EP2036800A2 - Electronic element control that is safe for signalling for carrying out drive operations for rail vehicles - Google Patents

Abstract

The method involves providing a signal-technical safe operation and observation level (1), a safety level (2) and a process level (4) containing elements to be controlled, and providing a data communication device between the elements of the levels. Safety-oriented examinations and algorithms are provided for ensuring a process safety by a safe computer system (3) of the safety level, where the computer system and/or other components of the operation and observation level and the process level are satisfied for smaller safety requirements. An independent claim is also included for a device for signal-technically safe electronic element control for execution of a drive operation of rail vehicles.

Description

The invention relates to a method and a device for fail-safe electronic control of elements that guide and secure the operation of rail vehicles.

In the case of technically secured routes, rail vehicle operation is centrally managed and secured by a signal box responsible for the relevant infrastructure area.

The elements of the outside installation of the signal box, such as Signals, switches, level crossings, block facilities, etc. must be safely controlled and monitored by the interlocking logic signal, that is, the elements of the outdoor facilities are sufficiently likely to be arbitrarily assumed errors in the system in a state that the safety of Driving operation is not endangered.

Signaling safety of positioning and monitoring devices is realized by means of safety-related components, whereby all components involved in the positioning and monitoring processes are checked accordingly.

A comparative overview of the different types of electronic interlocking systems used by various railway administrations with regard to the computer components, system structures, security concepts and design of hardware and software used is described in the article "Sicherungs- und

Telecommunications technology "in Signal + Draht 3, 1997. The systems in use differ, among other things, with regard to single or dual-channel, safe or non-secure operating systems, operating concept and costs.

Thus, in particular in German ESTW a secure display and operation is required.

Examples of the system architecture in German ESTW can be found in the overview articles "SIMIS D", in Signal + Draht 3, 2006 as well as "The Bombardier solution of a new ESTW design at DB AG", in Signal + Draht 5, 2005.

All established, predominantly proprietary electronic LST concepts are based on "process backups". For example, there is a classic 2-by-3 processor system from commercially available electronic components, such as the Intel Pentium 1. A programmed in the standard processors specific application maps the security mechanisms. The results of the test applications are compared to hardware partitions designed from standard semiconductor components and safety shutdowns are triggered in the event of a fault.

In some cases, the principles of process safety are already being applied in railway safety technology today.

For safety-related operations in a signal box, process assurance from source to sink is implemented. The company-neutral SBS interface prescribed by DB AG defines appropriate dialogs. Corresponding procedures in the safe interlocking core and in the operating station preclude a malfunction of the interface and the display with sufficient probability in the event of safety-critical operation.

In order to meet the high safety requirements also in operation and display, but until now it was forced to use secure computer technology not only in the interlocking core, but also in the areas of element control and operation / display. Thus, at both ends of the process, ie at source and sink, there are safe and therefore cost-intensive components.

In DE 10 2005 043 305 A1 describes a system architecture for controlling and monitoring components of a railway safety system. In this case, an automation platform, which comprises a plurality of modules, in particular CPU, power supply, module for safety-related signal processing, module for non-safety-related signal processing, communication module, connected via special interfaces with safety-related and non-safety-relevant components of the railway safety system. The automation platform is a programmable logic controller (PLC). The predetermined software structure of the automation platform is usually arranged in such a modular or hierarchical manner that the logistics of the railway safety system, in particular the interlocking logistics, can be organized in function-specific software programs.

Out DE 196 06 894 C2 a device for fail-safe control and monitoring of electrical consumers in the railway industry is known in which each load circuit at least two in series, regardless Having controllable each other, not technically safe switch for opening / closing of the circuit has. The two switches can be controlled by independent computer channels of a secure computer system. Each wire of the circuit contains one of the two switches. At least one detector is provided for detecting a test voltage derived from a feed or test current flowing via the consumer or at least indirectly applied by the consumer and dependent on the operating state of the consumer. An inadequately closed or opened switch changes the voltage in a marked manner compared to the test voltage which is established when the switch position is correct. The detector output signals are evaluated by the two computer channels of the secure computer system, and the computer system detects an untimely open / closed at least one of the switches from the occurrence of not expected at this time detector output signals.

