JP2018030541A - Interlocking device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an interlocking device having a small installation area and a reduced cost, while maintaining redundancy for securing safety in a railway.SOLUTION: An interlocking device controls field devices constituting a route of a train based on an interlocking logical program. A first control part includes a plurality of logical operation parts for executing a first interlocking logical program. A second control part includes a plurality of logical operation parts for executing a second interlocking logical program. A third control part has both of the first interlocking logical program and the second interlocking logical program and includes a plurality of logical operation parts capable of executing any one of the first interlocking logical program and the second interlocking logical program. When abnormality occurs in the first control part or the second control part, the plurality of logical operation parts of the third control part executes the first interlocking logical program or the second interlocking logical program in lieu of the first control part or the second control part in which the abnormality occurs.SELECTED DRAWING: Figure 1

Description

  Embodiments according to the present invention relate to an interlocking device.

  The interlocking device controls on-site devices such as traffic lights and turnouts at the station according to the interlocking table, and determines the course of the train while ensuring safety in the railway. When the interlocking device breaks down, the operation of the train is greatly affected. Therefore, the system of the interlocking device is usually made redundant. For example, the system of the interlocking device is configured as a parallel dual system, and switches to the second system when an abnormality occurs in the first system. Thereafter, the system of the interlocking device controls the field device using the second system.

  However, when a plurality of interlocking devices are arranged at one station, each of the plurality of interlocking devices is composed of a plurality of systems, so that there is a problem that the installation area of the interlocking device increases and the cost also increases. .

Japanese Patent No. 3208060 Japanese Patent No. 4845918

  Provided is an interlocking device having a small installation area and low cost while maintaining redundancy in order to ensure safety in railways.

  The interlocking device according to the present embodiment controls the field devices constituting the course of the train based on the interlocking logic program. The first control unit includes a plurality of logic operation units that execute the first interlocking logic program. The second control unit includes a plurality of logic operation units that execute the second interlocking logic program. The third control unit includes both a first linked logic program and a second linked logic program, and includes a plurality of logic operation units capable of executing either the first linked logic program or the second linked logic program. When an abnormality occurs in the first control unit or the second control unit, the plurality of logic operation units of the third control unit perform the first or second in place of the first control unit or the second control unit in which the abnormality has occurred. Execute the linked logic program.

The figure which shows the structural example of the interlocking apparatus 1, the site apparatus 2, and the monitoring part 3 by 1st Embodiment. The figure which shows the structural example of the 1st-3rd control logic part 11-13. The flowchart which shows the operation example of the interlocking device 1 by 1st Embodiment. The figure which shows the structural example of the interlocking apparatus 1, the site apparatus 2, and the monitoring part 3 by 2nd Embodiment. The flowchart which shows the operation example of the interlocking device 1 by 2nd Embodiment. The figure which shows the structural example of the interlocking apparatus 1, the site apparatus 2, and the monitoring part 3 by 4th Embodiment. The flowchart which shows the operation example of the interlocking device 1 by 4th Embodiment. The figure which shows the structural example of the interlocking apparatus 1, the site apparatus 2, and the monitoring part 3 by 5th Embodiment. The flowchart which shows the operation example of the interlocking device 1 by 5th Embodiment. The flowchart which shows the operation example of the interlocking device 1 by 6th Embodiment.

  Embodiments according to the present invention will be described below with reference to the drawings. This embodiment does not limit the present invention.

(First embodiment)
FIG. 1 is a diagram illustrating a configuration example of the interlocking device 1, the field device 2, and the monitoring unit 3 according to the first embodiment.

