EP0920391B1 - Process of controlling and monitoring a traffic control system - Google Patents

Abstract

PCT No. PCT/CH97/00303 Sec. 371 Date Feb. 5, 1999 Sec. 102(e) Date Feb. 5, 1999 PCT Filed Aug. 19, 1997 PCT Pub. No. WO98/07609 PCT Pub. Date Feb. 26, 1998Process and device for controlling and monitoring of a traffic control system which has actuators and monitoring elements and by means of which at least two traffic tracks for railborne vehicles can be controlled by a control process which, upon request for allocation of a route, blocks all the actuators belonging to this route against other requests to create additional routes and control operations and carries out the request. To that effect, each of the changes in the positions or conditions of the actuators to be carried out by the control process, takes place only after successful testing for permissibility by a test process which is independent of the control process and which, in each case, tests whether the actuators and/or monitoring elements to be blocked or to be actuated for the allocation or release of the route already are in use and, thus, have been blocked.

Description

The present invention relates to a method according to the preamble of patent claim 1.

Various procedures are used in the construction of signal boxes for railway traffic. Above all, two types of functions are known for interlockings, interlockings based on the track plan and interlockings with a locker logic.
Electronic interlockings operating according to the track plan principle have a memory in which all adjustable routes are recorded. In DE-AS 10 30 383 (see also DE-PS 35 35 785 C2, column 4, lines 38-47) an electronic signal box is described in which the target stresses of all route elements to be involved in the individual routes are in one in a table provided for storage are stored. The positioning orders for the individual guideway elements are derived from the deviations between target and actual loads. However, this requires a large amount of memory, which increases significantly with the size of the system to be controlled. In the case of a larger station, more than 50,000 start / destination combinations can possibly be set. It must be ensured that all data on the optionally adjustable routes have been correctly selected and saved in order to achieve the required safety.

To ensure the greatest possible safety, however, electronic track interlockings are now primarily used used as e.g. are described in DE-PS 32 32 308. As part of the route search data words are meshed from the computers marked by the start and finish into the track plan Compound system entered and stored data words for many turnouts, a large part of which is not needed later. The unnecessary filing and deleting of data words leads to "superfluous" processing procedures in this electronic signal box, in particular assume an unacceptable scope for complex systems.

To reduce the effort in a method known from DE-PS 35 35 785 C2 in track elements, which are provided in the vicinity of points lying at a point, target group information filed, which simplifies the route search. The correct definition and decentralized storage However, the information in the corresponding storage units requires a corresponding one Expenditure.

A simplification of the monitoring of an electronic one working according to the track plan principle Signal box controlled system is described in DE 43 20 574 A1. In it, individual Partial controls assigned to several track elements at the same time in order for them to be cleared and dissolution to take effect together. This prevents malfunctions caused by short-term occurring different working conditions of the individual track elements otherwise occur could. However, this advantageous solution is also not suitable, a greater simplification of the electronic interlocking.

It is also important to observe the required safety standards. In DE-PS 32 32 308 possible component failures that can lead to changes in transmitted data, recognized by the transmission and comparison of non-equivalent data words. However, this leads to one additional effort without a comprehensive security check.

From DE-AS 24 02 875 it is known that protection against processing errors can be achieved by all safety-relevant commands with practically twice the effort on two independent ones Because of being worked out, when operating with only one computer, the double command processing carried out with two different programs and an intermediate command check program through which the developed commands are compared.

EP 0 683 082 A1 also describes a device in which the operator of a control system is largely relieved of monitoring tasks. Thereby already set Switching state combinations read out by a display device and in terms of compatibility checked with logical rules stored in a data processing system. This logical Rules must be created when planning a signal box and checked for correctness. To ensure comprehensive security, therefore, must be done with great effort for everyone switching conditions that may occur error-free logical rules are provided.

The present invention is therefore based on the object of a method for the control and To specify the monitoring of a traffic control system having actuating and monitoring elements, through which, taking into account high safety requirements, at least two lanes for track-bound vehicles can be set with little effort.

This object is achieved by the measures specified in claim 1.

Advantageous embodiments of the invention are specified in further claims.

The method according to the invention allows simple engineering of traffic engineering systems, in particular of electronic signal boxes in railway technology. By using two mutually independent procedures for control and monitoring arise simultaneously less effort for project planning of the plant as well as increased operational safety. With the request To set up a route, all of the control elements belonging to this route are a control process versus other requests to build further routes and Operations locked and then posed, with each being performed by the control process Changes to the positions or states of the control elements only after a successful check for admissibility by means of an inspection process that is independent of the control process. The control process can therefore with less effort can be realized because the security certificate based on a diversified review the admissibility of changes in the positions or states of the control elements by a dated Control process independent test process is carried out.

