EP2445771B1 - Method to create an electronic interlocking for replacing an existing interlocking - Google Patents

Description

The invention relates to signal boxes for rail traffic. It relates in particular to a method for creating an electronic interlocking and an electronic interlocking.

A major part of the railroad interlockings in operation today are relay interlocking, i. electrical interlockings. For relay interlockings, the fuse-related dependencies are completely electrically produced by signal relays.

Maintenance and operation of these interlockings can become increasingly costly and problematic. In addition, the integration of the existing relay interlocking in remote control and automation equipment is associated with great costs.

Therefore, the relay interlockings are increasingly being replaced by electronic interlockings. In the case of electronic interlockings, the interlocking dependencies are implemented by software in dedicated computers. For this purpose, electronic interlockings according to the prior art are based on a central computer, on which the entire track image is mapped in the form of software. Accordingly elaborate is the appropriate software and This has to be adapted and parameterized for each station, resulting in an immense effort for the certification.

Replacement of relay interlockings by electronic interlockings also requires large investments for the project planning, the new construction of the interlocking and especially for the replacement of the outdoor facility and the new certification.

The WO 2005/113315 shows a control system for railway signaling equipment, which is intended as a replacement of conventional relay-based systems. Processor units are used to take over the function of each unit of a relay interlocking control. The units used for this purpose are programmable processor cards which have a plurality of microprocessors and a memory. Also, this procedure is based so like electronic interlocking on microprocessors that work off commands set in a program; this being implemented so as to equivalently replace the switching logic of a relay-based system.

WO 03/070537 relates to a method for generating logical control units for train station computer systems. WO 2006/051355 has a control system for railway vehicles to the content. The control system has a plurality of programmable logic controllers (PLC).

Due to the necessary use of microprocessors, the systems of WO 2005/113315 . WO 03/070537 and WO 2006/051355 however, the drawbacks of electronic interlocking in terms of certification effort - programmed processor systems are inherently hugely complex, and leaps in executing a chain of instructions due to a single fault can put the system in a completely different state, which is a large certification-relevant one Risk.

The font US 5,922,034 shows a programmable device driver for railway signaling equipment. The device driver acts as an input and / or output unit for a particular function, such as a relay, a signal light, a motor, a switch, etc. It has a CPU and RAM memory. Various
Device drivers may be serially connected; They are controlled by a central computer, which can be understood as an electronic interlocking. Also in the approach according to US 5,922,034 There are the disadvantages of the system discussed above.

It is an object of the invention to provide a solution for the replacement of relay interlockings, which overcomes disadvantages of the prior art and in particular requires less large investments than solutions according to the prior art.

The invention is defined by independent claims 1 and 10.

According to the invention, a method for creating an electronic interlocking as well as an electronic interlocking are made available, which allow the replacement of relay interlockings by modern technology, without too much effort for changes would have to be made and without the certification effort is too large.

According to a first aspect of the invention, the switching logic of an existing relay interlocking is mapped to a functionally equivalent circuit of electronic components. It is therefore preferable to the components of the relay circuit functionally identical / equivalent semiconductor devices used.

The functionally equivalent circuit is a configurable logic circuit, ie a circuit whose functional structure is configured. In contrast, for example, to computers or common control systems - and, for example, electronic interlockings - so is not given by a 'generic' microprocessor to be processed, presented in a memory sequence of commands, but a function structure configured with interconnected blocks.

The configuration of a configurable logic circuit is not to be confused with programming in the conventional sense, i. Creating Software for a Processor: In a configurable logic circuit, circuit structures are created using hardware description languages or schematics, and subsequently these structures are transferred to the device for configuration. As a result, certain switch positions are activated and / or deactivated in the configurable logic circuit. This results in a concretely implemented digital circuit that i.A. works highly in parallel because each unit of the switch position works in parallel. In contrast, even the fastest microprocessors perform at most few and usually no operations in parallel.

An important example of a configurable logic circuit is a Field Programmable Gate Array (FPGA). Such may include memory cells (e.g., EEPROM, EPROM, SRAM, Flash) in which the configuration is stored. During commissioning, the configuration is transferred to the actual circuit. According to an alternative embodiment, the FPGA may also be permanently programmed by permanently establishing the connections between the switching units, for example with the so-called 'antifuse' technology.

The FPGAs are often also the Complex Programmable Logic Devices (CPLD), which represent another example of configurable logic circuits.

Thus, according to the approach of the invention, no replacement of the relay circuit by a software is desired, but the relay circuit is sought-in itself functioning, but in the implementation associated with great effort is replaced by a semiconductor-based electronic circuit providing the same functions and the same characteristics.

