a road or rail tunnel or ship tunnel. The traffic tunnel control system comprises a programmable logic controller (PLC) and several automation devices that are coupled to the programmable logic controller via a field bus or a network.

The programmable logic controller is configured to capture an input image from the automation devices, to process the input image and to generate an output image by executing a program and to output the output image for controlling the automation devices. The capture of the input image, the execution of the program and the output of the output image are repeated cyclically. The program consists of a sequence of program modules, with at least a first of the program modules being assigned to an address range of an intermediate result memory in order to store an intermediate result there. At least a second of the program modules is assigned to the same address range of the intermediate result memory in order to read and further process the intermediate result from there. The storage of the intermediate result by the first program module and the reading and further processing of the intermediate result by the second program module take place in the same cycle.

The use of an intermediate result memory can be advantageous because it enables data exchange between different program modules of the program (hereinafter also referred to as the "PLC program") within the same PLC cycle. By storing some parameter values (such as the temperature measured by a specific temperature sensor, the wind speed in a specific section of the tunnel, the current speed of a specific fan, etc.) in a predetermined address range of an intermediate result memory so that one or more other program modules can access these parameter values and, if necessary, process them further during the cycle in which they are recorded, a data exchange interface is created between different program modules that functions independently of the field bus or network. An interface is therefore provided for storing and exchanging intermediate results by or between different modules of the PLC program within the same PLC cycle, bypassing the field bus or network. This can speed up program execution because it is no longer necessary for each program module to read an input value from the input image and prepare it for further processing in the next cycle. Instead, all program modules can access a buffered, preprocessed and validated input value, possibly in the same cycle.

At least some of the data values calculated by the individual program modules are stored in the data memory not as part of the output image, but as an intermediate result in the address range of the intermediate result memory stored for this purpose in the respective program module. PLC program modules that are later executed within the same cycle then calculate part of the output image from one or more of these intermediate results, possibly taking into account other data such as raw data in particular. The program modules can, for example, contain an assignment configuration that specifies from which intermediate result memory address range the parameter values belonging to a specific parameter can be read or where the parameter-related results generated by the module must be stored in the intermediate result memory.

The writing and reading of the data stored in the address areas of the intermediate result memory by the program modules preferably takes place without using or bypassing the field bus or network. This can reduce the load on the field bus or network, since the required data does not have to be read via the bus or network for each calculation step. This can be advantageous for the real-time capability of the control system.

The use of a program for tunnel control can be advantageous because programs can ensure that in the event of certain specified events, e.g. a fire, specified reactions are carried out automatically and reliably (even in the event of possible malfunctions or partial failures). PLC programs are characterized by a high safety standard, very short cycle times for program execution (typically max. 100 ms) and a very high level of reliability.

In addition, programmable logic controllers or PLC programs according to embodiments of the invention can, due to their cyclical and - within a cycle preferably loop-free - nature, ensure that the program cannot get lost in an endless loop or become blocked in the program flow for other reasons.

The applicant has observed that programming can be complex, demanding and very error-prone, particularly for larger systems - such as a fully equipped road tunnel. Due to the large number of combinable device types, device arrangements, configurable processes and possible boundary conditions during operation, testing a control program for traffic tunnels is very time-consuming and can never offer 100% certainty that the program is error-free. Tunnels sometimes differ considerably in terms of their device equipment, which is partly due to the different local conditions (length, wind and light conditions, width, type of traffic route), partly to the year of construction, partly to the operator's choice of components and partly to the applicable building regulations. Traffic tunnels are therefore usually unique in technical terms, for which individually tailored control software had to be programmed. Practically every newly created software contains errors that are often not immediately recognizable but must first be discovered and corrected using complex simulation and testing procedures. However, due to the complexity of the possibilities of interaction between the various devices and possible framework conditions, it is not possible to fully play through all possible case scenarios. Complex programs are also often difficult to understand and analyze retrospectively. Once the software reaches a certain level of complexity, it is not possible to take all theoretically possible case constellations and boundary conditions into account and development is complex.

Developers therefore often copy existing source code from a control program and manually adapt the source code in many places to a new tunnel (“copy and paste” approach). This means that a conventional control program for a new tunnel project contains program parts that are not used, for example, but can still have a negative influence on other program parts under certain conditions. The “copy and paste” approach can also lead to incorrect designations or assignments of technical facilities and devices that only become apparent during a complete data point test, which can often only be carried out superficially due to the high level of effort involved. All of these problems can be avoided or at least reduced by using a program that consists of a series of predefined program modules, preferably provided in the form of a predefined library. Copy-paste errors are thus prevented and development time, including testing time, is significantly reduced.

In addition, the modular structure of the program can significantly increase the operational reliability of the tunnel. Since the program is based on program modules that exchange data via predefined address ranges, the program modules can be selected from a library and strung together according to the modular principle in order to adapt the program specifically to the devices present in a tunnel. without having to write a new program specifically for the respective tunnel. Individual program modules or highly interoperable program module groups can be intensively tested and, after a corresponding period of operation over years, have proven to be safe in several traffic route tunnel control systems. The modular structure therefore allows the use of individual program modules that have already been used successfully (possibly over a long period of time, e.g. years) in other programs for other tunnel control systems. A program according to embodiments of the invention can therefore enable particularly safe tunnel operation.

The effort required for software testing can also be significantly reduced by the fact that when creating the program for a specific tunnel, it is possible to use program modules that have already been intensively tested and do not have to be tested again in every detail. In addition, error-prone individual programming is no longer necessary. The reduced testing effort shortens the commissioning time of traffic tunnels.

The use of address areas of an intermediate result memory to exchange predefined data, e.g. device-related and/or parameter-related data, can also make troubleshooting and testing easier, because the processing steps of the PLC program refer to predefined address areas of a data memory when it comes to reading and writing data. The program modules therefore preferably do not exchange data directly via method-based module-to-module interfaces, but rather via the memory areas external to the program module, so that dependencies between the modules are reduced. This makes it possible to use the advantages of object-oriented programming in the context of a tunnel control without reducing the freedom to combine the modules through method-based module-to-module interfaces for data exchange.

In a further advantageous aspect of embodiments of the invention, the latency time of the controller is reduced when (disturbance) events occur, because the program with all its program modules is already in the controller's working memory when the event occurs. Loading a program or program module in response to a disturbance event is therefore not necessary.

According to embodiments, the program is free of program loops within a PLC cycle.

The program can therefore be configured to run linearly (no loops) without interruption. The PLC program can be a non-interruptible program.

This can be advantageous because it prevents the controller from becoming overloaded or causing "locks" or delays in program execution. The program cannot get lost in an endless loop or be blocked for other reasons. This can make it possible to implement the controller as a real-time capable controller.

According to embodiments, the assignment of the first, second and preferably further program modules to address areas of the intermediate result memory is based on an assignment configuration contained in the respective program modules. An assignment configuration assigns one or more parameters to the program module comprising it. The parameters can include device-specific parameters. In addition, it assigns each of these parameters an address area of the intermediate result memory that is intended for storing at least one parameter value corresponding to the parameter. The assignment configuration enables at least some of the program modules to store a parameter value related to a specific parameter as an intermediate result during the execution of a cycle, so that it can be read from this address area by another program module in the same cycle.

For example, a parameter can refer to the combination of a specific device and a specific physical or chemical parameter such as temperature, air velocity, on/off state of a device, etc. The parameter can therefore refer to a measurement parameter recorded by a specific device or to a state parameter specifying the state of a device.

According to one implementation variant, the assignment configuration is specified as part of the source code of a program module. According to another implementation variant, the assignment configuration is implemented in the form of metadata that is delivered (deployed) together with the compiled source code of the program module, but is not itself compiled as part of the source code. This variant has the advantage that the assignment configuration of a program module that has already been compiled can be changed without the source code having to be recompiled for the changes to take effect.

This means that a program module can be made usable for another tunnel very easily by only adapting the assignment configuration to the new tunnel, but not the source code or other source code of the program module. The assignment configuration can therefore specify for which of a large number of fans (or other devices) used in the new tunnel this program module is used, for example to normalize the currently measured speed of the fan, and in which memory area of the intermediate result memory of the control of this new tunnel the normalized speed is to be stored.

For example, an assignment configuration can be created or modified by a user opening a specific program module in a program editor and making a change to the assignment configuration and/or a change to the source code via the editor.

Typically, the parameter address range assignments of the assignment configurations of several program modules overlap at least partially, which means that two or more modules assign a specific memory area B to a specific parameter P in their assignment configuration. The shared knowledge of the assignment P→B enables several program modules to exchange data with each other, in particular intermediate results or preprocessed raw data regarding the parameter P.

By arranging the individual program modules sequentially, the flow and distribution of information between the program modules is determined when the program is created.

According to embodiments of the invention, the PLC program is configured to generate, store, re-read and further process intermediate results in a defined manner within a PLC cycle, even multiple times in sequence, and thus to carry out significantly more data processing steps per cycle than is possible with conventional, PLC-based controls.

According to embodiments, the assignment configuration of one or more of the program modules includes an assignment of one of a plurality of predefined data types to at least one of the address ranges of the intermediate result memory. At least some of the program modules are each configured to check, when reading a parameter value from an address range of the intermediate result memory, whether the data type of the read data value is identical to the data type assigned to this address range according to the assignment configuration of this program module. If these program modules determine that the data types are not identical, they store the result of the non-identity in another address range of the intermediate result memory.

This can have the advantage that the use of unauthorized, possibly untrustworthy program modules and/or program errors can be detected. For example, debugging software can read the aforementioned areas of the intermediate result memory to determine whether, during the data type check during normal program execution in tunnel control, one or more program modules have noticed a deviation from the expected data type specified in the configuration of these program modules and have saved this result. A data type deviation can, for example, result from the fact that the operator of a tunnel has used an unauthorized program module that the operator has developed themselves, for example, or obtained from a device manufacturer. Such unauthorized program modules can contain errors that can lead to parameter values being saved in address areas in which values of other parameters should actually be saved (e.g. saving a temperature value in a memory area reserved for the fan speed).

It is also possible that when adjusting the assignment configuration of a program module for the purpose of using the module in a new tunnel control for a new tunnel, a reference to an address range was inadvertently not adjusted or was adjusted incorrectly, with the result that parameter values are stored in address ranges in which a different parameter value should actually be stored. Another possible consequence is that, due to an incorrect assignment configuration, a program module reads a parameter value from an address range in which values of a different parameter are actually stored. Such errors are often very difficult to detect and can lead to unforeseen errors in certain constellations. However, due to the data type check carried out by the program modules themselves, such errors can be detected, which increases the security of the tunnel control.

According to embodiments, the control system is implemented on the basis of a CPU module for program-based controls, in which a data memory comprising the intermediate result memory is embedded. For example, a Siemens Simatic module can be used. The control functions are stored as a program in a memory of the CPU module, whereby this memory contains not only a program memory for the PLC program but also a data memory for the predefined address ranges of the intermediate result memory and the data to be stored therein.

The module's data memory can, for example, contain a memory area used as the intermediate result memory, which contains, for example, measured values (raw data) and intermediate results. The data memory can optionally also contain memory areas for the input image, for the output image, possibly further memory areas for test purposes or for a test input image and test output image generated in test mode, etc.

