EP0668204A1

EP0668204A1 - Multi-processor module

Info

Publication number: EP0668204A1
Application number: EP95300671A
Authority: EP
Inventors: Mark Edwin Cooper; Christopher Martin Platt
Original assignee: GEC Alsthom Signalling Ltd
Current assignee: GEC Alsthom Signalling Ltd
Priority date: 1994-02-17
Filing date: 1995-02-02
Publication date: 1995-08-23
Also published as: GB2286705A; GB2286705B; GB9403044D0

Abstract

A multi-processor module (33) for use in a solid-state interlocking system for a railway network includes a first processor for receiving instructions concerning the operation of parts of the trackside equipment (40) within the network and carrying out those instructions in dependence upon the current overall status of that trackside equipment, and a second processor for receiving the instructions from the first processor and effecting the operation of the appropriate trackside equipment via a data link. The first processor runs at a higher clock speed than the second. A program run in the first processor is arranged to be slowed down in those areas which interface with the second processor. The slowing down may be effected by the inclusion of delay loops, no-operation instructions, or by the increasing of time constants in timing hardware.

Description

The invention concerns a multi-processor module, and in particular, but not exclusively, a multi-processor module for use in a railway solid-state interlocking system.
It is known to control railway signalling and the like by means of so-called interlocking arrangements, whereby the operation of trackside signalling devices, points and so forth is effected according to a set scheme depending on the state of various inputs, e.g. other signalling devices or points, such that operation of a particular device can only occur under certain desired conditions. Thus, the trackside devices are said to be "interlocked", the interlocking being necessary to ensure the safety of railway passengers and staff, when the rail service is running.
Older interlocking arrangements were based on relay technology; however, for some years now, advantage has been taken of solid-state technology to achieve interlocking systems having high reliability.
A description of a known, modern-day solid-state interlocking system is contained in chapter 2 of "Railway Control Systems", published by A&C Black, London, published August 1991. A typical interlocking system is shown in Figure 1. The interlocking system comprises two main parts: a control centre 10 and a lineside area 20. The control centre 10 comprises one or more "interlockings" 30, a control and display panel 31 and a technician's terminal 32. The interlocking 30 (of which only one is illustrated) contains a number of main multi-processor modules (MPM's) 33, a number of panel processor modules 34, a diagnostic multi-processor module 35 and a number of data link modules, two only of which, 36, 38, are shown.
The interlocking 30 is designed as a multiple-processor system for implementing all the logic functions necessary to generate safety commands for trackside signalling equipment 40, and in the interest of safety is arranged to be fail-safe. Commands generated by the interlocking are communicated to the trackside equipment 40, which may include visible signals, points, etc, by way of the data link module 38, an associated data link 42 and lineside data link modules 50. Similarly, information is transferred back to the interlocking 30 from the trackside equipment 40 via the data link 42 and the data link modules 38 and 50.
A single interlocking 30 can control, typically, around forty signals and between twenty and forty sets of points. Thus, an interlocking will normally be associated with a particular geographical section of railway line, other sections consequently being served by further interlockings (not shown) within the control centre 10 of the system. All interlockings will share the same technician's terminal 32 and display and control panel 31.
The panel processor modules 34 take care of all information flowing to and from the interlocking and the display and control panel 31, which may be, for example, a visual display unit type system. Control commands are received on a bus 43 from actions performed on the control panel 31. Such actions may take the form of entrance and exit button operations, point key operations, etc. These commands are passed on to the main MPM's 33 where they are further processed. In addition, indications of all functions are received by the panel processor modules 34 from the interlocking MPM's, and the panel processor modules 34 provide driving signals to drive the appropriate displays in the display and control panel 31.
Where more than one interlocking 30 is used in the control centre 10, there will be routes having one end in each geographical area represented by the interlockings, i.e. there will be common routes at the boundary between interlocking areas, and there will also be track circuits which are required by both interlockings. Other functions, e.g. the state of points, may additionally be passed between interlockings. In order to enable the bi-directional transfer of such information between the main multi-processor modules of the various interlockings within the control centre 10, at least one internal data link module 36 is provided in each interlocking 30, along with a corresponding common internal data link 44.
Since it is essential that the reliability of the interlocking system be as near 100% as possible in an environment as safety-conscious as a railway network, a certain degree of redundancy is provided in some of the functions of the interlocking. Thus, Figure 1 shows a total of three main MPM's 33 and two panel processor modules 34 for each interlocking. The main MPM's function as a two-out-of-three voting system, whereas the panel processor modules 34 are duplicated to provide the requisite fault tolerance. Both panel processors run the same program and receive the same inputs, and are arranged to drive their outputs onto the bus 43 in alternation during normal operation. Failure of one such module still allows normal operation of the other without any interruption.
The diagnostic MPM 35 is a module much like the three main MPM's 33 and is the link between the interlocking and the technician's terminal 32. The diagnostic module 35 monitors changes of state of indications and controls and notes any lack of response of points and signals to control commands, faults being displayed at the technician's terminal 32 for the attention of the railway system maintenance personnel. Changes of state of the signalling information are also passed on to a technician's terminal processor 46 and subsequently logged on a tape unit 47. In addition, the fault reports which are generated by the diagnostic processor module 35 are printed out on a printer 48, and the maintenance personnel can also, through a keyboard 49, interrogate the interlockings 30 to check the states of signals and points, etc.
The safety and availability of hardware and data transmission, the correct execution of signal controls and interlocking, and the effectiveness of the diagnostic aids all depend on the software employed in the solid-state interlocking system.
According to a first aspect of the invention, there is provided a multi-processor module, for use in a solid-state railway interlocking system including a control station, in which the multi-processor module is housed, and lineside equipment for driving and receiving signals from trackside equipment such as signalling devices and points, the control station containing a control and display panel for controlling, among other things, the routing of trains and displaying related functions, respectively, characterised in that the multi-processor module contains a first, main, processor for running first software for receiving instructions from the control and display panel and acting correspondingly upon the appropriate trackside equipment in accordance with information received by the multi-processor module concerning the current overall status of the trackside equipment, and a second, subsidiary, processor for running second software for handling communications between the first processor and the lineside equipment, the first processor being arranged to run at a higher speed than the second processor, and the first software being arranged to be slowed down where it interfaces with the second processor.
The advantage of this arrangement is that, by running the main processor at a higher speed than the subsidiary processor, bottlenecks in the processing of SSI data can be alleviated, while at the same time reliable interfacing with external devices, e.g. the trackside equipment, via the subsidiary processor can be assured by arranging for the software run by the main processor to be slowed down at the points where interfacing between the main and subsidiary processors occurs. Thus, the performance of the subsidiary processor can always be made to be compatible with that of the main processor, regardless of how fast the main processor is arranged to be run.
In practice, where the amount of lineside equipment is considerable, the second, subsidiary, processor may be duplicated, communication between the subsidiary processors and the lineside equipment then taking place via two data link busses.
The first software may be arranged to be slowed down by the inclusion into its object code of delay loops and/or no-operation instructions. Alternatively, the slowing down may be effected by the increasing of time constants associated with parts of the first processor that carry out a timing function.
The multi-processor module may contain a third, subsidiary, processor for running third software for communicating with other multi-processor modules within the control centre, the first processor being arranged to run at a higher speed than the third processor, and the first software being arranged to be slowed down where it interfaces with the third processor.
The first processor may be arranged to run at a clock speed of approximately 2 MHz and the second and/or third processors may be arranged to run at a clock speed of approximately 1 MHz.
According to a second aspect of the invention, there is provided a solid-state interlocking system including a multi-processor module as described above.
The multi-processor module according to the invention will now be described, by way of example only, with reference to the drawings, of which:

