JP2008254556A - Fail-safe control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a fail-safe control system for achieving the train control of the high responsiveness by performing the use acceptance/rejection control of an ATC telegram by the majority decision of the result of determination for normality/abnormality of a main system of a ground equipment by an onboard device receiving the transmission of the result of determination for the self system and the counter system executed by each ground equipment system. <P>SOLUTION: Computers 2A-2C of a multiple computer 1 of a ground equipment exchange and collate the processed computation results of the self system and the counter system with each other, and prepare the result of determination for soundness of the total system by determining the soundness of the self system and the counter system based on the result of collation. The multiple computer 1 outputs the result of determination of the soundness of the total system to an onboard device 5 together with the processed computation result. A control device as its reception control unit 7 performs the majority decision processing of the result of determination of the soundness of the total system to determine the acceptance/rejection of the use of the result of the processed computation. By using the logical fail-safe method, the size and the cost of the system can be reduced more compared with the hardware constitution, the interface can be expanded, and the high responsiveness can be realized in the train control. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a fail-safe control system for guaranteeing safety when control data is transmitted between a multiplex system control device and an on-board device for train control performed by an automatic train control device (ATC). .

  In order to ensure safety in train control, the control device is configured to operate in a fail-safe manner. Fail-safe in train control is a method of coping with always controlling the train to the safe side, that is, the side to stop when an abnormality occurs in the device or system.

  Traditionally, train control devices have a multiple system configuration with the same logic to perform fail-safe information transmission, and the main system (system that outputs data) determined by each system computer by exchanging and collating the output results The normal / abnormal state is input to dedicated hardware and a majority decision is made, and when the main system abnormality is determined, the data output is limited by a relay in the hardware.

  In recent years, however, the entire system has been made fail-safe using the logic of each device that transmits information from the device that deletes the hardware and outputs a control instruction to the device that actually receives the instruction and performs control. Techniques to ensure have been proposed.

After each system of the multi-system device exchanges and collates the output result to determine the normal / abnormal state of the main system, the determination result of each system is added to the control instruction information to be output, and the device receiving the control instruction There has been proposed a multi-system information processing apparatus that takes the majority of the main system state determined by each system of the control apparatus and uses received information for its own control when the main system is determined to be normal (Patent Document 1).
If an error in the entire system occurs in the multi-system device, there is a possibility that an erroneous message is output once. Therefore, when the same control instruction is received twice by the controlled device, the message is used for control. I am going to do that.
JP 2004-302708 A

  In recent years, as an automatic train control device (ATC), a wireless ATC, which is a train control system that directly communicates with an on-board device using radio, performs train detection, and transmits an ATC telegram, is spreading worldwide. The wireless ATC can realize a reduction in equipment cost and maintenance cost compared to a conventional track circuit system. For this reason, in the logic part of the radio ATC, the interface with the radio base station is increased in addition to the configuration of the conventional ATC logic part. However, considering the cost of the apparatus and the installation space, it is required to suppress the increase in hardware constituting the control apparatus while maintaining the safety as the train control apparatus.

  Therefore, a technique that realizes fail-safe telegram transmission between the logic unit (ground device) for transmitting information and the on-board device using the logic of both devices without using dedicated hardware as described above is very useful. It is.

  An object of the present invention is to transmit all normal / abnormal determination results for the own system and other systems performed by each system of the ground device to the on-board device, and determine the possibility of the entire system abnormality of the ground device in the on-vehicle device. By controlling the availability of ATC messages by majority decision of the main system normal / abnormal judgment result of ground equipment, it is possible to use the ATC messages received by the on-board device for immediate control and higher response than before It is to provide a fail-safe transmission system that can realize a reliable train control.

  In order to achieve the above object, the present invention uses the following means. In other words, the fail-safe control method according to the present invention comprises a multi-system computer configured of a plurality of computers that execute the same processing calculation for the same processing target and outputs the processing calculation result, and receives the input of the output processing calculation result. A control device that controls the processing target based on the processing calculation result, and each of the computers of the multi-system computer mutually exchanges the processing calculation result of its own system and the processing calculation result of the other system. Exchanging and collating, making a soundness judgment for the computer of the own system and other systems based on the matching result to create a soundness judgment result of the entire system, the multi-system computer, the processing calculation result together with the processing calculation result The whole system soundness judgment result is output, and the control device consists of majority processing the received whole system soundness judgment result and judging whether or not the processing calculation result can be used. .