For example, the module can be a Simatic module from Siemens and the PLC program can have been programmed using the STEP 7 programming software or software from other manufacturers.

Preferably, modules are used that are robust against electromagnetic interference (in accordance with the requirements of the EMC Directive) and climatic stress (e.g. from -20 to +60 °C ambient temperature during operation) and that can be expanded. The Simatic S7 controllers and their STEP 7 programming software are examples of such modules.

According to embodiments, in addition to the sensor and/or status data, control commands for specific devices are also stored in a predefined address range of the intermediate result memory assigned to a specific device and a specific device parameter.

According to embodiments, the data memory containing the intermediate result memory includes a further memory area for the input image and/or a further memory area for the output image.

At the end of a cycle, a complete, current output image is available, which can be used to control the automation devices. Since the program preferably does not contain any loops, it is ensured that the program has completed all calculations to provide the output image, including the calculation of any intermediate results required, within a defined cycle time. This ensures that the control system can react reliably and very quickly to various situations, especially safety-critical ones.

According to embodiments, both the writing and the reading and processing of intermediate results can take place within the execution of a single PLC cycle. This has the advantage that the control is significantly accelerated and can therefore react more quickly to various events. The system can react to a fault with a very low latency, because it is now possible to provide one or more intermediate processing steps within a cycle, e.g. for the purpose of data aggregation or plausibility checks. Sub-problems can thus be pre-calculated and solved during the execution of a single cycle and the results can be made available to the functions of the program or a control software, e.g. a control center control software, that are executed later in the cycle.

According to embodiments, the controller is configured to store the entire program with all program modules in a working memory of the controller. At least one of the program modules of the program is configured to read and process a value of a parameter from an address range of the intermediate result memory assigned to this parameter in order to detect the presence of an event in the tunnel or in one of the automation devices. The at least one program module is configured to generate a result which indicates the presence of this event and/or which serves to adapt the control of the traffic route tunnel in response to this event.

This can make it possible to reduce latency times until a fault is responded to, as the PLC program is already running and loaded in the controller's memory when the fault occurs, so that the controller can respond immediately. It is therefore not necessary for the control center to actively intervene or for additional programs to be loaded and initialized.

• - eine Rauchentwicklung,
• - ein Brand,
• - eine Überschreitung eines festgelegten Kohlenmonoxidgrenzwerts,
• - ein Stau,
• - ein Falschfahrer,
• - ein stehendes Fahrzeug in einer Pannenbucht,
• - ein Hindernis oder Gegenstände auf der Fahrbahn,
• - eine Person im Verkehrswegetunnel,
• - das Öffnen einer Notrufnischentür,
• - ein Verkehrsunfall-Notruf,
• - das Betätigen eines Tasters für behinderte Personen,
• - die Entnahme eines Feuerlöscher,
• - das Öffnen einer Fluchttür,
• - ein Ausfall oder eine Störung eines der Geräte im Verkehrswegetunnel,
• - ein Ausfall eines Übertragungsweges zur ständig besetzten Stelle,
• - ein Energieausfall im Verkehrswegetunnel.

The event in question can be one of the following events:

• - smoke development,
• - a fire,
• - exceedance of a specified carbon monoxide limit value,
• - traffic jam,
• - a wrong-way driver,
• - a stationary vehicle in a breakdown bay,
• - an obstacle or objects on the road,
• - a person in the traffic tunnel,
• - opening an emergency call niche door,
• - a traffic accident emergency call,
• - pressing a button for disabled persons,
• - the removal of a fire extinguisher,
• - opening an escape door,
• - a failure or malfunction of one of the devices in the traffic tunnel,
• - a failure of a transmission path to the permanently manned location,
• - a power failure in the traffic tunnel.

For example, the calculated result can be a specification of the type, location and/or severity of the event, e.g. a quantification of the size or extent of a fire, the length of a traffic jam, the type or degree of malfunction of a device, etc.

According to further examples, the calculated result may include a control signal configured to place one or more of the devices in an operating mode suitable for limiting and/or mitigating the severity of the event or its consequences. For example, closing fire doors and/or automatically opening escape doors may reduce the risk of personal injury in the event of a fire. Stopping fans near a fire may prevent or reduce air turbulence and the risk of further spread of the fire. The signal may, for example, be stored as an intermediate value or part of the output image in an address range of the data storage assigned to this signal and/or provided to the control center control software.

Depending on the embodiment, the multiple program modules can be compiled and deployed individually. Preferably, this can also be done while the tunnel is running.

For example, it is possible to individually define, compile and deploy program modules using the AWL programming language. AWL is a Step7 programming language in which individual instructions are written in the order in which the CPU should then process them. The AWL programming language is part of the basic SIMATIC Step7 software. Program modules can be edited in AWL using incremental editors. AWL sources can be created and translated into program modules using a source-oriented editor. The LAD and FBD programming languages can also be used, but AWL is preferable because no additional translation step is required.

The individual compilability of program modules can be advantageous because it makes it possible to specifically change individual aspects of a program without affecting the functionality of the other program modules.

For example, a tunnel may already contain 10 fans of a certain type and the control software may have 10 corresponding program modules for processing status data from the respective fans. If an eleventh fan of the same type is now added to the tunnel, the PLC program may only need to be expanded to include another and slightly reconfigured instance of this program module, and recompiling the other program modules is not necessary.

According to embodiments of the invention, the traffic route tunnel control system comprises a system control level control software for visualizing and/or controlling the program flow of the program.

According to embodiments, one or more of the program modules comprise an interface to a plant management level control software in the form of predefined address areas of the intermediate result memory known to the plant management level control software. The program modules of the PLC program are configured to transmit a parameter value calculated by one of the program modules to the plant management level control software via the interface and/or to receive a control command from the plant management level control software.

This can be advantageous because at least some of the program modules also "know" the address ranges required for data exchange with a system control level control software, so that the connection to the control level does not have to be reprogrammed for each tunnel. Rather, the data exchange with the control level is also modular and can be tested individually for each program module once during program module development, so that the risk of errors in the control software can be significantly reduced with regard to this data exchange.

For example, the interfaces between individual program modules and the plant management level control software can be based on standardized data types that are specifically defined for this interface (e.g. Float, Int, String, Boolean, etc.).

According to embodiments, the plant control level control software comprises several program modules. At least some of the program modules of the plant control level control software correspond functionally to one of the program modules of the PLC program of the tunnel control (“PLC program module”). The correspondence means that the program module of the plant control level control software is configured to graphically represent device-related parameter values that are processed by the PLC program module corresponding to this module and to output them on a display. The sequence and/or nature of the device-related parameter values displayed by the plant control level control software thus depends on the sequence and type of the PLC program modules.

For example, the program modules of the plant management level control software can be display modules that are configured to graphically represent the data received from the corresponding program module (e.g. measured values that provide information about the condition or status of a device and/or the tunnel) in a defined manner (e.g. using symbols, measured values, messages, etc.) and to output the graphic representations on a display. The graphic representations can be, for example, symbols, colors, warning messages, text, selection menus or control panels for generating control commands to program modules or the like.

This can have the advantage that the system control level control software does not have to be adapted for each tunnel for the purpose of visualizing the tunnel status, but rather dynamically activates those program modules or display modules that are already in use for a known PLC program module of another tunnel on the control center side. For example, a large number of programs can be used to control a large number of different tunnels, with the programs all being based on program modules from the same library. Each program module in this library, provided it exchanges data with the control software, corresponds to a program module in the control software. When the control software is executed, all control software program modules that have a corresponding PLC program module in the library can already be instantiated, so that the control center can be used seamlessly during operation to visualize additional, newly constructed tunnels, provided the program used to control the tunnel is a program based on the program library in question. This also significantly increases the flexibility of the tunnel control and the integration of new tunnels and corresponding control software.

According to some embodiments, the plant control level control software also comprises predefined program modules that are configured to send control commands (which are generated by the plant control level control software or entered or triggered by a human operator in the plant control level control software) to a PLC program module that is functionally complementary to this program module. For example, via a fan control module of the plant control level control software that is assigned to a specific tunnel T1, a command to switch this fan on or off can be sent to the data exchange interface of the PLC program module responsible for this fan.

According to embodiments, the program modules of the PLC program are configured to exchange data with each other via predefined address ranges of the intermediate result memory. The data exchange interface can therefore consist of a predefined address range, for example.

According to some embodiments, the plant management level control software is configured to read parameter values of one or more parameters indicating the status of the tunnel from predefined address ranges of the intermediate result memory and/or the memory containing the output image.

Additionally or alternatively, the plant management level control software is configured to write control commands for controlling one or more of the automation devices into predefined address ranges of the intermediate result memory and/or the memory containing the input image.

The plant level control software can be implemented on a standard computer system, for example. Preferably, however, the plant level control software is part of a SCADA system (Supervisory Control and Data Acquisition). Such systems are used in the area of industrial control systems (ICS) to monitor and control technical processes. The architecture of automation is divided into several levels according to the automation pyramid. Level 1 is the process-related layer with sensors and actuators. The 2nd level is used for control, in particular for optimizing the function of level 1 automation and for issuing control signals. sizes and target values. The program(s) for controlling the corresponding traffic tunnels can be part of the second level, for example. The control software can be located on the third level, the process control level for monitoring and controlling the processes. By evaluating the operational data acquisition (BDE) or machine data acquisition (MDE), it is determined whether values exceed a certain threshold. If this happens, the control software sounds an alarm to give users the opportunity to solve the problem through inspection, maintenance, repairs or replanning. The fourth level represents the operational control level. The communication between the control software and the program(s) takes place, for example, on the basis of TCP-based Internet technology.

According to embodiments, at least some of the program modules of the program are device program modules. A device program module is a program module that is assigned to at least one of the automation devices and is configured to process one or more parameters related to this at least one automation device.

If a device program module is assigned to several devices, these are preferably devices of the same device type. The device program module can then be used, for example, to aggregate a parameter value received from several devices of the same type, e.g. to calculate an average value, to normalize it, or to process it in another way. A parameter related to a device can, for example, be a parameter whose value is measured by the automation device, whose value provides information about the current status of the automation device and/or which represents data that controls or otherwise influences the operation of the automation device.

For example, the PLC program can have a ventilation device program module for each fan installed in the tunnel and an emergency exit door device program module for each door of an emergency exit in the tunnel. The device program module can be used, for example, to evaluate status data of the respective device (e.g. performing a plausibility check, checking whether a limit value has been exceeded, aggregating or normalizing a corresponding measured value, etc.) and saving the result as an intermediate result in a predefined and specified address range of the intermediate result memory.

For example, one or more of the program modules, in particular device program modules, can each be configured to read sensor and/or status data of several of the devices from predefined address ranges of the intermediate result memory assigned to these devices, to aggregate them and to store the aggregated value as an aggregated intermediate result in another predefined address range within the intermediate result memory so that program modules executed later during the cycle can read and process the aggregated intermediate result.

The input image can, for example, include several measured values that are measured at least once per cycle, or several times if necessary, transferred via a fieldbus from the respective device to the data storage containing the intermediate result storage or another data storage, and collected there in a buffer memory area. The contents of the buffer memory are copied to an input image memory area before the start of each cycle. It is possible that some values in this buffer memory area change during a single PLC cycle, e.g. if the corresponding measured value is measured at a higher frequency than the cycle frequency. The contents of the buffer memory at the start of a cycle serve as the input image or part of the input image. However, during the execution of a PLC cycle, the contents of the input image remain constant. This ensures that all program modules can use the same input image as a starting point, regardless of when within a PLC cycle they are executed.

