EP0031046A2 - Device for data secure control and supervision of electric equipments - Google Patents

Abstract

In a remote control system which is operated by way of light wave guides a specific switching routine is executed at the receiving side upon failure of the system. As long as the remote control system functions properly, cyclically alternating signals, triggered at the transmission side, set a logic element at the receiving side so that the loads are connected for normal command-responsive operation. When the signals fail, or when a transmission is intentionally suppressed, the logic element is conditioned to cause execution of the specific switching routine. Given the design of the remote control system as a light signal control for traffic signals, the switching routine causes the connection of the STOP signal with simultaneous disconnection of the GO signals of the respectively affected light signal.

Description

The invention relates to a device according to the preamble of claim 1.

For monitoring electrical consumers, it is known to measure the current consumption of the consumers and to compare the measured values recorded with predetermined target values. The monitoring process can be carried out continuously over dedicated lines, as is the case, for example, with the monitoring of traffic light systems in the railroad sector, or it can be carried out cyclically or sporadically in successive time intervals, which allow a sufficiently short error detection time to be achieved.

In order to identify errors that could occur in the measurement of the current consumption of the electrical consumers, for example by shunts to the switches, and to detect transmission interference, for example by coupling electrical signals arise in the transmission path between the consumers and the control center and could pretend a certain operating state of the consumers in the control center, it is known to trigger certain reactions by briefly inverting the control commands on the consumer side and to evaluate the short-term change of state of the monitoring messages. Such a system for controlling and monitoring electrical consumers is described, for example, in the electronics magazine of August 30, 1979. There, a control and monitoring device for motor vehicles operated by a microprocessor is presented, in which the individual consumers, preferably the lighting devices of a vehicle, are monitored by briefly switching off the consumers that are operationally switched on and briefly switching on the consumers that are switched off. The time spans for the short-term reversal of the consumers are chosen so that the monitoring devices can respond to the determination of the respective consumer current, but the human eye cannot yet follow the switching on and off of the consumers in the reversal periods. The known control and monitoring device, even if only with a limited number of consumers to be monitored, enables extraordinarily rapid fault detection in the event of a fault. A message board is provided for the fault display, on which each fault identified can be optically localized. This optical localization is the starting point for subsequent troubleshooting.

The further the consumers to be controlled and monitored are from a control point, the more The risk of transmission errors increases, both in the command and in the signaling direction. According to the current state of the art, these transmission errors can be avoided by using optical fibers as the transmission medium between the control point and electrical consumers. If transmission interference can also be ruled out with these optical fibers by coupling interference variables, component failures in the connected transmit and receive modules must be expected. These component failures are not as easy to determine when using electronic switching means as, for example, when using special relays with positively driven contacts, the switching status of which can be monitored several times simultaneously in different circuits. Since component defects cannot be ruled out in principle, special measures - at least in those areas of application in which undetected incorrect information can lead to personal injury or property damage - can result in the fail-safe behavior of the circuits working with these components, i.e. unavoidable component defects may be achieved lead to a dangerous operating state neither in the transmitter nor in the receiver modules of the system and the downstream circuits.

The object of the present invention is to provide a device according to the preamble of claim 1 which, despite the use of relatively unsafe switching elements, is sufficiently safe both in the control point and in the local operating points in the signaling sense.

The invention solves this task by applying the features specified in the characterizing part of the main claim. Particularly advantageous additions and embodiments of the device according to the invention are specified in the subclaims.

The invention is explained below with reference to an embodiment shown in the drawing.

The drawing shows in the left part the command transmitter KS and the message receiver ME of a control center, in the right part the command receiver KE and the message transmitter MS for several electrical consumers arranged spatially adjacent to one another at a certain operating location; the electrical consumers are symbolized by signal lamps L1 to L4. The command transmitter KS and the message receiver ME of the control station are controlled, for example, by a secure microcomputer, not shown, to whose data and address bus DB and AB an input register ER for commands and an output register AR for messages are connected. To take command, the input register ER of the command transmitter is addressed by the address bus AB of the computer; it takes the data from the data bus DB into the register. This register can have a width of 5 bytes, corresponding to 40 bits. After the 5th byte has been written into the input register ER, the conversion of the bits stored in the register into a serial telegram is started. For this purpose, the data are read out from the input register ER into a parallel / series converter PSK for the commands and fed from this to an encoder CK for the commands. In this encoder CK, the pulse sequence supplied by the parallel / series converter PSK is converted into a for the Transfer appropriate form implemented. This is done, for example, by the encoder CK converting the bits read out from the parallel / series converter PSK into a pulse train with a changing pulse / pause ratio, depending on their respective binary state. A counter ZS1 is connected to the output of the encoder CK; by counting the pulses emitted by the encoder, this counter is able to recognize the beginning and the end of a pulse telegram complete for the command. It blocks the encoder after the output of a complete command telegram and thus ensures that no further telegram can be output without new input information.