  The interlocking device 1 is a device that determines the course of a train by associating and controlling field devices 2 such as traffic lights and turnouts in accordance with an interlocking logic program at a railway station or the like. The interlocking device 1 includes a first control logic unit 11, a second control logic unit 12, and a third control logic unit 13. The first control logic unit 11 and the second control logic unit 12 have first and second interlocking logic programs different from each other. The interlocking logic program is a program that indicates the interlocking logic (interlocking relation) of field devices in a predetermined range (for example, for each station), and corresponds to a so-called interlocking chart. The 1st and 2nd control logic parts 11 and 12 control field device 2 according to the 1st and 2nd interlocking logic program, respectively according to the operation schedule of a train, the actual operation situation of a train, etc. The third control logic unit 13 stores both the first and second interlocking logic programs, and when an abnormality occurs in one of the first or second control logic units 11 and 12, the control in which an abnormality has occurred A linked logic program is executed on behalf of the logic section. That is, the third control logic unit 13 is provided as a common backup for the first and second control logic units 11 and 12, and is parallel to the first and second control logic units 11 and 12, respectively. A dual system is configured. The configuration of the first to third control logic units 11 to 13 will be described later.

  The field device 2 is, for example, a device such as a traffic light and a branching unit (turning machine) that are arranged at a site such as a station and configure the course of a train. The field device 2 may include a control device that controls the traffic light and the branching device.

  The monitoring unit 3 monitors the interlocking device 1 and / or the field device 2 and enables an operator to transmit a command to the interlocking device 1 and / or the field device 2 as necessary. For example, the monitoring unit 3 includes a display unit 31 that displays the states of the first to third control logic units 11 to 13 and an input unit 32 that can input a command from an operator. When an abnormality occurs in one of the first or second control logic units 11 and 12, the operator refers to the display unit 31 and identifies the control logic unit (11 or 12) in which the abnormality has occurred. Further, the operator operates the input unit 32 to transmit a command for starting the third control logic unit 13 of the interlocking device 1. As a result, the third control logic unit 13 can execute the interlocking logic program in place of the control logic unit in which an abnormality has occurred. The display unit 31 may be a touch panel display, for example. In this case, the display unit 31 can also have the function of the input unit 32. The input unit 32 may be, for example, a keyboard, a mouse, a touch panel display, a switch, or the like.

  The interlocking device 1, the field device 2, and the monitoring unit 3 are connected to each other via a network 4 so that they can communicate with each other. The network 4 may be either wired or wireless, and may be a network such as a LAN (Local Area Network) or a WAN (Wide Area Network).

  FIG. 2 is a diagram illustrating a configuration example of the first to third control logic units 11 to 13. The first to third control logic units 11 to 13 have the same configuration in hardware, although different in software such as programs and data stored in the respective storage units 103. Therefore, here, the configuration of the first control logic unit 11 will be described, and the description of the configuration of the second and third control logic units 12 and 13 will be omitted.

  The first control logic unit 11 includes logic operation units PU1 and PU2, a transmission unit 101, an input / output unit 102, and a storage unit 103.

  The logical operation units PU1 and PU2 simultaneously execute the first interlocking logic program stored in the storage unit 103 and outputs a control signal for controlling the field device 2 from the input / output unit 102. At this time, the logical operation units PU1 and PU2 are doubly redundant, and independently perform the same logical operation. The logical operation units PU1 and PU2 may be the same arithmetic processing unit such as a CPU, for example. Therefore, when the logical operation units PU1 and PU2 are operating normally, the logical operation units PU1 and PU2 output the same control signal (the same logic) by simultaneously executing the first interlocking logic program. . However, when an abnormality has occurred in the logical operation units PU1 and PU2, the logical operation units PU1 and PU2 output different control signals (different logics) even when the first interlocking logic program is executed in parallel. To do. As a result, the first control logic unit 11 can make a self-diagnosis.

  For example, the operation results of the logic operation unit PU1 and the logic operation unit PU2 are stored in a dual port memory provided in the storage unit 103, and the logic operation units PU1 and PU2 collate each other's operation results. When these calculation results match, the logical operation units PU1 and PU2 determine that the own device is operating normally. When these calculation results do not match, the logical operation units PU1 and PU2 determine that an abnormality has occurred in the own device. In this way, the logical operation units PU1 and PU2 detect the presence or absence of an abnormality in the first control logic unit 11 based on the comparison of the respective operation results. That is, the logical operation units PU1 and PU2 have a self-diagnosis function. When the abnormality of the own device is detected, the logical operation units PU1 and PU2 stop the control operation. Therefore, the logic operation units PU1 and PU2 are redundantly configured to be fail-safe.