Out DE 100 53 023 C1 For example, a method for controlling a safety-critical rail operation process and a device for carrying out this method are known. In this case, at least one signal-technically secure computer is used, the signaling commands safely issued from incoming commands in accordance with a Bahnbetriebsordnung signal-technically reliable control commands to process elements and from there originating messages a process state monitoring and process control supplies. Only a system software is stored in the secure computer whose programs enable the secure computer to make a signal-technically secure input / output and the signal-technically secure data comparison. The decisive conditions for the railway operating process and

Dependencies are stored in one or more non-signal-secure commercial computers. In this case, the signal-technically secure computer generates from the commands and messages supplied to it processing jobs that are transmitted to the or the commercial computer and there at least twice processed independently. The resulting results or intermediate results are transmitted back to the secure computer where they are signal-technically tested for consistency.

Common disadvantage of the above-described prior art is the still quite expensive and therefore expensive system architecture; also related on the required in Germany safe operation and display, which must be technically implemented.

In the case of the established solutions, special, manufacturer-specific "control elements" ensure adaptation to the railway-specific conditions and the insulation.

Long star-shaped copper connections to the outer elements mean that high voltage resistance and various cable faults must be controlled by the control elements. This traditionally leads to elaborate railway-specific special developments.

Traditionally, the desired event has not yet been evaluated in the control concepts. When signal z. B. the lamp current tested and concluded from whether the signal lamp is lit with sufficient probability. In points one starts from a positive connection of the adjusting rods and the bearing and transmission parts with the switch blades or the heart and evaluates appropriate switch packages (mostly in the point drive housing) for the feedback of the state of the switch. The 4-wire circuits used reduce and complicate the number of responses and their fuse-related plausibility checks.

It is therefore an object of the invention to realize the use of industrial standards for control and safety technology in an electronic interlocking the electronic control of elements that guide the driving of rail vehicles and secure and while the most efficient and cost-effective the high demands in terms of safety and function Network of Deutsche Bahn AG.

In this case, the required safe display and operation is to ensure.

This object is achieved according to the features of the preamble of claim 1.

The system architecture is based on the proven industrial level model, consisting of an operating and monitoring level, a backup level and a process level.

According to the invention, a fully graphic system based on market standards represents the operating and monitoring level.

The backup level is formed by a secure computer system.

In the process level are the elements of the outdoor facility to be controlled as well as other signaling equipment, such as neighboring signal boxes, block facilities, railroad crossings, etc.

The components of the various levels communicate via corresponding data transmission devices.

The safety-related checks and algorithms for ensuring process security are performed exclusively by the secure computer system of the security level, whereas the computers or other components of the operating and monitoring level as well as the process level can meet lower security requirements.

The method is based on safety technology on a variant of the known process assurance, wherein according to the invention, the backup procedures, although consistently at the endpoints (source and sink) take the actions, the intermediate and final results, however, are checked only in the safe interlocking core. Thus, for all components outside of the secure interlocking core, that is, both the communication and the process level, the method allows for low cost, industry standard components that meet a lower level of security.

A major advantage of the method is that the high cost of secure software design, secure programming and testing, and secure hardware is only required at one point in the secure interlocking core.

By applying the CENELEC standards, a quantitative analysis of the malfunction of individual modules, programs and data connections is possible, so that different types of process assurance can be calculated with regard to the required SIL.

Claim 2 describes how the method reliably triggers commands for controlling elements of the process level. A distinction must be made between the way in which commands are issued to the process level.

When commands are entered by the operator input at the operating and monitoring level, they are transmitted with a data transmission device to the secure computer system in the security level, where they are checked for plausibility. Plausible commands are re-coded and transmitted back to the control and monitoring levels. In the at least one computer of the operating and monitoring level of the newly coded command of the secure computer system is also checked for plausibility and the Transfer the result of the plausibility check in the final encoded form to the secure computer system in the backup level.

In addition, it must generally be ensured with such safety-relevant manual operating inputs via a separate communication path that the operation is explicitly desired in this form. For this purpose, in particular a doubled or antivalent contact is closed, and / or additionally encoded digital addresses are read in and checked.