Preferably, the traffic route tunnel controller is configured to capture the input image of the tunnel, which contains the current state of the tunnel and the devices located therein, at the beginning of each PLC cycle and to store this in the form of raw data in address areas of a data storage device reserved for the input image. This input image remains unchanged throughout the entire cycle. The data storage device used to store the input and output images can be the same data storage device that contains the intermediate results or a different data storage device.

In the cycle, several program modules, in some implementation variants a single program module of the program, can then read the raw data contained in the input image (e.g. luminance values, temperatures, etc.), process them and save them in the intermediate result memory. If necessary, device-related intermediate results from different device program modules are read, processed and saved several times per cycle, e.g. filtered, smoothed, checked for compliance with specified limits, scaled, etc., and the resulting results The data are available for further processing by other program modules executed at a later point in time within the same cycle (e.g. other device program modules and/or function program modules).

More complex data processing steps that process several parameters of different device types are preferably implemented in the so-called functional program modules.

• - Parameterwerte, die in einem dem Parameter zugewiesenen Adressbereich innerhalb des Zwischenergebnisspeichers und/oder innerhalb eines Eingangsabbilds gespeichert sind, zu lesen;
• - unter Verwendung der gelesenen Parameterwerte Steuerungsdaten zur Steuerung zumindest eines der Automatisierungsgeräte zu berechnen; und
• - die berechneten Steuerungsdaten in einen dem zu steuernden Automatisierungsgerät zugewiesene Adressbereich innerhalb des Ausgangsabbilds zu speichern, um zumindest eine Funktion des dem Funktions-Programmmodul zugeordneten Automatisierungsgeräts zu steuern.

According to embodiments, at least some of the program modules of the program are functional program modules. A functional program module is a program module that is configured to:

• - to read parameter values stored in an address range assigned to the parameter within the intermediate result memory and/or within an input image;
• - to calculate control data for controlling at least one of the automation devices using the read parameter values; and
• - to store the calculated control data in an address range assigned to the automation device to be controlled within the output image in order to control at least one function of the automation device assigned to the function program module.

The control data can, for example, contain control commands.

For example, a function program module can calculate one or more control commands for one or more automation devices controlled by the function block for each PLC cycle and write these into the intermediate result memory or into a memory containing the output image. At the end of the cycle, the control commands contained in the output image are transferred to the device periphery and control the behavior of the automation devices.

By generating and storing the control commands, the raw data recorded by the devices can be transformed directly or indirectly via intermediate results by the functional program modules into parts of the output image in order to adapt the state of the devices and thus also the state of the tunnel to the current requirements.

Some function program modules can also calculate intermediate control command results and save them in the address areas of the intermediate result memory reserved for this purpose. Other function program modules executed later within the same PLC cycle can then calculate one or more final control commands from several intermediate control command results, which are saved as part of the output image. For example, three function program modules for three fire doors can each generate the control command "close door" as an intermediate result if the function program modules detect the presence of a fire. However, before the control commands for the three doors are written to the output image, another function program module can perform another calculation to orchestrate the sequence of door closings or the control commands issued in such a way that as little draft as possible is created or other optimization criteria are met.

According to embodiments, several functional program modules or other program modules of the program are configured to read and process at least some of the same data. For example, status information "door open" can be processed by a first functional program module in such a way that it generates a control command to switch on the lighting in response to this, and processed by a further functional program module in such a way that, if a fire is present at the same time, another door is automatically closed in order to prevent the formation of draft air currents that fan the fire.

The use of a program with device and function program modules that exchange data and intermediate results within the same cycle via the assigned address ranges can have the advantage that, despite the strictly sequential execution of the program modules, the data flow is not strictly hierarchical, but can be branched "within" the PLC layer and within the same cycle.

According to embodiments, at least two of the program modules are configured to access at least one identical address range of the intermediate value memory and to process the data stored therein during a PLC cycle and to generate different results (intermediate results or components of the output image).

• - Tunnellüftungsgerät, insbesondere Strahlventilator, Axialventilator, Absaugklappe;
• - Temperatursensor;
• - Beleuchtung, insbesondere Einfahrtsbeleuchtung, Durchfahrtsbeleuchtung, Notbeleuchtung, Fluchtweghinweisbeleuchtung;
• - Kamera;
• - Beleuchtungssensor, insbesondere Leuchtdichtesensor, Helligkeitssensor;
• - Sensor für die Sichttrübung im Tunnel;
• - Sensor für die Rauchdetektion im Tunnel;
• - Luftfeuchtigkeitssensor;
• - Luftgeschwindigkeitssensor;
• - Lautstärkemessgerät;
• - Meßquerschnitt für die Verkehrsstärkeerfassung;
• - Anzeigequerschnitt für die Darstellung von Verkehrszeichen nach StVO;
• - Steuerungseinheit für das Öffnen und Schließen von Flucht- und Wartungstüren;
• - Sensor bezüglich des geöffnet-geschlossen-Status von Türen und Toren;
• - Sensor bezüglich des Status einer Beleuchtung;
• - Einheit für die Erzeugung von Stör- und Betriebsmeldungen;
• - Sicherheitstechnisches Gerät, insbesondere Feuerlöschanlage, Alarmanlage, Brandmeldeanlage;
• - Stromverteilungs- und Überwachungsgerät.

According to embodiments, the devices comprise one or more devices selected from the following group of devices:

• - Tunnel ventilation equipment, in particular jet fan, axial fan, extraction flap;
• - Temperature sensor;
• - lighting, in particular driveway lighting, passage lighting, emergency lighting, escape route lighting;
• - Camera;
• - illumination sensor, in particular luminance sensor, brightness sensor;
• - Sensor for visibility in the tunnel;
• - Sensor for smoke detection in the tunnel;
• - Humidity sensor;
• - Air speed sensor;
• - Volume meter;
• - Measuring cross-section for traffic volume recording;
• - Display cross-section for the representation of traffic signs according to the StVO;
• - Control unit for opening and closing escape and maintenance doors;
• - Sensor regarding the open-closed status of doors and gates;
• - Sensor regarding the status of a lighting;
• - Unit for generating fault and operating messages;
• - Safety equipment, in particular fire extinguishing system, alarm system, fire detection system;
• - Power distribution and monitoring device.

According to embodiments of the invention, the controller is configured to execute at least one of the program modules only on the nth program execution, where n is an integer greater than 1. For example, a certain program module may only be executed every third cycle and another only every fourth cycle, with the majority of the program modules being executed once per cycle.

Certain program modules are therefore not executed in every cycle, but only after a set number of cycles. This can have the advantage of preventing the PLC CPU from becoming overloaded. Resource consumption, in particular the load on the PLC CPU, is reduced without reducing the performance of the controller, since some sensors work with inertia or some parameters change only relatively slowly, so that it is often sufficient, for example, to read out and process the current value of a device's energy consumption only every second or third cycle. The behavior of the PLC program modules can be implemented, for example, using the time slicing method (round-robin). In this method, processor time is assigned to the program modules according to their position within the module sequence in the PLC program, with the controller checking before the assignment whether this program module should be executed in the currently executed cycle or not. If not, no processor time is assigned to this program module, but to the subsequent program module (unless this should also be skipped in this cycle). For example, the controller may include metadata of each program module that specifies whether a particular program module should be executed every cycle or every nth cycle, where n may have different values for different program modules.

According to embodiments, the PLC program comprises one or more program modules that are configured to check whether the data stored in one or more of the address ranges has a data type that it should have according to the assignment of the address range to certain devices and/or parameters. For example, the program modules can each contain an assignment configuration, e.g. in the form of an assignment table, which assigns address ranges of the intermediate result memory to one of several predefined data types. The data type is, for example, a data type of which it is known that the data originating from the device or the parameter that is to be stored in the address range has this data type. The data type can be, for example, a float, integer, boolean, a time stamp or the like. If the check shows that the data value does not correspond to the assigned data type, a result or intermediate result is generated and stored in an address space assigned to this result. The result indicates that the data type in question is not valid. This can be advantageous because it allows errors caused by using an incompatible device (wrong manufacturer, wrong device version, wrong firmware, etc.) to be detected immediately.

According to some embodiments, one or more of the program modules are configured to store a secret data value known to the program module in an address area provided for this purpose in the intermediate result memory. To do this, they use an encryption key that is preferably issued specifically for a certain program module or a group of program modules, e.g. specifically for a device program module for a device of a certain device type. One or more further program modules contain a Copy of the secret data value and a cryptographic decryption key corresponding to the encryption key, which is configured to decrypt the encrypted secret data value. The other program modules can compare the decrypted data value with the secret reference value known to them in order to determine whether the program module that wrote the encrypted data value was in possession of the secret data value. For example, the reference value can be a copy of the secret data value and the check can include an identity check of the decrypted data value and the reference value. This enables the program modules to determine whether or not they can trust the intermediate results provided by other program modules.

If the test shows that the module providing the encrypted value did not have the secret data value and is therefore not trustworthy, the other module can refuse to use the intermediate values provided by this module or issue a warning that the module providing the encrypted data value is not trustworthy. The test has the advantage of enabling a particularly high level of trustworthiness and integrity of the program modules, since without knowledge of the secret data value, no program module can be created that is interoperable with the other modules. However, the test is comparatively complex, so it is preferably carried out on particularly powerful PLC CPUs.

For example, the secret data value can be a hash value, e.g. a CRC checksum, which was calculated from the source code or machine code of the respective program module. The other program modules can, for example, contain a positive list of hash values which are used, for example, for different versions of the first module considered valid as valid secret data values or as suitable reference values for checking them. If the decrypted secret value and one of the reference values of the positive list are identical, the other program module determines the validity of the program module providing the encrypted data value. According to some embodiments, the said provision and checking takes place in each PLC cycle for one, several or all of the program modules of the program.

The encrypted data value may also be stored associated with a digital signature, and the validity check may include checking the signature using a public signature verification key.

The test can have the advantage that it can be detected and recorded if, for example, the tunnel operator uses a program module that is not part of an officially provided and tested program module library for tunnel operation. This ensures that tunnel operation is only possible on the basis of sufficiently tested program modules and that any replacement or manipulation of one of the program modules is detected. Replacing a program module with another, not yet tested program module with an invalid identifier is therefore immediately detected even during operation and can be transmitted to the control software, which can issue a warning message in this case.

According to embodiments of the invention, only one of the program modules of the program is configured to read the input image when executing a cycle ("input program module"). Only one of the program modules of the program is configured to write the output image when executing the cycle ("output program module"). All other program modules of the program are configured to read their input data from predefined address areas of the intermediate result memory and to write them to further predefined address areas of the intermediate result memory.

Preferably, the traffic route tunnel control system comprises a user interface that enables a user, during runtime of the program, to switch the operation of the program from a normal operating mode to the test operating mode. In the test operating mode, the only program module that reads the input image from the input image storage area in the normal operating mode is caused to read test input image data from another storage area of the data storage, and the only program module that writes the output image to the output image storage area in the normal operating mode is caused to write the test output image calculated on the basis of the test input image data to another storage area of the data storage.

