EP0796779A1 - Method for the control and the safety of a guided transport system - Google Patents

Abstract

The method involves storage in formal language of a model of all foreseeable network states and events. Type-related dynamic data are represented in the form of Petri nets or their derivatives, and example-related static track network data in the form of double-vertex graphs. A first algorithm computes all possible sequence states and prevents triggering of a verifiable event when a forbidden state is involved. A second algorithm is brought in when an unacceptable event occurs, triggering verifiable events when these reduce the expected number of consequential forbidden states.

Description

The invention relates to a method according to the preamble of patent claim 1.

Such a method is known from M. Montigel's doctoral thesis "Modeling and guaranteeing dependencies in railway safety systems", submitted in 1994 at the Swiss Federal Institute of Technology, Zurich (DISS.ETH No. 10776).

It is intended to replace the methods used today to control and secure track-guided transport systems, in particular railway networks, and also to support the planning and economic use of such transport systems in a completely new way.

The system control and security solutions used today are based on track elements with neighboring relationships, provided with train speed data that are linked to form a route either via geographic circuits and then secured, or according to a prepared route that represents the route to be set List checked one after the other for their occupancy status and their current setting and saved, if necessary after switching to a predefined position.

These solutions are unsatisfactory in terms of treating the system with formal methods. The track element construct, of which there are relatively many basic types, is still too complex for this.

The above The dissertation therefore provides for the representation of the track network with the help of colon graphs, which has the advantage over a representation with simple directional graphs that there is no unnatural marking of a direction of travel (which leads to problems with track triangles and turning loops), and that topological peculiarities are better taken into account can, for example, hairpin bends on switches are not possible from the outset, so they do not have to be excluded.

In the dissertation mentioned at the outset, the railway protection system is understood as a distributed, discrete event system that can be reproduced using formal languages as a logical data model, with individual data areas being represented as stated at the outset.

The method proposed there is based on close dependencies and initially does not formulate security conditions. A model of the states and events of the system is developed, which allows the formulation of inadmissible states and events on a local basis, ie no remote dependencies need to be considered. The requirements for the security system are not described directly, but the behavior of the system, including the vehicles moving around, is modeled as such, as if there were no security level. The security conditions to be implemented at the security level then arise as a consequence of the modeled system properties.

Instead of explicitly implementing the security conditions in the security system, as is customary, a representation of all states and events considered relevant for operational security is developed, especially those that are considered inadmissible for security reasons. The events are divided into controllable and uncontrollable. An event is called controllable if and only if there is freedom in any system state to prevent it from arriving, otherwise the event is called uncontrollable.

At runtime, the backup system always contains an image of all states of the overall system and the rules for how all subsequent states can be calculated from the current state. Furthermore, an algorithm (so-called eunomic algorithm) is implemented, which calculates the set of all possible subsequent states caused by sequences of uncontrollable events every time a controllable event is to be triggered and then examines whether it contains one or more impermissible states.

In order to be able to represent the large number of states in a space-saving manner in the system, a distributed representation with Petri nets was chosen. In this way, 2 ⁿ states can be represented with n binary digits or conditions. The algorithm mentioned above, which checks the admissibility of a controllable event, does not really calculate the amount of subsequent states that can be reached in an uncontrollable manner, since this would be far too extensive, but only clarifies the derivability of each individual location or event individually (not in combination ). It can be shown that every achievable state or each achievable event can be derived in the above sense, so that an inadmissible state cannot be reached if the corresponding points cannot be derived.