If all these conditions are met, it can be assumed with sufficient certainty that an element control from the operating and monitoring level is actually desired and the command is plausible and the communication with the element and the correct addressing of the element in the process level are working properly , Accordingly, the command to control the element can be triggered by the secure computer.

However, as soon as at least one of the abovementioned plausibility checks of the commands used in at least one of the participating computers fails, the control of elements of the process level must be safely aborted with a corresponding error message.

If the commands for controlling at least one element of the process level are issued in the secure computer system of the security level due to the internal program sequence, the control is triggered directly by the secure computer system of the security level.

Claim 3 describes how the activation event generated by the command triggered in accordance with claim 2 is reliably monitored by signal technology.

After the command for triggering an element of the process level has been triggered by the secure computer system of the security level, it is transmitted via a data transmission device to the appropriate element in the process level. The effect of this command results in at least one control event, the result of which is monitored by suitable sensors and reported back to the secure computer system in the backup level. The results of each triggering event must be checked several times for the required logical and timely sequence. Since only one secure computer system is available in the safe interlocking core, all tests must be carried out there as well. This is realized by multiple, but time-delayed checks in the single secure computer system, so that for each result multiple dialogues arise, which are led to the final result. After a positive check of all results on the activation events, a successful element activation is assumed in the secure computer system and this is disclosed. If the examination of at least one result of the activation events in at least one of the multiple dialogs contradicts the required logical and timely sequence, then the secure computer system assumes and also reveals a faulty element activation.

The multiple, time-staggered examination of the different events at only one point in the safe interlocking core requires a powerful computer architecture. It must ensure that the time required for the tests required according to the desired safety level and the subsequent placement of the elements of the process level does not take more time than the maximum time required by the approval authority, within which the signal term "stop" must be shown (holding time) ,

Today's proven, proven processors and communication systems make this possible.

According to claim 4, an advantageous embodiment of the invention is that the secure computer system of the security level consists of a modular system for industrial automation systems. This eliminates the previously required costly special developments for railway operations.

In claim 5, a decentralizable process level is described, which is connected via a data network with the backup level. In this process, logically passive components are used at the process level, which convert the transmitted data into digital input / output bits in a process-protected manner. Basically, the decentralized process element converts only network telegrams of the safe interlocking core into digital outputs and reports changes to the digital inputs event-controlled or, on request, from the safe interlocking core, also via the communications network.

Both the communication in the entire process chain and the function of the decentralized, generally non-secure elements of the process level must be constantly checked according to claim 6. For actions initiated by the safe interlocking core, this is done via dialog-oriented process security.

For this purpose, mechanisms triggered and monitored by the security level must cyclically check the communication in the process chain as well as the function of the elements in the process level. In the event of an error, at least the power supply to the associated element of the process level is reliably switched off by the fuse level.

Optionally, the signal supply voltage is additionally separated in such a way that in the event of a fault only the elements belonging to the signal term "stop" are supplied with voltage.

In claim 7, a device is described which implements the method mentioned in claim 1.

The system architecture is based on the proven industrial level model, consisting of an operating and monitoring level, a backup level and a process level.

According to the invention, a fully graphic system based on market standards represents the operating and monitoring level.

The backup level is formed by a secure computer system.

In the process level are the elements of the outdoor facility to be controlled as well as other signaling equipment, such as neighboring signal boxes, block facilities, railroad crossings, etc.

The components of the various levels communicate via corresponding data transmission devices.

A secure computer system is only in the backup level. It performs the safety-related checks and algorithms to ensure process security, whereas the computers or other components of the operating and monitoring level as well as the process level meet lower safety requirements.

The device is based on safety technology on a variant of the known process assurance, wherein according to the invention, the backup procedures, although consistently at the endpoints (source and sink) take the actions, the intermediate and final results, however, are checked only in the safe interlocking core. Thus, all components outside the safe interlocking core, that is, both for communication and for the process level, are industry standard components that satisfy a lower level of security.

Time-consuming secure programming and testing as well as expensive hardware is only required at one point in the safe interlocking core.

By applying the CENELEC standards, a quantitative analysis of the malfunction of individual modules, programs and data connections is possible, so that different types of process assurance can be calculated with regard to the required SIL.

In claim 8 is described how the device safely triggers commands for controlling elements of the process level. A distinction is made between the way in which commands are issued to the process level.

