EP3312073B1 - Method for testing a rail system and rail system - Google Patents

Description

The invention relates to a method for testing a railway system or parts thereof and a railway system that works according to this method.

Railway systems are typically highly complex and require high levels of management and testing to ensure proper operation.

1. [1], EP1750988B1 , offenbart z.B. ein Interlocking System für eine Eisenbahnanlage, welches über eine Schnittstelle mit einem zentralen Steuerungs- und Überwachungssystem verbunden ist. Ferner sind lokale Prozessoreinheiten vorgesehen, die logische Operationen, die einem oder mehreren spezifischen streckenseitigen Ausrüstungselementen, einem Signal, einem Satz von Weichen oder einer festen Kreuzung zugeordnet sind, durchführen, und die dazu über eine Schnittstelle mit den streckenseitigen Ausrüstungselementen verbunden sind.
2. [2], WO2006136216A1 , offenbart ein Verfahren zur Konfiguration einer leittechnischen Einheit, insbesondere eines Stellwerks, das zur Überwachung und/oder Einstellung/Auflösung von Fahrstrassen für schienengebundene Fahrzeuge verwendet wird, indem eine Fahrstrasse auf Anforderung mit der jeweiligen Fahrstrasse zugeordneten Elementen gestellt oder aufgelöst wird, falls diese Anforderung für die mit der Anforderung verbundenen Elemente nicht negativ quittiert wurde. Für die Fahrstrasse werden flankierende Attribute, insbesondere Gleisbelegung, Fahrtrichtung, Blockverschluss, Streckensperre, mit Erwartungswerten definiert und eine angeforderte Fahrstrasse wird erst nach Vorliegen der Erwartungswerte für die definierten Attribute eingestellt oder aufgelöst.

The individual modules of modern railway systems are usually controlled electronically using processors and appropriate software.

1. [1], EP1750988B1 , discloses, for example, an interlocking system for a railway installation, which is connected to a central control and monitoring system via an interface. Furthermore, local processor units are provided which perform logical operations associated with one or more specific trackside equipment items, a signal, a set of points or a fixed crossing, and which are therefore interfaced with the trackside equipment items.
2. [2], WO2006136216A1 , discloses a method for configuring an I&C unit, in particular an interlocking, which is used to monitor and/or set/cancel routes for rail-bound vehicles by providing a route on request with elements assigned to the respective route or canceling it, if this requirement has not been negatively acknowledged for the items associated with the request. Accompanying attributes, in particular track occupancy, direction of travel, block closure, route closure, are defined for the route with expected values and a requested route is only set or canceled after the expected values for the defined attributes are available.

I&C or safety-related units that fulfill defined tasks can normally be controlled electronically, with process variables occurring when the corresponding tasks are fulfilled or when the corresponding processes are running, such as the attributes mentioned when a road is built or dismantled. The process variables are accessible via interfaces, optionally air interfaces.

From [3], WO2010148528A1 It is known to replace existing interlockings with electronic interlockings, with the switching logic of the existing interlocking being mapped onto a functionally equivalent circuit of electronic semiconductor components by means of a transformation, and the outputs of this circuit being connected to at least some of the installed components that are to be controlled.

Processes for operating, securing and testing existing railway systems are therefore also usually specifically adapted to the installed control technology units, such as interlockings, which have a different technical status and can be supplied by different manufacturers. The system functions are therefore controlled and checked at a low level with a relatively high level of effort. Statements on higher-level operational processes and in particular on changes in higher-level processes that could be used for preventive measures or for planning the necessary expansion of the railway system are therefore missing.

A train control system based on ERTMS (European Rail Traffic Management System) and ETCS (European Train Control System) Level 2 with an RBC (Radio Block Center) is described, for example, in [4], EP1897781A2 , described.

The RBC, which is connected to an interlocking, is used to guide vehicles on a specific route section using radio links via the GSM-R mobile network (Global System for Mobile Communication-Railways). The ETCS implements the safe train control functions. Among other things, GSM-R enables data transmission between vehicles and the RBC. For example, position reports from the vehicle are sent to the RBC and travel authorizations are sent to the vehicle.

The GSM-R and ETCS systems can therefore be used to determine the use of the appropriately equipped locomotives in order to check whether the use data match the planning data. Using the ETCS data, the deployment data can be updated whenever contacts are made with the Eurobalises installed at certain points.

The AFI (Automatic Vehicle Identification) system was implemented in the Swiss railway network, a proprietary RFID system with RFID readers, which were mostly installed at junctions.

It should also be noted that using known train protection systems, such as those described in [5], EP2090491A1 , are described, the position of a train, which moves from route block to route block can be determined within a route network. The train running data or the arrival and departure of the train at the operating points can therefore be registered by a corresponding administration unit, to which the signal boxes report the entry of a train into a section block. However, the location of the train's resources is not recorded by this management unit. Interlocking systems are usually equipped with axle counters, by means of which the axles of a train are detected and counted when entering and leaving a section of track. If the number of axles detected is the same when entering and leaving the track and no axle connects the two tracks resistively, a track vacancy message is issued for this section of track.

[6], Gunnar Bosse, Basis for a generic reference system for the operating procedures of track-guided transport systems, November 23, 2010, describes that within the scope of the increasing internationalization of the railway system, an increased generic description of the operational functions of the railway system is sought. By definition, an operating procedure is a “system of operating rules and technical means for carrying out journeys with railway vehicles on a railway infrastructure”. This definition includes the three essential elements of railway systems, with each of which specific tasks are implemented. Firstly, the vehicles that are used to pick up people and goods and provide the driving and braking forces required for changing locations. Second, the infrastructure that supports and guides the vehicles. Thirdly, the operating procedures, with the help of which the journeys are ultimately coordinated and controlled in such a way that a suitable route, usually in sections, is available for each permitted journey between the start and destination and the vehicles do not collide with each other. Operating procedures are of particular importance to railway systems for both operational and safety reasons. Following the operational perspective, the operating procedures are not limited to the provision of mandatory operational and security functions, but can also include other functions, such as scheduling. Safety-relevant as well as scheduling functions can be merged into one function carrier.

