EP0503336B1 - Arrangement for fail-safe remote control of a substation in a railway system - Google Patents
Arrangement for fail-safe remote control of a substation in a railway system Download PDFInfo
- Publication number
- EP0503336B1 EP0503336B1 EP92102996A EP92102996A EP0503336B1 EP 0503336 B1 EP0503336 B1 EP 0503336B1 EP 92102996 A EP92102996 A EP 92102996A EP 92102996 A EP92102996 A EP 92102996A EP 0503336 B1 EP0503336 B1 EP 0503336B1
- Authority
- EP
- European Patent Office
- Prior art keywords
- station
- sub
- computer
- central station
- computer system
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Lifetime
Links
Images
Classifications
-
- B—PERFORMING OPERATIONS; TRANSPORTING
- B61—RAILWAYS
- B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
- B61L27/00—Central railway traffic control systems; Trackside control; Communication systems specially adapted therefor
- B61L27/30—Trackside multiple control systems, e.g. switch-over between different systems
Definitions
- the invention relates to a device according to the preamble of patent claim 1.
- a device is from Signal & Draht, Vol. 77, No. 4, April 1985, pages 67-72, "SAFE L go", Halfpap et al. known.
- the known remote control requires a special, signal-technically secure command line for transmitting the execution command.
- the invention has for its object to provide a remote control device that enables a transmission of commands to be carried out safely by signaling without a special command line that is safe by signaling.
- a device that solves this problem is represented by the features of claim 1.
- the device according to the invention enables the use of commercially available, non-secure computers, e.g. Personal computer, in the central station.
- Special security measures are limited to checking the redundantly received report image data by comparison. All test and security measures can be carried out in the substation using the two computer channels.
- claim 3 protects the transmitted message information from corruption by bit lines that have become static at parallel computer inputs and outputs.
- the manual switching of the screen required according to claim 4 to the computer system capable of displaying the security code prevents thoughtless routine confirmation of requested auxiliary operations.
- the figure schematically shows a central station Z and a substation UST1 with their most important devices and a transmission link U connecting both stations. Additional substations UST2 can also be connected to the transmission link.
- the central station contains two computer systems R1, R2, e.g. Personal computer, which can be alternately connected to a display device M via a changeover switch MS to display a stored message image. Only the computer system R1 has a manual input T and a printer D for recording actions that are required to be recorded. Data output on the transmission link Ü via a modem MZ is also only possible from the computer system R1.
- R1, R2, e.g. Personal computer which can be alternately connected to a display device M via a changeover switch MS to display a stored message image.
- Only the computer system R1 has a manual input T and a printer D for recording actions that are required to be recorded.
- Data output on the transmission link Ü via a modem MZ is also only possible from the computer system R1.
- the substation UST1 has a computer system which is secure in terms of signal technology and has two computer channels, each of which consists of a main computer UR1, UR2 and a front-end computer VR1, VR2.
- the two main computers are connected to one another via a neighboring computer connection NRB and via a control and message bus SMB to the hardware STW of the substation to be controlled.
- connection to the transmission path runs here via the upstream computer of the computer channels. These are connected to a substation modem MU in the output direction with separate outputs. In contrast, inputs of both upstream computers are acted upon in parallel from a common output of the modem.
- Control commands which are entered in the central station and are intended to result in an actuating action without special security responsibility in the substation, pass from the input T into the computer system R1.
- the computer system develops the command corresponding to the control command and outputs it to the modem MZ, from where it is, e.g. as a serial, frequency-modulated data telegram, which is transmitted on the transmission link.
- the substation modem MU converts the data telegram into the originally entered command and routes it to the pre-computers of both computer channels in parallel.
- Both computer channels now decode the control command contained in the received command. They exchange interim results and the end result via the neighboring computer connection NRB and compare their own result with that of the neighboring computer channel. If the results are determined by both computer channels, the control command is output on the control and message bus and the actuating action is thus triggered.
- reporting lines of the control and reporting bus These are queried at regular intervals and after each actuation by both computer channels for their switching status.
- the result of the query is sent to the substation modem MU separately from both pre-computers and transmitted to the central station as a reporting data telegram.
- one of the front computers gives his Data in inverted form on the modem.
- both computer systems receive the reporting data transmitted from both computer channels of the substation in parallel and compare the simply transmitted data with the inverted transmitted data. If there is a match, the transmitted current switching states are saved and taken into account in the display of the message image. From the change in the message screen, the operator can see whether the control command he has entered has been executed.
- a control command for this is likewise entered into the computer system R1 via the operating device T and transmitted as a command to the substation.
- a command with security responsibility is identified as such by an addition or a special form of input. But it can also only be in the substation, e.g. by comparing the received command with pre-stored lists of safety-relevant and non-safety-relevant commands, it can be determined whether the command to be executed has safety meaning.
- the computer channels of the substation determine when a command transmitted from the central station relates to an actuating action that is to be carried out with security responsibility.
- the control command contained in the transmitted command is first stored in the substation in a signal-safe manner.
- the associated actuation is not yet carried out.