For example, this can be done by having the two program modules read out an address assigned to the parameter “Operating mode of the input program module” or the parameter “Operating mode of the output program module” at each cycle execution, and depending on its content, the input image is either copied from the actual Input image reads from the address range reserved for the input image or from another address that contains a test input image. For example, the data value "0" can stand for normal operation and the data value "1" for test operation. Switching the output program module works in the same way. This can be advantageous because all dependencies on the input image are limited to a single program module, and this program module has two operating modes that can be controlled by the user at runtime. This means that certain scenarios can be simulated and tested in the tunnel without having to worry about errors occurring when switching between normal operating mode and test mode due to continued dependencies of other parts of the program code on the previously used input image.

According to embodiments of the invention, at least one of the program modules comprises an event-effect matrix (“cause-effect matrix”). The at least one program module, also called EWM program module, is configured to generate at least a portion of the output image according to the event-effect matrix in order to control one or more of the devices according to the event-effect matrix.

The use of an event-effect matrix can be advantageous because it allows simple as well as complex relationships, e.g. between several different events and desired reactions to these in several different devices, to be defined in the PLC program in such a way that they can be easily recognized and changed. For example, an event-effect matrix can determine whether and which doors should be closed in the event of a fire, how the extinguishing system is controlled in the event of a fire, etc.

According to embodiments, the at least one program module with the event-effect matrix includes an interface to the system control level control software. The interface enables the system control level control software to control at least one function of the program with at least one control function. The event-effect matrix is configured to overwrite the at least one control function of the system control level control software in such a way that a tunnel-specific adaptation of the functionality of the system control level control software to the type and number of devices present in the tunnel takes place. The interface can, for example, be via predefined address ranges in the intermediate result memory or in another memory area of a data memory reserved for data exchange with the control software.

An event-effect matrix can also be advantageous because certain control functions take place at the program level and can be adapted to the specific characteristics of the respective tunnel at this level. It is therefore possible to monitor and/or control several different tunnels using the same plant control level control software. If the tunnels have differences in terms of the number and type of devices used, it may be sufficient to use just one program module with an event-effect matrix adapted to the respective tunnel. If, for example, the control software (or an operator using the control software) writes a control command to open all doors into the input image of two tunnel control programs, this command can be identical for both tunnels, even if the two tunnels have a different number of doors. The event-effect matrix for the implementation of this command can be adapted to the individual tunnels at the program level in such a way that the number of existing doors is taken into account and the command to open is stored in each of the address ranges that are assigned to the doors present in the respective tunnel and are used by the respective door-related program modules to control the open status of the respective door.

According to embodiments, the program modules are configured to exchange data with each other via the predefined address ranges of the data memory, in particular via address ranges in the intermediate result memory (i.e. bypassing the field bus or network of the automation system containing the controller).

According to embodiments, the program modules and the system management level control software are configured to exchange data with each other via predefined address ranges of the data memory. These address ranges can, for example, be part of the input image, the intermediate result memory, a separate communication data memory area or the output image of a PLC cycle.

According to embodiments, the program includes at least one program module, e.g. the input program module, which is configured to read and process the input image in the form of binary data exclusively from the input image. The program includes at least one further program module, e.g. the output program module, which is configured to write processed data in the form of binary data into the output image.

The strict use of binary rather than analog data in the input and output image can have the advantage that both the data input used per cycle and the data output generated to the peripherals/devices are clearer and therefore more comparable. In the intermediate calculations, however, analog values are often advantageous because they enable comparison with limit values and various aggregation methods.

According to some embodiments, the program comprises one or more program modules, in particular functional program modules, which are configured to read data of the input image and optionally also intermediate results from the data memory, to process them and to store them in the form of intermediate results in the data memory.

Additionally or alternatively, the program may include one or more program modules, in particular device program modules, which are configured to transform analog data of the devices into digital data and to store the transformed digital data in address areas of the data memory assigned to the respective devices. These digital data may form part of the input image of the next cycle to be executed.

According to embodiments, the traffic route tunnel control system comprises a power supply. The power supply is located in the tunnel and/or in close proximity to the tunnel. The traffic route tunnel control system is configured to control the devices autonomously and independently in emergency situations, even in the absence of external control commands and external energy sources, so that the emergency situation is eliminated or limited and the functionality of the tunnel is maintained for as long as possible.

In a further aspect, the invention relates to a use of a traffic tunnel control system according to one of the embodiments described here for controlling a traffic tunnel.

In a further aspect, the invention relates to a system comprising a plurality of traffic route control systems according to the embodiments described here, each of which contains a program. The plurality of programs contain copies (instances) of one or more program modules of a program module library, wherein the plurality of programs differ in the number of program modules, the selection of the program modules and/or in terms of their arrangement within the respective program. In some embodiments, a single control level control software monitors the PLC control programs of several tunnels.

In a further aspect, the invention relates to a method for automatically or semi-automatically creating a program for controlling a traffic tunnel. The method comprises: providing a flow chart for the information flow and information processing of parameter values, in particular measurement data recorded by devices in the tunnel, and control data that control the state of the devices in the tunnel; providing an assignment of parameters relating to the devices in the tunnel and address ranges of an intermediate result memory and optionally also address ranges of the output image and/or input image. The method comprises automatically arranging predefined program modules in accordance with the flow chart in order to provide a program whose program modules process device-related parameter values in accordance with the flow chart. The method further comprises an automatic configuration of the program modules arranged in series such that they contain at least the parts of the assignment that relate to parameters that are processed by the program module, so that the configured program modules read the input value for a parameter processed by them from the address range assigned to this parameter and/or write the value calculated by them for a parameter to be output by them into the address range assigned to this parameter.

Preferably, the address ranges also include those for storing intermediate results that are written during the execution of a PLC cycle and then read and further processed, wherein the address ranges for intermediate results are neither part of the address ranges of the input image nor of the output image.

In a further aspect, the invention relates to a program library for generating a program for controlling a traffic tunnel with multiple devices. The program library comprises a plurality of predefined program modules that can be assembled into a program for controlling a traffic tunnel.

One or more of the program modules are configured to process an input image of the automation devices and to generate an output image for controlling the automation devices. At least a first of the program modules is assigned to an address range of a Intermediate result memory in order to store an intermediate result there. At least a second of the program modules is assigned to the same address range of the intermediate result memory in order to read the intermediate result from there and process it further. The at least first and the at least second program module can be assembled in such a way that the program executes the at least one second program module after the at least one first program module, so that the result of the at least one first program module can be read and processed as an intermediate result by the at least one second program module in the same cycle in which it was calculated.

At least some of the program modules are each associated with one of the devices and are configured to read a value of a parameter related to that one device from a predefined address range within the input image memory area or the intermediate result memory, process it, and store a result of the processing in another predefined address range within the intermediate result memory or the output image memory area during the execution of each cycle of the program.

Definitions

A "data storage device" is understood here to mean a medium for the volatile or permanent storage of data. A data storage device can comprise a large number of physical data storage devices whose addresses can be addressed using logical and/or physical addresses. In particular, it can be a data storage device that is integrated ("embedded") in a component of an automation system. The data storage device can be used to store electronic data of any kind that can be read and/or written by computers or peripheral devices. In particular, it can be an electronic, semiconductor-based data storage device that serves as the working memory of a PLC.

An "address area" is understood here to mean an area of a logical or physical data memory that can be addressed via an address and that contains one or more sub-areas, each of which can also be addressed via a unique address. For example, an address can consist of an absolute address or a combination of an absolute address and an offset. In particular, according to embodiments of the invention, the addresses assigned to the parameters can be addressed uniformly and uniquely by all program modules of the program.

A "programmable logic controller" (PLC) is a device that is used to control or regulate a machine or system and is programmed on a digital basis. The PLC works cyclically: it reads the values of all inputs at the beginning of a cycle (in this context, this is also referred to as "reading the process image" or the "input image") - then executes the stored program(s) (also called "programs") and sets the outputs at the end. The totality of the data values generated by a PLC up to the end of a cycle is also referred to as the "output image". The cycle then starts again. There is often no end to the program. However, event-oriented processing can be implemented at the PLC level or at the level of a higher-level control software.

A program of a programmable logic controller, also called a PLC program, is understood here to be a program that implements some or all of the control functions of the controller. According to embodiments of the invention, the program works according to the EVA principle, i.e. it has an input, a processing and an output section. The I/O devices (the devices connected to the inputs/outputs) are connected to the program, e.g. via a field bus or a network. The peripheral image of the inputs is read in at the beginning of a cycle as the so-called "input image" of the cycle, then the program is processed and the outputs are transferred to the peripheral image of the outputs ("output image" of the cycle).

An "input image" is understood here as the totality of all input values already present at the beginning of a cycle, which are read and processed by a program during a cycle. The values of the input image are constant during the cycle execution.

An “output image” is understood here to be the totality of all data values present at the end of a cycle that were calculated by a program during a cycle and made available to the devices.

The term "control" or "regulation" is intended to include both control processes in the narrower sense, which do not involve comparing the manipulated variable with a target value, and regulation processes. Regulation is a process in which a physical quantity is continuously measured, compared with a set value (target value, target size) and adjusted to this.

A device is understood here to be any type of component, machine or object that has or can have a technical function in monitoring and/or controlling a tunnel. For example, a device can be an object that contains one or more sensors. The sensors can include, for example, a temperature sensor, pressure sensor, wind speed sensor, brightness sensor, a camera, a carbon monoxide sensor and the like. However, a device can also be a component, for example a door, a closure of a ventilation shaft or the like. A device can also be a machine, for example a fan, a fire extinguishing system, a siren, a lighting system, a loudspeaker or the like.

A program module is understood here to be a building block which can be linked together with other program modules to form a program and which implements a specific function and reads input data, processes it and outputs the result of the processing.

Short description of the characters

• 1 zeigt ein Automatisierungssystem zur Überwachung und Steuerung eines Verkehrswegetunnels,
• 2 illustriert Schritte der Programmausführung zur Berechnung und Verarbeitung eines Zwischenergebnisses,
• 3 den modularen Aufbau eines Programms zur Tunnelsteuerung,
• 4 das Speichern gerätespezifischer Messwerte in vordefinierte Adressbereiche,
• 5 die Zuweisung von Adressbereichen an mehrere Geräte-Programmmodule und an ein Funktions-Programmmodul,
• 6 weitere Zuweisungen von Programmmodulen und Adressbereichen,
• 7 einen Adressbereich mit allgemeinen Konfigurationsdaten, die von vielen verschiedenen Programmmodulen verwendet werden,
• 8 den Ablauf eines Programms mit je nur einem einzigen Programmmodul für das Lesen des Eingangsabbilds und das Schreiben des Ausgangsabbilds,
• 9 ein Funktions-Programmmodul zur Entprellung von Messwerten,
• 10 ein Flussdiagramm eines Verfahrens zur Erstellung eines SPS-Tunnelsteuerungsprogramms,
• 11 unterschiedliche Reaktion zweier Tunnel auf das gleiche Ereignis,
• 12A die Verwendung eines Funktions-Programmmoduls mit einer Ereignis-Wirk-matrix,
• 12B eine GUI einer Leitebenen-Kontrollsoftware,
• 13 die Verwendung mehrerer Programmmodule eines Programms für die Steuerung einer Brandlüftungsanlage.

