JP2020144575A - Railway control system - Google Patents

Abstract

To provide a railway control system capable of controlling train services without fail by avoiding system failures to occur.SOLUTION: A railway control system 100 comprises an electronic interlocked device 10 for controlling train services by interlockingly controlling on-site devices 30 and the like over a communication network 1. The electronic interlocked device constitutes a multiplex system by a plurality of processing units 11-1, 11-2 disposed at different stations. The plurality of processing units 11-1, 11-2 retain mutual information transmitted to/received from over the communication network 1, and each of which performs normality determination based on the retained information, for deciding whether or not the processing unit itself operates as a main system or as a sub-system.SELECTED DRAWING: Figure 1

Description

The present invention relates to a multiplex railway control system that controls train operation via a communication network.

For example, an electronic interlocking device is known as one of the railway control systems that control the operation of trains. The electronic interlocking device controls on-site devices such as traffic lights and turning machines according to the interlocking chart data to ensure the safety of train operation. If a failure occurs in such an electronic interlocking device, the train cannot operate. Therefore, the electronic interlocking device is usually a multiplex system.

For example, Patent Document 1 discloses an electronic interlocking device that is composed of a dual system of a used system and a standby system, operates both systems at all times, and switches to a standby system when the used system fails. This dual system electronic interlocking device has a common part having a relay connection type logic circuit that receives the operating state of both systems and switches the system, and the used system and the standby system are metal through this common part. It is connected by a line.

Japanese Patent No. 32008060

With regard to the conventional electronic interlocking device as described above, it has been difficult to install the use system and the standby system constituting the dual system at a distance (for example, different stations). That is, if both systems are to be installed at different stations or the like, the total length of the metal line connecting the used system and the standby system and the common portion becomes long. Since the signal transmitted through such a long metal line is easily affected by external noise, there is a possibility that a malfunction may occur in system switching. For this reason, in the conventional electronic interlocking device, it is necessary to install the usage system, the standby system, and the common part in the equipment room of the same station.

When the used system, the standby system, and the common part are installed in the same equipment room in this way, if this equipment room is hit by a disaster such as a fire or flood, the problem is that the interlocking control system including the electronic interlocking device cannot be maintained. was there. In addition, in the case of an centralized or centralized interlocking control system that collectively processes interlocking logic related to multiple stations by an electronic interlocking device integrated at one base station, the impact of system failure due to a disaster may occur. There is a possibility that it may cover the entire line section, and it is required to realize a system configuration that can avoid such a situation.

It should be noted that such a problem is not limited to the interlocking control system including the electronic interlocking device, but is a problem common to various railway control systems that adopt a multiplex system in order to ensure the safety of train operation. ..

The present invention has been made by paying attention to the above points, and an object of the present invention is to provide a multiple-system railway control system capable of reliably performing train operation control while avoiding the occurrence of system failures.

In order to achieve the above object, one aspect of the railway control system according to the present invention has a plurality of processing units capable of controlling train operation via a communication network, and the plurality of processing units are the communication network. Each of them holds each other's information transmitted and received via the above, and each makes a normal judgment based on the held information, and decides whether it operates in the main system or the slave system.

According to the above-mentioned railway control system, each of the plurality of processing units constituting the multiplex system independently makes its own normal judgment and master-slave determination, so that the common part of the conventional relay connection method becomes unnecessary. As a result, each processing unit can be installed at a distance. As a result, even if one of the plurality of processing units cannot operate due to a disaster, the other processing units located away from the processing unit can operate as the main system, and a system failure due to a disaster can occur. It is possible to avoid it and reliably control the operation of the train.

It is a block diagram which shows the schematic structure of the railroad control system which concerns on one Embodiment of this invention. It is a block diagram which shows an example of the hardware composition of the processing part in the said embodiment. It is a functional block diagram of the processing part in the said embodiment. It is a figure which shows an example of the format of the control signal in the said embodiment. It is the schematic which exemplifies another method alternative to the synchronization signal in the said embodiment. It is a flowchart which shows an example of the processing operation at the time of starting up an electronic interlocking apparatus in the said embodiment. It is a flowchart which shows an example of the process for the slave operation. It is a flowchart which shows an example of the processing at the time of operation of the electronic interlocking device in the said embodiment. It is a figure for demonstrating the master-slave switching operation when a communication path failure occurs in the main system processing part in the said embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.
FIG. 1 is a block diagram showing a schematic configuration of a railway control system according to an embodiment of the present invention.
In FIG. 1, the railway control system 100 of the present embodiment is connected to an electronic interlocking device 10 having a plurality of (here, two) processing units 11-1 and 11-2 connected to the communication network 1 and the communication network 1. It includes a plurality of (n in this case) electronic devices 20-1, 20-2, ..., 20-n connected, and a field device 30 connected to the electronic device 20-1.

