EP3102475B1 - Spare ressource for the faulty channel of a rail vehicle - Google Patents

Description

The invention relates to a method for providing a replacement resource for a defective computer channel of a rail vehicle, a corresponding device and a corresponding rail vehicle.

DE 103 19 904 A1 relates to a communication system for rail vehicles.

US 2013/0261842 A1 relates to a configuration control for rail vehicles.

In interlocking and (rail) vehicle computers for signal-safe controls multi-channel computer cores (also referred to as computers) are used, in which monitor the computer channels each other. In particular, such monitoring involves an exchange of synchronization information as well as a comparison of output data. Thus, the computer channels operate synchronously, so that a deviation between computer channels or between the provided by the computer channels results, can be determined.

In a so-called 2-of-3 system (also referred to as 2v3 system) three computer channels are used so that a failure of a single computer channel can be tolerated: it can be determined by means of a majority decision regarding the results provided by the computer channels, which the three computer channels is defective. The two remaining computer channels, which still provide the same results, then still represent a redundant functional system that meets the safety requirements specified in railway technology. In particular, can with two of three working computer channels the operation of a rail vehicle to be continued.

In a so-called 2-of-2 system (also referred to as 2v2 system) there are 2 computer channels, with each deviation between the computer channels to a security-technical shutdown (a so-called "safety shutdown") of entire vehicle computer leads. In case of a deviation between the results produced by the two computer channels, it can not be determined by means of a majority decision as in the 2v3 system which of the two computer channels produces the correct results or which one is defective.

2v2 systems are less expensive than 2v3 systems, but if one of the two computer channels fails, manual on-site intervention is required, for example by maintenance personnel. In particular, it may be necessary to replace the failed computer channel or the computer with both computer channels. Until the intervention of the vehicle computer and thus the rail vehicle can be used only to a limited extent (for example, at a greatly reduced speed), which can lead to significant operational restrictions.

The object of the invention is to avoid the above-mentioned disadvantages and in particular to provide an efficient solution to provide a redundant resource for a computer of a rail vehicle flexible.

This object is achieved according to the features of the independent claims. Preferred embodiments are in particular the dependent claims.

To solve the problem, a method is proposed according to the features of claim 1.

Furthermore, the object is achieved according to a rail vehicle with the features of claim 2.

The replacement resource can be implemented both in hardware and in software. A combination of hardware and software is possible.

An advantage of the solution presented here is that the availability e.g. of a 2v2 system to the level of a 2v3 system without requiring each system (e.g., each computer) to require a third computer channel. This reduces effort and costs for each computer.

It should be noted that a rail vehicle (also referred to as "train") has at least one car, wherein the car may be a traction vehicle, a travel car, a freight car or a combination of such compartments or functions. The traction unit has a driver's cab (also referred to as an operator station) and can be designed with or without drive. The traction vehicle may in particular be a locomotive. In particular, the rail vehicle may be a metro train (e.g., suburban or underground) at least partially underground in tunnels. In particular, the rail vehicle may be a vehicle driver or a driverless rail vehicle. In driverless operation, the traction unit may have an emergency operating console, which is arranged, for example, in the passenger compartment behind a closable flap.

According to the invention, the spare resource is a spare computer channel which is connected to the computer via a network.

For example, the network may be an Ethernet. Preferably, a communication link is used, which allows a fast and secure data transmission.

According to the invention, the spare resource is a computing resource in a computer or a computer channel which is connected to the computer via a network.

In particular, it is a development that the replacement resource is a resource in another computer of the rail vehicle.

It is also a development that the communication link has a wired and / or wireless connection.

• indem die mindestens zwei Rechnerkanäle zumindest einen Teil ihres Speicherinhalts an einen Steuerrechner übermitteln,
• indem der Steuerrechner anhand der übermittelten Speicherinhalte bestimmt, welcher der Rechnerkanäle defekt ist.

According to the invention, it is determined which of at least two computer channels of the computer is defective,

• in that the at least two computer channels transmit at least part of their memory contents to a control computer,
• in that the control computer determines which of the computer channels is defective on the basis of the transferred memory contents.