According to [6], page 39, it should be noted that on the vehicle side, ie in or on the vehicle, not only vehicle functions but also Operating procedure functions such as speed control can be implemented.

Vehicle functions according to prEN 15380-4 are mentioned in [6], pages 35-44. Finally, it is stated that for the area of operating procedures, the elaboration of a generic reference, the consideration of the vehicle function list is essential, but not sufficient. The three subsystems train control, train protection and signaling and traffic operation and traffic safety as well as the telematics applications subsystem in a higher-level sense are relevant for the area of operating procedures (see [6], Table 5). The security, control and monitoring of vehicles moving in a traffic network is to be regarded as an original task of operating procedures.

According to [6], page 47, with the FunkFahrBetrieb (FFB) an operating procedure was developed in which functionalities, which are currently mainly performed by trackside devices, such as signals, signal boxes and track vacancy detection devices, on the vehicle and in a route control center have been relocated. The operational and safety-related processes, such as route assignments, the control of switches and level crossings and the vehicle location (track vacancy detection) were carried out with radio support.

In [6], page 131, it is summarized that it is possible to define a generic reference for the operating procedures of track-guided traffic systems solely on the basis of a functional system definition, i.e. without a concrete system architecture.

[7], EP2631152B1 , discloses scheduling functions, ie a method for the management of resources provided with mobile terminals, in particular locomotives that run on a rail network and can each be registered functionally in a cellular mobile network by means of a mobile terminal, which functions provided for the operation of the rail network, such as the functional registration of the participants. The train movement data of trains is monitored and change messages are generated for status changes of the trains. For change notifications signaling the departure of a train from an operating point, a candidate list of managed resources that may be carried with this train is created for that train. For change reports, which affect the arrival and / or the passage of the train at an operating point, the radio cells by means of inquiries to the mobile network or inquiries to the appropriate Determines mobile terminals where the resources entered in the candidate list are located. The radio cells determined are used to determine whether the resources are located at the operating point of arrival, and resources that do not belong to any radio cell of this operating point are removed from the candidate list.

[8th], EP2868547A1 , discloses, for example, a signal box for controlling decentralized functional units, which are connected to the process control system via communication channels, comprising a number of computer-aided control units, the control units being connected in series or in parallel according to a control plan and receiving and/or outputting control data according to this control plan . Mobile devices can be used as computer-aided control units.

It follows from [6] that processes for operating, securing and testing existing railway systems are defined by operational rules. From [6], [7] and [8] it follows that variables of these processes can be recorded by modern means of communication.

In the documents [1] to [8] railway systems and sub-systems of planning, disposition, control technology and safety technology are described, which fulfill different functions and generate a large number of signals and messages.

With reference to [3], it was found that the control and testing of the system functions at a lower level takes place with great effort and statements on higher-level operational processes and in particular on changes in higher-level processes that are used for preventive measures or for planning the necessary expansion of the railway system could not be derived from it or only with great effort. Documents [1] to [8] thus prove that information for improved testing is available in railway systems, but is not or cannot be used.

The DE102013218814A1 discloses a method for operating a safety-critical system with at least one first data device with approved, safety-related software and with at least one reference data device with the same approved, safety-related software, in which, before outputting safety-related data information, output information from the at least one first data device and the at least one reference data device can be checked for consistency with regard to the safety-related software.

The EP1085415A2 discloses a program module containing a first and a second program part, which are implemented in different logic and for different functions, the first program part being designed as an executing program and suitable for determining a number of output data from a number of input data, and the second Program part is designed as a controlling program and is suitable for checking only parts of the output data.

From F. Denecke / M. Brandt, Innovative diagnostic system - first use at DB AG, SIGNAL + DRAHT (100) 5/2008, a diagnostic device for electronic signal boxes is known, using the information required in remote areas of signal boxes about the operating situation and the State of individual elements can be determined.

From M. Scheuer et al., Thales ProVIS+: Visualized performance monitoring including trend analysis, SIGNAL + DRAHT (104) 4/2012, an error correction system is known for which diagnostic data is provided and interpreted for each signal box under observation.

The present invention is therefore based on the object of specifying an improved method for testing a railway system and a railway system operating according to this method.

The method according to the invention should allow the information available in the railway system to be used efficiently in order to gain knowledge which is particularly valuable for the maintenance and expansion of the railway system are. It should also be possible to monitor and secure existing control systems.

In particular, a method is to be specified which allows the railway system or parts of it to be checked with little effort, i.e. practically automatically.

The test should be able to be carried out automatically and scaled as required. The operator of the railway system should also be able to adjust the subject of the test as required. The examination of the railway system should be possible at different levels of the railway system. The breadth and depth of the test should therefore be optionally adjustable.

The procedure is intended to deliver test results that allow the performance and changes in the railway system to be determined in order to be able to initiate corrective measures that are necessary in the long term.

Necessary corrective measures should be able to be derived directly from the information determined according to the invention, preferably taking into account other data sources, in particular master data of the railway system.

The method according to the invention should be able to be carried out parallel to existing test methods and supplement, verify or replace them on a case-by-case basis.

The method according to the invention should be able to be implemented in parts of the railway network with little effort and, if necessary, to be extended to the entire railway system.