- a specially marked message data telegram is transmitted to the central station via the signaling-safe signaling path, which simulates the actuation that has not yet been carried out.
- the computer controlling the display device displays this anticipated actuation action in a special shape or color on the display device.
- the actuation action to be carried out is thus "mirrored" in the central station. The operator can check again whether the mirrored command corresponds to the originally entered command and can finally decide whether the command should be carried out.
- the computer channels of the substation contain a program for generating a special security code.
- This program is processed when a command triggering an actuating action with security responsibility is recognized and the determined security code is transmitted to the central station together with the data required to mirror the actuating action to be performed.
- the security code can now be displayed in the central station and, after being entered again, can be transferred back to the substation as an execution command. There it is compared with the originally generated security code stored there. If there is a match, the execution command is given. The prepared actuation is carried out.
- the computer system R2 In the central station, only the computer system R2 that is not used for command transmission contains a program for receiving and displaying the security code. The computer system R1 is unable to record and display the security code or to transmit it back to the substation.
- the security code can only be retransmitted if the computer system R2 is connected to the display device by means of the manually operable switch MS, for example, and is thus able to display the security code to the operator.
- the operator is forced to enter the displayed security code into the computer system R1 by means of the operating device T if it wants to transmit it to the subordinate station and thus to execute the prepared actuating command.
- the security code can also be transmitted in encrypted form to the central station, decrypted in a decrypted form in the second computer with the aid of a decryption program only contained therein, and transmitted back to the substation after being entered again become.
Landscapes
- Engineering & Computer Science (AREA)
- Mechanical Engineering (AREA)
- Selective Calling Equipment (AREA)
- Remote Monitoring And Control Of Power-Distribution Networks (AREA)
- Electric Propulsion And Braking For Vehicles (AREA)
Abstract
Description
Die Erfindung betrifft eine Einrichtung gemäß dem Oberbegriff des Patentanspruchs 1.The invention relates to a device according to the preamble of patent claim 1.
Eine Einrichtung gemäß dem Oberbegriff des Anspruchs 1 ist aus Signal & Draht, Bd.77, Nr.4, April 1985, Seiten 67-72, "SAFE L go", Halfpap et al. bekannt.A device according to the preamble of claim 1 is from Signal & Draht, Vol. 77, No. 4, April 1985, pages 67-72, "SAFE L go", Halfpap et al. known.
Eine solche Einrichtung ist in ihren wesentlichen Teilen z.B. in einem Beitrag der Stadtbahn-Gesellschaft Rhein-Ruhr, Gelsenkirchen mit dem Titel "Konzeptionelle Festlegung der Verbindungsschaltung - Datenübertrager und -konzentrator - der Stadtbahn Rhein-Ruhr SSR" in der BMFT-Veröffentlichung "Statusseminar BMFT '82" enthalten.The essential parts of such a device are e.g. in a contribution by the Stadtbahn-Gesellschaft Rhein-Ruhr, Gelsenkirchen with the title "Conceptual definition of the connection circuit - data transmitter and concentrator - the Stadtbahn Rhein-Ruhr SSR" in the BMFT publication "Status Seminar BMFT '82".
Hier ist auf Seite 46 die Fernsteuerung von Streckenstellwerken von einem Zentralstellwerk aus beschrieben. Ein dem Streckenstellwerk zugeordneter, intelligenter Datenübertrager und -konzentrator (DÜK) empfängt Stellkommandos von dem Zentralstellwerk und leitet sie an das Streckenstellwerk weiter. Signaltechnisch sicher auszuführende Kommandos werden vom Datenübertrager und -konzentrator signaltechnisch sicher an das Zentralstellwerk zurückgespiegelt und erst ausgeführt, wenn nach nochmaliger Kontrolle durch den Bediener ein von diesem eingegebenes, signaltechnisch sicher übertragenes Ausführungskommando empfangen wird.The remote control of interlockings from a central signal box is described on page 46. An intelligent data transmitter and concentrator (DÜK) assigned to the interlocking receives control commands from the central interlocking and forwards them to the interlocking. Commands that are to be executed safely in terms of signaling are safely reflected back to the central signal box by the data transmitter and concentrator and are only executed when, after a further check by the operator, an execution command entered by the operator and transmitted in terms of signaling is received safely.
Die bekannte Fernsteuerung benötigt neben einer für Regelbedienungen verwendeten Übertragungsleitung eine besondere, signaltechnisch sichere Kommandoleitung zur Übertragung des Ausführungskommandos.In addition to a transmission line used for control operations, the known remote control requires a special, signal-technically secure command line for transmitting the execution command.
Der Erfindung liegt die Aufgabe zugrunde, eine Fernsteuereinrichtung zu schaffen, die eine Übertragung signaltechnisch sicher auszuführender Kommandos ohne eine besondere, signaltechnisch sichere Kommandoleitung ermöglicht.The invention has for its object to provide a remote control device that enables a transmission of commands to be carried out safely by signaling without a special command line that is safe by signaling.