When at least one command is input from the operator input at the control and observation level, a data communication device transmits the command to the secure computer system at the backup level. The secure computer system checks the command for plausibility. Plausible commands are re-coded and transmitted back to the operating and monitoring level. In the at least one computer of the operating and monitoring level of the newly coded command of the secure computer system is also checked for plausibility and transfer the result of the plausibility check in final coded form to the secure computer system in the backup level.

In addition, in general with such safety-relevant manual operating inputs, a separate communication path ensures that the operation is explicitly desired in this form. For this purpose, in particular a doubled or non-equivalent contact must be concluded by the operator, and / or additionally coded digital addresses are read in and checked.

If these conditions are met, it can be assumed with sufficient certainty that an element control from the operating and monitoring level is actually desired on the one hand and the command is plausible on the other hand and the communication with the element in the process level functions flawlessly. Accordingly, the secure computer triggers the command to control the element.

However, as soon as at least one of the abovementioned plausibility checks of the commands used in at least one of the participating computers fails, the secure computer system aborts the control of elements of the process level with a corresponding error message.

If the commands for controlling at least one element of the process level are issued in the secure computer system of the security level due to the internal program execution, then the secure computer system of the security level triggers the control directly.

Claim 9 describes how the secure computer system reliably monitors the activation event generated by the command triggered in accordance with claim 8.

After the command for triggering an element of the process level has been triggered by the secure computer system of the security level, it is transmitted via a data transmission device to the appropriate element in the process level. The effect of this command results in at least one control event, the result of which is monitored by suitable sensors and reported back to the secure computer system in the backup level. As final results of the driving events, for example, the feedback from optical sensors in the connection of light signals or the use of magnetic sensors, such as. industrial beros for monitoring the mechanically correct circulation of a switch in question.

The results of each triggering event must be checked several times for the required logical and timely sequence. Since only one secure computer system is available in the safe interlocking core, all tests must be carried out there as well. For this reason, the software in the secure computer system checks the results several times, but with a time lag, so that multiple dialogs result for each result, which are carried to the final result.

After a positive check of all results for the triggering events, the secure computer system starts from a successful element control and reveals this. If the examination of at least one result of the triggering events contradicts the required logical and timely sequence, then the secure computer system assumes and also reveals a faulty element control.

The multiple, time-staggered examination of the different events at only one point in the safe interlocking core requires a powerful computer architecture. It ensures that the time required for the tests required according to the desired safety level and the subsequent placement of the elements of the process level is not spent more time than the maximum time required by the approval authority, within which the signal term "stop" must be shown (holding time) ,

Today's proven, proven processors and communication systems make this possible.

According to claim 10, an advantageous embodiment of the invention is that the secure computer system of the backup level consists of a fail-safe programmable logic controller (PLC).

The logic implemented on the PLC is programmed according to DIN EN 61131 and is therefore easy to port to other PLC systems.

In claim 11, a decentralizable process level is described, which is connected via a LAN (Local Area Network) with the backup level. In this case, standard ET (electronic disconnect bar) or small PLC systems act as logically passive converters for the data transmitted via Ethernet or another standardized data network technology, so that there are digital input / output bits behind the converters.

The process level is the multiplier for the LST, the main cost and LCC share.

ETs are standard products of industrial automation and are offered with a similar range of services by many companies.

Neutral network addressing and comparable performance characteristics of the manufacturer result in a simple substitutability of the selected supplier.

In addition, compact small PLC systems are now on the market. These too can perform ET functions. Their use is also possible, but requires a CENELEC-compliant "Code Inspection".

According to the invention, consistent decentralization places standard components close to the target object and controls them via LAN connections (copper cables or fiber-optic cables) from the safe interlocking core. This results in very short cable lengths and protected cable routes within the outdoor area. Thus, significantly lower induced voltages for safety and protection considerations on the cables are to be assumed.

Both the communication in the entire process chain and the function of the decentralized, generally non-secure elements of the process level must be constantly checked according to claim 12.

For this, watchdogs triggered and monitored by the protection level cyclically check the communication in the process chain and the function of the elements in the process level. In the event of a fault, the fuse level safely disconnects at least the power supply to the associated element of the process level. Optionally, the signal supply voltage is additionally separated in such a way that in the event of an error only the elements belonging to the signal term "stop" are supplied with voltage.