In the following, embodiments of the invention are explained in more detail by way of example only, with reference to the drawings in which they are included. They show:

• 1 shows an automation system for monitoring and controlling a traffic tunnel,
• 2 illustrates steps of program execution for calculating and processing an intermediate result,
• 3 the modular structure of a tunnel control program,
• 4 storing device-specific measured values in predefined address ranges,
• 5 the allocation of address ranges to several device program modules and to a function program module,
• 6 further assignments of program modules and address ranges,
• 7 an address range with general configuration data that is used by many different program modules,
• 8th the execution of a program with only one program module each for reading the input image and writing the output image,
• 9 a functional program module for debouncing measured values,
• 10 a flow chart of a procedure for creating a PLC tunnel control program,
• 11 different reaction of two tunnels to the same event,
• 12A the use of a function program module with an event-effect matrix,
• 12B a GUI of a management level control software,
• 13 the use of several program modules of a program for controlling a fire ventilation system.

Detailed description

The 1 shows a system 100 for monitoring and controlling a traffic tunnel 124.

The traffic tunnel 124 can, for example, be a road tunnel that includes a variety of different devices. For example, the devices can include the following: one or more cameras 126 for recording the current traffic situation, brightness or air opacity. One or more fans 128, 130 for ventilating the tunnel or for ventilating tunnel sections. One or more doors 136, 138, for example fire doors or escape doors. The devices can also include sensors such as a temperature sensor 132 and/or a carbon monoxide concentration sensor 134.

In the example shown here, the tunnel and its devices are monitored and controlled using a programmable logic controller (PLC) 101. The PLC includes a program 120 that consists of a large number of sequentially executed program modules. The program 120 can be executed cyclically in an endless loop. The program 120 is located in a program memory 110, which in this context is also referred to as a load memory. The program memory is used to store and execute application programs in the form of executable object code. For example, the program memory can consist of RAM or FlashEPROM (memory cards).

The controller also includes a data memory 108, which can be designed as a working memory, for example. The data memory contains a memory area that serves as an intermediate result memory 114 for storing the intermediate values calculated during the cycle execution.

In the example shown here, the data memory 108 also contains an input image storage area 112 that contains the input image 112 valid during the currently executing cycle and an output image storage area 116 that contains an output image 116 calculated during the currently executing cycle. In other implementation variants, however, the input image, the intermediate results and the output image can also be stored in different data memories.

Since the input image must not be overwritten during cycle execution, updated measurement data acquired during cycle execution, which are used as part of the input image of the next cycle, are stored in a buffer memory area 118, referred to here as the "measurement value buffer" or "input value buffer". In addition, the output image can be stored in a buffer memory area 117, referred to here as the "output buffer", before it is written to the peripherals. The buffer memory area 118 and/or the buffer memory area 117 can be contained, for example, in the data memory 108 or another data memory.

The controller can also include a system memory in which the operating system and system programs are located (not shown here). RAM or FlashEPROM (memory cards) are usually used for this.

• E: Eingangsdaten (insbesondere Sensordaten) werden aus dem Pufferspeicher 118 ausgelesen und in das Eingangsabbild 112 kopiert. Dies geschieht zu einem festen Zeitpunkt vor Beginn des Zyklus. Damit wird sichergestellt, dass das Eingangsabbild eines Zyklus während der gesamten Zyklusdauer unverändert bleibt.
• V: Verarbeiten bzw. Abarbeiten des Programmcodes: das Eingangsabbild bleibt während dieses Prozesses unverändert. Die vom Programm berechneten Ausgangssignale werden ins Ausgangsabbild 116 geschrieben und können dabei die veralteten Werte vom vorher ausgeführten Zyklus und auch während des aktuellen Zyklus geschriebene Werte überschreiben. Der letzte Schreibvorgang ist dominant. Dieses Prinzip gilt auch für den Inhalt der Adressbereiche 114, in welchem die Zwischenwerte gespeichert sind, die nicht als Ausgangsabbild dienen. Der Programmcode des Programms 120 darf keine Endlosschleifen enthalten und vorzugsweise überhaupt keine Arten von Schleifen oder Bedingungen, die zu einem Stillstand oder verzögerten Programmablauf führen können.
• A: Ausgangssignale (insbesondere Aktuatorendaten) werden zunächst in den für das Ausgangsabbild reservierten Adressbereich 116 des Datenspeichers 108 geschrieben und von dort in den Ausgangspufferspeicher 117 kopiert. Die im vorhergehenden Zyklus berechneten Ausgangssignale werden hierbei überschrieben.

The PLC program 120 can be repeated continuously in an endless loop or until a predefined maximum number of cycles is reached, usually without waiting time between runs (cycles). The program is executed according to the so-called EVA principle:

• E: Input data (in particular sensor data) are read from the buffer memory 118 and copied into the input image 112. This occurs at a fixed time before the start of the cycle. This ensures that the input image of a cycle remains unchanged throughout the entire cycle duration.
• V: Processing or executing the program code: the input image remains unchanged during this process. The output signals calculated by the program are written to the output image 116 and can overwrite the outdated values from the previously executed cycle and also values written during the current cycle. The last write operation is dominant. This principle also applies to the content of the address areas 114 in which the intermediate values are stored that do not serve as an output image. The program code of the program 120 must not contain any endless loops and preferably no types of loops or conditions at all that can lead to a standstill or delayed program execution.
• A: Output signals (in particular actuator data) are first written into the address area 116 of the data memory 108 reserved for the output image and from there copied into the output buffer memory 117. The output signals calculated in the previous cycle are overwritten in the process.

In addition, the tunnel control system 100 can, for example, also include functions for initialization, for communication with the peripheral devices via data buses 122 or networks and/or for internal monitoring processes.

The tunnel control system 100 can have one or more processors 106, which can be designed, for example, as part of special microcomputers whose special hardware and software components are adapted to the respective application scenario. The operating system and computer architecture can be manufacturer-specific. The program 120 is based on a series of predefined program modules with clearly defined functions, in which the address ranges of those memory areas of the data memory 108 from which the program module in question reads data and/or into which the program module writes data are internally specified. All program modules that contain an identical or at least overlapping assignment of parameters and address areas of the data memory can therefore exchange data with one another without a direct program module-to-program module interface having to be defined for this purpose.

The communication between the program and the peripheral devices in the tunnel can take place at least partially via the data bus or field bus 122. So that the controller can communicate with peripheral devices from different manufacturers, the field bus system is preferably a standardized bus system such as AS-Interface (ASI), PROFIBUS, CANOpen, Devicenet, PROFINET, Ethercat, or Powernet.

The program modules of the program 120 can map a hierarchical structure and/or linear structure of the information flow. For example, the program modules can implement a call hierarchy of different devices or device groups or a hierarchy for aggregating the measured values of several devices into a common aggregated value.

For the development of the program 120, various software systems or frameworks can be used, such as CoDeSys, Simatic STEP7, TiA-Portal.

The program can be connected via a network to a higher-level control software 104 of the control level 102. The control software is used in particular to visualize current processes and status changes of devices in the tunnel and to enable the operator to intervene if necessary by entering control commands.

The 2 illustrates individual steps of program execution, including the calculation and further processing of an intermediate result. Current status data of the device and/or measurement data, e.g. images, brightness values, etc., are typically recorded by the peripheral devices, e.g. a camera 126 and a fan 128, at least once per PLC cycle and stored in an area of the data memory, which is referred to here as buffer memory 118. The entirety of the data present at the start of the execution of the program and to be processed by the program during a cycle is referred to as the input image and can, for example, consist of a copy of the current data in the buffer memory, which is stored in the memory area 112. In contrast to the values in the buffer memory, the data in the input image are not overwritten during a PLC cycle. For example, the program module BS1, which is executed first, can read and process three brightness values recorded by three cameras in different sections of the tunnel from the address ranges of the input image 112 assigned to these three devices for the "brightness" parameter. The processing can, for example, consist of determining the smallest of the three brightness values (minimum value). This minimum value is stored as an intermediate result in an address area of the intermediate result data memory reserved for this purpose. In the same cycle, the program module BS3, which is executed after BS1, reads this intermediate result again and compares it with a reference value for the minimum required brightness. If the comparison shows that the minimum value is smaller than the reference value, this result is written by BS3 into a data memory as part of the output image. The result can, for example, be written into the output image as a control command and transmitted to the devices, causing the lighting to be switched on in the tunnel section in which the minimum value was measured, or in the entire tunnel. The minimum value stored as an intermediate result can also be used by other program modules, e.g. BS12, in the same cycle to solve other tasks. For example, a sudden drop in brightness during the day can be an indication of a fire with smoke development, the occurrence of which the program module BS12 should detect.

The 3 shows the modular structure of a program for tunnel control according to an implementation variant. The program 120 comprises several program modules that can be compiled and deployed independently of one another. Depending on the equipment of the tunnel for which the control is to be created, the type and number of program modules can be selected from a program library with extensively tested program modules so that all devices in the tunnel are integrated into the tunnel control system. The program module library can, for example, contain device program modules for specific devices or device types and/or function program modules for specific sub-functions of the tunnel control and/or general configuration program modules with configuration data that are used by several other program modules and (co-)determine their mode of operation.

In the example shown here, the program modules that were selected and combined from the program module library include several device program modules 304, e.g. a device program module 330 for luminance cameras LDK, a device program module 332 for doors/gates TT and a device program module 334 for adaptation lighting A. Each device in the tunnel is represented by its own, independent device program module in the PLC program (instance). This is done by integrating a device program module that has been predefined once for the device type into the program in several copies, so that each device program module instance receives instance-related input values from the respective device. Each device program module can store the data supplied by "its" device in raw form or in processed form in an address range of the intermediate result data memory assigned to the device (here: a device type instance) for a specific parameter. This makes this data available to other program modules.

A PLC program as shown here can contain one or more function program modules 302. This can include, for example, a function program module 322 that contains an event effect matrix EWM, an operating mode lighting BABE function program module 324 and an emergency control panel NBT function program module 326.

Preferably, a sub-function of the tunnel control is completely implemented in a functional pro program module. For example, the program library can contain a separate function program module for each device type, which is used to control and in particular to activate or suppress a function of the device. Preferably, for each device installed in the tunnel, the device program module suitable for the device type and, optionally, also a function program module must be included in the program and used. However, some of the function program modules can also implement functions that control several devices in a network and/or which evaluate status or measurement data from several devices of the same or different type in order to control a device function of one or more devices.

In some embodiments, the control system is configured to execute control commands for devices of a certain type exclusively from predefined function program modules that have been specifically developed for this device type and have been provided and/or validated by a trusted authority. Controlling a device by an entity other than a pre-defined, valid function program module of the PLC program is therefore not possible.

