DE2502764A1 - CONTROL DEVICE - Google Patents

Description

DR. E. WIEGAND DIPL-ING. W. NIEMANN 2502764

DR. M. KÖHLER DIPL-ING. C. GERNHARDT

MÖNCHEN HAMBURG ■ "."

TELEPHONE: 381233 2000 HAMBU RG 50, Qft Ii

TELEGRAMS: KARPATENT KON1GSTRASSE 28 * · ^fcl "'

W. 26602/75 20 / Af

Westinghouse Brake and Signal Company Ltd. London (England)

Control device

The invention relates to control devices and control systems in particular, but not exclusively, on control devices for complicated or, ".complexes Processes and situations, for example for signal controls on railways and process controls, where the Occurrence of wrong control signals undesirable or even is ominous.

Experience with railroad signal controls has shown that certain empirical principles are followed v / can ground, and a very long mean time between the occurrence / of failures on the unsafe side or; wrong i '.-. Lte (Γ-Τ.'Τ "-., T.F), i.e. situations where constriction occurs which creates a hazard. In the In practice, electromechanical relays have become a thing of the past Used in VerrLege long systems where the safety of le ti ^ f. · Is meaningful or of vital interest. Each-

S09831 / 0812

however, it has been widely recognized that electronic control systems have many advantages over electromechanical Control systems offer, however, stood out as an obstacle to the introduction of electronic controls from vital or important functions in railway signaling and other interlocking systems or among each other dependent processes counter the security question. Through mathematical analysis it is now recognized that by connecting the electronic control units in a special way the mean time until failure to the unsafe or wrong side could be increased exceptionally, probably up to a value so that this control is the well-known electromechanical Systems is superior.

According to a first feature of the present invention, a control device is provided which at least has two tax rates, plural marriage individually or each of them are able to perform a necessary tax function by generating corresponding output signals in response to common input signals, wherein the apparatus comprises an output signal comparator which is responsive to the output signals to provide output signals to control functions only to be carried out when a majority or all of the output signals match or, on the other hand, fail-safe is working. The apparatus may have three tax rates that operate on a majority basis. The comparison device can be an AND gate or a circuit that works in an analogous manner to an AND gate. the Tax rates may have input signal sensing devices, the solely to a single form of an input signal or to input signals in a range of

50-9 83 1/08 12

Address values that are relatively small in relation to possible values, causing erroneous input signals to be discriminated. The tax rates can have circuits operating in the same way work as the input sensing devices and respond to output signals to an improper or dangerous Determine the value or an impermissible or dangerous form of the output signal and preferably work to the effect of rendering the outputs of the device ineffective to make and / or to delete such output signals. The device preferably has an indicator and / or a display or alarm device that points to faulty work respond to the device to give warnings or messages about the malfunction.

According to a second feature of the present invention, a control system is provided which has a device according to the first feature of the invention ₃ furthermore has a detector which, during operation, is coupled to the devices to be controlled by the system in order to determine the status or the settings of the to determine the controlling device and to generate input signals for the device, which are indicative of the determined conditions or settings, and further comprises a device responsive to the output signals, which is coupled in operation to the device to be controlled to operate the device in accordance with To control output signals generated by the device. The device to be controlled may be a railway device which encloses a plurality of signals and display points or display signals, the control system performing a fail-safe interlocking control function which is a substantially larger one.

509831/0812

mean time to failure in the wrong direction compared to a single tax rate which is part of the control device forms. As a modification of this, the device to be controlled may be an electricity transmission system or a Chemical processing factory, for example a refinery, or any other device or plant in which no wrong Connections may be made. (In the case of a railway installation, connecting routes are allowed not be released at the same time, no signal representations may be carried out incorrectly, at least insofar as it is a misrepresentation of an onward journey signal; in an electricity transmission system Parts of the system that are not compatible with one another must not be interconnected; in a chemical Factory may not produce undesirable or dangerous mixtures).

The invention is explained below with reference to the drawing, for example.

Figure 1 is a schematic block diagram of a locking system for a railroad installation;

The figures

2 and 3 - show input and output circuits, respectively, for control devices used in the in FIG 1 can be used;

Figure 4 is a schematic diagram of the output comparator for use in the control unit.

In Figure 1 is the basic implementation of a system in which two conditions out of two possible conditions

509831/0812

actually have to be fulfilled (abbreviated also 2-of-2-systera) or a double locking railroad signal system is shown. The system is in an upper, not important one or non-essential section 10, where safety is not an absolutely essential condition, and divided into a lower vital section 20 where safety is an absolute factor. Of the Upper section 10 has a train description panel il, and a dual control computer 12 associated therewith, which consists of known systems. The dual computer 12 represents a parallel redundant system for maximum accessibility or ■ maximum efficiency, which works analogously to an output of the OR type, and is different of the dual control computer system according to the present invention.