  The transmission unit 101 controls transmission / reception of data, and for example, performs transmission processing of a control signal via the network 4.

  The input / output unit 102 is an I / O interface that enables communication connection between the first control logic unit 11 and an external device. For example, the input / output unit 102 outputs control signals from the logic operation units PU1 and PU2 to the field device 2. The input / output unit 102 enables transmission of control information to other control logic units.

  The storage unit 103 stores various programs, data, interlocking logic programs, and the like that control the components of the first control logic unit 11. For example, the storage unit 103 of the first control logic unit 11 stores a first interlocking logic program. The logical operation units PU1 and PU2 read the first interlocking logic program from the storage unit 103 and execute it. Thereby, the 1st control logic part 11 controls the signal apparatus, branching device, etc. corresponding to the 1st control logic part 11 among the field devices 2. At this time, as described above, the logical operation units PU1 and PU2 periodically execute the self-diagnosis function.

  The second and third control logic units 12 and 13 have the same configuration and function as the first control logic unit 11. However, the storage unit 103 of the second control logic unit 12 stores a second interlocking logic program. The logic operation units PU1 and PU2 of the second control logic unit 12 read the second interlocking logic program from the storage unit 103 and execute the second interlocking logic program in parallel. Thereby, the 2nd control logic part 11 controls the signal apparatus, branching device, etc. corresponding to the 2nd control logic part 12 among the field devices 2. At this time, also in the second control logic unit 12, the logic operation units PU1 and PU2 execute a self-diagnosis function.

  Further, the storage unit 103 of the third control logic unit 13 stores both the first and second interlocking logic programs. The logic operation units PU1 and PU2 of the third control logic unit 13 can execute either the first interlocking logic program or the second interlocking logic program. In the present embodiment, the logical operation units PU1 and PU2 of the third control logic unit 13 are in a standby state when the first and second control logic units 11 and 12 are operating normally. When an abnormality occurs in the first and second control logic units 11 and 12, the logic operation units PU1 and PU2 of the third control logic unit 13 replace the control logic unit 11 (or 12) in which the abnormality occurs, One interlocking logic program (or second interlocking logic program) is executed in parallel. When the third control logic unit 13 executes the first or second interlocking logic program, the logic operation units PU1 and PU2 of the third control logic unit 13 also execute the self-diagnosis function. Even if the third control logic unit 13 is in a standby state, the logic operation units PU1 and PU2 of the third control logic unit 13 execute a self-diagnosis function to confirm that the own device is normal. It's okay. In this case, the third control logic unit 13 may execute one or both of the first and second interlocking logic programs.

  FIG. 3 is a flowchart showing an operation example of the interlocking device 1 according to the first embodiment. Hereinafter, a case where an abnormality has occurred in the first control logic unit 11 will be described. The operation when an abnormality occurs in the second control logic unit 12 can be easily inferred from the operation when an abnormality occurs in the first control logic unit 11, and the description thereof is omitted.

  First, when the first and second control logic units 11 and 12 are operating normally (NO in S10), the first and second control logic units 11 and 12 execute the first and second interlocking logic programs, respectively. This is executed, and the traffic lights and branching devices corresponding to each are controlled (S20). At this time, in the self-diagnosis function, the first and second control logic units 11 and 12 determine that the operation results of the logic operation units PU1 and PU2 are the same, and that the own device is normal. In the self-diagnosis function, it may be determined that not only the calculation results match but the calculation conditions including the input match.