A functionally equivalent circuit can be present in accordance with an approach if, for each input and output of the relay interlocking switching logic, a corresponding input or output of the functionally equivalent circuit is present and for the same binary input, a same binary output.

In addition to the circuit which forms the logic unit, the interlocking preferably has a plurality of input and / or output units, which form the interfaces to the elements (switches, signals, Gleisfreimeldeeinheiten, track block monitoring units) of the outdoor facility. These do not contain 'intelligence' (i.e., no logic) in many embodiments. In other embodiments, for example for special signals, switches, etc., they may also have a functional logic. They are dependent on the type of element to be controlled and serve only to convert the logic signal into the physical control of the corresponding element and thus, for example, the amplification and the potential decoupling between the logic unit and the external system. They may have a relay, an optocoupler and / or a contactor and / or other components known per se. The input and / or output units can be centrally located in the interlocking, i. in the interlocking building and essentially at the location of the logic unit. Thus, when replacing the relay interlock, ideally only components that are inside the building need to be replaced and installed.

The procedure according to the invention may also include the implementation of the circuit in a signal box.

The outputs of the functionally equivalent circuit are connected to the existing components to be controlled (switches (controls), signals, barriers (controls)) without them having to be significantly adapted or even replaced.

In contrast to the prior art, the approach according to the aspect of the invention discussed here thus distances itself from the very powerful tool of a software-based implementation of the logic unit and makes a step towards the supposedly more elaborate and less flexible implementation in the form of programmable hardware.

Although, in principle, the functionality of a hardware electronics could also be provided by an appropriate software, the simple step taken in the first aspect of the invention toward switching electronic components is enormously advantageous. The use of software is always linked to the use of computer systems running the software, and these are necessarily very complex. Even a simple modern computer has literally billions of transistors, various data memories, etc., and all these components are part of the interlocking and must be considered in certification. A feature of software-implemented systems such as the prior art systems mentioned above is that jumps occur in the sequential execution of a chain of instructions. If, due to an error (for example, after the action of an ionizing particle), the jump address has an error, the system can be put into a completely different state, which can lead to a total failure. In a physically wired logic circuit, however, such jumps do not occur.

Therefore, in order to meet safety requirements anyway, conventional software-based electronic interlockings, although very powerful tools, but based on very different principles than the relay interlocks, and correspondingly complex is the retooling and especially the certification, which includes all subsystems. In the approach according to the first aspect of the invention, however, the security of the acquired, on the configurable logic circuit mapped relay switching logic does not have to be redetermined, since this is already proven.

Due to the amazingly simple approach according to the invention, the architecture of the relay interlocking can be maintained substantially and thus eliminates a significant proportion of the design costs, and the entire certification process can be simplified. In addition, the interlocking with programmable devices can be realized so that only minor changes to the outdoor facilities must be made. The maintenance is much less expensive than with conventional relay interlockings. Finally, remote control and automation tasks and the integration into higher-level systems such as in a remote control system or in subordinate systems such as the ETCS (European Train Control System) can be done relatively easily by the logic modules used.

Another advantage over electronic interlockings is the speed. In comparison to the software of a conventional electronic interlocking, the interlocking with the logic circuit designed according to the first aspect of the invention shifts orders of magnitude faster.

The first aspect of the invention is, for example, for relay interlocking according to the shutter plan principle but also for relay interlocking according to the track plan applicable. Due to the advantages of the inventive approach to electronic interlockings to be replaced interlocking can also be a software-based electronic interlocking whose core function (binary output in function of the binary input) also by a fixed electronic circuit of semiconductor devices (iA at least one FPGA or a comparable Block) is replaced.

According to a second aspect of the invention, the architecture of a relay equivalent functionally equivalent circuit is established by transforming a shutter plan or a track plan into a logic circuit by an automatic translator. In this case, the closure plan or the track plan may be in the form of a drawing, a table or in another technical form.

The automatic translator may be in the form of computer software that assigns electronic circuitry to the shutter / track schedule based on unique, predefined prescriptions. The regulations are therefore comprehensible at any time and can be designed to meet the requirements of safety-relevant systems. They can also be verified by a certifying body.

An analogous procedure can also be selected for software-based electronic interlockings to be replaced, wherein for the circuit layout of the logic circuit, in which the logic is transformed, a corresponding alternative, based on the input-output logic of the software translation program is used ,

Particularly favorable is a combination of the first aspect of the invention with the second aspect.

In order to verify the correctness of a logic circuit obtained by transformation, this can optionally be transformed back into a comparable form to the original shutter plan / track plan with a back-translation algorithm. The comparison between the closure plan / track plan and the reconstructed comparison plan can be part of the safety-relevant review.