The lower section 20 has two tax rates in the Form of a plurality of dual computer locking units 21 which act on track circuit relays, other inputs, control signal devices, signals and other (not shown) Address railway equipment via appropriate input and output circuits 22. One of the units 21 is working as a remote satellite locking system and is connected to the control computers 12 via multiplex or Demultiplex circuits 13 and 23 and an appropriate cable or connection 33 are connected.

The dual computer locking units 21 perform a pure locking function and are not required to perform any other control function (one with no safety requirement). The dual control computer 12 performs all other functions, including route selection, train description, train report, fault recording, etc. The computer 12 is preferably in fault-free states or under

509831/0812

such conditions do not attempt the locking units 21 to set a route which is not safe, i. H. the computers 12 should preferably not try to bypass or omit the locking units 21 or to use them.

To accommodate satellite relay rooms, the locking units 21 are preferably in small units performed and the master lock may require multiple such units. The potential benefits of This design is an increased standardization of the equipment or hardware, the effects of failure small units will expand less than failure of one large unit and smaller units can be more easily manufactured to meet security requirements.

(Described in connection with Figures 2 and 3) two Each locking unit 21 has mutually identical computer 2k, corresponding input and output circuits and an output signal comparison means 25, which will be explained k in connection with FIG. In the ideal case there is no common equipment in any unit 21 which could result in a failure on the wrong side (failure on the danger side). Preferably, each computer 2k is designed to be inherently fail-safe, but this is not absolutely essential with regard to the function of the output device 25. The number of components whose failure could cause failure on the wrong side is preferably one Minimum, which may require the total number of components to be small. As far as possible, all failures are self-indicating failures. The computers 2k can be programmed appropriately

509831/0812

General purpose or special purpose computers and preferably mini data processors used. The two computers 24 in each unit 21 preferably perform error checking programs and mutual memory parity checking. *

The input circuit of a computer 24 is described below with reference to FIG.

Contacts or other suitable detectors are denoted by ^ i 1, which are actuated by track circuits, signals or signal display devices and lead a positive supply voltage 42 via an alternating voltage decoupling circuit 43 to an input transistor 44. When transistor 44 is fully conductive (it is believed to be operating as a switching transistor), transistor 44 grounds one end of a resistor 45 and thereby brings its connection to a resistor 46 of substantially the same value to half the voltage between a point 47 connected to a positive voltage and the earth, thereby raising the data transmission path 48 of the computer to a special potential or level and if another input should malfunction at the same time, the data transmission path is raised to a different potential thereby causing the computer 24 to reject that particular input and to register it as an error, the status of the various contacts 4l (ie, whether they are open or closed) is interrogated cyclically by an address decoder 49 which is operated from signals _out; raised. , which have an addr food transmission line 50, the decoder 49 controlling an input gate 51 which acts to divert excitatory signals from the base of transistor 44,

509831/0812

unless this is special by the decoder 49 prepared or actuated. (Only one input circuit is shown for the sake of clarity reproduced, and parallel inputs, i.e. H. Data from different sources arriving at the same time, can be accepted along the data transmission line 48 or are accepted). The transistor 4 ^ act accordingly and resistors 45 and 46 as a circuit to determine one condition and only one condition, which is usually Regularly correcting the work is checked, for example by: "an appropriate signal is applied directly to the base of the input transistors.

The output circuit of a computer 24 will now be explained in detail with reference to FIG.

Each output (only one output is shown for clarity of illustration) has an address decoder 61, which operates from the address line 50 through which the outputs are individually addressed are, a monostable circuit 62, a relay driver stage 63 and a relay 64, which a plurality of actuated contacts shown in Figure 4. The one-shot circuit 62 is continuously running at regular time intervals triggered by the computer 24 (via the address line 50 and the address decoder 61) when the specific Output in the "!" State under the control of the control input signals from the control computer 12 should go. The driver stage 63 then energizes the relay 64. The address decoder are operated (if necessary) individually in a cyclical sequence, and the outputs of the decoders are activated by appropriate Circuits queried or checked which state "1" and only determine this state (circuit 65 with regard to the decoder 6l), which in the same

509831/081 2

Way are effective, like the im. Related to · the corresponding circuit described in the description of FIG.