  The ground logic unit for creating an ATC telegram used for train control has a plurality of computers having the same logic, and each computer can exchange data with each other via a communication path. This makes it possible to perform data collation between computers and determine soundness. Further, the ATC telegram can be transmitted from the logic unit to the on-board device to be controlled via the communication path. The ATC telegram created by the computer of the logic unit can be configured to include information necessary for the control target train to perform traveling control and soundness information determined by the plurality of computers. Further, the on-board device receives the ATC message output from the logic unit and determines the validity of the received data from the soundness information of each computer, so that fail-safe control is possible.

As described above, according to the fail-safe transmission method according to the present invention, since the fail-safe technique based on the logic of the control device that performs information transmission is used, the device can be reduced compared to the hardware fail-safe device configuration. In addition, the cost can be reduced and the interface can be expanded, and the on-board device can determine the entire system abnormality of the control device. Moreover, since a constant control message can be used immediately, high responsiveness can be realized in train control.
In the fail-safe telegram transmission method by logic, even if the ground device is abnormal in the entire system, the on-board device can detect this and discard the control information that may be erroneous. It is possible to use the control message immediately in the continuous control.

Hereinafter, embodiments of the fail-safe transmission system according to the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a device configuration of an embodiment of a fail-safe transmission system according to the present invention. The logic unit 1 as a ground device is composed of three systems of computers 2A, 2B, and 2C. The computers 2A to 2C in each system operate independently, but simultaneously perform the same processing. Data exchange of each system is performed using the communication path 3.

  The main computer (for example, system 1 (computer 2A) in FIG. 1) uses the communication path (usually a wireless path) 4 for ATC telegrams including the health judgment results for all systems implemented by each system. To the on-train device 5 of the train to be controlled. The on-board device 5 inputs the received ATC message to the reception control unit 7 via the IF (interface) device 6. The reception control unit 7 has a fail-safe (FS) function in the present invention. In the reception control unit 7, each system soundness determination result carried out by all three systems of the ground device (logic unit) 1 included in the ATC telegram is collated and determined from the majority of the main system soundness determination result. The main system is determined to be normal / abnormal, and it is determined whether or not the ATC message is to be used for travel control.

  Next, the logic of each device in performing fail-safe transmission between the ground and the on-vehicle device in the fail-safe control system according to the present invention will be described. FIG. 2 shows a processing flow in each device while the ATC telegram is transmitted from the logic unit 1 to the on-board device 5. As a processing flow in the logic unit 1, a processing flow of the main system 1A 2A is shown as an example. External conditions such as train detection information and interlocking information from the on-board device 5 are input to the main system 2A. The train detection information is information on the position of the train on which the on-board device 5 is mounted, and the linkage information as an external condition is information on the travel route of the actual travel line (for example, distinguishing which line is up or down) , And the switching state of the rotary machine). The logical unit 1 of the main system 2A receives the input of these pieces of information, and information on the point where the train should stop and the allowable speed, that is, how fast the train can travel to. Train control data such as information is created (step 8). In each of the systems 2B and 2C other than the main system 2A, similarly, the train detection information and the external conditions are input and train control data is created.

  In the logic unit 1, the train control data is then exchanged between the systems again using the data exchange communication path 3 as output information, and each system collates its own system data with other system data. Each system diagnosis result as to whether or not there is a discrepancy between the data is created (step 9). Based on the results, the system when the data matches at least one other system is normal, the system that does not match the other two systems is abnormal, and the soundness of the own system and other systems is determined. A soundness determination result is created (step 10).

  The soundness result for each system of each system obtained in step 10 takes into account the error setting by the main system when it is transmitted to the on-board device 5 of the train to be controlled. Use. Similarly to the case of train control data, the overall system health determination result created in step 10 is output to another system and receives the entire system health determination result from the other system. The soundness result for the entire system of each system is added to the train control data (step 11) and transmitted to the on-board device 5. That is, all system soundness determination results in each system are transmitted to the on-board device 5 without being evaluated in any system.