The electronic interlocking device 10 controls the train operation by interlocking and controlling the electronic devices 20-1 to 20-n and the field device 30 via the communication network 1. The electronic interlocking device 10 has a dual system composed of processing units 11-1 and 11-2 having the same configuration, and the processing units 11-1 and 11-2 are arranged at different stations. .. Specifically, the processing unit 11-1 is installed in the equipment room of station A, and the processing unit 11-2 is installed in the equipment room of station B, which is far from the station A.

When the electronic interlocking device 10 is in operation, one of the processing units 11-1 and 11-2 operates in the main system, and the other processing unit operates in the slave system. The system used and the standby system in the conventional electronic interlocking device described above correspond to the main system and the slave system in the electronic interlocking device 10 of the present embodiment, respectively. The processing unit (main system processing unit) that operates as the main system is the synchronization signal Ss that serves as a reference for matching the processing timing in the interlocking control of the electronic devices 20-1 to 20-n and the field device 30, and the interlocking. A control signal Sc1 (or Sc2) for executing control is generated and transmitted to the communication network 1. On the other hand, the processing unit (subordinate processing unit) that operates as a slave system is a control for executing the interlocking control in synchronization with the synchronization signal Ss transmitted from the main system processing unit and received via the communication network 1. The signal Sc2 (or Sc1) is generated and transmitted to the communication network 1. The method of determining master-slave and the details of the synchronization signal Ss and the control signals Sc1 and Sc2 in the interlocking control will be described later.

The electronic devices 20-1 to 20-n are subject to interlocking control via the communication network 1 by the electronic interlocking device 10. Here, a plurality of field devices 30 are connected to the electronic device 20-1 among the electronic devices 20-1 to 20-n. The field equipment 30 is, for example, equipment such as a traffic light, a turning machine, a railroad crossing, and a track circuit. The electronic devices 20-1 to 20-n and the plurality of field devices 30 of the present embodiment correspond to the "device group" in the present invention.

The electronic device 20-1 controls the operation of each field device 30 according to the synchronization signal Ss and the control signals Sc1 and Sc2 received from the electronic interlocking device 10 via the communication network 1. Further, the electronic device 20-1 grasps the current state of each field device 30 under control, generates a state signal C1 indicating each state information, and generates a communication network at a predetermined cycle. Send to 1. Similarly to this, the other electronic devices 20-2 to 20-n are controlled in their respective operations according to the synchronization signal Ss and the control signals Sc1 and Sc2 from the electronic interlocking device 10, and the current state information of each is displayed. The indicated state signals C2 to Cn are transmitted to the communication network 1 at a predetermined cycle. Although an example in which the field device 30 is connected only to the electronic device 20-1 is shown here, a plurality of electronic devices to which the field device is connected may exist on the communication network 1.

The communication network 1 is a well-known communication means capable of bidirectionally transmitting information and signals between the processing units 11-1 and 11-2 of the electronic interlocking device 10 and the electronic devices 20-1 to 20-n. It is possible to use it. In the railway control system 100 of the present embodiment, for example, by multicast communication, each of the processing units 11-1 and 11-2 and the electronic devices 20-1 to 20-n can exchange data at any time. ..

FIG. 2 is a block diagram showing an example of the hardware configuration of the processing unit 11-1 of the electronic interlocking device 10. Since the processing unit 11-2 has the same hardware configuration as the processing unit 11-1, description thereof will be omitted.
In FIG. 2, the processing unit 11-1 includes a processor 41, a memory 42, a storage device 43, a communication device 44, and an input / output device 45.

The processor 41 incorporates a CPU (Central Processing Unit), a cache memory, and the like, and executes various programs stored in the storage device 43.
The memory 42 is, for example, a RAM (Random Access Memory) or the like, and a program executed by the processor 41 is loaded and data used for processing of the processor 41 is stored.

The storage device 43 is, for example, an HDD (Hard Disk Drive), a flash memory, or the like, and determines the master-slave determination program, the interlocking processing program, the interlocking chart data referred to during the interlocking processing, and the master-slave in the simultaneous startup state described later. Priority data to be referred to when doing this is stored. The master-slave determination program describes an algorithm for processing related to determination of the operation mode (main system or slave system) of its own processing unit at the time of startup and switching of the operation mode at the time of operation after startup. Further, in the interlocking processing program, an algorithm for realizing interlocking control corresponding to each operation mode of the main system and the slave system in cooperation with the processing of the master-slave determination program is described.

The communication device 44 transmits various signals generated by arithmetic processing in the processor 41 to the communication network 1, and also transmits the signals from the other processing units 11-2 and each electronic device 20-1 to 20-n to the communication network 1. It receives various signals and transmits them to the processor 41.
The input / output device 45 is, for example, a keyboard, a display, or the like, and receives operation commands and various setting values by the operator, and outputs the result of arithmetic processing by the processor 41.
Each component of the processing unit 11-1 is connected by a bus 46.