Referring to Figure 4, there are details of the output comparator 25 one of the locking units 21 with respect to the one relay 64 of each of the outputs of the two computers 2 * 1, which are labeled A and B. are to distinguish them from each other. These relays provide the same outputs from the two Halves of the unit 21. A single relay OOC (out ~ of-correspondence) is through front (normally open) and rear (normally closed) contacts of all relays 64, as shown in the lower part of FIG. 4 in block 25, and only the contacts of relay A are controlled and B are shown in detail. The relay 0OC only remains energized as long as all outputs from one Computer 24 in unit 21 with the corresponding outputs of the other computer 24 in the same unit 21 match, and relay 00C will, should, drop out there may be some discrepancy between these duplicated outputs. However, since the inputs to the unit 21 are cyclical be sampled by the computer 24, and since these samples are not synchronized with one another, it is possible that an input after it has been scanned by the one computer 24 and sufficiently before it has been through the Another computer 24 in the unit 21 is scanned, changes to allow the output of the first computer 24 to be relative to the corresponding output of the second computer 24, so as to result in an obvious discrepancy cause which in fact is not an error condition; Therefore, the relay 00C is given a release time not less than the length of the input scan cycle of the computer 24

509831/08 12

- ίο -

plus any desired addition. This release time; should not be made longer than necessary, since if two produce identical outputs • Errors in the output occur within the release time, such a coincidence (although unlikely) could cause failure on the wrong side.

While relay OOC remains energized, outputs 22 can be energized from appropriate energy sources 71 through cooperating contacts of relays A and B (as another parity check for safety), as shown in the upper half of block 25, causing a the output signal responsive device is formed to thereby feed display devices, multi-display signals, "train command circuits and other railway devices (not shown), the correct operation of which is of vital importance in consideration of safety. Should a mismatch in the outputs of the computers 2k occur, namely a mismatch other than the possible-brief mismatch due to the input sampling cycles (as discussed above), after its enable time has elapsed, relay 0OC will drop and stay dropped because it is energized by one of its own front (normally open) contacts (and even then not again anzi eht, if another error like Icher doubles exactly the same incorrect output from computer 24 occurs).

Figure 4 shows only one way to an essential Part of the present invention to implement other ways to obtain fail-safe parity checking are known.

509831/0812

- ii -

A possible disadvantage of the system described above could be that in the event of an internal fault in one of the units 21, the entire part of the railway control device which is controlled by this unit 21 is switched off. In order to overcome this problem that arises when using consensus systems, it is possible according to the invention to use a majority system, for example one in which there are three tax rates, ie in which the computers 2H within each Unit 21 are present in triplicate, in which, however, the output signal comparison device 25 only requires two of these three computer outputs in order to generate acceptable outputs. Such a system is _s must in which all outputs of the tax rates coincide as such a little less bootcovers, but it remains functional despite a single fault.

A principle that should be followed when designing control devices and control systems, which works as described above, it is to be ensured as far as possible that control commands are only given by excitation rather than being given by de-excitation. If the computer outputs are excited accordingly or to the logical count or the state "1" to be excited to a control signal generate, the output signal device 25 can simply be an AND gate, in which the computer outputs match is required.

509831/0812

Claims (1)

Claims f Ij) control device, characterized by at least two control sets (24), each of which is individually capable of performing a required control function by generating corresponding output signals in response to a common input signal and by an output signal comparison device (25) ₃ which responds to the output signals ,
to let pass output signals to the control function only then carried out when a plurality or all of the output signals match or otherwise _w refusal sure continue work. 2. Control device according to claim 1, characterized
through three tax rates, which are on a majority basis
work. 3 control device according to one of claims 1 or 2, characterized in that the comparison device (25) has an AND gate or an element operating in an analogous manner is. 4. Control device according to one of claims 1 to 3, characterized in that the control sets (24) are input signal sensing devices (44, 45, 46) that only to a single form of input signal or to input signals respond in a range of values which is relatively small compared to possible values, whereby erroneous input signals are discriminated. ■ 5. Control device according to claim 4, characterized in that that the control sets (24) have circuit elements (65) which are in the same manner as the input signal sensing devices (44, 45, 46) work and on 509831/0812 address input signals to detect an impermissible or dangerous Determine the level or an impermissible or dangerous form of the input signal. 6. Control device according to claim 5 _3, characterized in that the circuit element (65) makes the output of the device (24) ineffective and / or deletes such output signals. 7. Control device according to one of claims 1 to 6, characterized by an indicator and / or an alarm device, which responds to malfunction of the device in order to give a warning or message of the malfunction. 8. Control system with a control device according to a of claims 1 to 7, characterized by a detector device (4l), which is coupled during operation to the device to be controlled by the system, to the condition or to detect settings of the device to be controlled and to assign input signals to the device generate which are indicative of the conditions or states identified, and by one on the output signal appealing device (63, 64), which in operation coupled to the device to be controlled, the device in accordance with by the device to control generated output signals. 9. Control system according to claim 8, characterized in that the device to be controlled is a railway system which has a plurality of signals and signal display devices and that the control system performs a fail-safe control interlocking function which provides a mean time between the occurrence of failures on the unsafe or Has dangerous side, which is much larger than that of the individual tax rates (24) ₃ which form part of the control device. 509831/0812 10. Control system according to claim 8, characterized in " that the device to be controlled is an electricity transmission system or a chemical processing plant, such as a refinery, or other control system in which no wrong connections may be made. 509831/0812 Blank page