The invention is explained in more detail below with reference to a drawing with two figures and an example in an advantageous embodiment.

Fig. 1:

die Darstellung der dialogorientierten Sicherungskette zwischen sicherem Stellwerkskern und Prozessebene, inkl. Watchdog,

Fig. 2:

die Prinzipschaltung des Prozesselements "Signal" mit Ethernet-Schnittstelle, Elektronischer Trennleiste, Stromversorgung und Überwachung des Lichtstroms mit einem optischen Sensor.

The drawing shows in

Fig. 1:

the representation of the dialog-oriented security chain between safe interlocking core and process level, incl. watchdog,

Fig. 2:

the basic circuit of the process element "Signal" with Ethernet interface, electronic isolator, power supply and monitoring of the luminous flux with an optical sensor.

The system architecture of an electronic interlocking for carrying out the driving operation of rail vehicles is divided into three levels of operation / monitoring, the fuse and the process elements

A fully graphic system based on market standards can be found at the operating and monitoring level (1).

The fuse level (2) is formed by a secure computer system that can be used as a fail-safe PLC, such as a PLC. a SIMATIC S7-F is formed.

In the process level (4) are the elements to be controlled outdoor facilities and other signaling devices, such as neighboring interlocking, level crossings, etc. For reasons of clarity, only the process element "signal" is named. The other process elements of the process level are only indicated by the dashed representation of the Ethernet.

Via copper cables, the data is exchanged, for example, in an Ethernet LAN (5) between the security level (2) and the decentrally placed elements (6) of the process level (4). This results in very short cable lengths and protected cable routes within the outdoor area. Thus, significantly lower induced voltages are assumed on the cables. Cable faults can be easily revealed, since only small ohmic resistances are to be assumed for the short cable paths. Ground faults are only relevant as double faults due to galvanic isolation of the supply voltage and are revealed in terms of hardware and process safety. In addition, simple earth faults can be detected by earth fault detectors.

Electronic interfaces (ET, 7) are used as an interface to the elements of the process level. As logically passive components set the ET (7) converts the data transmitted via Ethernet (5) into digital input / output bits.

If, for example, a signal incandescent lamp (20) is to be switched on as part of the automatic, internal program sequence of the route setting, the process chain for the reliable activation and feedback of the lamp thread is as follows:

The interlocking core (3) triggers a data telegram in the first PLC cycle which resets a digital output (DA, 9) from the ET (7) of the addressed signal process element. This reset controls a positively driven relay K1 (16). K1 (16) has a normally closed contact in the circuit of the signal lamp. Thus, the potential of the signal lamp voltage is passed to the normally open contact of the electronic relay (ELR, 17).

This potential is now detected by a digital input (8) of the process element and transmitted via the ET (7) via network (5) to the safe PLC (3). The safe PLC (3) expects just this reaction (change of the status of the corresponding DE bits from 0 to 1) for triggering the next process step, namely the control of another digital output (9) of the process element. This DA (9) now drives the ELR (17). The ELR closes the circuit consisting of current source (10), NC contact relay K1 (16), NO contact of the ELR (17) and lamp filament (20). Since the relay contact of the K1 (16) is already closed, this is conserved, which significantly increases the life of the relay. A corresponding sequence when deleting the signal term also serves to protect the relay contact. The lifetime of the ELR (17), however, is not affected by the number of switching operations.

By at least one optical sensor (15) on the corresponding signal lamp is now recognized that the signal light bulb is lit correctly. This information is transmitted to the safe interlocking core (3) via a digital input (8) on the ET (7). Thus, the expected response (change of the status of the corresponding DE-bits from 0 to 1) has occurred in a timely manner. The interlocking core (3) can check for logical sequence and also evaluate the timely result of the optical feedback in a defined time window. After a positive check, the safe interlocking logic can proceed from a correct procedure and take into account the signal optics (20) operating in accordance with the regulations in the central lane logic.

It can be assumed that the non-signal-safe components only control the untimely display of a driving signal image with a THR of> 10 exp -4 per hour.

The possible malfunction of the communication, e.g. with the consequence that a pending green is not turned off, is to be monitored. Also the possible malfunction of the ET.