The commands are transmitted from the command transmitter to the message receiver via an optical fiber LWK for the commands. For this purpose, the pulse sequences emitted by the encoder CK with different pulse-pause ratios are converted into short light pulses with a corresponding pulse spacing in a transmission module SK and fed into the optical waveguide. In a receiving module EK at the operating location of the consumers to be controlled and monitored, the light pulses received via the optical waveguide LWK are converted back into electrical pulses, the pulse pause ratio of which corresponds to the pulse pause ratio of the pulses emitted by the encoder CK to the transmitter module SK. A downstream decoder DK for the commands converts the supplied pulse sequence back into the bit sequence extracted from the parallel series converter PSK with the associated binary status values "high" and "low" and feeds it to a series / parallel converter SPK for the commands. As soon as a counter ZE1 assigned to the message receiver ME has a switch position corresponding to the number of bits to be transmitted is sufficient, it delivers a transfer pulse to an output register AS downstream of the series / parallel converter SPK, which then takes over the bit sequence stored in the series / parallel converter SPK and makes it available for the execution of the command.

In the exemplary embodiment shown, it is assumed that each bit of the bit sequence transmitted via the optical waveguide LWK is assigned to a specific consumer of the operating location and that the respective binary signal state of this bit identifies the respective desired operating state of the associated consumer. For this reason, switches T1 to T4 are connected to the outputs of the output register AS and are used to switch the consumers L1 to L4 on and off. The respective switching state of the consumers L1 to L4 is determined by monitors U1 to U4 connected directly or indirectly to their current path and is sent to a message transmitter MS for issuing status messages. The monitors are advantageously designed as threshold switches, which respond to an inadmissibly low and an inadmissibly high consumer current and which issue a status message for the relevant consumer which is different from the status message given in the case of a proper consumer current.

In the message transmitter, the status messages of the monitors U1 to U4 are fed as a bit pattern to a parallel / series converter PSM for the messages. At its output, this parallel / series converter emits a pulse train to an encoder CM for the messages which, when all the consumers in the operating location are in the correct operating state, with the exception of a few test bits and a monitoring bit for the switching element of the pulse train forwarded by the parallel / series converter PSK of the command transmitter KS. to the local encoder CK. corresponds. The encoder CM for the messages has the same structure as the encoder CK for the commands. It converts the pulse train supplied to it by the parallel / series converter PSM into a pulse train with a pulse / pause ratio that corresponds to the binary signal state of the bit pattern adopted by the parallel / series converter. A counter ZS2 connected to the output of the encoder CM responds as soon as the encoder CM has forwarded a complete message telegram to a transmission module SM connected downstream of it and then blocks the output of further signals by applying blocking potential until commands are received again by the command receiver . The switching means for synchronizing command reception and message delivery are not shown in the drawing because they have nothing to do with the essentials of the invention. The synchronization is carried out by recovering the constant switching frequency for the parallel / series converter PSK selected on the transmission side from the clock pulse sequence of the commands received via the fiber optic cable LWK with a different pulse / pause ratio.

The pulse sequence supplied by the encoder CM of the message transmitter is converted in a transmission module SM into short light pulses with a corresponding pulse spacing and transmitted via an optical fiber LWM for the status messages to the message receiver ME of the control center. There, a signaling module EM is connected to the optical waveguide LWM, which converts the received light pulses into electrical pulses with different pulse intervals in accordance with the receiver module EK of the command receiver. A downstream one Decoder DM for the messages converts these pulses into corresponding binary signals with the signal states "high" and "low". The bit pattern emitted by the decoder DM reaches a series / parallel converter SPM for the messages and is buffered there. A counter ZE2 connected to the output of the receiver module EM, which counts the incoming pulses, responds after receipt of a complete pulse telegram and outputs an accept pulse for the output register AR, which then accepts the bit sequence stored in the series / parallel converter SPM . The received data on the data bus are called up as required from the output register AR.

The correct execution of the commands can be determined by comparing the data stored in the output register AR with the sent commands. For this purpose, the commands sent are to be stored in temporary memories (not shown) until the corresponding feedback has been received.