It is also a possibility that the control computer causes a reset of the at least one computer channel, so that the computer channel performs so-called switch-on. Upon successful completion of the power-on checks, the old memory content (e.g., previously communicated to the control computer) could be transferred back to the computer channel and work continued therefrom.

• indem der Steuerrechner die Ersatz-Ressource anhand des übermittelten Speicherinhalts des nicht defekten Rechnerkanals initialisiert und
• indem der Steuerrechner einen Kontakt zwischen der Ersatz-Ressource und dem nicht defekten Rechnerkanal herstellt.

A next development is that the replacement resource is provided for the defective computer channel,

• in that the control computer initializes the replacement resource on the basis of the transferred memory contents of the non-defective computer channel and
• in that the control computer establishes contact between the replacement resource and the non-defective computer channel.

It is also a development that is determined which of at least two computer channels of the computer is defective is determined by a control computer by means of at least one test, which of the computer channels is defective.

For example, a still active or remaining computer channel can continue to be used if it passes the test.

Thus, the control computer could send a command to the at least one computer channel and check the response delivered by the at least one computer channel. The command may be, for example, the request to perform an operation, e.g. an arithmetic operation, act. On the basis of this check, the control computer can determine which computer channel is defective and which computer channel is still functional.

The mechanism employed here may be e.g. depend on a given level of security, i. a probability of a safety-threatening misconduct.

An embodiment is that the control computer is executed externally to the computer.

An alternative embodiment is that the control computer is not part of the rail vehicle.

Optionally, the control computer can also be located in the rail vehicle.

A next embodiment is that the control computer has the replacement resource.

It is also an embodiment that the replacement resource is performed separately to the rail vehicle and separately to the control computer, wherein the replacement resource has a communication connection to the control computer.

The replacement resource may have a direct communication link to the control computer, or e.g. be coupled via the network with the control computer.

The statements concerning the method apply correspondingly to the other categories of claim.

A further development consists in that the replacement resource is arranged in the rail vehicle or separately from the rail vehicle.

It is also a development that the processing unit is designed separately from the rail vehicle, wherein the Connection to the processing unit comprises a wired and / or wireless connection.

The processing unit mentioned here may in particular be embodied as a processor unit and / or an at least partially hard-wired or logical circuit arrangement, which is set up, for example, in such a way that the method can be carried out as described herein. Said processing unit may be or include any type of processor or computer or computer with correspondingly necessary peripherals (memory, input / output interfaces, input / output devices, etc.). The processing unit may be part of a control unit of the rail vehicle.

The above-described characteristics, features, and advantages of this invention, as well as the manner in which they will be achieved, will become clearer and more clearly understood in connection with the following schematic description of exemplary embodiments which will be described in detail in conjunction with the drawings. In this case, the same or equivalent elements may be provided with the same reference numerals for clarity.

Fig.1

ein schematisches Diagramm mit zwei Computern, die jeweils ein 2v2-System darstellen und in einem Schienenfahrzeug angeordnet sein können, wobei bei einem Ausfall eines der Rechnerkanäle der Computer von einem Steuerrechner ein Ersatz-Rechnerkanal bzw. eine entsprechende Ressource bereitgestellt wird;

Fig.2

ein beispielhaftes Ablaufdiagramm, das die Nutzung eines weiteren Rechnerkanals, der über die Kommunikationsverbindung angebunden wird, veranschaulicht.

Show it:

Fig.1

a schematic diagram with two computers, each representing a 2v2 system and can be arranged in a rail vehicle, wherein in case of failure of one of the computer channels of the computer from a control computer, a replacement computer channel or a corresponding resource is provided;

Fig.2

an exemplary flowchart illustrating the use of another computer channel that is connected via the communication link.

It is proposed that a failed computer channel with a computer channel (referred to here as a replacement computer channel) at least partially (in particular completely) to replace, with the failed computer channel and the replacement computer channel are connected to each other via a communication link. The replacement computer channel can be a resource which can be provided in hardware and / or software and which can be connected or attached via the communication connection.

The failed computer channel can be part of a computer with multiple computer channels. In particular, the computer is a computer that is used in a web component, e.g. used in a rail vehicle.