Eine Einrichtung, die diese Aufgabe löst, wird durch die Merkmale des Patentanspruchs 1 wiedergegeben. Die Einrichtung nach der Erfindung ermöglicht den Einsatz handelsüblicher, nicht sicherer Rechner, z.B. Personal Computer, in der Zentralstation. Besondere Sicherungsmaßnahmen beschränken sich dort auf die Prüfung der redundant empfangenen Meldebilddaten durch Vergleich. In der Unterstation können alle Prüf- und Sicherungsmaßnahmen mittels der beiden Rechnerkanäle ausgeführt werden. Besondere, signaltechnisch sicher arbeitende Schaltungsteile, wie sie z.B. zum Empfang eines sicheren Ausführungskommendos notwendig wären, können entfallen.A device that solves this problem is represented by the features of claim 1. The device according to the invention enables the use of commercially available, non-secure computers, e.g. Personal computer, in the central station. Special security measures are limited to checking the redundantly received report image data by comparison. All test and security measures can be carried out in the substation using the two computer channels. Special circuit components that work safely in terms of signaling, such as those e.g. would be necessary to receive a safe execution coming.
Weiterbildungen der Einrichtung nach der Erfindung sind Gegenstand der Unteransprüche. So erlaubt der Einsatz von Vorrechnern in den Rechnerkanälen der Unterstation gemäß Anspruch 2 eine Trennung der für die sichere Meldungsübertragung und den Kommandoempfang auszuführenden Verarbeitungsschritte von der Kommandoausgabe an die Stellelemente und der Erfassung von deren aktuellem Schaltzustand.Developments of the device according to the invention are the subject of the dependent claims. For example, the use of pre-computers in the computer channels of the substation allows the processing steps to be carried out for the secure transmission of messages and the receipt of commands to be separated from the command output to the control elements and the detection of their current switching status.
Der Gegenstand des Anspruchs 3 sichert die übertragene Meldungsinformation vor Verfälschung durch statisch gewordene Bitleitungen an parallelen Rechnerein- und ausgängen.The subject matter of claim 3 protects the transmitted message information from corruption by bit lines that have become static at parallel computer inputs and outputs.
Die gemäß Anspruch 4 erforderliche manuelle Umschaltung des Bildschirms auf das zur Darstellung des Sicherungscodes befähigte Rechnersystem verhindert eine unbedachte routinemäßige Bestätigung angeforderter Hilfsbedienungen.The manual switching of the screen required according to claim 4 to the computer system capable of displaying the security code prevents thoughtless routine confirmation of requested auxiliary operations.
Anhand einer Figur soll nachstehend die Einrichtung nach der Erfindung ausführlich beschrieben werden.The device according to the invention will be described in detail below with reference to a figure.
In der Figur sind schematisch eine Zentralstation Z und eine Unterstation UST1 mit ihren wichtigsten Geräten sowie eine beide Stationen verbindende Übertragungsstrecke Ü dargestellt. An der Übertragungsstrecke können zusätzlich weitere Unterstationen UST2 angeschlossen sein.The figure schematically shows a central station Z and a substation UST1 with their most important devices and a transmission link U connecting both stations. Additional substations UST2 can also be connected to the transmission link.
Die Zentralstation enthält zwei Rechnersysteme R1, R2, z.B. Personal-Computer, die zur Darstellung eines gespeicherten Meldebildes über einen Umschalter MS wechselweise mit einer Anzeigeeinrichtung M verbunden werden können. Nur das Rechnersystem R1 besitzt eine manuelle Eingabe T und einen Drucker D zur Aufzeichnung protokollpflichter Handlungen. Auch die Datenausgabe auf die Übertragungsstrecke Ü über ein Modem MZ ist nur vom Rechnersystem R1 aus möglich.The central station contains two computer systems R1, R2, e.g. Personal computer, which can be alternately connected to a display device M via a changeover switch MS to display a stored message image. Only the computer system R1 has a manual input T and a printer D for recording actions that are required to be recorded. Data output on the transmission link Ü via a modem MZ is also only possible from the computer system R1.
Über das Modem MZ empfangene Daten werden jedoch parallel beiden Rechnersystemen zugeführt.However, data received via the MZ modem is fed in parallel to both computer systems.
Die Unterstation UST1 besitzt ein signaltechnisch sicheres Rechnersystem mit zwei Rechnerkanälen, die jeweils aus einem Hauptrechner UR1, UR2 und einem Vorrechner VR1, VR2 bestehen. Die beiden Hauptrechner sind über eine Nachbarrechnerverbindung NRB miteinander und über einen Steuer- und Meldebus SMB mit der zu steuernden Hardware STW der Unterstation verbunden.The substation UST1 has a computer system which is secure in terms of signal technology and has two computer channels, each of which consists of a main computer UR1, UR2 and a front-end computer VR1, VR2. The two main computers are connected to one another via a neighboring computer connection NRB and via a control and message bus SMB to the hardware STW of the substation to be controlled.