For example, one or more of the program modules can contain a check function which, in addition to a control command that another program module has written into a corresponding address range, also reads other data, e.g. information on the data type or an encrypted data value from the intermediate result memory. Before these program modules containing the check function write the control command into a corresponding address range of the output image, they check whether the data type associated with the read control command is correct and/or whether the control command has been stored linked to an encrypted secret data value that provides proof that the control command originates from a functional program module that has been validated to control the device of this type. The check can, for example, include decryption and a check of the secret encrypted value, e.g. a hash value, a checksum, and/or a signature check. In the latter case, the program module that provides the control command has a private signature key for signing the control command or another data value, and the other functional program module that carries out the validity check in question has a corresponding signature verification key. The program module that carries out the check only writes the control command into an address range of the output image and thus only allows the device to be controlled if the control command comes from a functional program module for which the validity check has shown that this program module is approved for controlling a device of this type. The validity check can include comparing a decrypted secret data value with a reference value.

The use of device program modules has the advantage that program modules exist for the individual devices that only need to be intensively tested once for devices of a certain type and can then be reused for a large number of device instances of the same type. The device program modules can preferably be visualized and/or controlled using the control software of the control level. Since the device program modules can be combined with many other device program modules or function program modules, the program can still be very flexibly adapted to the respective tunnel. Similar advantages arise for function program modules that control the functions of devices of a certain type.

In 3 and several of the figures described below, device program modules are marked with a “G”, function program modules with an “F” and basic program modules with a “B”.

4 shows the storage of device-specific measured values in predefined address ranges of the intermediate result memory, which are assigned to these devices. The devices 402 can be, for example, brightness sensors, for example cameras and sensors for detecting the wind strength in the tunnel. In 4 For example, four brightness sensors of the same type and three wind speed sensors are shown in the form of pictograms. These sensors preferably record the current brightness or wind speed in different sections of a tunnel at least once, possibly several times per cycle, but in some embodiments only at time intervals that are longer than one cycle. The recorded measured values are initially stored in a measured value buffer 118 and ultimately in address areas of the input image memory area. The set of all current measured values that is present at the start of a cycle and is stored, for example, in another memory area 112, serves as the input image of the cycle now being executed.

Anyone who 4 A corresponding device program module (i.e. a program module of the program that is individually assigned to the device) is assigned to each device 402. The assignment means that, for example, the device program module 410 can selectively adjust the current brightness value of the brightness sensor assigned to it is used as the input data value. The brightness sensor device program module 410 is assigned the address range 310 in the input image memory area of the data memory 108, which in this case means that the device program module 410 stores the brightness value of the corresponding sensor in the input image in the address range 310 of the input image memory area. Optionally, the measured value can be processed here, for example a check to see whether the measured value has the data type expected for the brightness sensor device type. If this is not the case, an error message can be written to the address range 310 instead of the current brightness value.

In an analogous manner, the address range 403 is assigned to the device program module 412. The device program module 404 is assigned the address range 312, etc. Each device program module can therefore, when executed, store the measured values of the device assigned to it after a test step, aggregation step and/or other data processing steps in an address range assigned to this device and this device-related parameter. It is also possible for a device program module to receive several measured values for several different parameters from the same device and store them accordingly in several different parameter-related address ranges of the intermediate result memory.

The intermediate result store can serve as a central storage location for data and states of the devices contained in a tunnel.

According to an implementation variant, one or more address ranges for storing parameter-specific data values can be assigned to a program module, for example by permanently assigning the address ranges to the respective parameters in an assignment configuration that can be part of the program source code before the program is executed, e.g. when programming the program module. However, these implementation variants require changes in the source code in order to change the assignment of parameters and address ranges. It is also possible to provide the assignment configuration in the form of metadata of the program module, which is used and read by the compiled module at runtime, but is not part of the compiled program code.

Embodiments allow that during program creation, copies of the same device program module, e.g. a fan program module, are lined up for each of the fans in the tunnel, whereby the different copies are initialized with different address ranges so that they can write control data specifically into those address ranges from which the respective fans receive or read their control commands.

This has the advantage that the assignment of parameters to address ranges can be changed without having to recompile the program module. Other program modules, for example function program modules or general program modules, can also have corresponding configuration interfaces for assigning parameters and address ranges in the data memory. Depending on the program module, the address ranges passed as arguments when configuring a program module can contain, for example, current measured values (actual values), setpoints, messages or commands.

5 shows the allocation of address areas of the data memory 108 to several device program modules 304 and to a function program module 508. From the example shown here, it can be seen that the lowest device program module is configured to store the brightness value detected by its assigned brightness sensor in the address area 314. The second lowest device program module is configured to store its corresponding brightness value in the address area 312. The topmost of the three device program modules is configured to store the brightness value detected by its device in the address area 310.

During its configuration, the function program module 508 receives references to all three address ranges inside 310, outside 312, outside2 314 and also a reference to the further address range 308. The function program module can now, for example, read out the brightness values of the three brightness sensors from the three address ranges 310, 312, 314 during the execution of the program, process them and store the result in the address range 308.

6 shows further assignments of program modules and address ranges. The assignments shown here illustrate that in some embodiments the program can contain several program modules 508, 602, which read the same parameter values from an address range 310 reserved for them. The program block LDK writes a data value into the address or address range 310 assigned to the parameter “LDK01” (the luminance value measured by the luminance camera 01). The program blocks 508, 602 contain or know the same assignment of the parameter “LDK01” (the luminance value measured by the luminance camera 01 measured value of luminance) to the address range 310 and read this address range to obtain the current parameter value of this parameter.

7 shows a special configuration address area 712 of the data memory 108. The configuration address area 712 contains general configuration data 710 that can be used by many different program modules, for example device program modules, general program modules and/or function program modules. This allows important standard variables to be set centrally and easily for all program modules in a tunnel-specific manner. For example, it can be specified there that the lighting in the tunnel must always have a certain minimum brightness and/or that a maximum of a certain carbon monoxide concentration is considered acceptable. It is not necessary to specify these general limit values and setpoints for all devices individually in the respective device program modules. This can be particularly advantageous because a large number of instances of the same device (for example a certain light, a certain fan, a certain sensor, etc.) are often used in a tunnel. If a modified copy of a program according to implementation variants of the invention is reused to control another tunnel, only the contents of the address range 712 need be adjusted to adapt various setpoints or limits to the other tunnel.

8th shows the flow of a program with only one program module for reading the input image and a single additional program module for writing the output image.

The input image is transferred once per PLC cycle to the memory area 112 of the data memory 108 reserved for the input image. Accordingly, once per PLC cycle, the entirety of the values of the output image are stored in the memory area 116 reserved for the output image. Preferably, the input image is read in and processed in a single step by a single program module 802 of the program, referred to here as the input program module. Preferably, the entire output image is stored in a single step by a single program module 804 of the program, referred to here as the output program module. The output image is calculated from the input image by all the other program modules 806, 808, 810 of the PLC program 120, with intermediate values also being stored in the data memory and further processed.

According to embodiments of the invention, the program is thus configured so that the data values of the input image and the output image are each processed only at a single location (a single program module) in the program code of the program 120. This can be advantageous because it enables consistent simulation of input values and output values and error-free switching between normal operating mode and test mode of the tunnel. This can be done, for example, by having an interface in the input program module 802 that allows a user to execute the program module 802 either in test mode or normal operating mode. In normal operating mode, the program module 802 reads the input image from the memory area 112, in test mode from another memory area in which other, e.g. specifically changed, parameter values are stored. The output program module 804 can also be executed either in test mode or in normal operating mode depending on an input from the user. In normal operating mode, the program module 804 stores the data of the output image generated during a cycle of the program in the memory area 116 provided for storing the output image in normal operation, and in test mode in another memory or memory area. Preferably, the interfaces therefore allow a user to run the two program modules 802, 804, and thus the entire PLC program, either in normal operation or test operation, so that it is very easy to switch back and forth between these operating modes. Preferably, the controller includes an interface that allows a user at the program level and/or at the control center level to switch back and forth between test operation and normal operation. In test operation, the program is executed as described, but does not read its input image from the memory area 112 normally reserved for this purpose, but from the test input image memory area. In test mode, the calculated output image is not written into the memory area 116 for the normally generated output image, but into a separate memory area for the test output image.

According to some implementation variants, the data memory 108 therefore comprises additional memory areas and address areas that are intended for storing a test input image and a test output image in the test mode of the program. A test input image corresponds to in size and in terms of data organization to the input image 112. However, one or more data values of the test input image are changed, for example in order to be able to understand the effect of these changes on program execution and tunnel control.

Because in these implementation variants only a single program module reads the input image and only a single, further program module writes the output image into the corresponding address range, it is possible to switch back and forth very easily between test mode and normal operation and to test the behavior of the control system in different scenarios for each tunnel without having to search the entire program code for further references to values in the input image. This reduces the risk of errors when testing the software and when returning to normal operation.

9 shows a function program module that is used to suppress short-term status changes of devices ("debouncing"). In some cases, the frequent changing of the status of a device can lead to false triggering of fault messages and alarms. If, for example, the status of a door with a contact sensor distinguishes between "open" and "closed", and if this door is mounted in such a way that even small vibrations or gusts of wind lead to movements of the door leaf that trigger a status change of the door, propagation of this malfunction of the door status measurement can be prevented by the device program module responsible for this door recognizing, based on the frequency of the status change or other circumstances and parameters, that the alleged change of status of the door is a false report. A similar situation can occur if, for example, a branch with foliage has grown over a brightness sensor at the entrance to a tunnel, which repeatedly overlays the brightness sensor due to the wind. Based on the frequency of the brightness change, the device program module assigned to the sensor can recognize that it has not become darker at the entrance to the tunnel because of smoke or the setting sun, but that the brightness values reported by the sensor are flickering for another reason. In this case, the device program module of this brightness sensor can ignore the received brightness change and, for example, refrain from overwriting the data value currently in the corresponding address range, or provide this data value with an appropriate warning. The function program module, which reads the three pre-processed brightness values from the corresponding three address ranges, can recognize, for example, based on the data type or data content of the read data that the values supplied by the brightness sensor in question are problematic and may need to be ignored or corrected. Digital inputs that require a quick response from the controller are preferably not debounced.

According to further implementation variants not shown here, the program 120 can also contain program modules, which are referred to as collector program modules. These are configured to read and aggregate the data provided by several device program modules (preferably of the same device type) that are stored in corresponding address ranges known to the collector program module. For example, the aggregation can consist of calculating the median or the arithmetic mean or a maximum value, a minimum value or another derived value. This aggregated value can then be stored as a result of the collector program module in a corresponding address range of the data memory reserved for this purpose. Aggregation preferably also takes into account data types or other information that may be contained in the data provided by the device program modules that provides an indication of whether the data value is valid (device has a certain device type, the measured value is within an expected, plausible range, the measured value has the expected data type, the measured value does not have an unusually high fluctuation rate, etc.).

10 shows a flow chart of an automatic or semi-automatic procedure for creating a PLC program for traffic tunnel control.

In a further aspect, the invention relates to an automatic or semi-automatic creation of a PLC program for controlling a traffic tunnel.

In a first step 910, a flow chart is provided for the information flow and information processing of measurement data recorded by devices in the tunnel. The flow chart can be provided, for example, as an XML file or a file in another format. In addition, control data is provided that indicate how the state of the devices in the tunnel should be controlled - possibly depending on various parameters. For example, the control data can contain certain target values or specify in which operating mode a device should be operated.

In step 912, an assignment is provided, e.g. in the form of an XML file, a table or other data structure. In this assignment, parameters relating to the devices of the tunnel and address ranges of a data storage device intended to store them are assigned to one another.