The control process preferably works in accordance with the known closure panel principle. The required dependencies of the route elements involved in the individual routes are documented in a matrix in a locking plan or in a locking table. This form of documentation justifies the designations of logic that are also used as a locking plan principle or a tabular principle. The individual guideway elements involved are wired in free connection and do not correspond to the track topology. The advantages lie in the flexible adaptability for application-specific functionalities.
A control process that works according to the locking board principle can be easily configured by creating a table in which the positions and states of the control elements provided for the individual travel routes are entered. The routes can therefore be switched easily, which eliminates the need to search for a route using the track plan principle with the problems described above.

The monitoring of the opening and closing caused by the control process according to the closure panel principle if necessary, the removal of the route is also carried out by the test process in this case after Principle of the track plan by checking on a case-by-case basis whether the actuating and / or Monitoring elements are used for an already created route and thus already are locked.

To check the positions and conditions provided by the control process for the actuators However, the testing process is advantageously carried out according to the track plan principle, through which all positions and conditions the actuators blocked for other routes are taken into account. The layers to be switched and states are therefore not based on a large number of logical rules created in advance, but checked based on the actual condition of the entire system. Through this comprehensive Testing results in increased operational reliability. Furthermore, the review is carried out after Track plan principle with little effort, since the correct one associated with a high effort and complete creation of test rules for route setting is no longer necessary.

Especially with the use of modern control technology, it is also possible to control the process to implement with reduced effort according to the track plan principle. To ensure the required In this case, the test process, which is independent of the control process, is based on the locking panel principle realized. The measures according to the invention therefore make it possible to adapt them to a planned one Track topology and a required level of security, one on two independent from each other To implement process-based system control with the least possible effort. The tax process is preferred for smaller systems according to the closure panel principle and for larger systems Systems implemented according to the track plan principle. Larger expenses for the implementation of the tax process do not apply, however, because the required security verification by the application of the control process independent test process can be fulfilled more easily.

Fig. 1

eine Eisenbahnanlage mit zwei parallel geführten Geleisen, die über zwei Verbindungsgeleise und je zwei Weichen miteinander verbindbar sind,

Fig. 2

den Spurplan der Anlage gemäss Fig. 1,

Fig. 3

den Spurplan eines erstellten Fahrweges von C nach B und

Fig. 4

den Spurplan eines erstellten Fahrweges von A nach D.

The invention is explained in more detail below using a drawing, for example. It shows

Fig. 1

a railway system with two tracks running in parallel, which can be connected to each other via two connecting tracks and two switches,

Fig. 2

the track map of the system according to FIG. 1,

Fig. 3

the track plan of a created route from C to B and

Fig. 4

the track plan of a created route from A to D.

Fig. 1 shows a railway system with two tracks running in parallel from A to B or from C to D. GL1, GL2, the two connecting tracks GL12, GL21 and two each to this connecting track Turnouts W1, W3 or W4, W2 connecting GL12, GL21 can be connected to one another. The tracks GL1, GL2 are divided into different areas, which are monitored by Freemeldemem FM1, ..., FM14. The track areas around the turnouts W1, ..., W4 to the middle of the associated connecting track GL12, GL21 are monitored by FM3, FM5, FM10 and FM12. Following the The areas belonging to the free detectors FM1, FM7, FM8 and FM14 are signals S1, S4, S5 and S8 intended. The areas associated with the free detectors FM4 and FM11 are the signals S2 and S3 or S6 and S7 assigned.

Fahrweg 1

von A über Geleise GL1 nach B,

Fahrweg 2

von A über Geleise GL1, Verbindungsgeleise GL12, Geleise 2, Verbindungsgeleise GL21 und Geleise GL1 nach B,

Fahrweg 3

von A über Geleise GL1, Verbindungsgeleise GL12 und Geleise 2 nach D (s. Fig. 4),

Fahrweg 4

von C über Geleise GL2 nach D und

Fahrweg 5

von C über Geleise GL2, Verbindungsgeleise GL21 und Geleise 1 nach B (s. Fig. 3).

The following routes can be created between points A, B, C and D starting from point A or point C (excluding shunting routes):

Route 1

from A via track GL1 to B,

Route 2

from A via track GL1, connecting track GL12, track 2, connecting track GL21 and track GL1 to B,

Route 3

from A via track GL1, connecting track GL12 and track 2 to D (see Fig. 4),

Route 4

from C via track GL2 to D and

Route 5

from C via track GL2, connecting track GL21 and track 1 to B (see Fig. 3).