The procedure should be able to optionally check any operating processes that serve, for example, performance, security or disposition

This object is achieved with a method and a railway system which has the features specified in claims 1 and 15, respectively. Advantageous configurations of the invention are specified in further claims.

The procedure is used to test a railway system or parts of it. The railway system includes resources of a physical infrastructure, in particular a track network, vehicle resources, resources of a control system and resources of a safety technology, which of at least be used in a control system on the basis of operating rules and operating procedures, by means of which defined operating processes are implemented on a case-by-case basis, to which process data such as input variables, output variables and operating variables are assigned.

According to the invention, operational processes implemented during operation of the railway system are identified and process results of the identified operational processes are recorded from the railway system and compared with reference data in a test computer in order to check the sequence of the identified operational processes.

According to the method according to the invention, individual operating processes are thus identified, which usually consist of a number of sub-processes. According to the invention, at least one sub-process or the entire operating process is checked. For example, a train run from an operating point A to an operating point B is checked. If necessary, measures to secure the route with follow-up protection, counter-vehicle protection, flanking protection, securing movable route elements, protection at level crossings, protection against external objects (clearance monitoring), speed monitoring (train control) are monitored. For example, the free reports and the positions of the stop signals are checked for the block sections of the route. This check can be carried out redundantly to existing backup procedures in order to verify them. However, the procedure can also be used to carry out extensive tests that include larger sections of track or higher-level system parts. If the operating points A and B are far apart and e.g. separated from each other by other operating points, higher-level information can be determined, which particularly relates to the performance of the railway system and the disposition of the vehicles.

In the case of complex railway systems, the method according to the invention can also be carried out with the involvement of a number of test computers which test processes independently of one another or which perform different tasks when testing a process. A first test computer can check registered inflow data. A second test computer can check the vehicles and their condition. A third test computer can check security aspects. A fourth test computer can consolidate the data determined and initiate the necessary measures.

So that operating processes, the implementation of which is planned and which should be accessible for testing, from the test process or from the test computer can be identified, process data are provided in particular by the planning technology, the control technology or the security technology. The process data are used to form identification data, based on which operating processes are identified, selected and checked. The test computer or the test process can access and test operating processes selectively, specifically or randomly. The operator of the railway system can also specify which types of operating processes are to be examined with priority. Furthermore, it can be determined which process parameters or process results of a specific process are to be checked.

Furthermore, a test depending on the time is possible. In particular, it is possible to check events and statuses for specific time windows for which specific rules or regulations have been made or in which different loads on the railway system occur. The completeness and plausibility of the determined data and/or the registered events are preferably also checked.

If, for example, a negative driving time is determined, there is no plausible result, which is why an error message must be issued.

It is also normally relevant that event messages have a correct timing or are present in a specific sequence. For example, a barrier should be closed before a train passes through and not afterwards. If the closure of the barrier is reported after the train has passed, an error message is issued again.

The testing of the railway system is not limited to the isolated monitoring of individual trains and processes assigned to them, but can also monitor several operating processes running in parallel, in particular different train journeys, which should run independently of one another or separately from one another in terms of safety. For example, the train sequence data in the railway network is monitored in order to identify hazards or the potential for densification.

If, for example, there is no message from a barrier for a train passage, the data is not complete, which is why an error is reported and a check is initiated.

Automated sequences and processes or those influenced, for example, by manual intervention or by faults or work can be checked individually. Preferably, the test computer are scheduled Operating processes and changes thereto as well as internal influencing variables, such as fault reports, and external influencing variables are reported. For example, it is possible to monitor train journeys in the area of temporary construction sites, for example compliance with reduced maximum speeds. The test procedure is very flexible and can be adapted to any task with little effort. If all construction sites in the railway system are registered in a higher-level computer, eg a maintenance computer, the relevant data can be loaded from this maintenance computer and operating processes or train journeys in the area of selected construction sites can be checked and evaluated.

In principle, all influences on the railway system can be taken into account. In particular, weather influences can be taken into account. If, for example, temperatures drop, energy consumption can increase. Likewise, the energy consumption can also increase when the temperatures are high, since cooling units are switched on. Tolerance values for the energy consumption used in the test can be adjusted accordingly.

It is essential that the test computer or the test process carries out the test of the railway system while it is in normal operation. No special measures need to be taken to carry out the tests. Operating processes that are integrated into the daily operation of the railway system and normally run in a scheduled manner are optionally identified, selected and checked.

In preferred configurations, the checking processes are completely separate from the operating processes. This means that there are no repercussions from the test computer on the railway system. In further preferred configurations, repercussions are permitted for parts of the railway system and, for example, only excluded for the safety technology. In particularly preferred configurations, however, the verification process can also intervene in the safety technology. For example, safety conditions can be defined that must be met by the safety technology and are monitored by the test process or test computer.

In preferred configurations, the master data is also checked in addition to the running processes. If a mismatch between the master data of the railway system and the process results is determined, the corresponding master data are preferably checked. The test system can work in the background and detect system deficiencies in any area of the railway system.

In preferred refinements, the control device of the railway system, which controls the selectable operating process, sends an identification and all associated process parameters to the test computer before it is implemented, so that it can derive the reference data from it and monitor and test the selected operating process. As a precaution, the corresponding data for all operating processes can be stored as test cases or reference cases on the test computer.

Alternatively, the test computer identifies operational processes that are of interest and prepares the reference data required for the test.