  In addition, when there is no abnormality in the first and second control logic units 11 and 12, and each is operating normally, the first and second control logic units 11 and 12 are the first normal signal and the second normal signal, respectively. A signal is periodically transmitted to the monitoring unit 3 via the network 4 (S30). The monitoring unit 3 receives the first and second normal signals and causes the display unit 31 to display the states of the first and second control logic units 11 and 12. As a result, the operator can recognize that the first and second control logic units 11 and 12 are operating normally.

  When an abnormality occurs in the first control logic unit 11 (YES in S10), the first control logic unit 11 stops the first interlocking logic program (S40). At this time, the first control logic unit 11 also stops outputting the first normal signal. The monitoring unit 3 displays on the display unit 31 that an abnormality has occurred in the first control logic unit 11 when the first normal signal has not been received for a predetermined period. Accordingly, the operator can recognize that an abnormality has occurred in the first control logic unit 11.

  Next, the operator inputs a command to execute the first interlocking logic program in the third control logic unit 13 to the monitoring unit 3, and the monitoring unit 3 transmits the command to the third control logic unit 13 of the interlocking device 1. (S50). The third control logic unit 13 executes the first interlocking logic program based on the command from the monitoring unit 3 (S60). At this time, the third control logic unit 13 executes the first interlocking logic program in place of the first control logic unit 11 and further executes a self-diagnosis function.

  Similarly, when an abnormality occurs in the second control logic unit 12, the second control logic unit 12 stops the second interlocking logic program. Then, the third control logic unit 13 executes the second interlocking logic program in place of the second control logic unit 12.

  As described above, the interlocking device 1 according to the present embodiment includes the third control logic unit 13 having both the first and second interlocking logic programs. When an abnormality occurs in the first or second control logic unit 11, 12, the third control logic unit 13 replaces the control logic unit (11 or 12) in which the abnormality has occurred with the first or second interlocking logic program. Execute. As a result, the third control logic unit 13 can configure a parallel duplex system for both the first and second control logic units 11 and 12.

  If each of the first and second control logic units attempts to form a parallel duplex system, a third control logic unit for the first control logic unit and a third control logic unit for the second control logic unit are required. It becomes. That is, four control logic units are required. In this case, the installation area of the whole interlocking device is increased and the cost is also increased.

  On the other hand, in the interlocking device 1 according to the present embodiment, the third control logic unit 13 has both the first and second interlocking logic programs, and is shared by both the first and second control logic units 11 and 12. Yes. Therefore, if any of the first or second control logic units 11 and 12 fails, the third control logic unit 13 can execute the interlocking logic program in place of the failed control logic unit. That is, the interlocking device 1 according to the present embodiment suffices with almost three control logic units. Thereby, this embodiment can make the installation area of the whole interlocking | linkage apparatus 1 small, and can also reduce cost, maintaining redundancy in order to ensure the safety | security in a railway.

(Second Embodiment)
FIG. 4 is a diagram illustrating a configuration example of the interlocking device 1, the field device 2, and the monitoring unit 3 according to the second embodiment. In the second embodiment, in the interlocking device 1, the first and second control logic units 11 and 12 are directly connected to the third control logic unit 13, and the first and second normal signals are sent to the third control logic unit 13. Can be sent to. In the second embodiment, the third control logic unit 13 detects an abnormality in the first and second control logic units 11 and 12 and autonomously starts the interlocking logic program. Therefore, in the second embodiment, the monitoring unit 3 is not necessarily provided. Other configurations of the interlocking device 1 of the second embodiment may be the same as the corresponding configurations of the interlocking device 1 of the first embodiment.

  FIG. 5 is a flowchart showing an operation example of the interlocking device 1 according to the second embodiment. Hereinafter, similarly to the description of FIG. 3, a case where an abnormality occurs in the first control logic unit 11 will be described.

  First, as in the first embodiment, when the first and second control logic units 11 and 12 are operating normally (NO in S10), the first and second control logic units 11 and 12 The 1st and 2nd interlocking logic programs are executed, and the traffic lights, branching devices, etc. corresponding to each are controlled (S20).