By triggering short-term control commands for an individual or all consumers at an operating location, the transmission path from the control point to the consumers and back and the functional behavior of the consumers can be monitored. In order to achieve the required security in the control and monitoring of the consumers, it is not only necessary to recognize any faults or any misconduct on the part of the consumer, but it must also be possible for the control point to target the consumers in the event of a fault individual locations. This can be done, for example, by switching off some or all of the consumers to the one individual locations.

In order to be able to address the consumers of the individual operating locations reliably and precisely in the event of a fault, a switching element R which can be acted upon by certain control commands from the control point is provided at each operating location and becomes effective if the control commands are not present for a specified period of time. It then permanently switches off those consumers of the operating location in question according to a predetermined switching routine, the current-carrying state of which could represent a hazard. In addition, the switching element switches on a consumer, the current-carrying state of which signals a moment of danger and which thus leads to relaxation of the dangerous situation at the operating location.

According to the invention it is provided that the control commands to act on the switching element are formed by cyclically changing reversing commands. The time between two successive control commands is determined by the permissible error disclosure time, which in turn determines the time interval for the treatment of the consumers of an operating location by the safe microcomputer of the control center. If the rerouting commands are omitted, for example as a result of a transmission disturbance or if they are deliberately suppressed by the control unit, the switching element acts on the consumers of the operating location concerned in accordance with the predetermined switching routine. The respective switching state of the switching element can be recognized by corresponding status messages in the control unit, which triggers a fault signal in the absence of changing status messages in the successive transmission cycles.

In Figure 1, the switching element R is symbolically indicated as a relay circuit and the switching means controlled by it as relay contacts R1 to R4. The arrangement is such that the switching contacts assume the switching position shown, as long as changeover signals for the switching element are received from transmission cycle to transmission cycle. If these control commands fail, the switch contacts R1 to R4 change their position. As a result, the consumers L1 and L2 are switched off by opening the switch contacts R1 and R2; At the same time, the consumers L3 and L4 are energized via the contacts R3 and R4, regardless of whether the switches T3 and T4 are closed or not. The switching element can also be designed in a different technology than in relay technology; Accordingly, other corresponding switching means are then to be used instead of the switching contacts shown.

In the illustrated embodiment, the consumers are designed as signal lamps of a light signal. The lamps L3 and L4 should be assigned to the stop concept of the signal; The lamps L1 and L2 stand for a large number of signal lamps for representing driving terms.

In the event of any fault, which must be classified as questionable by the control point, the switching element can become effective and thus the switching of the switching means controlled by it can be brought into effect by deliberately suppressing the reversal commands for the switching element located in the faulty consumers. So, for example, if for some reason a light signal is incorrectly displayed on a light signal, although this should not be the case, it is in the tax by comparing the no longer corresponding commands with the retransmitted messages. Safe access to the switching element means that the incorrectly activated signal term is switched off and the one STOP signaling danger is switched on. This process also takes place if the transmission path via the optical fiber or one or more of the elements of the command transmitter or the command receiver are defective. As soon as the reversing commands for the switching element are not available for a longer period of time, the loads arranged at the associated operating location are controlled in a switching state in accordance with the emergency or fault program previously defined for the operating location concerned, which precludes personal or material hazards due to incorrectly transmitted or evaluated commands.

To test the function of the telecontrol system and the electrical consumers at the individual operating locations, it is now possible, in a known manner, to issue short-term test commands from the control point which reverses the consumers arranged there at the operating location that is switched on. It is easily possible to briefly switch off all connected consumers at the same time and to evaluate the corresponding feedback in the control center. However, it is usually not possible to briefly switch on all previously switched off consumers because this could lead to unacceptable drops in the supply voltages. This risk is particularly to be expected when switching on signal lamps, because at the moment they are switched on they draw a cold current that is far above their nominal current. For this reason, the testing process is divided into several. successive sections for each just break down some of the consumers. If you break down the test program so that during a first test phase only the secondary thread and in a further test phase main and secondary thread of a signal lamp are briefly switched on together, then the retransmitted status messages can not only determine the correct operating state of the two lamp threads _. but also carry out a functional test of the lamp thread monitors for the changeover from main to secondary thread. In the second test phase, both threads will initially draw electricity; As soon as a lamp thread monitor switched into the current path of the main thread has responded, it switches off the secondary thread that was already switched on in the first test phase, the monitor switched into the current path of the secondary thread sending a corresponding status message to the control point.