1. a) Netz-Daten, Streckendaten, Betriebspunktdaten; und/oder
2. b) von Grundfahrplandaten und Sollfahrplandaten; und/oder
3. c) Prognosemeldungen zu aktuellen Zugläufen; und/oder
4. d) Formationsdaten für Personenzüge und Güterzüge

ermittelt. Bei der Identifikation des Betriebsprozesses können auch Infrastrukturdaten und/oder Fahrzeugdaten vorteilhaft berücksichtigt werden. Auf diese Weise gelingt es Prozesselemente, die vom Betriebsprozess genutzt werden zu identifizieren und zu lokalisieren. Für Fahrzeuge wird z.B. die Übereinstimmung der gemeldeten Fahrzeugdaten mit den aus dem Betriebsprozess ermittelten Fahrzeugdaten geprüft.Preferably, identification data are taken into account

1. a) network data, route data, operating point data; and or
2. b) basic timetable data and target timetable data; and or
3. c) forecast reports on current train runs; and or
4. d) Formation data for passenger trains and freight trains

determined. When identifying the operating process, infrastructure data and/or vehicle data can advantageously also be taken into account. In this way, it is possible to identify and localize process elements that are used by the operating process. For vehicles, for example, the correspondence between the reported vehicle data and the vehicle data determined from the operating process is checked.

On the basis of the identification data and, if necessary, process data, address data, for example, are formed, by means of which the resources of the selected operating process are addressed and the relevant process results are queried. For example, status data is stored in the tested resources, in particular the process control units, which can be queried directly by the test computer, or which is temporarily stored by a control device and can be queried by it. Status data can also be queried multiple times in order to track changes that are triggered by the operating process.

Reference data are created so that the determined process results and the related changes to the elements of the railway system can be checked. This can be done in a number of ways. For example, the changes or process results caused by an implemented operating process are registered. The registered process results are subsequently used as a reference case for further similar operating processes are used. Assuming that the relevant part of the railway system is functioning properly, the test computer can thus register operating processes and/or corresponding process data and store them in a database as a reference case. The corresponding reference data, for example the determined process data or process variables, which are preferably linked to time information, can subsequently be used to check this or the same operating process. If the railway system has, for example, a certain number of identically designed routes that diverge in a star shape, a reference case can be registered and used for all identical routes.

Preferably, the railway system is analytically divided into parts, which are then classified into groups in which the same or similar parts are provided. It is also possible to allocate parts of a group which differ, for example, in one parameter, with the different parameter being registered. For example, two routes differ only in the distance between two switches or signals. If these different parameters are known to the test process, it can take into account the resulting time delays in the test. The corresponding reference data can therefore be provided with reduced effort for different groups of operating processes. These measures are particularly effective in railway systems that are made up of largely similar modules. In addition, the generic descriptions can be provided with reduced effort for the modules of the same type. In the application, after an operating process has been identified, it is thus preferably determined whether it belongs to a group for which reference data has already been provided.

In [6], page 3, it is stated that the basic technical features of the functioning of the railways, which are the same everywhere, are first expressed in functions that are operational in nature, which is why they are necessary for changing locations Functions are particularly suited to form the starting point for the definition of a generic reference.

In a particularly preferred embodiment of the invention, uniform operational functions and rules, preferably generic operational functions and rules, are therefore created for the railway system and subsequently used to define the operational processes. generic Descriptions can therefore be used particularly efficiently to form reference data.

For an operating process to be implemented that relates to a change of location, reference data is determined, for example, using infrastructure data and operating rules. The test computer uses the infrastructure data to determine, for example, which I&C units are available and how they are used according to the definition, and preferably uses their generic description. For example, for the construction and dismantling of a secured route, it is checked which process control units, e.g. points or signals, have to be operated and in what chronological order. Furthermore, it is checked which input signals and output signals are assigned to these I&C units. The corresponding generic descriptions of the I&C units are therefore linked to a reference process. Process data, i.e. target process variables, and preferably the time sequence within which these target process variables occur are specified for the reference process and the linked I&C units. The reference data can therefore define target processes or reference processes and/or target process variables or reference variables, which are compared with the tested processes or with the process results. The reference data can therefore consist of individual or chained rules of a generic reference system. Corresponding target process variables can be taken from tables, flow charts or state event charts, for example.

Before an operating process is implemented, preferably process data of this operating process and preferably associated vehicle data and/or infrastructure data are provided, which can be optionally called up by the test computer. The test computer uses the available process data to identify individual operating processes. Reference data required for the test can already be available for identified operating processes, which are retrieved from a database after the operating process has been identified. Alternatively, reference data for the selected operating process is determined on the basis of process data and operating rules. The process data used to provide reference data in this way is typically more extensive than the process data used to identify an operational process. Process data that is used for identification on the one hand and the provision of reference data on the other hand can also form an intersection. The examination can take into account the nature of the Train traffic, eg the presence of passenger traffic, freight traffic, shunting trips, etc., are carried out.

1. a) Daten der Planung, insbesondere Zuglaufdaten, und/oder
2. b) Daten der Disposition, wie Fahrzeugdaten, und/oder
3. c) Infrastrukturdaten des Gleisnetzes, und/oder
4. d) Daten eines aktuellen Zuglaufs; und/oder
5. e) externe und interne Einflussgrössen,

wie Störungen, manuelle Eingriffe, WitterungseinflüsseThe process data preferably includes

1. a) Planning data, in particular train running data, and/or
2. b) Scheduling data, such as vehicle data, and/or
3. c) infrastructure data of the track network, and/or
4. d) data from a current train run; and or
5. e) external and internal influencing factors,

such as faults, manual intervention, weather conditions

Based on the train running data, the vehicle data, in particular the train configurations and the infrastructure used, operating processes can be forecast and corresponding reference data can be created, taking into account the operating rules.

Process results essentially consist of process data or are formed from data that can be retrieved from the control technology, the safety technology, the train control system or the vehicle technology. Process results therefore describe the statuses or status changes of elements, in particular process control units, which are the subject of the tested operating process.