Die Verbindung zur Übertragungsstrecke verläuft hier über die Vorrechner der Rechnerkanäle. Diese sind in Ausgaberichtung mit getrennten Ausgängen an ein Unterstationsmodem MU angeschlossen. Eingänge beider Vorrechner werden dagegen von einem gemeinsamen Ausgang des Modems aus, parallel beaufschlagt.The connection to the transmission path runs here via the upstream computer of the computer channels. These are connected to a substation modem MU in the output direction with separate outputs. In contrast, inputs of both upstream computers are acted upon in parallel from a common output of the modem.
Steuerbefehle, die in der Zentralstation eingegeben werden und eine Stellhandlung ohne besondere Sicherheitsverantwortung in der Unterstation bewirken sollen, gelangen von der Eingabe T in das Rechnersystem R1. Das Rechnersystem erarbeitet das dem Steuerbefehl entsprechende Kommando und gibt dieses auf das Modem MZ aus, von wo aus es, z.B. als serielles, frequenzmoduliertes Datentelegramm, auf die Übertragungsstrecke ausgesendet wird.Control commands, which are entered in the central station and are intended to result in an actuating action without special security responsibility in the substation, pass from the input T into the computer system R1. The computer system develops the command corresponding to the control command and outputs it to the modem MZ, from where it is, e.g. as a serial, frequency-modulated data telegram, which is transmitted on the transmission link.
Das Unterstationsmodem MU setzt das Datentelegramm in das ursprünglich eingegebene Kommando um und führt dieses den Vorrechnern beider Rechnerkanäle parallel zu.The substation modem MU converts the data telegram into the originally entered command and routes it to the pre-computers of both computer channels in parallel.
Beide Rechnerkanäle decodieren nun den in dem empfangenen Kommando enthaltenen Steuerbefehl. Dabei tauschen sie Zwischenergebnisse und das Endergebnis über die Nachbarrechnerverbindung NRB gegenseitig aus und vergleichen ihr eigenes Ergebnis mit dem des Nachbarrechnerkanals. Bei von beiden Rechnerkanälen festgestellter Übereinstimmung der Ergebnisse wird der Steuerbefehl auf den Steuer- und Meldebus ausgegeben und die Stellhandlung damit ausgelöst.Both computer channels now decode the control command contained in the received command. They exchange interim results and the end result via the neighboring computer connection NRB and compare their own result with that of the neighboring computer channel. If the results are determined by both computer channels, the control command is output on the control and message bus and the actuating action is thus triggered.
Die Rückmeldung des Vollzugs der ausgelösten Stellhandlung erfolgt über Meldeleitungen des Steuer- und Meldebusses. Diese werden in regelmäßigen Zeitabständen sowie nach jeder Stellhandlung von beiden Rechnerkanälen auf ihren Schaltzustand hin abgefragt. Das Abfrageergebnis wird von beiden Vorrechnern getrennt dem Unterstationsmodem MU zugeführt und als Meldedatentelegramm zur Zentralstation übertragen. Hierbei gibt einer der Vorrechner seine Daten in invertierter Form auf das Modem aus. In der Zentralstation empfangen beide Rechnersysteme parallel die von beiden Rechnerkanälen der Unterstation übermittelten Meldedaten und führen einen Vergleich der einfach übertragenen Daten mit den invertiert übertragenen Daten durch. Bei Übereinstimmung werden die übertragenen aktuellen Schaltzustände abgespeichert und bei der Darstellung des Meldebildes berücksichtigt. Aus der Veränderung des Meldebildes erkennt der Bediener, ob der von ihm eingegebene Steuerbefehl ausgeführt wurde.The completion of the triggered actuation is reported back via reporting lines of the control and reporting bus. These are queried at regular intervals and after each actuation by both computer channels for their switching status. The result of the query is sent to the substation modem MU separately from both pre-computers and transmitted to the central station as a reporting data telegram. Here one of the front computers gives his Data in inverted form on the modem. In the central station, both computer systems receive the reporting data transmitted from both computer channels of the substation in parallel and compare the simply transmitted data with the inverted transmitted data. If there is a match, the transmitted current switching states are saved and taken into account in the display of the message image. From the change in the message screen, the operator can see whether the control command he has entered has been executed.
Soll eine Stellhandlung mit Sicherheitsverantwortung ausgeführt werden, so wird ein Steuerbefehl hierzu ebenfalls über die Bedieneinrichtung T in das Rechnersystem R1 eingegeben und als Kommando zur Unterstation übertragen. Üblicherweise wird ein Befehl mit Sicherheitsverantwortung bereits bei der Eingabe durch einen Zusatz oder eine besondere Form der Eingabe als solcher gekennzeichnet. Es kann aber auch erst in der Unterstation, z.B. durch Vergleich des eingegangenen Kommandos mit vorgespeicherten Listen sicherheitsrelevanter und nicht sicherheitsrelevanter Kommandos, ermittelt werden, ob der auszuführende Befehl Sicherheitsbedeutung hat. In jedem Falle stellen die Rechnerkanäle der Unterstation fest, wann ein von der Zentralstation her übertragenes Kommando eine Stellhandlung betrifft, die mit Sicherheitsverantwortung auszuführen ist.If an actuating action with safety responsibility is to be carried out, a control command for this is likewise entered into the computer system R1 via the operating device T and transmitted as a command to the substation. Usually, a command with security responsibility is identified as such by an addition or a special form of input. But it can also only be in the substation, e.g. by comparing the received command with pre-stored lists of safety-relevant and non-safety-relevant commands, it can be determined whether the command to be executed has safety meaning. In any case, the computer channels of the substation determine when a command transmitted from the central station relates to an actuating action that is to be carried out with security responsibility.