In step 914, predefined program modules are automatically arranged in accordance with the flow chart. For example, the arrangement can be carried out by software for automatic or semi-automatic program creation based on an existing program module library. This provides a program whose program modules process device-related data in accordance with the flow chart.

In step 916, an automatic configuration of the program modules arranged in series is carried out. The configuration is carried out in such a way that the configured program modules contain at least the parts of the assignment that relate to parameters that are processed by the program module. The configured program modules are therefore configured to read the input value for a parameter they process from the address range assigned to this parameter and/or to write the value they calculate for a parameter they are to output into the address range assigned to this parameter.

11 shows the different reaction of the control of two tunnels to the same event (a door is opened). In both tunnels, the decision on how to react to certain events is made by a special program module with an event-effect matrix, whereby the event-effect matrix of this program module differs in the two programs used to control the two tunnels.

In the tunnel shown on the left, the device program module 938 NN01 (door in emergency niche 01) responsible for the door reports that the door NN01 has been opened and stores a corresponding data value in an address area of the data memory, from which the program module 934 reads this data value again with the event effect matrix. The program module 934 also processes further intermediate results from various function program modules and decides that full lighting should be activated in response to the door being opened. In addition, the display of the maximum permitted speed should be reduced to 60 km/h. The EWM program module stores corresponding control commands in corresponding address areas of the data memory, where they are read by the device program modules 930, 932 for the tunnel lighting or for the maximum speed display and further processed into control commands of the output image.

The process flow for the right half of the 11 The tunnel shown is essentially analogous, with the difference that the EWM program module 958 used here decides according to its event-effect matrix that the lighting is not activated (for example because the tunnel is so short that this is not necessary, at least during the day) and that the maximum speed is reduced to 80 km/h (only because of the better visibility).

In some implementation variants, the programs of several tunnels can each also include one or more program modules 960 for data exchange and for synchronizing the control of the several tunnels. This can be advantageous, for example, if the two tunnels are two tubes of a tunnel system consisting of several tubes. The behavior of the devices in the two tunnels is specified by the program modules of the programs used.

According to some implementation variants, not visualized here, the devices in the traffic tunnel include several ventilation systems, for example jet fans or other types of fans. Each ventilation system is assigned a corresponding device program module. The program includes another program module specific to the respective tunnel, which is assigned to an address range in which tunnel-specific actual values and setpoints for ventilation (wind speed, temperature) are stored. Due to the different setpoints stored in the data memory, it is possible that several tunnels with exactly the same sequence of program modules are controlled differently because their setpoints are different.

12A shows the use of a function program module 984 (“Main tunnel operating mode” - BAH) with an event matrix for lighting control depending on the opening of a door. The numbers in circles in the 12A and 13 represent the sequence of different work steps that are carried out during the execution of the program within a PLC cycle. A step can correspond to the execution of one or more of the program modules. For example, a step of transferring data from one module to another usually includes the execution of the first module to write the data value and the execution of the other module to read the data. When executing a program module, one or more read steps and/or one or more storage steps are executed.

First, in response to the opening of an emergency niche door (NN) at the beginning of a cycle, a device program module 980 assigned to the door determines that the door has been opened and, for example, the parameter value "opened" is stored in the address range of the data memory provided for the "open status" parameter of this door (step "1"). Optionally, this step can include the implementation of plausibility checks or data preprocessing steps. In a later step "2" within the current PLC cycle, the function program module 984 reads the status value of this door from the address range assigned to this status value and this door in an assignment configuration. The function program module 984 contains an event effect matrix in which the reaction "Activate full lighting of the adaptation lighting A, switch off the passage lighting D" is stored for the event "door is open". In accordance with this matrix, in the same cycle, in step “3,” the program module 984 writes a result value indicating that the adaptation lighting should be 100% activated into a first address range and another result value indicating that the passage lighting should be switched off into a second address range assigned to this further result. As the cycle continues, the program module 986, which is assigned to the adaptation lighting A, reads out the first address range in a step “4” not shown here and switches the adaptation lighting on according to the contents of the read address range. Also in the same cycle, in step “5” not shown here, the program module 988, which is assigned to the passage lighting D, reads out the second address range and switches the passage lighting off according to the contents of the read address range. In the same cycle, the two program modules 986 and 988 write a message about the completed status change of the respective lighting A, D into further address areas of the data memory 108, which can be read out by the function program module 984 (in a step “6” not shown here).

The program module 984 then evaluates these two status changes and saves a result value that both lights A, D have now changed their status in another address area, the content of which is read and processed by the other program module 982 (“Main tunnel lighting operating mode” - BABEH). This program module 982 has an interface to the control software of the control level (e.g. in the form of an address area of the data memory 108, which is known to both the control software and the program module 982 and is used for data exchange). The status change of both the door and the two lights A, D in response to the door being opened can now be visualized by the control software of the control center.

12B shows a GUI 901 of the control level control software, which reads and displays the parameter values output by the module 982 when the lighting in the main tunnel is in "event operation" mode. Depending on the parameter values generated by various program modules, various messages or boxes are optically highlighted within the GUI 901, e.g. by means of a check mark or a dynamically newly set color value that distinguishes the box or message from the other boxes or messages.

13 shows the use of several program modules of a program 120 for controlling a fire ventilation system in a tunnel. By using predefined program modules, it is possible to implement a uniform fire ventilation concept for a large number of different tunnels, even if the tunnels are of different lengths and therefore contain a different number of devices.

For example, the tunnels can be viewed as a sequence of sections of predefined length, for example 10 m. Each section contains a certain number of devices, for example sensors for detecting temperature, brightness, traffic situation or other devices such as displays, light sources, ventilation flaps, fans, etc. The individual devices and the program modules corresponding to them can be assigned a tunnel section number, which implicitly also contains a position indication for the corresponding device. If sensors detect signs of a fire within a certain tunnel section, the section identifier can be used to determine where the fire is in the tunnel. The control system can therefore provide different reactions from the individual devices for different sections of the tunnel depending on the location. If a tunnel has 100 sections, each with a fan, the program has 100 device program modules for these fans, which can be switched on and off individually.

For example, according to some implementation variants, the program is configured so that in the event of a fire, all fans that are close to the source of the fire (for example, less than a maximum distance from the source of the fire away) can be switched off or their speed reduced. This can help to prevent air turbulence and the destruction of a stable smoke layer. However, fans that are further away from the fire can continue to operate in the event of a fire and can even be switched on or accelerated if necessary in order to reduce the carbon monoxide concentration and the associated risk of poisoning and/or to safely maintain the smoke layer below the tunnel ceiling.

In the example shown here, the work step numbers 1 to 9 indicated in circles reflect the order in which certain work steps are carried out or the program modules that carry out these steps are carried out within a cycle. For example, in a work step "1", a line fire detector program module 1302 (LMZ) stores temperature measurement data that was measured in all sections of a tunnel in an address range of the data memory 108 reserved for this purpose. If the temperature in any tunnel section exceeds a maximum permissible temperature, the corresponding tunnel section can be identified as the location of a fire. The LMZ program module 1302 can also write a warning signal in the said or another address range to indicate that and where a fire is occurring.

Furthermore, the flow measurements near the fire site must not be used to calculate the air flow in order to avoid incorrect results. Therefore, for example, the flow measurement of the flow meter corresponding to program module “STR 1318” near the fire site is declared invalid by the LMZ program module in work step “1” ( 13 bottom right). The current flow velocity calculated by the device program module 1316 in a later work step "5" is determined by the program module 1316 reading the flow data from the individual sensor program modules 120-1322 and calculating them to a total value, which is stored as the current flow velocity in a corresponding address range. The data value contained in the address range described by the STR program module 1318 is ignored because it is invalid. For example, the LMZ module 1302 stored an error value or a data value in an incorrect data type, so that a reading program module can recognize from the data value or the data type that the data value is invalid.

The device program modules "inductive loops" IS 1304 and 1306 store various data that provide information about the density and/or speed of traffic, e.g. radar-based speed data from vehicles or the results of the evaluation of camera images, as intermediate results in additional address areas reserved for this purpose. A device program module 1308 ("traffic jam") processes the data stored by the program modules 1304 and 1306 in a work step "2" in order to calculate an aggregated overall result regarding the question of whether or not there is a traffic jam. If there is a traffic jam, i.e. there are a lot of people in the tunnel, this must influence the reaction of the fire ventilation system to a fire.

The fire ventilation function program module 1310 can access the temperature data and fire locations stored by the LMZ program module 1302.

In a later step "3", the function program module 1310, which contains the fire ventilation program, creates a prioritization list of the fans. The list specifies which fans should be switched off in response to the detection of a fire and which should be switched on or continued to operate. For example, the jet fan (SV) No. 3 should be switched on. The program module 1310 gives the ventilation control a corresponding prioritization score, e.g. the value "1" in the "PRIO" column of the fan SV No. 3, and writes this into an address range of the data memory assigned to this parameter and this fan. The fans SV 1 and SV 2 near the fire site must not be used and are pre-assigned the value "99" in the PRIO column.

Furthermore, the function program module 1310, which contains the fire ventilation program, will specify the target flow for the current fire ventilation case. In the case of a traffic jam (the information for this is provided by the module 1308 in step "2"), a lower flow value is specified as the target value for the ventilation in order to create a stable smoke layer for the self-rescue of the tunnel users. In the case of no traffic jam, a higher flow value is specified. The target value calculated by the program module 1310 is stored in an address range of the data memory assigned to the result parameter in an assignment configuration.

In order to be able to adapt not only the priority, i.e. the order in which the fans are switched on and off, but also the ventilation intensity to the current fire situation, in step “4” the function program module 1312 for ventilation control reads the prioritization list calculated in step “3” (or other data that directly or indirectly provides information about the position of the fire source in the tunnel) from the corresponding address. Furthermore, the determined target flow value is read by the program module.

In step “6”, the program module 1312 also reads current environmental data (e.g. wind influence on the tunnel portals) provided by the device program module 1314 and aggregated flow data of the air flow in the tunnel calculated by the program module 1316 from the corresponding address ranges. From all of these values, the function program module 1312 calculates a setpoint value for the ventilation intensity for each flow fan in the tunnel, with 100 indicating the maximum possible intensity. The calculated setpoint values of the fans are saved in the corresponding address ranges in step “7”, thereby completing the priority list.

For example, the functional program module 1312 for ventilation control calculates in step “7” for the jet fan No. 3 a corresponding target value for the ventilation intensity of “100”. This value (see column “BF” of the fan SV No. 3) is written into an address range of the data memory 108 assigned to this parameter and to the fan No. 3.

In a further work step “8” of the same cycle, the target value “100” for the jet fan SV No. 3 is read from the said address range by the device program module 1330 of this same fan SV3 and the fan is started. In the next work step “9”, the program module 1330 then writes the speed actually achieved (actual value) into another address range reserved (assigned) for this purpose. When a fan is started, the corresponding device program module 1330 also begins time recording and writes and updates the previously measured running time of the fan into another address range reserved for this purpose.

The device program modules 1326, 1328 and 1332 also read control data or setpoints from the address ranges assigned to them in each cycle and start or stop their respective fans accordingly.