1. a) die Kompatibilität der Referenzdaten mit dem geprüften Betriebsprozesses bestätigt;
2. b) den erfolgreichen Abschluss der Prüfung bestätigt; und/oder
3. c) die Abweichung der Prozessergebnisse von den Referenzdaten meldet.

Based on the verification of the process results using the reference data, reports are issued that preferably

1. a) confirms the compatibility of the reference data with the audited operational process;
2. b) confirms the successful completion of the examination; and or
3. c) reports the deviation of the process results from the reference data.

If the reference data is not compatible with the tested operating process, the cause of the error is analyzed and a correction made. For example, an adjustment or supplement to the operational rules is made. In this way, the examination system can be continuously improved.

If deviations from the reference data are detected, malfunctions in the railway system can be checked and corrective measures can be initiated.

The repeated testing of the same operating process is particularly revealing. Expected values are preferably determined from the test results recorded in each case, so that deviations of a currently tested operating process from the expected values can be determined. Data, in particular event data, are preferably grouped, after which it is determined which group new events are to be assigned to. For example, no follow-up measures are planned for a first group. For a second group, data is forwarded for verification. An alarm is raised for a third group. For a fourth group, for example, corrective interventions are made in the railway system. Furthermore, continuous changes in test results can be determined for operating processes that have been implemented and tested multiple times. The operator of the railway system thus has a "sensor" by means of which changes, bottlenecks and overloads can be recognized at an early stage and necessary corrective measures can be evaluated and initiated.

Fig. 1

den schematischen Aufbau eines erfindungsgemässen Eisenbahnsystems 100 in einer vorzugsweisen Ausgestaltung, mit einem zur Durchführung des erfindungsgemässen Verfahrens geeigneten Testrechner 1, der anhand von Referenzfällen und betrieblichen Regeln, die in Datenbanken 11, 12 gespeichert sind, Referenzdaten bildet und mit Prozessergebnissen identifizierter Betriebsprozesse vergleicht;

Fig. 2

ein Flussdiagramm für einen erfindungsgemässen Testprozess TP, anhand dessen der Testrechner 1 im Eisenbahnsystem 100 von Fig. 1 implementierbare Betriebsprozesse identifiziert, zugehörige Referenzdaten und Prozessergebnisse ermittelt und miteinander vergleicht;

Fig. 3

einen Teil des Eisenbahnsystems 100 von Fig. 1 mit Prozessergebnissen, die während des Ablaufs eines Betriebsprozesses, in dem ein Zug 9 einen Gleisabschnitt 8 durchfährt, im Bereich der Bahnsicherungstechnik 5 und der Zugbeeinflussung 7 auftreten und vom Testrechner 1 abgerufen werden können;

Fig. 4

das Eisenbahnsystem 100 von Fig. 1 mit einem Streckenabschnitt 8, innerhalb dem eine Fahrstrasse FS erstellt wird, mit einem schematisch gezeigten funktionalen System, welches Eingangsgrössen und Ausgangsgrössen mit Nachbarsystemen austauscht und entsprechende Funktionen erfüllt; und

Fig. 5

das Eisenbahnsystem 100 von Fig. 4 mit der schematischen Darstellung von Betriebsprozessen, von denen ein Teilprozess p vom Testrechner 1 identifiziert, selektiert und geprüft wird.

The invention is explained in more detail below with reference to drawings. It shows:

1

the schematic structure of a railway system 100 according to the invention in a preferred embodiment, with a test computer 1 suitable for carrying out the method according to the invention, which forms reference data on the basis of reference cases and operating rules stored in databases 11, 12 and compares them with process results of identified operating processes;

2

a flowchart for an inventive test process TP, based on which the test computer 1 in the railway system 100 of 1 identifies operational processes that can be implemented, determines and compares the associated reference data and process results;

3

part of the railway system 100 from 1 with process results that occur during the course of an operating process in which a train 9 runs through a track section 8 in the area of railway safety technology 5 and train control system 7 and can be called up by the test computer 1;

4

the railway system 100 of 1 with a route section 8, within which a route FS is created, with a functional system shown schematically, which exchanges input variables and output variables with neighboring systems and fulfills corresponding functions; and

figure 5

the railway system 100 of 4 with the schematic representation of operating processes, of which a sub-process p is identified, selected and checked by the test computer 1.

1 shows the schematic structure of a railway system 100 according to the invention in a preferred embodiment, with at least one test computer 1 suitable for carrying out the method according to the invention, which is connected to one or more distributed databases 11, 12, ..., 14, in which on the one hand for the test used reference cases and operational rules and on the other hand test results are or will be stored.

The representation in 1 includes the basic components of a railway system, namely "vehicles", "structural infrastructure" and "control and safety technology", which are shown in [6], page 5, as adjoining triangles that enclose another triangle that describes the operating procedures and the Interaction of vehicles, structural infrastructure as well as control and safety technology.

1 shows a module 3 for the control technology, a module 5 for the security technology and an intermediate module 4 for the processing of data that occur in the control technology 3 or in the security technology 5 or are supplied from the outside. Further modules 2 and 6 represent the planning technology and disposition as well as the vehicles 9 and the infrastructure 8.