In einem solchen Fall wird der in dem übertragenen Kommando enthaltene Steuerbefehl in der Unterstation zunächst signaltechnisch sicher zwischengespeichert. Die zugehörige Stellhandlung wird jedoch noch nicht vollzogen. Über den signaltechnisch sicheren Meldeweg wird ein besonders gekennzeichnetes Meldedatentelegramm an die Zentralstation übertragen, das die noch nicht vollzogene Stellhandlung simuliert vorwegnimmt. Der die Anzeigeeinrichtung steuernde Rechner stellt diese vorweggenommene Stellhandlung in besonderer Form oder Farbe an der Anzeigeeinrichtung dar. Die auszuführende Stellhandlung ist damit in die Zentralstation "zurückgespiegelt". Der Bediener kann nochmals kontrollieren, ob der gespiegelte Stellbefehl dem ursprünglich eingegebenen Stellbefehl entspricht und kann endgültig darüber befinden, ob der Stellbefehl ausgeführt werden soll.In such a case, the control command contained in the transmitted command is first stored in the substation in a signal-safe manner. However, the associated actuation is not yet carried out. A specially marked message data telegram is transmitted to the central station via the signaling-safe signaling path, which simulates the actuation that has not yet been carried out. The computer controlling the display device displays this anticipated actuation action in a special shape or color on the display device. The actuation action to be carried out is thus "mirrored" in the central station. The operator can check again whether the mirrored command corresponds to the originally entered command and can finally decide whether the command should be carried out.
Das hierzu erforderliche Ausführungskommando muß jedoch signaltechnisch sicher in der Unterstation vorliegen.However, the execution command required for this must be safely available in the signaling station.
Um dies zu erreichen, enthalten die Rechnerkanäle der Unterstation ein Programm zur Erzeugung eines speziellen Sicherungscodes. Dieses Programm wird bei Erkennen eines eine Stellhandlung mit Sicherheitsverantwortung auslösenden Kommandos abgearbeitet und der ermittelte Sicherungscode wird zusammen mit den zur Spiegelung der vorzunehmenden Stellhandlung erforderlichen Daten in die Zentralstation übertragen. Der Sicherungscode kann nun in der Zentralstation angezeigt und nach erneuter Eingabe als Ausführungskommando in die Unterstation zurück übertragen werden. Er wird dort mit dem dort abgespeicherten, ursprünglich erzeugten Sicherungscode verglichen. Bei Übereinstimmung gilt das Ausführungskommando als gegeben. Die vorbereitete Stellhandlung wird ausgeführt.To achieve this, the computer channels of the substation contain a program for generating a special security code. This program is processed when a command triggering an actuating action with security responsibility is recognized and the determined security code is transmitted to the central station together with the data required to mirror the actuating action to be performed. The security code can now be displayed in the central station and, after being entered again, can be transferred back to the substation as an execution command. There it is compared with the originally generated security code stored there. If there is a match, the execution command is given. The prepared actuation is carried out.
In der Zentralstation enthält nur das nicht zur Kommandoübertragung verwendete Rechnersystem R2 ein Programm zum Empfang und zur Darstellung des Sicherungscodes. Das Rechnersystem R1 ist nicht in der Lage, den Sicherungscode aufzunehmen und anzuzeigen oder von sich aus zur Unterstation zurückzuübertragen.In the central station, only the computer system R2 that is not used for command transmission contains a program for receiving and displaying the security code. The computer system R1 is unable to record and display the security code or to transmit it back to the substation.
Damit ist eine versehentliche Rückübertragung des Sicherungscodes ausgeschlossen. Eine Rückübertragung des Sicherungscodes ist nur möglich, wenn das Rechnersystem R2 mittels des z.B. manuell betätigbaren Umschalters MS mit der Anzeigeeinrichtung verbunden und damit in die Lage versetzt wird, den Sicherungscode dem Bediener anzuzeigen. Der Bediener ist gezwungen, den angezeigten Sicherungscode mittels der Bedieneinrichtung T in das Rechnersystem R1 einzugeben, wenn er dessen Übertragung an die Unterstelle und damit die Ausführung des vorbereiteten Stellbefehls bewirken will.This prevents accidental retransmission of the security code. The security code can only be retransmitted if the computer system R2 is connected to the display device by means of the manually operable switch MS, for example, and is thus able to display the security code to the operator. The operator is forced to enter the displayed security code into the computer system R1 by means of the operating device T if it wants to transmit it to the subordinate station and thus to execute the prepared actuating command.