For this purpose, a watchdog (11) is used. This must be controlled in a defined pulse / pause ratio by a digital output (9) of the ET (7). If the pulse remains off in a defined time window, the watchdog (11) passivates the power supply (10). The impulse is generated by the safe interlocking core.

If the cyclic pulse is present at the watchdog (11), the ET (7) and the communication to the safe interlocking core (3) function.

If the communication fails, the digital output (9) of the ET (7) is not cyclically requested to output the watchdog pulse. The pulse remains off, and the watchdog (11) interrupts the power supply (10).

If the ET (7) fails, the cyclic pulse and the required pulse / pause ratio, which the watchdog (11) expects, are very likely absent or pending in another pulse sequence. The watchdog (11) detects this and interrupts the power supply (10).

The watchdog (11) itself switches the supply voltage of the ET (7) via the closer of a positively driven small relay (12). If the pulse remains off, the positively driven relay (12) drops out, and the supply voltage is interrupted. The safe interlocking core (3) detects this by the absence of the Ethernet telegrams.

To test the positively driven relay (12) and the entire watchdog function, the watchdog pulse from the safe interlocking core (3) is briefly exposed. The supply voltage at a DE of the ET is then expected via the NC contact of the positively driven relay (12). If the relay contacts are welded or there is another error in the communication chain of the watchdog pulse, this reveals itself in the test cycle. For the duration of the interruption of the supply voltage, the ET supply voltage is buffered behind the watchdog relay via a capacitor (13).

By further contacts of the positively driven relay, if necessary, the signal voltages driving terms off (18) and the signal voltage holding terms turned on (19).

Through the process chain of the safe software of the interlocking core (3) further errors of each element and also secondary errors are revealed:

Defect of the ET (7):

Each action on an element (6) of the process level (4) is initiated via the associated ET (7). In the event of a defect in the ET, the deactivation of the DA (9) for relay 16 is not carried out. So also no feedback of the upcoming potential at the ELR (17) arrives. The safe interlocking core (3) detects the error.

Defect at the DA (9) in the ET (7):

1. 1. Deformed relay (16):
   • The relay is constantly energized. The corresponding feedback on DE (8) does not materialize. The safe interlocking core (3) detects the error.
2. 2. High-impedance relay (16):
   • The relay has already fallen down in the ground state. The associated feedback of the potential at the ELR (17) is there at the wrong time. The safe interlocking core (3) detects the error.

Defect at the DE (8) in the ET (7):

Feedback is not received or made at the wrong time. The safe interlocking core (3) detects the error.

Another second-error disclosure results from the following identical procedure with the ELR (17), and additionally by reading back the light:

Defective in the feedback of the light:

1. 1. Durchlegiert:
   • Licht wird ständig detektiert. Die zugehörige Rückmeldung über DE (8) steht zur Unzeit an. Der sichere Stellwerkskern (3) erkennt den Fehler.
2. 2. Hochohmig:
   • Licht wird nach Ansteuern des ELR (17) nicht detektiert. Der sichere Stellwerkskern (3) erkennt den Fehler.

Light sensor DE / sensor (15):

1. 1. Alloyed:
   • Light is constantly detected. The associated feedback via DE (8) is at an inopportune time. The safe interlocking core (3) detects the error.
2. 2. High impedance:
   • Light is not detected after driving the ELR (17). The safe interlocking core (3) detects the error.

Even if the feedback of the light is correct, faults due to extraneous light may occur.

A foreign light incident only has a secondary effect in connection with the first fault "defective control / illumination". An effect arises only when exactly in the time window in which the optical feedback of a control of the signal optics (20) is pending, extraneous light is incident and despite not existing signal illumination for a positive feedback by the optical sensor (15).

If external light is already present, this is recognized by the safe interlocking core (3), since the optical sensor (15) gives a positive feedback at an inopportune time.

The case of external light incidence precisely in the time window of the term control is sufficiently controllable by suitable positioning and protection of the sensor (15) from extraneous light.

For the error disclosure of signal optics, which do not change the state for a long time, short test cycles must be performed by the safe interlocking core, e.g. once per 24h, when several track sections are free in front of the element.