The failed computer channel is one of several computer channels of a computer, wherein the multiple computer channels are designed to be redundant. For example, the redundant computer channels may operate synchronously, and the results provided synchronously by the computer channels may be e.g. be checked at predetermined times. It is also possible that different computer channels perform similar or identical operations, which should each produce the same results. As soon as a deviation in the results is determined, the failure of at least one of the computer channels can be deduced.

The replacement computer channel is part of another computer, the other computer is connected to the computer in which the failed computer channel is implemented via the communication link.

The communication connection may be, for example, an Ethernet connection or include such. The communication connection can be wired and / or wireless. Also combinations of a wired and a wireless connection as a communication connection are possible.

The approach is particularly advantageous if a multiplicity of identical or almost identical computer channels are present in different computers, which are interconnected, for example, via a network. The failure of a computer channel in a computer can thus be compensated for via a computer channel of another computer (i.e., the spare computer channel) to which the communication link exists.

In particular, it is possible that the replacement computer channel takes over all or part of the functions of the failed computer channel. Also, it is an option that such a replacement computer channel be used for a predetermined period of time (e.g., temporarily), for example, until the defective hardware can be replaced.

Also, the replacement computer channel can be held by a computer in the network. Such a computer may provide one or more computer channels for potential failures. If a computer channel fails in a 2v2 system, a functional 2v2 system can be restored by means of such a replacement computer channel.

A replacement computer channel may be implemented in hardware and / or software. In particular, it is possible that resources are provided on a hardware unit for the replacement computer channel, which takes over the function of the failed computer channel partially or completely (co-). Such a resource can also be kept in the form of software.

The replacement computer channel is preferably supplied with necessary data (eg RAM contents) before it can take over the function of the failed computer channel. Here, the same or similar mechanisms can be used as in the addition of a third computer channel to two already running computer channels.

For example, a defective computer channel can be determined in a 2v2 system using the replacement computer channel and / or a separately executed control computer. For this purpose, the replacement computer channel and / or the control computer evaluates information provided by the two computer channels of the 2v2 system and, as a result, determines which of the two computer channels of the 2v2 system is defective.

Preferably, for such an evaluation of computer channels, a central office can be provided, with which a communication connection exists (at least temporarily). This judgment may be made by a replacement computer channel or by the central office (e.g., in the form of the control computer). The control computer may e.g. assess the functionality of the computer channels of the 2v2 system and, as a result, initialize the replacement computer channel. In particular, the control computer and the replacement computer channel can be implemented on a common hardware or on a distributed hardware. Such distributed hardware may also be provided over a communication link, e.g. be connected via a network. Also, the computer channel found to be defective could be switched off by the control computer or switched inactive.

Such a control computer could be designed by the standards of railway technology as safe. The communication connection is also preferably made using a secure communication protocol, e.g. a protocol (such as UDP, IP or Ethernet) that complies with the EN 50159 standard.

Fig.1 shows a schematic diagram with two computers 101 and 102, each representing a 2v2 system and can be arranged in a rail vehicle. In particular, the computers 101 and 102 may be arranged in different cars of the same rail vehicle. Each of the computers 101 and 102 here has two computer channels.

The computers 101 and 102 are interconnected via a network 103. Furthermore, with network 103 and thus with the two computers 101 and 102, a control computer 104 is connected, which has a replacement computer channel 105.

If one of the computer channels in one of the computers 101 or 102 fails, the control computer 104 can determine which of the two computer channels is defective and provide the replacement computer channel 105 for this purpose. Thus, the computers 101 and 102 of the rail vehicle are again redundantly equipped with two functioning computer channels and the operation of the rail vehicle can be continued.

The replacement computer channel 105 is part of the control computer 104. By way of example, the replacement computer channel 105 may be executable separate hardware of the control computer 104 or on the hardware of the control computer 104 (e.g., in the form of software).

Optionally (or additionally), a replacement computer channel 106 could be maintained, which has a direct communication link 107 with the control computer 104 and is administered by the latter to take over the function of the failed computer channel. The spare computer channel 106 is coupled to the network 103 and could also connect to the control computer through this coupling (e.g., instead of the direct communication link 107). Furthermore, the replacement computer channel 106 could be part of a computer that provides resources for multiple replacement computer channels, which may be activated by the control computer 104 to take over functions of failed or defective computer channels.