With the request to build a route (e.g. route 1), all associated with this route Control elements of a control process versus other calls to build other routes (e.g. one of routes 2, 3, 4 or 5) and controls blocked and then posed. Any of the changes in the locations or states of the control process Control elements only take place after a successful check for admissibility by one of the control processes independent testing process. Monitoring the by the control process according to the lock plate principle initiated and possibly also the dismantling of the route by the test process is carried out according to the track plan principle, in which case by case it is checked whether the ones to be blocked and those to be set Adjustment and / or monitoring elements for an already created route are used and thus are locked.

For routes 1, ..., 5, track elements S1, ..., S8, W1, ..., W4, FM1, ..., FM14 are in the states specified in Table 1 below. This table 1 corresponds to the table described in DE-AS 10 30 383, in which the target loads of all the route elements to be involved in the individual routes are stored. The routes 1, ..., 5 can therefore be set using a control process.

In order to ensure a required security standard for interlockings working according to the locking panel principle, very high security standards must be chosen, especially for the creation of the software. The so-called software integrity level is determined by a procedure specified in the European standard EN 50 126. The various risks (dangers to human life, dangers to human health, dangers to the environment, dangers to property) must be taken into account. The following software integrity levels are specified in the standard mentioned as follows: Software integrity level Integrity software 4 very high 3 high 2 medium 1 low 0 non safety related

Known signal boxes operating according to the locking panel principle therefore have to be used with great effort taking into account the highest software integrity level according to the European standard EN50128 can be planned and implemented. In train stations with a larger number of routes This results in an enormous effort for these known signal boxes.

When planning a signal box that works according to the combined locking panel and track plan principle can provide the software required for the control process, while complying with the required Security standards with a lower software integrity level for signal boxes and thus with one less effort.

Every change of the positions to be carried out by the control process according to the closure panel principle or states of the control elements is therefore only carried out after a successful check for admissibility an audit process that is independent of the tax process. From the standard EN 50128, section B, 17 or the DE-AS 24 02 875 is known that protection against processing errors can be achieved by all safety-relevant commands are elaborated in two independent ways, with the Operation with only one computer, double command development with two different programs and intermediate command check program is performed by which the commands developed be compared. By the control process independent of the control process according to the track plan principle works, there is a diversified review of the admissibility of changes in the situation or conditions of the control elements. Instead of a control command with great effort in two independent ways a command is drawn up according to the locking panel principle and an independent one Verification according to the track plan principle. The check according to the track plan principle is guaranteed As is well known, a high level of security. Because the route search and process control according to the track plan principle omitted, there is little effort for the configuration and implementation of the test process. The monitoring of the opening and closing caused by the control process according to the closure panel principle if necessary, the removal of the route through the test process is based on the track plan principle, by checking on a case-by-case basis whether the actuating and / or monitoring elements to be blocked and provided can be used for a route that has already been created and are therefore blocked.

The control process and the independent test process can be controlled by software that stored in parallel or separately operated computers or even only in a single computer is. For the sake of simplicity, it is assumed below that the control process, as shown in FIG. 1 by a control process computer PR1 and the test process by a test process computer PR2 is controlled. The control process computer PR1 has a memory which, among other things, for storing the Lock plate data is used. The test process computer PR2 has a memory that i.a. for filing the set travel routes and preferably also for storing the track plan of the monitored Route network serves. The control of the control elements and the monitoring of the states of the track elements takes place as in the interlockings known from the prior art.

When route 1 is created by the control process, all associated control elements are blocked from other requirements for routes and controls. If route 5 is already set, the states of the track elements associated with route 5 are stored in the test process computer PR2. The control process is able to set the travel routes automatically. To ensure the required security, all control commands generated by the control process according to the locking panel principle are verified element by element in the test process according to the track plan principle on the basis of the actual positions of the control elements and the information provided by the monitoring elements and, taking into account the routes already created, in particular with regard to enemy routes, required side protection is checked and released if no conflicts are found. However, if an error occurs in the control process and, for example, signal S3 is to be set to run, even though signal S3 is set to stop for route 5 that has already been created (see table 3), this will be changed by the test process based on the status of the route in the test computer 5 associated track elements immediately determined, after which the control process is stopped and an error is reported.

The test process can also be used to determine whether the side protection for the set Route is guaranteed. In the guideway 5 shown in Fig. 3, the side protection is by the Switch W1 and the signals S3 and S8 guaranteed. The switch W1 is in the "straight" state and the signals S3 and S8 blocked in the "Halt" state. The route 3 shown in FIG Edge protection guaranteed by signals S2, S5 and S4. The signals S3 and S8 in the state "Halt" blocked. Before the release of a route can be determined again by the test process whether there are conflicts with further routes or regulations. After the release of the Route (e.g. route 1 was released after route 5 was dismantled), its data becomes available stored in the memory of the test process computer PR2 and for checking the actions of the control process used.