A system computer 1000 is provided at a higher level, which can preferably communicate with all modules 1-9 directly or indirectly, without bidirectional or bidirectional, in order to collect data or to influence the railroad system 100 . In principle, this system computer 1000 can be integrated into the control technology module 3 and/or include the data transfer/data processing module 4 . Furthermore, the system computer 1000 can access other computer systems 1001, 1002, ... in order to collect the required data, in particular data from external factors, such as weather data and Retrieve climate data or store determined data that is used, for example, for the billing of services or the maintenance of the railway system 100 . The symbolically shown system computer 1000 can preferably also exchange data either directly or indirectly with the test computer 1, so that the test computer 1 preferably has all the data of the railway system 100 available and preferably data determined by the test computer 1 and, if necessary, control commands and/or alarms to the railway system 100 can be supplied centrally or selectively. It is shown by way of example that the system computer 1000 can exchange data with a test vehicle 1003 which runs on the rail network of the railway system 100 . This data can be queried from the system computer 1000 to the test computer 1 or from the test computer 1 directly from the test vehicle 1003 .

The mentioned modules 1-9 as well as 1000, 1001, 1002, 1003, which can exchange messages and signals with each other in a known way, are in 1 shown as an example. However, they can have different configurations and interactions. The communication between the modules 1-9 as well as 1000, 1001, 1002, 1003 can be wireless or wired, circuit-switched or packet-switched.

The basic functions of the railway system known to those skilled in the art are described in [9], L. Fendrich / W. Fengler, Handbuch Eisenbahninstrumente, 2nd edition, Springer Verlag, 2007. Chapter 10, Control and safety technology, Chapter 17, Railway telecommunications technology, and Chapter 22, System monitoring of the track are particularly relevant.

The "Planning" and "Disposition" modules are described in [7], for example. Train run data is particularly relevant for checking operating processes that affect the relocation of vehicles. The train movement data of trains are preferably supplied by an administration unit that monitors train movements and receives plan data for the train movement from a planning computer and feedback on the actual train movement from the control system, such as data on the entry and exit of trains in a section block of an operating point.

The test computer 1 can request static and dynamic information and data from the modules 2-9, 1000, . Data from the control technology 3 and the safety technology 5 can be queried via the data processing module 4. Planning data, in particular timetable data, and, if necessary, disposition data are supplied by module 2. External process variables are supplied by the system computer 1000, for example.

The test computer 1 preferably automatically determines two types of information and data from the railway system 100. On the one hand, process data, i.e. data and information on operating processes from the modules 2-9, 1000, which are being implemented or have already been implemented, are retrieved. Based on the process data, the test computer can identify and select operating processes. From the timetable data, the test computer 1 can determine, for example, that a train will leave operating point A at 10:00 a.m. and be transferred to operating point B. The test computer 1 can monitor and check the overall process for this shift or sub-processes thereof. It is also possible to use the notification of the train's departure from operating point A as an incentive to monitor and check the relevant operational process.

Preferably, data on internal or external process variables are also loaded, which do not influence the operating processes directly, but rather indirectly. Weather and temperature data, which can significantly influence the operating processes and are preferably taken into account in the test, are particularly relevant.

In addition to process data, the text calculator 1 can also call up process results from the modules 2-9, 1000 in order to compare them with reference data. These process results are typically status information or information about status changes for process elements or functional elements of the railway system 100, such as control or safety-related units that are involved in the operating process for moving the train from A to B.

Messages about changes in the status of the relevant process elements can be transmitted directly or indirectly to the test computer 1 via the various wired or wireless communication channels of the railway system. [8] discloses an interlocking for controlling decentralized functional units, which are connected to the process control system via communication channels, comprising a number of computer-aided control units, the control units being connected in series or in parallel according to a control plan and receiving control data according to this control plan and/or spend. Mobile devices are used as computer-aided control units. The method according to the invention can be used particularly easily in a railway system according to [8] since process data, referred to as control data in [8], can be transmitted directly to the test computer 1 via a communication channel. Communication can be via a GSM communication network, eg GSM-R or LTE, or via a packet-switching network, such as the Internet, are transmitted to the test computer 1, which is equipped with the appropriate communication devices and communication addresses.

The test computer 1 can thus identify and select individual operating processes on the basis of static and dynamic process data. For selected operating processes, the test computer 1 can call up corresponding process results, typically dynamic process data, from the railway system and use any communication channels for this purpose.

Reference data, which is compared with the process results, is provided to check the selected operating process.

Reference data can be determined in different ways. Operational processes can be monitored and the process results can be saved as reference data. The control device of the railway system, which controls the selectable operating process, can send identification data and associated process parameters to the test computer 1 prior to its implementation, so that the latter can derive and store the reference data therefrom. The test computer 1 can also identify operational processes and create reference data based on operational rules and the use of process data, as described above.

2 shows a flowchart for a test process TP according to the invention, on the basis of which the at least one test computer 1 in the railway system 100 from 1 operational processes that can be implemented are identified, associated reference data and process results are determined and compared with one another. The test process TP or the test method comprises a number of process steps S1, . . . S7, some of which can be reversed in their order or executed in parallel. The test process TP is preferably run through repetitively in order to obtain as much information as possible about the railway system.

According to process step S1, process data for the operating processes of the railroad system 100 are provided. It is shown by way of example that the required process data can be collected and made available by the system computer 1000 . Furthermore, process data can be queried directly from other modules 2-9 of the railway system 100. Such process data, such as timetable data, are available in known railway networks and are routinely generated and typically form input variables operational processes carried out. Specific data or data valid for all processes can be provided for each process.

Parts and modules of the railway system that generate signals and messages or process data were initially described with reference to documents [1] to [8]. In this case, process data can relate to static or dynamic states of functional units in the railway network 100 . Furthermore, process data can relate to planned and actual process events, which ideally coincide in time. Process data can also relate to information on operating processes that have already been implemented. In contrast to process results, process data typically relate to process variables that occur when the operating processes are initialized.

The process results mentioned in process step S52 are basically also process data, which, however, relate to relevant results of the operating processes and typically occur towards the end of the process phases. Process results therefore form a special class of process data.