Defect in communication:

Multiple telegrams (14) to trigger an action results in a high computational error control. In the safe interlocking core (3) a communication error is revealed via a plausibility check. If a telegram is implausible, the safe interlocking core passivates the system.

Since defective communication means that timely processing of the process can not take place, an additional backup is provided.

In addition, the watchdog (11) is integrated into the overall chain of communication. As a result, errors in communication reveal promptly.

Taking into account the multiple dialogues, the opposite control of relays (de-energized switched on) and ELR (activated switched) in combination with the dialog-oriented check of the procedure in the safe interlocking logic, communication errors with a probability corresponding to SIL 4 are to be excluded.

Defect in the lamp socket:

A base connection (burn main and secondary thread) is detected by triggering the fuse (22) and by the DE (8) on the ELR (17).

Defect at the main thread:

The optical sensor (15) gives no positive feedback after connection. It can be triggered a switch to the secondary thread. In addition, information is sent to the dispatcher (main thread, for example, "red N1" is defective).

Time-staggered, independent procedures in the safe interlocking core (3), their plausibility checks and the timely testing of the light emission of the addressed light source (20) in the secure software result in process security, including the non-secure components of the process level (4).

In the case of a safety-related manual operation of the signal in the operating and monitoring level (1) instead of the automatic control described above, it is generally required that the manual operation is explicitly confirmed before the command is triggered. For this purpose, in this example, a decentralized process element KF (release command not shown) is installed on the operator station system via a separate communication path in conjunction with a pushbutton / key switch with a duplicated contact. This maps the KF operator dialog with the safe interlocking core.

LIST OF REFERENCE NUMBERS

1

Operating and observation level

2

assurance level

3

Secure computer system (safe interlocking core)

4

process level

5

Ethernet

6

process element

7

Electronic divider

8th

Digital input

9

digital output

10

power supply

11

Watchdog

12

positively driven small relay

13

buffer capacitor

14

Multiple dialogs

15

Optical sensor

16

Forced-controlled relay K1

17

Electronic relay (ELR)

18

Switch for time-indicating items

19

Halt term switch (red)

20

signal light bulb

21

Watchdog relay

22

fuse

Claims (12)