  In addition, when the first and second control logic units 11 and 12 are operating normally, the first and second control logic units 11 and 12 receive the first normal signal and the second normal signal (alternating signal), respectively. The data is periodically transmitted to the third control logic unit 13 (S31). As a result, the third control logic unit 13 can recognize that the first and second control logic units 11 and 12 are operating normally by receiving the first and second normal signals. In this case, the third control logic unit 13 maintains the standby state. Thus, in the second embodiment, the third control logic unit 13 can monitor the states of the first and second control logic units 11 and 12. The first and second control logic units 11 and 12 may also transmit the first normal signal and the second normal signal to the monitoring unit 3, respectively. In this case, the monitoring unit 3 receives the first and second normal signals and causes the display unit 31 to display the states of the first and second control logic units 11 and 12.

  When an abnormality occurs in the first control logic unit 11 (YES in S10), the first control logic unit 11 stops the first interlocking logic program (S40). At this time, the first control logic unit 11 also stops outputting the first normal signal. The third control logic unit 13 executes the first interlocking logic program when the first normal signal is not received for a predetermined period (S51). The monitoring unit 3 may display on the display unit 31 that an abnormality has occurred in the first control logic unit 11.

  Thus, according to the second embodiment, when the third control logic unit 13 monitors the first and second control logic units 11 and 12 and does not receive the first or second normal signal for a predetermined period. The first or second interlocking logic program is automatically executed. Thereby, after a short time (with a small time lag) after the first or second control logic unit 11 or 12 stops, the third control logic unit 13 can execute the first or second interlocking logic program. it can. Further, since it is not necessary for the operator to determine the operation switching, the burden on the operator is reduced. The second embodiment can further obtain the effects of the first embodiment.

(Third embodiment)
In the second embodiment, the first and second control logic units 11 and 12 transmit normal signals to the third control logic unit 13 but do not transmit other status signals or the like. That is, the third control logic unit 13 can recognize whether the first and second control logic units 11 and 12 are normal or abnormal, but cannot recognize the state of the field device 2 or the like. .

  On the other hand, in the third embodiment, the first and second control logic units 11 and 12 periodically send a status signal indicating the state of the train (not shown) and the field device 2 to the third control logic unit 13, respectively. Send to. The status signal includes, for example, information on the train operation status and the chain status (route status) of the field device 2.

  The 3rd control logic part 13 receives such a status signal periodically, and makes the 1st or 2nd interlocking logic program executable according to the state of a train and field device 2. As a result, the third control logic unit 13 takes over the first or second control logic unit 11 or 12 immediately after the first or second control logic unit 11 or 12 stops, and continues to the first or second control logic unit 11 or 12. A linked logic program can be executed. That is, the third control logic unit 13 of the third embodiment can continue without stopping the operation of the interlocking device 1.

  Thus, the third control logic unit 13 can execute the first or second interlocking logic program with almost no time lag after the first or second control logic unit 11 or 12 is stopped. Further, the third embodiment can further obtain the effects of the second embodiment.

  In addition, the structure of the interlocking device 1 of 3rd Embodiment may be the same as the structure shown in FIG. However, the first and second control logic units 11 and 12 and the third control logic unit 13 are connected by a transmission path capable of transmitting a state signal having a larger data amount than the normal signal. Further, the operation of the interlocking device 1 of the third embodiment may be performed by replacing the normal signal with the status signal in the flowchart shown in FIG.

(Fourth embodiment)
FIG. 6 is a diagram illustrating a configuration example of the interlocking device 1, the field device 2, and the monitoring unit 3 according to the fourth embodiment. In the fourth embodiment, in the interlocking device 1, the first and second control logic units 11 and 12 each have both the first and second interlocking logic programs as in the third control logic unit 13. Other configurations of the fourth embodiment may be the same as the corresponding configurations of the first embodiment.

  FIG. 7 is a flowchart showing an operation example of the interlocking device 1 according to the fourth embodiment.