  An example of the configuration of the ATC message is shown in FIG. As shown in FIG. 3, the ATC telegram consists of control data (train control data) 19 and main system selection information 21 created in step 8. The main system selection information 21 is composed of an overall system health judgment result 22A by the 1 system 2A, an entire system health judgment result 22B by the 2 system 2B, and an entire system health judgment result 22C by the 3 system 2C. ing. The health judgment result 22A of the entire system by the 1 system 2A is the health judgment result 22A1 of the 1 system 2A by the 1 system 2A (that is, the self health judgment result by oneself) and the health of the 2 system 2B by the 1 system 2A. It consists of sex determination result 22A2 and soundness determination result 22A3 of 3 system 2C by 1 system 2A. The same applies to the whole system soundness determination result 22B by the 2 system 2B and the all system soundness determination result 22C by the 3 system 2C.

  Further, in the processing flow shown in FIG. 2, on the on-board device 5 side, first, collation of the soundness determination results for all the systems performed by the logic unit (ground device) 1 of each system included in the received ATC telegram is performed (steps). 12). If the results of the entire system do not match, it is assumed that an abnormality of the entire system has occurred in the logic unit (ground device) 1, and the ATC message is discarded. Otherwise, the majority of the soundness results for the main system implemented by each system of the logic unit 1 is executed (step 13), and if the at least two systems are determined to be normal, the ATC message is controlled. Used for.

（ｂ）車上装置５は、列車制御データに各系の全系健全性判定結果が付加されたＡＴＣ電文を受信したとき、地上装置である各系の全系健全性判定結果を照合する。照合は、ＡＴＣ電文中の主系選択情報の多数決処理で行われる。全系健全性判定結果が少なくとも二つの系（２系と３系）で一致となるので、２系と３系の全系に対する健全性結果が採用される。続いて、２系と３系の主系（１系）に対する健全性結果が取得される。この健全性結果は「異常」となる。そのため、当該電文は不正として破棄されることになる。 Next, in the fail-safe determination method of the triple system device as a multiplex system, the verification of the entire system soundness determination result of each system on the on-board device 5 side will be described in more detail.
(1) When the main system becomes abnormal during triple operation, that is, when the first system is the main system and the second and third systems are subordinate systems, the main system (1 system) becomes abnormal. Case (a) The ground device 1 determines that the normal system 2 and system 3 are “system 1 abnormality / system 2 normal / system 3 normal” when system diagnosis is performed in each system. Since system 1 is abnormal, it can be judged as “abnormal” or “normal” for the entire system. The determination results are shown in Table 1.

(B) When the on-board device 5 receives the ATC telegram in which the whole system health judgment result of each system is added to the train control data, the on-board device 5 collates the whole system health judgment result of each system that is a ground device. The collation is performed by majority processing of the main system selection information in the ATC message. Since the whole system soundness determination result is the same in at least two systems (2 system and 3 system), the soundness result for the 2 system and 3 system is adopted. Subsequently, soundness results for the main system (system 1) of systems 2 and 3 are acquired. This soundness result is “abnormal”. Therefore, the message is discarded as illegal.

（ｂ）車上装置５は、列車制御データに各系の全系健全性判定結果が付加されたＡＴＣ電文を受信したとき、地上装置である各系の全系健全性判定結果を照合する。多数決処理で照合が行われると、全系健全性判定結果が少なくとも二つの系（１系と３系）で一致となるので、１系と３系の全系に対する健全性結果が採用される。続いて、１系と３系の主系（１系）に対する健全性結果が取得される。この健全性結果は「正常」となる。そのため、当該電文は正しいとして列車制御に用いられる。 (2) When one slave system becomes abnormal during triple system operation (for example, when 2 system becomes abnormal)
(A) When the system diagnosis is performed in each system, the ground device 1 determines that the normal system 1 and system 3 are “system 1 normal, system 2 abnormal, system 3 normal”. Since system 2 is abnormal, it can be judged as “abnormal” or “normal” for the entire system. The determination results are shown in Table 2.

(B) When the on-board device 5 receives the ATC telegram in which the whole system health judgment result of each system is added to the train control data, the on-board device 5 collates the whole system health judgment result of each system that is a ground device. When collation is performed in the majority process, the soundness determination results for the entire system are the same in at least two systems (1 system and 3 system), and therefore the soundness results for the 1 system and 3 systems are adopted. Subsequently, soundness results for the main system (system 1) of system 1 and system 3 are acquired. This health result is “normal”. Therefore, the said message is used for train control as correct.