The control process can be used to set a route after an order has been placed, e.g. detected whether the elements indicated in the corresponding line of the locking table (table) for other routes are used or reserved or released for switching (the control process therefore does not see a driveway, but the arbitrarily arranged elements of a row of the locking panel). Once all elements of the row of the locking panel are released and set to are reserved for a new route, the check is based on the track plan principle. The one after The test process working on the track plan principle has the data of the track topology at least for any adjustable route. The check can be done with more or less effort. For example, it is only checked whether the changes intended by the tax process are correct Guide the setting of the route. E.g. the correct setting is not provided for a turnout, This is due to the control process, which has no knowledge of the topology of the rail network and the routes has not recognized. By the independent of the control process, working according to the track plan principle Testing process, the fault is easily recognized because the lane between the endpoints is due the wrong position of the switch is interrupted. Likewise, any incompleteness of the Settings recognized. In a further stage, the testing process can include other framework conditions, e.g. Check edge protection, maximum permissible speed, etc.

The check is preferably carried out, as described in the section above, after the reservation of all elements specified in a line of the locking panel. After successful testing, the driveway set overall. It is also possible to carry out the test before the changeover individual element.

In a preferred embodiment of the invention, the test process working according to the track plan principle linked to a parameter list that allows customer-specific settings to be checked, which are carried out by the control process and which are independent of the topology of the to be set Routes are (e.g. for a route that serves express train traffic, a decentralized one arranged signal lamp). The signal lamp is therefore an element in the concerned Row of the closure panel and recorded by the test process based on the parameters supervised.

As described at the beginning, the control process for small systems becomes simpler according to the closure panel principle and for larger systems it is easier to implement the track plan principle (the test process is implemented accordingly according to the track plan or the locking panel principle). Between there is an area in which the tax process with no major differences in effort can be realized according to the locking panel principle or according to the track plan principle. Please note however, that plants tend to grow and products gradually, with each generation a larger one Should have scope of services. The choice of principle for realizing the control process is therefore, taking into account the prevailing framework conditions and the development forecasts made on a case by case basis hold true.

The scope of services of both processes is considered, taking into account the total to be fulfilled Security requirements, preferably coordinated. For example, can the performance of the Control process in relation to the fulfillment of the security requirements can be reduced if the Scope of services for the testing process is chosen accordingly larger.

The system structure of both processes is therefore preferably chosen to be modular, so that a corresponding one Adaptation to the overall security requirements can be achieved with little effort can.

Claims (9)

1. Method of controlling and monitoring a traffic control installation which has control and monitoring elements (W1 - W4, FM1 - FM14) and by means of which at least two tracks (GL1, GL2) for railborne vehicles can be controlled by a control process which, when requested to set up a route, disables all the control elements associated with said route with respect to other requests to set up further routes and controls and then sets said control elements,
   characterised in that
   each of the changes in the positions or states of the control elements (W1 - W4) to be performed by the control process only takes place after successful checking for permissibility by a control-process-independent proving process which checks, on a case-by-case basis, whether the control and/or monitoring elements (W1 - W4, FM1 - FM14) to be locked and set to set up or clear down the route are being used for an already set-up route and have therefore already been locked.
2. Method according to Claim 1,
   characterised in that
   the control process employs the geographical principle and the proving process employs the control table principle or that the control process employs the control table principle and the proving process employs the geographical principle.
3. Method according to one of Claims 1 or 2,
   characterised in that
   checking by the proving process takes place entirely after locking of all the control elements (W1 - W4) or after locking and prior to setting of each individual control element (W1 - W4).
4. Method according to one of Claims 2 or 3,
   characterised in that
   all the control commands generated by the control-table-based control system are verified element by element in the geographically based proving process on the basis of the actual positions of the control elements (W1 to W4) and of the information provided by the monitoring elements (FM1 - FM14) and are checked and released, taking account of defined criteria, particularly with respect to the route to be set up, possible conflicts with already set-up routes and/or flank protection required, if no conflicts are detected.
5. Method according to Claim 4,
   characterised in that
   the proving process employing the geographical principle has a parameter list used to check the settings which are not directly associated with the route to be set up.
6. Method according to one of the preceding claims,
   characterised in that
   element-by-element verification by the proving process takes place in accordance with railway engineering safety rules.
7. Method according to one of the preceding claims,
   characterised in that
   the control process monitors route entry and releases the control elements (W1 - W4) again to clear down the route.
8. Method according to one of Claims 2 - 7,
   characterised in that
   the data for the route released by the proving process is stored in a memory checked by said proving process and already containing the routes already set up and is jointly used to check further routes to be set up.
9. Method according to Claim 8,
   characterised in that
   a route recorded in the memory is deleted element-by-element by the proving process on passage of the vehicle for which the route was set up by normal cancellation as the corresponding elements are cleared.

Images