  First, in normal operation, the first control logic unit 11 executes the first interlocking logic program and the second control logic unit 12 executes the second interlocking logic program as in steps S10 to S30 of the first embodiment. ing. The third control logic unit 13 is in a standby state.

  On the other hand, for example, when an abnormality occurs in the first control logic unit 11 (S10 YES), the third control logic unit 13 replaces the first control logic unit 11 with the first interlocking logic program as in steps S40 to S60. Execute.

  Next, the first control logic unit 11 is replaced or repaired and restored to a normal state (S70). After the replacement or repair, the first control logic unit 11 acquires (downloads) the first and second interlocking logic programs from the second and third control logic units 12 and 13 (S80). Here, both the second and third control logic units 12 and 13 have first and second interlocking logic programs. Accordingly, after replacement or repair, the first control logic unit 11 acquires the first and second interlocking logic programs from the second and third control logic units 12 and 13, respectively. After the replacement or repair, the first control logic unit 11 compares the first and second interlocking logic programs of the second control logic unit 12 with the first and second interlocking logic programs of the third control logic unit 13, and Are equal (YES in S90), the first and second interlocking logic programs are held (S100). Then, the first control logic unit 11 monitors the second and third control logic units 12 and 13 as a standby system. That is, the first control logic unit 11 after replacement or repair serves as the third control logic unit 13 before the failure of the first control logic unit 11.

  If the first and second interlocking logic programs of the second control logic unit 12 and the first and second interlocking logic programs of the third control logic unit 13 are different (NO in S90), the first control logic unit 11 The first and second interlocking logic programs are acquired (downloaded) from the outside of the monitoring unit 3 or the like via the network 4 (S110).

  When an abnormality occurs in the second control logic unit 12, the second control logic unit 12 after replacement or repair acquires the first and second interlocking logic programs from the first and third control logic units 12 and 13. To do. In this case, the second control logic unit 12 after replacement or repair monitors the first and third control logic units 13 as a standby system.

  Thus, the restored control logic unit obtains the first and second interlocking logic programs from the other two normal control logic units. As a result, it is not necessary to download the first and second interlocking logic programs from the outside, and the recovery time of the failed control logic unit is shortened.

  Further, the restored control logic unit directly backs up the other two normal control logic units as a standby system. This function has any of the first to third control logic units 11 to 13. Therefore, as long as two or more control logic units do not fail simultaneously, the interlocking device 1 can continue to operate.

  Further, the restored control logic unit holds the first and second interlocking logic programs when the first and second interlocking logic programs from the other two normal control logic units are collated and equal. As a result, the restored control logic unit can obtain accurate first and second interlocking logic programs. The fourth embodiment can also obtain the same effects as those of the first embodiment.

  The fourth embodiment may be combined with the second embodiment. In this case, if the third control logic unit 13 does not receive a normal signal for a predetermined period, the third control logic unit 13 automatically executes the first or second interlocking logic program in place of the control logic unit 11 or 12 in which an abnormality has occurred. Good.

(Fifth embodiment)
FIG. 8 is a diagram illustrating a configuration example of the interlocking device 1, the field device 2, and the monitoring unit 3 according to the fifth embodiment. In the fifth embodiment, in the interlocking device 1, the first to third control logic units 11 to 13 have first to third interlocking logic programs, respectively. The third interlocking logic program is a program having a lower priority than the first and second interlocking logic programs, and its influence when the execution is stopped is relatively small. For example, when the first and second linked logic programs are programs for main routes with many users and the third linked logic program is a program for local lines with few users, the third linked logic programs are The priority is lower than that of the second interlocking logic program.

  In normal operation, when the first and second control logic units 11 and 12 are executing the first and second interlocking logic programs, respectively, the third control logic unit 13 executes the third interlocking logic program.

  When an abnormality occurs in the first or second control logic unit 11, 12, the third control logic unit 13 stops the third interlocking logic program, and the first or second control logic unit 11 in which an abnormality has occurred, In place of 12, the first or second interlocking logic program is executed.