According to process step S2, identification data for operating processes that are planned or already implemented are determined.

According to process step S3, an operating process is identified and selected which is to be subjected to an examination. The selection can be random. For example, operating processes of a timetable are recorded and checked sequentially. According to module S30, however, the identification process can be controlled so that, for example, different types of functions are subjected to a test. For example, the control technology, the safety technology, the vehicle technology, the point technology, the signaling technology and/or the communication technology can be checked for a relocation of a train from A to B. This means that the input signals and output signals from functional units in these technical areas can be checked. However, the operator of the railway network 100 can also have operating processes checked that are relevant to scheduling.

After an operating process has been identified, reference data are determined for it in process step S4 and process results are determined in process step S5, which are compared with one another in process step S6.

Reference data can be determined in process step S4 in various ways. It is preferably checked (process step S43) whether reference data or a reference data for this operating process is already in the database 12 reference case is available. In a further preferred refinement, it is checked (process step S42) whether the operating process belongs to a group of operating processes for which reference data or a reference case already exists. If there is still no reference case, reference data are determined using operational rules from database 11, possibly including process data (process step S41). For example, data from the part of the infrastructure that is used by the operating process is used. The process elements involved and their locations are determined from the infrastructure data. The operating rules are then used to determine which status changes are to be expected for the process elements involved during the course of the operating process. The reference data determined for this operating process is stored in the database 12 and is available as a reference case if the same operating process is selected again. The process steps S41, S42, S43 and S44 mentioned by way of example can be used as alternatives or, as described, in combination with one another.

To determine the process results in process step S5, process elements that are used in the implementation of the identified operating process are determined on the basis of the identified operating process, preferably taking into account process data. For a relocation of a train between the operating points A and B, infrastructure data is preferably used to determine which process elements, such as control units, switches, signals, transitions, barriers, are used in the implementation of the operating process. Status changes during the course of the identified operating process are registered for these process elements and corresponding process results are formed. Status changes can also only be queried at specific times.

Address data is preferably created or loaded for the identified process elements, by means of which process results can be queried for the relevant process elements, e.g. from the control technology, the safety technology, the train control system, the vehicle technology or directly from the process elements.

Finally, in process step S6, the determined process results are compared with the determined reference data.

The comparison results formed in process step S6 are evaluated in process step S7 to test results for the tested To form operating process, which are preferably used as a basis for necessary actions. Test results are stored in the database 14 and can be analyzed and statistically evaluated as desired using the test computer 1 or other computing units in order to identify faults, weaknesses and changes, in particular changes in the load on the railway network 100 . Previously determined test results can also be read out from the database 14 and used to evaluate the comparison results. Comparison results and test results are preferably stored in the database 14 as part of primary actions. In the context of secondary actions, repercussions on the railway system 100 are preferably triggered. Errors can be signaled and alarms triggered. Furthermore, control signals can be issued with appropriate priority. If, for example, a collision situation is detected on a route that was not caught by the safety technology, signals can be switched and the vehicles concerned can be controlled, if necessary, in order to avoid a collision.

3 Symbolically shows a part of the railway system 100 of FIG 1 with process results that occur during the course of an operating process, in which a train 9 drives through a track section 8, in the area of railway safety technology 5 and train control system 7 and can be called up by the test computer 1. The part of the railway system 100 shown relates to a control circuit for operational safety in rail traffic, as described in [9], Chapter 10.1.3, page 492, Fig. 10. 4 , shown and described. There it is stated that for a train 9 to travel in a track section 8, the associated clearance should be free of all objects and the moving track elements traveled on should have assumed the correct position. These states or changes in state are detected by a sensor system. The track vacancy notification stands for the freedom of track 8 from other rail vehicles. The clearance clearance message stands for the freedom of track 8 from objects that are not part of the system. When the track section 8 has been left by the preceding train 9', the track section 8 is reported to be free. After the information has been processed, a positioning command may have to be issued in order to bring the movable track elements into the correct position, which means that the position has to be read in again. If the requirements are met, a move command can be issued. This leads to the acceleration of the vehicle 9, which can enter the track section 8. Compliance with the permissible speed is monitored by the train control system 7. The Input signals a, b, c of the measured value acquisition (sensors), the output signals d, d1, d2, d3 of the control value output, control signals e from the train control system 7 and signals f, g from the vehicles 9, 9' can be recorded by the test computer 1 as process results become. As described in [8], mobile devices can be used as computer-aided control units that transmit corresponding status changes to the test computer 1 via a mobile radio network.

4 shows the railway system 100 of FIG 1 with a route section 8, within which a route FS is created, with a functional system shown schematically, which exchanges input variables and output variables with neighboring systems and fulfills corresponding functions. According to [6], pages 64-56 (see Figure 29), input and output are of particular importance when delimiting a functional system to be considered. They define what the functional system has to do (output) and what it should not do but take over from other systems (input). Who or what provides these inputs is in principle irrelevant when viewed generically. Theoretically, the neighboring systems could therefore be omitted and the delimitation made solely by the information on the inputs and outputs. In addition, functions s1, s2 are shown, which are not transmitted as an output to a neighboring system, but relate to a configuration change of the functional system, for example. The signals input x, y, z and output o can in turn be transmitted to the test computer 1. Operating rules can be defined for each functional system, which describe the behavior of the functional system, which represents a process element, during the course of the operating process. Once the relevant process element has been identified for an operational process, the expected behavior of this process element and corresponding reference data can be defined. Likewise, the actual behavior of this process element can subsequently be recorded with the corresponding process results. In principle, processes in the functional system shown form an operating process. By linking the generic descriptions of several functional systems, larger operating processes are described and corresponding reference data are provided. The test computer 1 can also be viewed as a neighboring system to which an output, namely status reports, is transmitted. The functional systems, such as the mobile terminals described in [8], preferably have an interface via which they can transmit data to the test computer 1.