Method for signal-safe electronic element control for carrying out a driving operation of rail vehicles, consisting of a signal-technically safe operating and monitoring level, a backup level and a process level containing the elements to be controlled and data transmission devices between the components of these levels, either by operator input on the operating and monitoring level or by internal program flow in the secure computer system of the security level commands for controlling at least one element of the process level can be given, characterized in that the safety-related checks and algorithms to ensure the process security provided by the secure computer system of the backup level, whereas the computer or other components The operating and monitoring level as well as the process level can meet lower safety requirements. A method for fail-safe electronic element control for performing a driving operation of rail vehicles according to claim 1, characterized in that the security-relevant activation of elements of the process level is triggered by the secure computer system of the security level, if i. in the case of commands entered by the operator input on the operating and monitoring level, the commands are transmitted with a data transmission device to the secure computer system in the security level, checked positively for plausibility and transmitted back to the operating and monitoring level in newly coded form, the software of the at least one computer of the operating and monitoring level, in turn, positively checks the plausibility of the newly coded command of the secure computer system and successfully transmits the result in finally coded form to the secure computer system in the security level, and if additionally via a separate communication path of the assigned process element For safety-relevant operations, a duplicate or anti-valent contact and / or additionally coded digital addresses were read in and positively tested. ii. a command is issued to control at least one element of the process level by internal program execution in the secure computer system of the security level, - The control of elements of the process level is safely aborted with a corresponding error message as soon as at least one of the aforementioned plausibility checks of the commands used in at least one of the computers involved negative. Method for signal-safe electronic element control for carrying out a driving operation of rail vehicles according to at least one of the preceding claims, characterized in that - The trigger command for controlling elements of the process level is transmitted via a data transfer device from the secure computer system of the backup level to the appropriate element of the process level and there leads to at least one control event whose result is monitored by a suitable sensor and fed back to the secure computer system in the backup level . the results of the activation events are checked for the required logical and timely sequence via multiple dialogs in the secure computer system of the security level, - after a positive test result of all results of the activation events in the secure computer system, a successful element activation is assumed and this is disclosed, - If a negative test result of at least one result of the driving events of a faulty element drive is assumed and disclosed. Method for fail-safe electronic element control for performing a driving operation of rail vehicles according to at least one of the preceding claims, characterized in that the secure computer system of the security level consists of a modular system for industrial automation systems. Method for signal-technically safe electronic element control for carrying out a driving operation of rail vehicles according to at least one of the preceding claims, characterized in that the decentralisierbare process level is connected via a data network with the backup level, wherein of logically passive components, the transmitted data to digital input / Output bits are implemented with process security. Method for signal-technically safe electronic element control for carrying out a driving operation of rail vehicles according to at least one of the preceding claims, characterized in that triggered by the security level and monitored mechanisms cyclically the communication in the entire process chain and the function of decentralized, generally non-secure elements of Process level is checked, and disconnected from the backup level at least the power supply to the associated element of the process level in case of failure and optionally additionally the signal supply voltage is separated so that only the elements belonging to the signal term "stop" elements are supplied with voltage in case of failure. Device for fail-safe electronic element control for carrying out a driving operation of rail vehicles, consisting of a signal-technically safe operating and monitoring level, a backup level and the elements containing the elements to be controlled and process data transfer between the components of these levels, either by operator input on the control and observation level or by internal program flow in the secure computer system of the security level commands for controlling at least one element of the process level can be given, characterized in that the safety-related checks and algorithms to ensure the process safety in safe Computer system the backup level done, whereas the computer or other components of the operating and monitoring level and the process level can meet lower security requirements. Device for signal-safe electronic element control for performing a driving operation of rail vehicles according to claim 7, characterized in that - The secure computer system of the backup level triggers the safety-relevant control of elements of the process level, if i. in the case of commands entered by the operator input on the operating and monitoring level, the commands are transmitted with a data transmission device to the secure computer system in the security level, checked positively for plausibility and transmitted back to the operating and monitoring level in newly coded form, the software of the at least one computer of the operating and monitoring level, in turn, positively checks the plausibility of the newly coded command of the secure computer system and successfully transmits the result in finally coded form to the secure computer system in the security level, and if additionally via a separate communication path of the assigned process element For safety-relevant operations, a duplicate or non-equivalent contact and / or additionally encoded digital addresses were read in and positively tested. ii. a command is issued to control at least one element of the process level by internal program execution in the secure computer system of the security level, - The control of elements of the process level is safely aborted with a corresponding error message as soon as at least one of the aforementioned plausibility checks of the commands used in at least one of the computers involved negative. Device for signal-safe electronic element control for performing a driving operation of rail vehicles according to at least one of the preceding claims, characterized in that - The trigger command for controlling elements of the process level is transmitted via a data transmission device from the secure computer system of the backup level to the appropriate element of the process level and there leads to at least one control event, the result monitors a suitable sensor and reported back to the secure computer system in the backup level, the secure computer system of the security level checks the results of the activation events via multiple dialogs in the required logical and timely sequence, the secure computer system assumes that the results of the activation events have been successfully checked by a successful element activation and discloses this, - The secure computer system assumes a negative examination result of at least one result of the driving events of a faulty element driver and disclosed. Device for fail-safe electronic element control for carrying out a driving operation of rail vehicles according to at least one of the preceding claims, characterized in that the safe computer system of the security level consists of a fail-safe programmable logic controller (PLC). Device for fail-safe electronic element control for performing a driving operation of rail vehicles according to at least one of the preceding claims, characterized in that the decentralizable process level via LAN (Local Area Network) is connected to the security level, with standard ET (electronic divider) or small PLC Systems act as logically passive converters of the data transmitted via Ethernet or another data network technology to digital input / output bits. Device for fail-safe electronic element control for performing a driving operation of rail vehicles according to at least one of the preceding claims, characterized in that triggered by the backup level and monitored watchdogs cyclically the communication in the entire process chain and the function of the decentralized, generally not secure elements of the process level check and the fuse level by means of positively driven contacts of the watchdog relay at least the power to the corresponding element of the process level in the event of failure switches off and optionally additionally separated the signal supply voltage so that only the elements belonging to the signal term "stop" elements are supplied with voltage in case of failure.

Images