List of reference symbols

100

Traffic tunnel control system

101

PLC control

102

Management level

104

Control software

106

Processor(s)

108

Data storage

110

Program memory

112

Input image storage area

114

Intermediate result storage

116

Output image memory

118

Measured value buffer memory

120

PLC program

122

Fieldbus

124

tunnel

126

camera

128

fan

130

fan

132

Temperature sensor

134

Sensor for CO concentration

136

door

138

door

302

Functional program modules

304

Device program modules

308

Basic program modules

309

address

310

address

312

address

314

address

316-320

Basic program module

322-328

Function program module

330-336

Device program modules

402

Devices

403

address

404-416

Device program modules

508

Function program module

602

Function program module

606

Device program module

702

Device program module

704-708

Functional program modules

710

Configuration data

712

Configuration program module

802

Input program module

804

Output program module

806

Device program modules

901

GUI

930

Device program module full lighting

932

Device program module signal display

934

Function program module with EWM

936

Functional program modules

938

Device program module for door

952

Device program module full lighting

954

Device program module signal output

956

Function program modules

958

Function program module with EWM

959

Device program module for door

980

Device program module for door

982

Functional program module for communication with control software

984

Function program module with EWM

986

Device program module for adaptation lighting

988

Device program module for passage lighting

1302

Device program module for temperature measurement

1304

Device program module for traffic jam sensor

1306

Device program module for traffic jam sensor

1308

Functional program module for traffic jam data processing

1310

Functional program module for fire ventilation

1312

Function program module for ventilation control

1314

Device program module for environmental data sensor

1316

Device program module for flow sensors

1318-1322

Device program modules for flow sensors

1324

Device program module for line fire alarm control panel program module (LMZ program module)

1326-1332

Device program modules for fans

Claims (22)

Traffic tunnel control system (100) for a traffic tunnel (124), in particular for a road or rail tunnel or ship tunnel, comprising: - a programmable logic controller (101); and - a plurality of automation devices (126-138) which are coupled to the programmable logic controller via a field bus (122) or a network, wherein the programmable logic controller is configured to capture an input image from the automation devices, to process the input image and to generate an output image by executing a program (120) and to output the output image for controlling the automation devices, wherein the capture of the input image, the execution of the program and the output of the output image are repeated cyclically, wherein the program consists of a sequence of program modules, wherein at least a first of the program modules is assigned to an address range of an intermediate result memory (114) in order to store an intermediate result there, and wherein at least a second of the program modules is assigned to the same address range of the intermediate result memory in order to read the intermediate result from there and to process it further, where the intermediate result is stored by the first program module, and the reading and the further processing of the intermediate result is carried out by the second program module in the same cycle. The traffic route tunnel control system according to one of the preceding claims, wherein the program is free of program loops within a PLC cycle. The traffic route tunnel control system according to one of the preceding claims, - wherein the allocation of the first, second and preferably further program modules to address areas of the intermediate result memory is based on an allocation configuration contained in the respective program modules, - wherein an allocation configuration allocates one or more parameters to the program module comprising it and each of these parameters allocates an address range of the intermediate result memory which is intended for storing at least one parameter value corresponding to the parameter, - wherein the allocation configuration enables at least some of the program modules to store a parameter value related to a specific parameter as an intermediate result during the execution of a cycle, so that it can be read from this address range by another program module in the same cycle. The traffic route tunnel control system according to one of the preceding claims, - wherein the assignment configuration of one or more of the program modules contains an assignment of one of a plurality of predefined data types to at least one of the address ranges; - wherein at least some of the program modules are each configured to: ◯ when reading a parameter value from an address range of the intermediate result memory, check whether the data type of the read data value is identical to the data type assigned to this address range according to the assignment configuration of this program module; and ◯ in response to the determination that the data types are not identical, store the result of the non-identity in another address range of the intermediate result memory. The traffic route tunnel control system according to one of the preceding claims, - wherein the controller is configured such that the entire program with all program modules is stored in a working memory of the controller, - wherein at least one of the program modules of the program is configured to read and process a value of a parameter from an address range of the intermediate result memory assigned to this parameter in order to detect the presence of an event in the tunnel or in one of the automation devices, and - wherein the at least one program module is configured to generate a result which indicates the presence of this event and/or which serves to adapt the control of the traffic route tunnel in response to this event. The traffic tunnel control system according to Claim 5 , - where the event is selected from a group comprising: ◯ smoke development, ◯ a fire, ◯ an exceedance of a specified carbon monoxide limit, ◯ a traffic jam, ◯ a wrong-way driver, ◯ a stationary vehicle in a breakdown lane, ◯ an obstacle or objects on the road, ◯ a person in the traffic tunnel, ◯ the opening of an emergency call niche door, ◯ a traffic accident emergency call, ◯ the pressing of a button for disabled people, ◯ the removal of a fire extinguisher, ◯ the opening of an escape door, ◯ a failure or malfunction of one of the devices in the traffic tunnel, ◯ a failure of a transmission path to the permanently manned location, ◯ a power failure in the traffic tunnel, - and/or where the result is selected from a group comprising: ◯ a specification of the type, location and/or severity of the event; ◯ a control signal configured to place one or more of the devices in an operating mode suitable to limit and/or mitigate the severity of the event or its consequences. The traffic route tunnel control system according to one of the preceding claims, wherein the plurality of program modules are individually compilable and deployable. The traffic route tunnel control system according to one of the claims, wherein one or more of the program modules have an interface to a system control level control software (104) in the form of predefined address ranges of the intermediate result memory known to the system control level control software and are configured to transmit a parameter value calculated by the program module to the system control level control software via the interface and/or to receive a control command from the system control level control software. The traffic route tunnel control system according to one of the claims, wherein at least some of the program modules are device program modules, wherein a device program module is a program module that is assigned to at least one of the automation devices and is configured to process, read from and/or write to the intermediate result memory one or more parameters related to this at least one device. The traffic tunnel control system according to one of the preceding claims, wherein one or more of the program modules are each configured to receive sensor and/or status data from several of the devices from predefined address ranges of the intermediate result memory assigned to these devices, to aggregate them and to store the aggregated value as an aggregated intermediate result in another predefined address range within the intermediate result memory so that program modules executed later during the cycle can read and process the aggregated intermediate result. The traffic route tunnel control system according to one of the preceding claims, wherein at least some of the program modules are function program modules, wherein a function program module is configured to: - read parameter values stored in an address range assigned to the parameter within the intermediate result memory and/or an input image memory area; - calculate control data for controlling at least one of the automation devices using the read parameter values; and - store the calculated control data in an address range assigned to the automation device to be controlled within the output image in order to control at least one function of the automation device assigned to the function program module. The traffic route tunnel control system according to one of the preceding claims, - wherein only a single one (802) of the program modules of the program is configured to read the input image when executing a cycle of the program execution; - wherein only a single one (804) of the program modules of the program is configured to write the output image when executing the cycle of the program execution; - wherein all other program modules of the program read their input data from predefined address areas of the intermediate result memory and write them to predefined further address areas of the intermediate result memory; and - wherein the traffic route tunnel control system preferably comprises a user interface which enables a user, during the runtime of the program, to switch the operation of the program from a normal operating mode to the test operating mode by causing the only program module which reads the input image from the input image storage area (112) in the normal operating mode to read test input image data from another storage area of the data memory, and by causing the only program module which writes the output image into the output image storage area (116) in the normal operating mode to write the test output image calculated on the basis of the test input image data into another data memory or another address area of the data memory than into the data memory or storage area intended for storing the output image. The traffic route tunnel control system according to one of the preceding claims, wherein the devices are selected from a group comprising: - tunnel ventilation device, in particular jet fan, axial fan, suction flap; - temperature sensor; - lighting, in particular entrance lighting, passage lighting, emergency lighting, escape route information lighting; - camera; - lighting sensor, in particular luminance sensor, brightness sensor; - sensor for visibility in the tunnel; - sensor for smoke detection in the tunnel; - humidity sensor; - air speed sensor; - volume meter; - measuring cross-section for traffic volume detection; - display cross-section for the display of traffic signs in accordance with the StVO; - control unit for opening and closing escape and maintenance doors; - sensor for the open-closed status of doors and gates; - sensor for the status of lighting; - unit for generating fault and operating messages; - safety device, in particular fire extinguishing system, alarm system, fire detection system; - Power distribution and monitoring device. The traffic route tunnel control system according to one of the preceding claims, - wherein the controller is configured to execute at least one of the program modules only during the nth program execution, where n is an integer greater than 1. The traffic route tunnel control system according to one of the preceding claims, - wherein at least one of the program modules comprises an event-effect matrix (“cause-effect matrix”), - wherein the at least one program module is configured to generate at least a portion of the output image according to the event-effect matrix in order to control one or more of the devices according to the event-effect matrix. The traffic route tunnel control system according to one of the preceding claims, further comprising a system control level control software (104) for visualizing and/or controlling the program flow of the program. The traffic tunnel control system according to Claims 15 and 16 , - wherein the at least one program module with the event effect matrix includes an interface to the plant control level control software (104), wherein the interface enables the plant control level control software to control at least one function of the program with at least one control function; - wherein the event effect matrix is configured to overwrite the at least one control function of the plant control level control software such that a tunnel-specific adaptation of the functionality of the plant control level control software to the type and number of automation devices present in the tunnel takes place. The traffic tunnel control system according to one of the previous Claims 16 - 17 , - wherein the plant management level control software comprises a plurality of program modules; - wherein at least some of the program modules of the plant management level control software functionally correspond to one of the program modules of the program in that the program module of the plant management level control software is configured to graphically represent device-related parameter values that are processed by the program module and to output them on a display; - wherein the sequence and/or nature of the device-related parameter values displayed depends on the sequence and type of program modules in the program. The traffic route tunnel control system according to one of the preceding claims, - wherein the program modules are configured to exchange data with each other via predefined address ranges of the intermediate result memory; and/or - wherein the program modules and the system management level control software of the traffic route tunnel control system according to one of the Claims 16 - 18 are configured to exchange data with each other via predefined address ranges of the intermediate result memory. The traffic route tunnel control system according to one of the preceding claims, further comprising: - a power supply; wherein the power supply is located in the tunnel and/or in spatial proximity to the tunnel and the traffic route tunnel control system is configured to control the devices autonomously and self-sufficiently in emergency situations, even in the absence of external control commands and external energy sources, so that the emergency situation is eliminated or limited. Use of a traffic tunnel control system according to one of the Claims 1 - 20 for controlling a traffic tunnel (124). A program library for generating a program (120) for controlling a traffic tunnel (124) with a plurality of automation devices, the program library comprising: - a plurality of predefined program modules that can be assembled into a program for controlling a traffic tunnel (124), ◯ wherein one or more of the program modules are configured to process an input image of the automation devices and to generate an output image for controlling the automation devices, ◯ wherein at least a first of the program modules is assigned to an address range of an intermediate result memory (114) in order to store an intermediate result there, and ◯ wherein at least a second of the program modules is assigned to the same address range of the intermediate result memory in order to read the intermediate result from there and process it further, ◯ wherein the at least first and the at least second program module can be assembled in such a way that the program executes the at least one second program module after the at least one first program module, so that the result of the at least one first program module is used as an intermediate result by that at least a second program module can be read and processed in the same cycle in which it was calculated.

Images