According to a first embodiment, after the inverse transformation, a user (for example, a person skilled in the trajectory) makes the comparison between the original shutter plan V / S and the comparison plan V '/ S' obtained by inverse transformation. The representation of the comparison plan V '/ S' then makes sense again in the same way as the representation of the original closure plan / track plan V / S. So it makes sense that, for example, a similar representation occurs in a drawing, for example with the same local position in the representation or the same numbering or designation, or that the same names are used when using names for variables or signals. In order to simplify this illustration metadata is generated by the translator, which is then used again for the inverse transformation. It goes without saying that these metadata do not fulfill a functional task; they merely serve for better readability of the comparison plan V '/ S' for humans.

According to a second embodiment, the comparison between the closure plan / track plan and the comparison plan may be made by the computer.

For example, as is known, the interlocking has a logic unit and input-output units which, as mentioned, correspond in their characteristics to those of the replaced relay interlocking. The logic unit preferably has at least one communication input for control, automation, ETCS, etc. The logic unit is in the core (i.e., in the elements that detect a binary output from a binary input) preferably free of microprocessors, i. of freely programmable units.

The logic unit may have additional systems which always ensure that the instantaneous logic function corresponds to the original logic function determined, for example, by the mentioned translation.

As mentioned, the input / output units of the electronic circuit preferably have similar connection structures to the outdoor equipment (switch controllers, signals, barrier controllers, etc.) as the replaced relay units. It is also preferred that the input-output units have similar external dimensions as the relay units. Each of the preferred features can help to make little or no changes to the outdoor facilities.

The architecture of the electronic circuit and the input-output units may provide according to a first embodiment, that the logic unit is connected in a star shape with the input-output units.

In another possible architecture, the logic function L is connected in a ring to the input-output units. This simplifies especially the wiring. The ring can be a parallel or serial system, electrical or optical, without or be executed with error correction, one way or two way. The possible characteristics of the communication have different costs and different characteristics: thus, an optically guided ring can have a large extent. Two-way communication has some error redundancy.

Of course, combinations between star and ring architectures are conceivable, for example, a plurality of subunits each having one or more input-output units, which are annularly connected to each other, wherein the connection between the logic unit and subunit is star-shaped.

Serial systems usually use data packets that are transmitted periodically. It is therefore technically easily possible to monitor this system state in a logging unit (for example, a separate "black box") and then to write (store) it. This allows all processes to be analyzed later by a computer that is directly connected to the "black box" B. This analysis can usefully be done during operation.

To increase the security of the system, two logic units can be connected in series. The first and the second logic unit preferably have an identical structure and have identical control inputs. In normal operation, the signals from both logic units should be identical. If they are not identical, there is an error in one of the logic units or in one of the higher-level systems. In this case, the input-output units can go into a "safe state" (eg signal to red) and / or trigger an alarm. Of course, the alarm can also be triggered by the "Black Box" B.

• Figur 1 ein Verfahren gemäss dem ersten Aspekt der Erfindung zum Erstellen eines elektronischen Stellwerks;
• Figur 2 ein Verfahren gemäss dem zweiten Aspekt der Erfindung zum Entwerfen einer logischen Schaltung für ein elektronisches Stellwerk;
• Figur 3 eine erste Ausführungsform der Architektur der elektronischen Schaltung;
• Figur 3a eine Variante der Ausführungsform gemäss Figur 3;
• Figur 4 eine weitere, alternative Ausführungsform der Architektur der elektronischen Schaltung;
• Figur 5 eine Variante der Ausführungsform gemäss Figur 4, mit zwei Logikeinheiten; und
• Figur 6 ausgehend von der Ausführungsform gemäss Figur 4 schematisch die Anbindung an Elemente der Aussenanlage; und
• Figur 7 eine Stellwerkarchitektur der erfindungsgemässen Art in einem Beispiel.

Hereinafter, embodiments of the invention will be described in more detail with reference to schematic drawings. In the drawings, like reference numerals (identification letters) designate the same or analogous elements. Show it:

• FIG. 1 a method according to the first aspect of the invention for creating an electronic interlocking;
• FIG. 2 a method according to the second aspect of the invention for designing a logic circuit for an electronic interlocking;
• FIG. 3 a first embodiment of the electronic circuit architecture;
• FIG. 3a a variant of the embodiment according to FIG. 3 ;
• FIG. 4 another alternative embodiment of the electronic circuit architecture;
• FIG. 5 a variant of the embodiment according to FIG. 4 , with two logic units; and
• FIG. 6 starting from the embodiment according to FIG. 4 schematically the connection to elements of the outdoor facility; and
• FIG. 7 an interlocking architecture of the inventive type in one example.