Um die Sicherheit bezüglich einer fehlerhaften versehentlichen Rückübertragung des Sicherungscodes noch weiter zu erhöhen, kann der Sicherungscode auch in verschlüsselter Form zur Zentralstation übertragen, im zweiten Rechner mit Hilfe eines nur dort enthaltenen Entschlüsselungsprogramms entschlüsselt in entschlüsselter Form zur Anzeige gebracht und nach erneuter Eingabe zur Unterstation zurückübertragen werden.In order to further increase the security with regard to an erroneous inadvertent retransmission of the security code, the security code can also be transmitted in encrypted form to the central station, decrypted in a decrypted form in the second computer with the aid of a decryption program only contained therein, and transmitted back to the substation after being entered again become.
Claims (4)
- A device for the fail-safe remote control of a sub-station (UST1) controlling a railway installation, in particular of a subsidiary signal box assigned to the track area of a railway station, and comprising a multi-computer system (VR1, VR2, UR1, UR2) with at least two computer channels with are independent of one another, collect all results in parallel and check these for identity by comparison with one another, from a central station (Z) which comprises at least two mutually independent computer systems (R1, R2), an operating device (T) and a display device (M) and is connected via a data link (Ü) to the multi-computer system of the sub-station, where the sub-station recognises as such a command which has been transmitted from the central station and which initiates a setting operation with responsibility for safety, mirrors back the setting operation to the central station and does not execute the setting operation until a special execute command has been received, and where the device comprises the sub-station, the central station and the data link, characterised in that for the input of commands which in the sub-station (UST1) initiate setting operations with responsibility for safety, the operating device (T) of the central station (Z) is connected only to a first computer system (R1) and this computer system initiates the transmission of the commands to the sub-station, that the multi-computer system of the sub-station contains a program for the generation of a protection code and for each setting operation to be mirrored-back generates a characteristic protection code and transmits the latter to the central station and that only a second computer system (R2), not used for the command transmission, of the central station contains a program for the reception and display of the protection code and displays the latter on the display device together with an up-to-date message image and the mirrored-back setting operation, that the displayed protection code is input as execute instruction into the first computer system (R1) via the operating device (T) and transmitted from the latter to the sub-station, that in the sub-station the protection code is compared with the originally generated protection code stored therein and that the execution of the mirrored-back setting operation does not take place until this comparison has resulted in identity.
- A device as claimed in Claim 1, characterised in that the computer channels of the sub-station consists of in each case a host computer (UR1, UR2) and in each case a front-end processor (VR1, VR2), and that the front-end processors control the reception of commands and output messages to the central station in fail-safe fashion.
- A device as claimed in Claim 1 or 2, characterised in that one of the computer channels of the sub-station outputs its message data in inverted form and that the computer systems of the central station further process a message as correct only when the latter is present in normal form and in inverted form.
- A device as claimed in one of the preceding claims, characterised in that the display device (M) can be alternately connected to the computer systems (R1, R2) by means of a manually operable change-over switch (MS).
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| DE4107639 | 1991-03-09 | ||
| DE4107639A DE4107639A1 (en) | 1991-03-09 | 1991-03-09 | DEVICE FOR SIGNAL-SAFE REMOTE CONTROL OF A SUBSTATION IN A RAILWAY SYSTEM |
Publications (3)
| Publication Number | Publication Date |
|---|---|
| EP0503336A2 EP0503336A2 (en) | 1992-09-16 |
| EP0503336A3 EP0503336A3 (en) | 1994-02-23 |
| EP0503336B1 true EP0503336B1 (en) | 1996-01-31 |
Family
ID=6426903
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| EP92102996A Expired - Lifetime EP0503336B1 (en) | 1991-03-09 | 1992-02-22 | Arrangement for fail-safe remote control of a substation in a railway system |
Country Status (4)
| Country | Link |
|---|---|
| EP (1) | EP0503336B1 (en) |
| AT (1) | ATE133620T1 (en) |
| DE (2) | DE4107639A1 (en) |
| ES (1) | ES2085505T3 (en) |
Families Citing this family (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| DE19745994A1 (en) * | 1997-10-20 | 1999-04-22 | Cit Alcatel | Process for the exchange of data between application processes in a secure multi-computer system |
| GB2348034A (en) | 1999-03-17 | 2000-09-20 | Westinghouse Brake & Signal | An interlocking for a railway system |