  Other configurations of the fifth embodiment may be the same as the corresponding configurations of the fourth embodiment.

  FIG. 9 is a flowchart showing an operation example of the interlocking device 1 according to the fifth embodiment.

  First, in normal operation, the first control logic unit 11 executes the first interlocking logic program, the second control logic unit 12 executes the second interlocking logic program, and the third control logic unit 13 is the third interlocking logic program. (S22).

  On the other hand, for example, when an abnormality has occurred in the first control logic unit 11 (YES in S10), the first control logic unit 11 stops the first interlocking logic program and the third control logic as in steps S40 to S50. The unit 13 receives a command from the monitoring unit 3.

  Next, the third control logic unit 13 stops the execution of the third interlocking logic program and executes the first interlocking logic program in place of the first control logic unit 11 (S62).

  Thus, in the normal state, the third control logic unit 13 may execute the third interlocking logic program without entering the standby state. Thereby, it is possible to effectively use the function of the third control logic unit 13 as a standby system without wasting it. On the other hand, when an abnormality occurs in the first or second control logic unit 11 or 12, the third control logic unit 13 stops the third interlocking logic program, and the control logic unit 11 or 12 in which the abnormality has occurred is stopped. Instead, the first or second interlocking logic program is executed. As a result, the third control logic unit 13 can also function as a backup for the first and second control logic units 11 and 12.

  Other operations in the fifth embodiment may be the same as those in the first embodiment. The fifth embodiment may be combined with the second embodiment. In this case, if the normal control signal is not received for a predetermined period, the third control logic unit 13 automatically stops the third interlocking logic program, and the first or second control logic unit 13 replaces the control logic unit 11 or 12 in which an abnormality has occurred. The two-linked logic program may be automatically executed.

(Sixth embodiment)
The sixth embodiment is a combination of the fifth embodiment and the fourth embodiment. The configuration of the interlocking device 1 according to the sixth embodiment may be the same as that of the fifth embodiment.

  FIG. 10 is a flowchart showing an operation example of the interlocking device 1 according to the sixth embodiment.

  First, in normal operation, as in steps S10, S22, and S30 of the fifth embodiment, the first control logic unit 11 executes the first interlocking logic program, and the second control logic unit 12 executes the second interlocking logic program. The third control logic unit 13 executes the third interlocking logic program.

  On the other hand, for example, when an abnormality occurs in the first control logic unit 11 (S10 YES), the third control logic unit 13 stops the execution of the third interlocking logic program as in steps S40 to S62 in FIG. The first interlocking logic program is executed in place of the first control logic unit 11.

  Next, the first control logic unit 11 is replaced or repaired and restored to a normal state (S70). The first control logic unit 11 after replacement or repair acquires (downloads) the first to third interlocking logic programs from the second and third control logic units 12 and 13 (S83). Here, both the second and third control logic units 12 and 13 have first to third interlocking logic programs. Therefore, the first control logic unit 11 after replacement or repair acquires the first to third interlocking logic programs from the second and third control logic units 12 and 13 respectively. The first control logic unit 11 after replacement or repair collates the first to third interlocking logic programs of the second control logic unit 12 with the first to third interlocking logic programs of the third control logic unit 13, and Are equal (YES in S93), the first to third interlocking logic programs are held (S103). Then, the first control logic unit 11 executes the third interlocking logic program while monitoring the second and third control logic units 12 and 13 as a standby system (S113). That is, the first control logic unit 11 after replacement or repair serves as the third control logic unit 13 before the failure of the first control logic unit 11.

  If the first to third interlocking logic programs of the second control logic unit 12 and the first to third interlocking logic programs of the third control logic unit 13 are different (NO in S93), the first control logic unit 11 is The first to third interlocking logic programs are acquired (downloaded) from the outside of the monitoring unit 3 or the like via the network 4 (S123).