According to FIG. 1 For example, a shutter plan V (or, not shown, a track plan S) is detected by a computer Comp, optionally with a special input unit I may be provided. The input unit may optionally be adapted to the format of the closure plan and, for example, have a scanner and corresponding software for detecting and detecting the symbols in the closure plan. Of course, the closure plan can be present from the outset in electronically readable form. From the detected closure plan, the computer comp creates a logic function L #. The logic function corresponds to the electronic representation of a logic circuit. It is mapped to a physical logic circuit that is implemented in a programmable logic device (FPGA).

The method for constructing the logic function L # from the closure plan V (or a track plan S) is shown schematically in FIG. 1 in a specific embodiment which makes verification possible FIG. 2 shown. From the closure plan V or the track plan S, a suitable translation program T will determine the logic function L #. In the embodiment shown here, the translation program also creates a file M with metadata which is not relevant to security and contains, for example, information relating to the presentation of the closure plan. In order to enable verification, a comparison plan V '/ S' is created from the logic function L # by a back translation program T ^-1 in the sense of 'reverse engineering', which is designed on the basis of the metadata so that, for example, a similar representation takes place or that the same names are used when using names for variables or signals. The comparison C is made by a verifying person or alternatively can also be done by the / a computer, in which case the metadata is used instead of creating the comparison plan V '/ S'. can also be made available to the comparative program.

In special cases - for example, in the case of a non-standard signal location), a user can make a manual adjustment via a corresponding manually-operated input option (Man).

The implementation of a logic function L # on an FPGA, which is subsequently equipped as a logic unit, is known per se.

As a variant of the method described above, it is also possible to engineer the implemented logic unit L instead of the logic function L # reverse.

FIG. 3 shows a star connection of the logic unit L (on which the logic function L # is implemented) with the input-output units IO ₁ ... IO _n . As mentioned, in all embodiments, the input-output units preferably have similar dimensions to the original relay units and also have similar connection structures to the outdoor equipment, so that little or no changes to the outdoor equipment must be made.

Reference symbol S denotes a communication input for communication with an input unit and / or with a higher-level system.

In a variant according to FIG. 3a the logic unit L is also connected in a star shape to the input-output units; however via a switch X.

The architecture according to FIG. 4 is an annular architecture. The logic unit L is annularly connected to the input-output units IO ₁ ... IO _n . While in a star-shaped architecture the wiring is structurally parallel (even a parallel architecture may optionally use a serial protocol), in an annular architecture it may be both parallel and serial. In the exemplary embodiment shown, the communication is serial, ie the data packet transmitted periodically by the logic unit, for example, contains data which contain the entire system state (switching state of each component to be controlled). Each input-output unit is addressed and extracts from the data packet the information needed for it. Because each data packet contains all the information, it is also suitable for monitoring the system and / or logging. For this purpose, the signal is also transmitted via the communication system CB to a "black box" B. There, the successive incoming data packets are stored and / or analyzed, usefully during operation.

Through another interface, the communicated state can be reliably transmitted to control systems or for operation under ETCS to the 'Radio Block Center' (RBC). In the same way, routes that are requested by the control system or by automation can be transmitted to the digital interlocking.

The embodiment according to FIG. 5 has, in addition to the logic unit L, a second, functionally equivalent and possibly identical logic unit L *. The control inputs S, S * of the logic units are identical and identical driven. The control signals of L and L * are passed through the communication system CB to the input-output units IO ₀ ... IO _n . In normal operation, the signals of L and L * should be identical. If they are not identical, there is an error in one of the logic units L or L *, or in one of the superordinate system S or S *. In this case, the input-output units IO ₀ ... IO _n can go into a "safe state" (eg set the signal to red) and trigger an alarm. The alarm can of course be triggered by the "Black Box" B.

Embodiments with two redundancy-aware logic units may also be used in star architectures or mixed architectures.

As a special security feature of preferred embodiments in many cases, for the logic unit L * another, not identical to the logic unit L make, may be used by another provider than for the logic unit L. This is a diverse redundancy obtained.

It is a great advantage of the inventive method according to all aspects of the invention that the logic unit can be realized due to the inventive approach by a comparatively simple means. The first allows the approach two logic units to work independently of each other in parallel, which, for example, in electronic interlocking hardly in question. This, in turn, allows the redundancy, which is often very desirable, from a safety point of view.

The independence of the two logic units may mean, for example, that the logic units exchange no intermediate results, or even that no signals from the one control unit are processed by the other control unit.