The functional system is part of a route section 8 in which a route FS is created based on the identified operating process and control engineering units such as points W1, W2 are controlled accordingly. The route section 8 corresponds, for example, to the route section 8 of 3 and is monitored and controlled accordingly. It is also possible to test shorter track sections, e.g. the track section between points W1 and W2, or selectively elements of the railway system 100.

figure 5 shows the railway system 100 of FIG 4 with the schematic representation of operating processes, of which a sub-process p, for example, to the functional system of 4 corresponds, was identified by the test computer 1, selected and checked. It is shown schematically that a number of operating processes can run in parallel with one another or that an operating process can have a number of sub-processes running in parallel or in series with one another. In the representation shown, the sub-process p is checked and process variables x, y, s and o are recorded as process results, on the basis of which the sub-process P is checked taking into account generic descriptions of the sub-process P or corresponding reference data.

bibliography

1. [1] EP1750988B1
2. [2] WO2006136216A1
3. [3] WO2010148528A1
4. [4] EP1897781A2
5. [5] EP2090491A1
6. [6] Gunnar Bosse, Foundations for a generic reference system for the operating procedures of track-guided transport systems, November 23, 2010
7. [7] EP2631152B1
8. [8th] EP2868547A1
9. [9] L. Fendrich / W. Fengler, Railway Infrastructure Handbook, 2nd edition, Springer Verlag, 2007

Claims (15)

1. Method of testing a railway system (10) or parts thereof, which comprises

   - resources of a constructional infrastructure (8), in particular a rail network,

   - vehicle resources (9),

   - resources of a guidance control system (3), and

   - resources of a safety technique (5),

   which are used by at least one control system (2, 3, 4, 5) on the basis of operating rules and operating methods (p1, ..., pn), by means of which defined operating processes (p) are implemented on a case-by-case basis, to which process data, such as input variables (x, y, z), output variables (o) and operating variables (s), are allocated, characterised in that during operation of the railway system (100) implemented operating processes (p) are identified and process results of the identified operating processes (p) are collected from the railway system (100) and compared in a test computer (1) with reference data in order to test the performance of the identified operating processes (p).
2. Method according to claim 1, characterised in that for each operating process, process data are provided before implementation, which can be used by the test computer (1) for identifying an operating process (p) and/or for providing corresponding reference data and/or for determining corresponding process results.
3. Method according to claim 2, characterised in that the process data optionally comprise

   a) data of the planning technique (2) and disposition, in particular guidance movement data,

   b) forecast data,

   c) data of the guidance control system (3),

   d) data of the safety technique (5),

   e) data of the vehicles (9),

   f) data of the infrastructure (8), in particular the rail network,

   as well as data on the temporary validity of these process data.
4. Method according to one of the claims 1, 2 or 3, characterised in that the test computer (1) determines identification data on the basis of process data, by means of which operating processes to be tested are identified, wherein identification data are preferably determined under consideration of timetable data.
5. Method according to claim 4, characterised in that identification data are determined under consideration of static or dynamic process data, whereby within the infrastructure (8) preferably status changes are detected and associated operating processes are identified.
6. Method according to one of the claims 1-6, characterised in that the test computer (1) loads stored reference data for an identified operating process from a data base (12, 13) or that the test computer (1) determines reference data from process data and stored operational rules, wherein the reference data correspond to the expected behaviour of the identified operating process.
7. Method according to claim 6, characterised in that reference data for an identified operating process are formed under consideration of data of the infrastructure of the railway system (100), wherein on the basis of the infrastructure data process elements used by the identified operating process, such as guidance control units, are identified and the operational rules are applied to them in order to represent the identified process in whole or in part.
8. Method according to one of the claims 1-7, characterised in that on the basis of the identification data and, optionally, process data, in particular infrastructure data, process elements used by the identified operating process, such as guidance control units, are identified, for which status changes are registered during the course of the identified operating process and corresponding process results are formed.
9. Method according to claim 8, characterised in that for the identified process elements address data are created or loaded, by means of which process results for these process elements can be queried from the train control system (3), the safety technique (5), the train control (7), the vehicle technology (9) or directly from the process elements.
10. Method according to one of the claims 1-9, characterised in that based on the examination of the process results by comparison with the reference data, a message is issued, which

    a) confirms the compatibility of the reference data with the tested operating process confirmed;

    b) confirms the successful completion of the examination; and/or

    c) reports the deviation of the process results from the reference data.
11. Method according to one of the claims 1-10, characterised in that based on the examination of the process results by comparison with the reference data, a failure of the railway system (100) is determined and

    a) alarm messages are issued; and/or

    b) control signals are delivered to the railway system (100).
12. Method according to one of the claims 1-11, characterised in that test results for a repeatedly implemented and tested operating process (p) are averaged and that deviations of the currently tested operating process (p) from the previously created average values are determined, or that changes in test results for a repeatedly implemented and tested operating process are determined.
13. Method according to one of the claims 1-12, characterised in that the testing of the implemented operational processes is performed repetitively for different time periods of a day, a week, a month or a year and/or that the testing of the implemented operational processes is performed selectively by the type of operational processes.
14. Method according to one of the claims 1-13, characterised in that operational processes are identified and sorted into groups according to their properties, to which corresponding reference data are assigned, after which the affiliation to a group is checked for identified operational processes and the corresponding reference data are loaded.
15. Railway system with at least one test computer (1) in which at least one software program is installed or a test process (TP) is implemented, which serve to carry out the method according to one of the claims 1 - 14.

Images