  When an abnormality occurs in the second control logic unit 12, the second control logic unit 12 after replacement or repair acquires the first to third linked logic programs from the first and third control logic units 11 and 13. To do. In this case, the second control logic unit 12 after replacement or repair executes the third interlocking logic program while monitoring the first and third control logic units 11 and 13 as a standby system.

  As in the sixth embodiment, the fourth and fifth embodiments may be combined. Thereby, 6th Embodiment can acquire the effect of both 4th and 5th Embodiment.

  Furthermore, the sixth embodiment may be combined with the second embodiment. In this case, the third control logic unit 13 automatically stops the third interlocking logic program when a normal signal is not received for a predetermined period, and replaces the first or second control logic unit 11 or 12 in which an abnormality has occurred. The first or second interlocking logic program is automatically executed.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and gist of the invention, and are also included in the invention described in the claims and the equivalents thereof.

DESCRIPTION OF SYMBOLS 1 ... Interlock apparatus, 11 ... 1st control logic part, 12 ... 2nd control logic part, 13 ... 3rd control logic part, 11 ... 1st control logic part, PU1, PU2 ... Logic operation unit, 101 ... Transmission unit, 102 ... Input / output unit, 103 ... Storage unit

Claims (8)

It is an interlocking device that controls the field devices that make up the course of the train based on the interlocking logic program,
A first control unit including a plurality of logical operation units for executing the first interlocking logic program;
A second control unit including a plurality of logical operation units for executing the second interlocking logic program;
Third control including a plurality of logical operation units having both the first interlocking logic program and the second interlocking logic program and capable of executing either the first interlocking logic program or the second interlocking logic program With
When an abnormality occurs in the first control unit or the second control unit, the plurality of logical operation units of the third control unit replace the first control unit or the second control unit in which the abnormality has occurred. The interlocking device that executes the first or second interlocking logic program. The first control unit detects presence / absence of an abnormality of the first control unit based on collation of each calculation result of the plurality of logical operation units of the first control unit,
2. The interlocking device according to claim 1, wherein the second control unit detects presence / absence of an abnormality in the second control unit based on collation of calculation results of a plurality of logical operation units of the second control unit.   3. The third control unit according to claim 1, wherein the third control unit executes the first or second interlocking logic program based on an instruction from a monitoring unit that monitors the first or second control unit. 4. Interlocking device. The first and second control units periodically transmit a first normal signal and a second normal signal to the third control unit, respectively, when there is no abnormality,
The third control unit executes the first interlock logic program when the first normal signal is not received for a predetermined period, and executes the second interlock logic when the second normal signal is not received for a predetermined period. The interlocking device according to any one of claims 1 to 3, which executes a program.   The said 3rd control part detects the presence or absence of abnormality of this 3rd control part based on collation of each calculation result of the several logic operation part of this 3rd control part, The any of Claim 1 to 4 The interlocking device according to claim 1. The first and second control units periodically transmit status signals indicating the status of the train and the field device to the third control unit, respectively.
6. The system according to claim 1, wherein the third control unit receives the status signal and enables the first or second interlocking logic program to be executed in accordance with the status of the train and the field device. The interlocking device according to claim 1. The first and second control units have the first and second interlocking logic programs, respectively.
When an abnormality occurs in the first control unit, the plurality of logic operation units of the third control unit execute the first interlocking logic program in place of the first control unit,
The interlocking device according to any one of claims 1 to 6, wherein the first control unit after replacement or repair acquires the first and second interlocking logic programs from the second and third control units. . The third control unit further includes the third interlocking logic program,
When the first and second control units are executing the first and second interlocking logic programs, respectively, the third control unit executes the third interlocking logic program,
When an abnormality occurs in the first control unit or the second control unit, the third control unit stops the third interlocking logic program and the first control unit or the second control in which an abnormality has occurred. The interlocking device according to any one of claims 1 to 7, wherein the first or second interlocking logic program is executed instead of a unit.

Images