• Schrittweises Entwickeln eines formalen Modells der Sicherungsebene des Transportsystems auf der Ebene eines Systemtyps (z.B. System für ein bestimmtes Transportsystem oder eine bestimmte Bahnverwaltung) in Form eines Predicate/Transition-Netzes. Dieses Modell beschreibt die Zustände und Zustandsübergänge der Sicherungsebene und ist unabhängig von den zu sichernden Gleisnetzen. Wenn für dasselbe oder ein ähnliches Transportsystem bereits früher ein Modell erarbeitet wurde, können die dort definierten allgemeinen Systemeigenschaften für das neue Modell übernommen werden.
• Erstellen der Spezifikationen der zu sichernden Gleisnetze (Daten der Systemexemplare)
• Durchführen eines automatisierten sogenannten Entfaltungsprozesses mittels Entfaltungstools:
  • Syntax-, Typen- und Plausibilitätsprüfung des Typ-Modells
  • Vorbereitung des Typ-Modells für den eigentlichen Entfaltungsprozess
  • Erzeugung von symbolischen Schnittstellen für die von der Sicherungsebene abhängigen Ebenen (Steuerungsebene, Hardware-Interface-Ebene etc.)
  • Herstellen eines interpretier- oder ausführbaren formalen Modells für die Systemexemplare (eigentliche Entfaltung): Für jeden allgemein beschriebenen Zustand und Zustandsübergang im abstrakten Typmodell werden alle konkreten Instanzen gesucht, die sich aus den Exemplardaten ergeben. Resultat ist ein Condition/Event-Netz, daß das entsprechende Systemexemplar beschreibt. Jeder Knoten des Netzes besitzt einen eindeutigen Namen, der sich aus dem Namen des entsprechenden abstrakten Knotens und den Namen der konkreten Objekte des Gleisnetzes zusammensetzt, auf die er sich bezieht.
• Überprüfen des formalen Exemplar-Modells mit einem Laufzeitsystem für Condition/Event-Netze. Dieses System enthält eine Implementation des o.g. Eunomischen Algorithmus, der die Zulässigkeit von kontrollierbaren Ereignissen überwacht. In der o.g. Dissertation wurden die von der Sicherungsebene abhängigen Ebenen (Außenanlage, Steuerungsebene etc.) mit interaktiven Tools simuliert. Die Sicherungsebene kann sowohl auf hohem Abstraktionsniveau (Simulation von Zügen) wie auch auf dem Detailniveau (Betrachtung einzelner Knoten des Condition/Event-Netzes) simuliert werden.

The development process of a security system is as follows in the procedure described in the dissertation:

• Step-by-step development of a formal model of the security level of the transport system at the level of a system type (e.g. system for a specific transport system or a specific railway administration) in the form of a predicate / transition network. This model describes the states and state transitions of the security level and is independent of the track networks to be secured. If a model has already been developed for the same or a similar transport system, the general system properties defined there can be adopted for the new model.
• Creation of the specifications of the track networks to be secured (data of the system copies)
• Carrying out an automated so-called unfolding process using unfolding tools:
  • Syntax, type and plausibility check of the type model
  • Preparation of the type model for the actual development process
  • Generation of symbolic interfaces for the levels dependent on the security level (control level, hardware interface level etc.)
  • Creating an interpretable or executable formal model for the system instances (actual unfolding): For every generally described state and state transition in the abstract type model, all looking for concrete instances that result from the copy data. The result is a condition / event network that describes the corresponding system copy. Each node in the network has a unique name, which is made up of the name of the corresponding abstract node and the names of the specific objects of the track network to which it refers.
• Checking the formal copy model with a runtime system for condition / event networks. This system contains an implementation of the above-mentioned eunomical algorithm, which monitors the admissibility of controllable events. In the above-mentioned dissertation, the levels dependent on the security level (outdoor area, control level, etc.) were simulated with interactive tools. The security level can be simulated both at a high level of abstraction (simulation of trains) and at the level of detail (consideration of individual nodes of the condition / event network).

The in the above Procedures reproduced in the thesis do not yet contain a concept for route monitoring and for various other control concepts that are common in railway control systems today.

It is therefore an object of the invention to integrate a function in the known method that enables monitoring of a route initially considered to be permissible.

This object is achieved by the features specified in claim 1.

By paying attention to the occurrence of so-called "normally unlikely events", ie events such as broken rails or losing the end position at switches whose Consideration from the outset would make every driving in a track network inadmissible. With the help of the additional, so-called reverted eunomic algorithm, dangerous consequences from such events can in many cases be avoided or at least reduced in their probability of occurrence.

Further developments of the method according to the invention are specified in the subclaims and relate to further control concepts to be included.

Claims 2 and 3 relate to the inclusion of the concept of speed in the control system, claim 3 relates to the handling of train operations and the interpretation of section assignments.

Claim 4 relates to the representation of transport units with the help of sequences of occupied track sections.

The subject of claim 5, finally, are the use of new transport units and the detection of train separations by means of occupancy and clearing of track sections.

The method according to the invention is to be described in detail below using exemplary embodiments and with the aid of four figures.

Fig. 1 -

den Aufbau der verwendeten Datenverarbeitungsanalge,

Fig. 2 -

schematisch einen Überblick über die Erstellung der Sicherungsebene,

Fig. 3 -

die Bewegung der Spitze eines Zuges in einem mit Doppelpunktgraphen dargestellten Gleisnetz,

Fig. 4 -

eine schematische Darstellung der Systemreaktion bei Eintritt eines unkontrollierbaren, normalerweise nicht anzunehmenden Ereignisses.