FIG. 6 shows schematically using the example of FIG. 4 the connection to the outdoor area. The bold black line symbolizes the boundary between the building in which the interlocking is located and the "outside". The input and / or output units are each assigned to an element of the outdoor system to be activated, for example the unit IO _{B1 to} the block B1, the unit IO _{W1 to} the diverter W1, the unit IO _{S11 to} the signal S11 etc. The interface between the existing wiring of the External installation and the replaced interlocking forms a cable distributor V, which is also preferably present in the building interior.

FIG. 7 shows as an example a simple outdoor area with the track shown in the figure below. The boxes B1 and B2 in the lower half of the figure designate the route blocks 1 and 2, W1 and W2 denote points, Sij are signals, and GFM1 and GFM2 train free-field units. In the upper half of the figure (in the indoor unit), the correspondingly labeled boxes designate the input and / or output units assigned to the respective elements.

The wiring of the logic unit (FPGA) in a ring architecture with the input and / or output units is serially formed in this example as an Ethernet bus. The outgoing from the cable distributor to the outside outdoor cabling can be taken over unchanged by the relay interlocking.

Claims (14)

1. A method for creating an electronic signal box as a replacement of an existing signal box, wherein the switching logic of the existing signal box is mapped onto a functionally equivalent circuit, and the outputs of this circuit are connected to at least some of the existing components which are to be activated, characterised in that the functionally equivalent circuit is a circuit of electronic semiconductor components, wherein the circuit of electronic semiconductor components is a configurable logic circuit, and that the switching logic of the existing signal box is mapped onto the functionally equivalent circuit by way of a transformation (T) and this mapping comprises a configuration of the configurable logic circuit.
2. A method according to claim 1, wherein the electronic semiconductor components comprise at least one field programmable gate array (FPGA).
3. A method according to one of the preceding claims, wherein the connection of the outputs of this circuit to the components which are to be activated is effected via component-specific input and/or output units (IO_1...n) without integrated logic or with integrated logic.
4. A method according to one of the preceding claims, wherein the signal box to be replaced is a relay signal box.
5. A method according to one of the preceding claims, for creating an electronic signal box as a replacement of a relay signal box, wherein an interlocking plan (V) or a track plan (S) of the relay signal box is transformed into a logic circuit by means of a translator whilst applying predefined unambiguous rules (T).
6. A method according to claim 5, wherein the logic circuit is translated back again into a comparison plan (V', S') by way of applying inverted rules (T^-1), said comparison plan being able to be compared with the interlocking plan (V) or track plan (S), and wherein a comparison (C) is carried out between the interlocking plan (V) or track plan (S) and the comparison plan (V'), wherein the translator for example further generates metadata (M) which is not relevant to safety and wherein the metadata (M) is used on back-translating, in order to represent the comparison plan so as to be able to be compared with the interlocking plan (V).
7. A method according to one of the preceding claims, wherein the circuit comprises a logic unit (L) and a plurality of input and/or output units (IO_1...n), wherein the logic circuit is connected to the input and/or output units in a star-shaped manner.
8. A method according to one of the claims 1-6, wherein the circuit comprises a logic unit (L) and a plurality of input and/or output units (IO_1...n), wherein the logic circuit is connected in a ring architecture to the input and/or output units, wherein preferably a communication takes place simultaneously along the ring in both directions.
9. A method according to claim 8, wherein the communication (CB) takes place in data packets which each represent the complete state of the system, wherein the communication takes place for example periodically and wherein the communication is recorded by an observer (B).
10. A method according to one of the preceding claims, characterised in that the circuit has two redundant logic units which both each execute the same logic function and output the results, wherein preferably, in the case that the results do not match, one switches into a safe state and/or an alarm is triggered.
11. A signal box, created according to a method according to one of the preceding claims, comprising an electronic logic unit (L) and a plurality of input and/or output units (IO_1...n) for activating components such as points, signals, barriers and the like, characterised in that the logic unit (L) at least partly is as a programmable semiconductor logic module in the form of a configurable logic circuit.
12. A signal box according to claim 11, characterised in that the at least one semiconductor logic module is a field programmable gate array (FPGA).
13. A signal box according to claim 11 or 12, characterised in that the logic unit (L) is free of microprocessors.
14. A signal box according to one of the claims 11 to 13, characterised by a second logic unit (L*) which is functionally equivalent to the logic unit (L), wherein the logic unit (L) and the second logic unit (L*) both each output control signals to the input and/or output units (IO_1...n), and wherein the second logic unit (L*) is selected according to the principle of diversity.

Images