（ｂ）車上装置５は、列車制御データに各系の全系健全性判定結果が付加されたＡＴＣ電文を受信したとき、地上装置である各系の全系健全性判定結果を照合する。多数決処理で照合が行われると、全系健全性判定結果が不一致となるので、地上装置全系が異常であると判断し、当該電文は不正として破棄される。 (3) When two or more systems become abnormal during triple system operation (when all systems become abnormal)
(A) When the ground device 1 performs system diagnosis in each system, abnormal systems 1 to 3 do not give a significant diagnosis result for each system. Since the entire system is abnormal, any determination of “abnormal” or “normal” can be made for the entire system. The determination results are shown in Table 3.

(B) When the on-board device 5 receives the ATC telegram in which the whole system health judgment result of each system is added to the train control data, the on-board device 5 collates the whole system health judgment result of each system that is a ground device. When collation is performed in the majority process, the whole system soundness determination result is inconsistent. Therefore, it is determined that the entire ground system is abnormal, and the message is discarded as illegal.

It is a figure which shows the apparatus structure of one Example of the fail safe control system by this invention. It is a flowchart which shows the flow of a process of each apparatus of one Example of the fail safe control system by this invention. It is a block diagram of the control message | telegram used in one Example of the fail safe control system by this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Logic part, 2A, 2B, 2C ... Each system computer, 3 ... Communication path for data exchange between systems, 4 ... Data communication path between ground apparatus-onboard apparatus, 5 ... Onboard apparatus, 6 ... IF apparatus, 7 ... Reception controller

Claims (5)

A multi-system computer composed of a plurality of computers executing the same processing calculation for the same processing target and outputting the processing calculation result, and receiving the input of the processing calculation result, the processing target based on the processing calculation result And a control device for controlling
Each of the computers of the multi-system computer exchanges and verifies the processing calculation result of the own system and the processing calculation result of the other system, and with respect to the computer of the own system and the other system based on the matching result Make a soundness judgment to create a wholeness soundness judgment result,
The multi-system computer outputs the whole system soundness determination result together with the processing calculation result,
The control device is a fail-safe control system comprising a majority process of the whole system soundness determination result received and determining whether or not the processing calculation result can be used. In the fail safe control system according to claim 1,
The control object is a train traveling on a track,
The multisystem computer is deployed as a ground device,
The control device is mounted on the train,
A fail-safe control method in which the processing calculation result is train control data for controlling the operation of the train. In the fail safe control system according to claim 1,
Each computer of the multisystem computer is
Train control data creating means for receiving the input of train detection information including the current position of the train and interlocking information including a track on which the train should travel, and creating the train control data as the processing calculation result,
A diagnostic result creating means for creating a diagnostic result of the computer of each system by collating the train control data exchanged from the computer of another system together;
Whole system health judgment result creating means for creating a whole system health judgment result by combining the diagnosis results of each system, and exchanging the train control data and the whole system health judgment result with the other system computer Fail-safe control system consisting of input / output means. In the fail safe control system according to claim 1,
The computer that is the main system among the multi-system computer outputs the overall system health judgment result created by the local computer and the other system computer together with the processing calculation result,
The control device compares normal / abnormal determination results for the own system and other systems performed by the computers of the multi-system computer and normal / abnormal determination for the main computer performed by the computers of the multi-system computer. A fail-safe control system comprising a computer for controlling availability of the processing calculation result by majority processing of results. A multi-system computer composed of a plurality of computers that execute the same processing calculation for the same processing target outputs the processing calculation result, and the control device that receives the output of the processing calculation result is based on the processing calculation result To control the processing target,
Each of the computers of the multi-system computer exchanges and verifies the processing calculation result of the own system and the processing calculation result of the other system, and with respect to the computer of the own system and the other system based on the matching result Make a soundness judgment to create a wholeness soundness judgment result,
The multi-system computer outputs the whole system soundness determination result together with the processing calculation result,
The control device is a fail-safe control method comprising a majority process of the soundness determination result of the whole system that has received an input and determining whether or not the processing calculation result can be used.

Images