The figures show:

Fig. 1 -

the structure of the data processing system used,

Fig. 2 -

schematically an overview of the creation of the security level,

Fig. 3 -

the movement of the tip of a train in a track network represented by a colon graph,

Fig. 4 -

a schematic representation of the system reaction when an uncontrollable, normally unlikely event occurs.

1 shows the structure of the data processing system with the aid of which the method according to the invention is carried out. The figure shows two levels, which - separately from each other - are used to control or secure the track network forming the outdoor area, including the existing switches, signals, free signaling devices and the trains using the track network. The essential functions of the security level and the control level are shown in the figure.

2 gives an overview of the creation of the data for the security level. As can be seen from the figure, a general Petri network, for example a predicate / transition network, which contains a formal specification of the system type, is first created from the information available via the network and checked for consistency and correct syntax. It is then unfolded, together with the special track topology data, which may be available in the form of a colon graph, using a suitable deconvolution tool, which creates a special Petri network, e.g. a condition / event network, which contains the data for the security level and in which an algorithm (so-called eunomic algorithm) can be used as a runtime system, which checks the admissibility of all network changes made possible by controllable events and prevents the triggering of the controllable event in the event of expected impermissible events.

The following exemplary embodiments specifically describe the creation of the security level and the use of the so-called reverted eunomical algorithm.

For example :

In the example shown in Fig. 4, the turnout loses its defined end position (uncontrollable, but normally unlikely event). This threatens a state in which the Zugspitze of the approaching train is on a switch that has no defined end position (edg_crash). To prevent this, the above algorithm is started. He examines the previous set of the event "edg_crash" and finds the emergency dependency "reset_signal - head". Then the event "reset_signal is triggered, which throws the main signal on hold.

Claims (5)

Method for controlling and securing the operation of an arbitrarily designed track-guided transport system with the aid of a data processing system, in which a model of all states and events occurring in the transport system is stored in a formal language, such that changing (dynamic) data due to incoming events, if they can be assigned to a track element type independently of the track network, in the form of Petri networks with a high level of abstraction, provided that they can be assigned to existing track elements in the track network, in the form of networks derived from these Petri networks, and (static) data applicable to each system state, provided that they can be assigned to a track element type independently of the track network, in the form of predicates or invariants, provided that they can be assigned to existing track elements in the track network, are represented in the form of topography element data, and in which an algorithm is available that calculates all possible subsequent states from the current state of the system before triggering a controllable event and prevents the triggering if one or more impermissible states are found among the calculated subsequent states, characterized in that an uncontrollable event, its arrival cannot be expected from the outset to be defined as a normally unlikely event, and that during the check of the admissibility of a controllable event, it is not assumed that a normally unlikely event will occur, that an additional algorithm will be started if after detection the admissibility of the controllable event, a normally unacceptable event occurs, that by means of the additional algorithm, starting from the current system state generated by the occurrence of this event, the set of all states achievable by the consequences of uncontrollable events is examined to determine whether one is described as inadmissible State below or the preconditions for the occurrence of an event designated as inadmissible are met, and that, if so, the quantity of all or specially designated for this case controllable events are examined to determine whether their triggering can change the system state in such a way that the amount of previously calculated, achievable impermissible states or events designated as impermissible is reduced, and that, if so, the corresponding controllable events are triggered will. Method according to Claim 1, characterized in that speed data in the form of data tuples are assigned to the topography element data associated with the track elements actually present in the track network, which data contain not only valid maximum speeds but also data from which a deceleration that can be achieved with maximum braking use can be derived, that the on a track element valid speeds, unless they are newly specified, are calculated recursively or iteratively from data which are assigned to the track element to be traveled in the respective direction of travel, and that the calculated speed data are used to determine the maximum speeds applicable in the system. Method according to Claim 2, characterized in that the topography element data assigned to the track elements have the form of colon graphs and the data tuples containing the speed data are assigned to the points or edges of these colon graphs. Method according to one of the preceding claims, characterized in that track sections of the track network are equipped with track vacancy detection devices, that a coherent sequence of occupied sections is interpreted as a transport unit moving in the track network and the direction of travel is inferred from the sequence of the new assignments or free messages and that a single faulty one Clearance does not change the assumed extension of the transport unit. Method according to claim 4, characterized in that a single occupancy of a section is interpreted as a new transport unit with initially two tips and no conclusion when all neighboring sections are validly released, that the occupancy of a section lying in the direction of travel behind the end of an existing transport unit is interpreted as a change the direction of travel of the transport unit or as a backward moving, separated part of the transport unit and that in both cases the original end of the transport unit is converted into a tip in the system model.

Images