In application of the invention, not only a functional test of the consumers, but also a functional test of the monitoring devices is possible and provided. This functional test is not coupled with the test program for testing the functional behavior of the consumers, which was explained in more detail above. Like this test program, however, it serves to increase the operational safety of the telecontrol system.

In order to check the functional behavior of the monitoring devices, they are first controlled into one and then into the other switching position by assigned commands, regardless of the switching state they assume. The control of the monitoring devices is shown in the drawing by dashed lines between the output register AS of the command receiver and the monitoring devices U1 to U4 indicated. From the status messages of the monitoring devices transmitted to the control unit during this test process, the correct or incorrect operating behavior of the monitoring devices including that of the switching element R can be recognized by comparison with the target states of the monitoring devices specified by the control unit.

In the case of the exemplary embodiment described above, it was assumed in a simplistic manner that the two transmitter modules issued the same commands and messages if the telecontrol system functions properly. However, it is more advantageous to invert either the commands or the messages in the associated transmitter and in the associated receiver and thus to force a response that is different from the associated command.

The illustrated embodiment relates to the application of the invention in a light signal system. The invention can of course also be used advantageously in other telecontrol systems in which a safe access to the consumers is required in the event of a fault.

Claims (10)

1. Device for the signal-technically safe control and monitoring of several electrical consumers arranged spatially adjacent to individual operating locations from a control point, in particular for controlling and monitoring light signal systems in railroads that are fed over greater distances, using preferably electronic switching means for comparing the loads from the consumers the control unit retransmitted status reports of the consumers with the commands triggered there, characterized in that the control unit transmits the commands worked out cyclically to the individual operating locations of the consumers (L1 to L4) via a telecontrol system and that at each operating location a changeover command which changes from transmission cycle to transmission cycle Switching point (R) which can be acted upon by the control point is provided which, in the absence of the reversal commands beyond the intended cycle time, also consumes the consumers (L1 to L4) of the relevant B Operating location switches on or off according to a predetermined switching routine and that the switching element (R) can be specifically switched off when the control unit detects certain operating faults by suppressing the reversal commands. 2. Device according to claim 1, characterized in that the predetermined switching routine includes the switching off of all consumers (L1, L2) of the operating location concerned, with the exception of those consumers (L3, L4) whose current-carrying state signals a moment of danger, 3. Device according to claim 2, characterized in that the predetermined switching routine includes switching on those consumers (L3, L4) whose current-carrying state signals a moment of danger. 4. Device according to claim 1 or 2, characterized in that means for inverting the data to be sent and the received data are provided at the control point and at the operating locations either in the command or in the reporting channel of the telecontrol system. 5. Device according to claim 1, characterized in that for the connection from the control point to the operating locations, a transmission system consisting of two separate optical fibers (LWK, LWM) is provided, one of which is an optical fiber (LWK), the command channel for the transmission of commands and, whose other optical fiber (LWM) forms the reporting channel for the transmission of status reports. 6. Device according to one of claims 1 to 5, characterized in that at the operating locations in the vicinity of the consumers are arranged as threshold switches trained monitors who recognize an impermissibly low and an impermissibly high consumer current and issue a related status message for the consumer concerned , which is different from the status message given when the consumer current is correct. 7. Device according to claim 1 and 6, characterized in that the evaluation of the status messages is only permitted in the control center if the retransmitted status messages are correctly assigned to the commands. 8. Device according to claim 1 and 5, characterized in that the commands and messages are transmitted via the optical fibers in time-division multiplex operation, with each consumer of an operating location being assigned at least one bit of the pulse train transmitted within a transmission cycle. 9. Device according to claim 8, characterized in that in each case a series / parallel converter and a counter (ZE1 or ZE2) is connected both in the control point and at the individual operating locations to the respective feeding optical fibers (LWK or LWM) and that the counter (ZE1 or ZE2) has received an output pulse for receiving the bit sequence present in the associated series / parallel converter (SPK or SPM) to an output register (AS or AR) after receiving a number of pulses to be transmitted per transmission cycle ) issues. 10. The device according to claim 8, characterized in that a counter connected to the respective transmission channel (ZS1 or ZS2) is provided both in the control point and at the individual operating locations and that the counter after receipt of one of the number to be sold per transmission cycle Number of pulses emits an output pulse to interrupt the transmission of information via the optical fiber in question (LWK or LWM) until a new command or a new message.

Images