Another option is that a computer channel is used as a replacement computer channel, which can be omitted temporarily. If, for example, the computers 101 and 102 each have two computer channels and, for example, one of them falls in the rail vehicle two computer channels in the computer 101, so the function of the failed computer channel could be at least partially (or completely) of one (or both) computer channels of the computer 102 mitübernommen. As described, the administration can take place via the control computer 104, which instead of the replacement computer channel 105 or the replacement computer channel 106 sets the resources of the computer channels of the computer 102 accordingly. This scenario may be advantageous if, for example, the computer 102 is only partially needed in a certain operating mode and / or if the computer 102 has sufficient computing resources that the functionality of the defective computer channel can be taken over without any loss of its own functionality. Another advantage could be that the communication link between two computers of the same rail vehicle has a higher performance than a communication link to a spare computer channel 105 or 106 outside the rail vehicle.

An advantage of the solution presented here is that the availability of a 2v2 system can be raised to the level of a 2v3 system without requiring each system (e.g., each computer) to have a third computer channel. This reduces effort and costs for each computer.

Fig.2 shows an exemplary flowchart illustrating the use of another computer channel that is connected via the communication link.

In a step 201, two computer channels of a 2v2 system diverge, ie there are different results in the two computer channels, which should actually deliver the same results in the case of proper operation. In this case, it is initially not clear which of the two computer channels is defective.

In a step 202, the two computer channels (or only one of the two computer channels, because the other can no longer perform transmission due to a hardware failure) transfer their RAM contents (or portions of their RAM contents) to the control computer, checking their functionality, and requesting them Success of the control computer a replacement computer channel.

In a step 203, the control computer decides, e.g. by triggering a reset at the at least one remaining computer channel and / or by performing a test with the at least one remaining computer channel, which of the two computer channels is functional, initializes the replacement computer channel with the data of the functional computer channel and provides the contact between the functional computer channel and the replacement computer channel.

If one of the two computer channels fails, for example, the computer channel not affected by the failure will contact the control computer and a replacement computer channel for this computer channel is made available.

While the invention has been further illustrated and described in detail by the at least one embodiment shown, the invention is not so limited and other variations can be derived therefrom by those skilled in the art without departing from the scope of the claims.

Claims (2)

1. Method for providing a spare computer channel (105, 106) for a faulty computer channel of a rail vehicle,

   - wherein the rail vehicle has two computers (101, 102), which represent a redundant 2-by-2 system in each case,

   - wherein each of the computers (101, 102) has two computer channels,

   - wherein the two computers (101, 102) are interconnected via a network (103), wherein a control computer (104) is connected to the network, and thus to the two computers (101, 102), and has the spare computer channel (105),

   - in which the control computer (104) connected to the computers (101) via the network (103) ascertains which of the two computer channels of one of the computers (101) is faulty,

   - by the two computer channels transmitting at least some of their memory content to the control computer (104),

   - by the control computer (104) determining which of the computer channels is faulty on the basis of the transmitted memory content,

   - in which the control computer (104) provides the spare computer channel (105, 106) for the faulty computer channel via the network (103),

   - so that the computer (101, 102) with the faulty computer channel is once again redundantly equipped with two functioning computer channels.
2. Rail vehicle, which has two computers (101, 102), which represent a redundant 2-by-2 system in each case,

   - wherein each computer is configured such that it has two computer channels,

   - wherein the two computers (101, 102) are interconnected via a network (103), wherein a control computer (104) is connected to the network (103), and thus to the two computers (101, 102), and has a spare computer channel (105),

   - wherein the control computer (104) is configured such that it is able to ascertain, with the existing network connection (103) with the computers (101, 102), which of the two computer channels of one of the computers (101) is faulty,

   - by the two computer channels transmitting at least some of their memory content to the control computer (104),

   - by the control computer (104) determining which of the computer channels is faulty on the basis of the transmitted memory content,

   - in which the control computer (104) is further configured so as to provide a spare computer channel (105, 106) for the faulty computer channel via the network (103),

   - so that the computer (101, 102) with the faulty computer channel is once again redundantly equipped with two functioning computer channels.

Images