Figure 1 is a block diagram showing a known solid-state interlocking system, and
Figure 2 is a diagram showing the relationship between various areas of programming incorporated within a main multi-processor module according to the invention.

The software in the main MPM 33 is subdivided into a number of programs which perform a variety of functions. These functions include initialisation, the management of redundancy, in which the performance of duplicated or triplicated hardware is checked and compared, the interfacing with the panel processors 34 and communications links 42, 44, and the transmission and reception of data.
The relationship between the various programs, data areas and input and output channels of the MPM's 33 is shown in Figure 2. The functional program 60 generates command messages on the basis of signalling controls for the interlocking area which are encoded as geographical data held in a ROM 61. These command messages are formed in accordance with an image of the state of the railway held in a RAM 62, the contents of the RAM 62 being continually updated by messages received from the trackside.
All programs are run on the main (or functional) processor within the MPM 33, except the trackside communications programs 63 and the internal communications program 64, which are run by dedicated processor chips.
In order to avoid bottlenecks in the processing of the various interlocking data and to achieve fast processing generally, the main (functional) processor of the MPM 33 is arranged to operate at a clock speed of 2 MHz. This is twice the speed of conventional solid-state interlocking arrangements and makes for difficulties in interfacing with the various communication interfaces (i.e. those relating to the trackside and internal data links 38, 36 and the panel processor modules 34), which normally operate at no more than 1 MHz. The invention overcomes this drawback by arranging for the object code of those areas of the main MPM functional program which have an interfacing function to be "slowed down" by various means. Techniques which may be used to effect such a slowing down are the use of delay loops or "no operations" within the code. An alternative technique is to increase time constants that exist in parts of the hardware that carry out a timing function.

Claims

A multi-processor module, for use in a solid-state railway interlocking system including a control station (10), in which the multi-processor module is housed, and lineside equipment (20) for driving and receiving signals from trackside equipment (40) such as signalling devices and points, the control station (10) containing a control and display panel (31) for controlling, among other things, the routing of trains and displaying related functions, respectively, characterised in that the multi-processor module (33) contains a first, main, processor for running first software for receiving instructions from the control and display panel (31) and acting correspondingly upon the appropriate trackside equipment (40) in accordance with information received by the multi-processor module (33) concerning the current overall status of the trackside equipment (40), and a second, subsidiary, processor for running second software for handling communications between the first processor and the lineside equipment (40), the first processor being arranged to run at a higher speed than the second processor, and the first software being arranged to be slowed down where it interfaces with the second processor.
A multi-processor module according to Claim 1, characterised in that the first software is arranged to be slowed down by the inclusion into its object code of delay loops and/or no-operation instructions.
A multi-processor module according to Claim 1, characterised in that the first software is arranged to be slowed down by the increasing of time constants associated with parts of the first processor that carry out a timing function.
A multi-processor module according to any preceding claim, characterised in that the first processor is arranged to run at a clock speed of approximately 2 MHz and the second processor is arranged to run at a clock speed of approximately 1 MHz.
A multi-processor module according to any preceding claim, characterised in that the module contains a third, subsidiary, processor for running third software for communicating with other multi-processor modules within the control centre, the first processor being arranged to run at a higher speed than the third processor, and the first software being arranged to be slowed down where it interfaces with the third processor.
A multi-processor module according to Claim 5, characterised in that the first processor is arranged to run at a clock speed of approximately 2 MHz and the third processor is arranged to run at a clock speed of approximately 1 MHz.
A solid-state interlocking system, characterised in that it includes a multi-processor module (33) as claimed in any one of Claims 1 to 6.