| DE10053023C1 (en) * | 2000-10-13 | 2002-09-05 | Siemens Ag | Method for controlling a safety-critical railway operating process and device for carrying out this method |
| US7209811B1 (en) | 2001-11-22 | 2007-04-24 | Siemens Aktiengesellschaft | System and method for controlling a safety-critical railroad operating process |
| AU2002224742A1 (en) * | 2001-11-22 | 2003-06-17 | Siemens Aktiengesellschaft | Method for controlling a safety-critical railway operating process and device for carrying out said method |
| DE10309200A1 (en) * | 2003-02-25 | 2004-09-16 | Siemens Ag | Procedure for securing the train sequence in train control mode |
| EP1596517B1 (en) * | 2004-05-10 | 2008-03-05 | Siemens Aktiengesellschaft | Method of transmission of redundantly provided data over a single channel |
| DE102007061807A1 (en) | 2007-12-19 | 2009-07-09 | Db International Gmbh | Element controlling method for control and safety system, involves characterizing condition of clients actually determined by sensors at exterior system of clients by monitoring-transaction messages |
| DE102008012953B4 (en) * | 2008-03-06 | 2022-01-27 | Bombardier Transportation Gmbh | Checking of display systems in rail vehicles |
| DE102019208924A1 (en) * | 2019-06-19 | 2020-12-24 | Siemens Mobility GmbH | Input procedure for safety-critical operating commands and operating system |
| EP3943265A1 (en) * | 2020-07-21 | 2022-01-26 | Siltronic AG | Method and device for simultaneously separating a plurality of plates from a workpiece |
Family Cites Families (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| DE2549197A1 (en) * | 1975-11-03 | 1977-05-05 | Siemens Ag | Remote signalling system for railways - inverts binary values of control information after each cycle from out stations |
| SU557367A1 (en) * | 1975-12-25 | 1977-05-05 | Предприятие П/Я В-8117 | System of duplicated digital computers (cvm) |
| US4368534A (en) * | 1979-01-29 | 1983-01-11 | General Signal Corporation | Keyboard controlled vital digital communication system |
| DE2912928C2 (en) * | 1979-03-31 | 1986-10-23 | Standard Elektrik Lorenz Ag, 7000 Stuttgart | Device for the transmission of binary coded information for the remote control of railway signal systems |
| DE2921860C2 (en) * | 1979-05-25 | 1986-07-31 | Licentia Patent-Verwaltungs-Gmbh, 6000 Frankfurt | Device for locating and controlling a track-bound vehicle with linear motor drive |
| DE2934039A1 (en) * | 1979-08-23 | 1981-03-26 | Robert Bosch Gmbh, 70469 Stuttgart | Protected remote control of radio station channel - requires instructions to be validated by exchange and acknowledged by remote station |
| DE3211977A1 (en) * | 1982-03-31 | 1983-10-06 | Siemens Ag | OPERATIONAL MONITORING OF TRANSMISSION ROUTES FOR DIGITAL SIGNALS |
| DE3232167C1 (en) * | 1982-08-30 | 1983-10-20 | Siemens AG, 1000 Berlin und 8000 München | Secured data transmission device for non-equivalent information pairs in railway security installations |
| DE3310975A1 (en) * | 1983-03-25 | 1984-09-27 | Siemens AG, 1000 Berlin und 8000 München | DEVICE FOR SAFE PROCESS CONTROL |
| DE3412049A1 (en) * | 1984-03-30 | 1985-10-17 | Licentia Patent-Verwaltungs-Gmbh, 6000 Frankfurt | SIGNAL-SAFE DATA PROCESSING DEVICE |
| DE3513357A1 (en) * | 1985-04-15 | 1986-10-16 | Fernsprech- und Signalbau KG Schüler & Vershoven, 4300 Essen | Circuit arrangement, in particular for a safety coupling switch in deep mining |
| DE3742118A1 (en) * | 1987-12-11 | 1989-06-22 | Siemens Ag | Data transmission device with secure signalling |
-
1991
- 1991-03-09 DE DE4107639A patent/DE4107639A1/en not_active Withdrawn
-
1992
- 1992-02-22 AT AT92102996T patent/ATE133620T1/en active
- 1992-02-22 ES ES92102996T patent/ES2085505T3/en not_active Expired - Lifetime
- 1992-02-22 EP EP92102996A patent/EP0503336B1/en not_active Expired - Lifetime
- 1992-02-22 DE DE59205198T patent/DE59205198D1/en not_active Expired - Lifetime
Also Published As
| Publication number | Publication date |
|---|---|
| EP0503336A3 (en) | 1994-02-23 |
| DE59205198D1 (en) | 1996-03-14 |
| EP0503336A2 (en) | 1992-09-16 |
| ES2085505T3 (en) | 1996-06-01 |
| ATE133620T1 (en) | 1996-02-15 |
| DE4107639A1 (en) | 1992-09-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| DE69718754T2 (en) | Combined remote access and security system | |
| EP0093881B1 (en) | Monitoring system for one or several similarly constructed process stations | |
| EP0503336B1 (en) | Arrangement for fail-safe remote control of a substation in a railway system | |
| DE69320873T2 (en) | Directly connecting process control system display in an open system with windows | |
| EP3295645B1 (en) | Method and arrangement for decoupled transmission of data between networks | |
| DE102007032805A1 (en) | Method and system architecture for secure single-channel communication for controlling a safety-critical rail operation process | |
| DE2701925A1 (en) | VEHICLE CONTROL SYSTEM WITH HIGH RELIABILITY | |
| EP0978775B1 (en) | Method for faultfree data transmission between a numerical controller and a remotely separated device | |
| EP1308366A1 (en) | Warning device for work gangs | |
| AT402909B (en) | METHOD FOR GUARANTEING THE SIGNAL TECHNICAL SECURITY OF THE USER INTERFACE OF A DATA PROCESSING SYSTEM | |
| EP2274874A1 (en) | Examination of a communication connection between field devices | |
| EP0970869B1 (en) | Method for securely displaying the status of a signalling installation | |
| DE19826875A1 (en) | Numerical control with a spatially separate input device | |
| DE19960959C2 (en) | Device for tamper-proof data exchange in a motor vehicle | |
| DE2423195A1 (en) | MAINTENANCE DEVICE | |
| EP0392328B1 (en) | Method of continuosly monitoring signals of a safe information display | |
| DE2912928C2 (en) | Device for the transmission of binary coded information for the remote control of railway signal systems | |
| EP3753802A1 (en) | Method for generic display protection and control system | |
| EP1133096B1 (en) | Method and system for fail-safe data transfer between fail-safe computers | |
| DE10330115B4 (en) | Device for controlling a system controlled by an operator, in particular a signal box of a railway system | |
| DE3232167C1 (en) | Secured data transmission device for non-equivalent information pairs in railway security installations | |
| DE3742118C2 (en) | ||
| EP1963162B1 (en) | Method and arrangement for the reliable monitoring and evaluation of operating states of at least one traffic control system, and use of the same | |
| DE3529056C2 (en) | ||
| EP3957033B1 (en) | Computing system and method for operating a computing system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
| AK | Designated contracting states |
Kind code of ref document: A2 Designated state(s): AT CH DE ES FR GB LI NL |
|
| RAP3 | Party data changed (applicant data changed or rights of an application transferred) |
Owner name: ALCATEL SEL AKTIENGESELLSCHAFT |
|
| PUAL | Search report despatched |
Free format text: ORIGINAL CODE: 0009013 |
|
| AK | Designated contracting states |
Kind code of ref document: A3 Designated state(s): AT CH DE ES FR GB LI NL |
|
| 17P | Request for examination filed |
Effective date: 19940712 |
|
| 17Q | First examination report despatched |
Effective date: 19950120 |
|
| GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
| AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): AT CH DE ES FR GB LI NL |
|
| REF | Corresponds to: |
Ref document number: 133620 Country of ref document: AT Date of ref document: 19960215 Kind code of ref document: T |
|
| REF | Corresponds to: |
Ref document number: 59205198 Country of ref document: DE Date of ref document: 19960314 |
|
| GBT | Gb: translation of ep patent filed (gb section 77(6)(a)/1977) |
Effective date: 19960222 |
|
| ET | Fr: translation filed | ||
| REG | Reference to a national code |
Ref country code: ES Ref legal event code: FG2A Ref document number: 2085505 Country of ref document: ES Kind code of ref document: T3 |
|
| PLBE | No opposition filed within time limit |
Free format text: ORIGINAL CODE: 0009261 |
|
| STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT |
|
| 26N | No opposition filed | ||
| REG | Reference to a national code |
Ref country code: GB Ref legal event code: IF02 |
|
| REG | Reference to a national code |
Ref country code: CH Ref legal event code: NV Representative=s name: JUERG ULRICH C/O ALCATEL STR AG Ref country code: CH Ref legal event code: EP |
|
| PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: FR Payment date: 20110218 Year of fee payment: 20 Ref country code: AT Payment date: 20110126 Year of fee payment: 20 Ref country code: NL Payment date: 20110216 Year of fee payment: 20 Ref country code: DE Payment date: 20110216 Year of fee payment: 20 Ref country code: CH Payment date: 20110214 Year of fee payment: 20 |
|
| PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: GB Payment date: 20110216 Year of fee payment: 20 Ref country code: ES Payment date: 20110315 Year of fee payment: 20 |
|
| REG | Reference to a national code |
Ref country code: DE Ref legal event code: R071 Ref document number: 59205198 Country of ref document: DE |
|
| REG | Reference to a national code |
Ref country code: DE Ref legal event code: R071 Ref document number: 59205198 Country of ref document: DE |
|
| REG | Reference to a national code |
Ref country code: CH Ref legal event code: PL Ref country code: NL Ref legal event code: V4 Effective date: 20120222 |
|
| REG | Reference to a national code |
Ref country code: GB Ref legal event code: PE20 Expiry date: 20120221 |
|
| PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: DE Free format text: LAPSE BECAUSE OF EXPIRATION OF PROTECTION Effective date: 20120223 |
|
| REG | Reference to a national code |
Ref country code: ES Ref legal event code: FD2A Effective date: 20120509 |
|
| PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: GB Free format text: LAPSE BECAUSE OF EXPIRATION OF PROTECTION Effective date: 20120221 |
|
| PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: ES Free format text: LAPSE BECAUSE OF EXPIRATION OF PROTECTION Effective date: 20120223 |
|
| REG | Reference to a national code |
Ref country code: AT Ref legal event code: MK07 Ref document number: 133620 Country of ref document: AT Kind code of ref document: T Effective date: 20120222 |