FIG. 3 is a functional block diagram illustrating the functions provided by the processing unit 11-1 in blocks. Since the functional block of the processing unit 11-2 is the same as that of the processing unit 11-1, the description thereof will be omitted.
In FIG. 3, the processing unit 11-1 has a signal monitoring unit 51, a normal determination unit 52, a master-slave determination unit 53, a failure information output unit 54, a synchronization signal generation unit 55, and a control signal as its functional blocks. The generation unit 56 and the like are included.

The signal monitoring unit 51 monitors signals transmitted from other processing units 11-2 and electronic devices 20-1 to 20-n and received via the communication network 1. The signal monitoring unit 51 can store the history regarding the presence / absence of signal reception and the validity / invalidity of the received signal for n cycles (where n is an integer of 2 or more). The monitoring result of the signal monitoring unit 51 is transmitted to the normal determination unit 52 and the control signal generation unit 56, respectively.

The normality determination unit 52 determines whether or not its own processing unit 11-1 is operating normally based on the monitoring result of the signal monitoring unit 51, and the other processing units 11-2 operate as the main system. When (it operates as a slave system), it is determined whether or not the main system processing unit is operating normally. The determination result of the normal determination unit 52 is transmitted to the master-slave determination unit 53 and the failure information output unit 54, respectively.

The normal determination of its own processing unit 11-1 by the normal determination unit 52 depends on, for example, the presence or absence of status signals C1 to Cn from the electronic devices 20-1 to 20-n monitored by the signal monitoring unit 51. Judge whether or not its own communication path is in a normal state. Here, the own communication path is a communication path of a portion connecting the processing unit 11-1 and the communication network 1. If a failure such as a disconnection of a communication cable or a poor connection of a connector occurs in the communication path, the processing unit 11-1 cannot receive any signal from the communication network 1. Since the status signals C1 to Cn from the electronic devices 20-1 to 20-n are repeatedly transmitted at a predetermined cycle as described above, it is possible to monitor whether or not any of the status signals C1 to Cn can be received. , It is possible to judge whether its own communication path is in a normal state or a failure has occurred. In addition to its own communication path, the normal determination unit 52 determines whether or not there is a problem in the arithmetic processing itself by using the self-diagnosis function of hardware such as the processor 41, the memory 42, and the communication device 44. You may try to do it.

Further, in the normal determination of the other processing unit operating in the main system in the normal determination unit 52, for example, the status signals C1 to Cn from the electronic devices 20-1 to 20-n monitored by the signal monitoring unit 51 are received. However, if part or all of the signal from the other processing unit 11-2 (main system) cannot be received, or if the signal from the main system contains the failure information F described later, a failure in the main system occurs. Judge the occurrence. The normal determination unit 52 in the present embodiment has functions as a "first determination unit" and a "second determination unit" in the present invention.

The master-slave determination unit 53 determines whether its own processing unit 11-1 operates as a main system or a slave system based on the determination result of the normal determination unit 52, and determines the determination result as the synchronization signal generation unit 55. And the control signal generation unit 56, respectively. The specific contents of the processing by the master-slave determination unit 53 will be described in detail later with reference to the flowchart, with the case of starting up the electronic interlocking device 10 and the time of operation after starting up.

When the failure information output unit 54 determines that the failure of its own processing unit 11-1 (own system) is determined by the normal determination unit 52, the failure information output unit 54 generates failure information F indicating that the own system is in a failure state, and the failure information F is generated. The information F is transmitted to the communication network 1 and at the same time transmitted to the control signal generation unit 56. As a method of transmitting the failure information F to the communication network 1, for example, the failure information F is put on a signal different from the control signal Sc1 transmitted by itself and transmitted, and the control signal Sc1 is transmitted with a flag indicating a failure. There is a method such as notifying the failure state to the outside by doing or not transmitting a signal.

The synchronization signal generation unit 55 generates a synchronization signal Ss when the master-slave determination unit 53 determines that its own processing unit 11-1 operates as the main system. The synchronization signal Ss matches the reference for matching the processing timing in the interlocking control, specifically, the timing at which the processing units 11-1 and 11-2 constituting the dual system start arithmetic processing. It is a reference signal for making the signal. The synchronization signal generation unit 55 transmits the generated synchronization signal Ss to the communication network 1 at a predetermined cycle. As a result, all the devices on the communication network 1 start their own processing triggered by the reception of the synchronization signal Ss, and operate periodically with reference to the timing.

When the master-slave determination unit 53 determines that the processing unit 11-1 operates as the main system, the control signal generation unit 56 adjusts to the timing of the synchronization signal Ss generated by the synchronization signal generation unit 55. While the status signals C1 to Cn from the electronic devices 20-1 to 20-n monitored by the signal monitoring unit 51 are adopted as input data, the master-slave determination unit 53 operates its own processing unit 11-1 as a slave system. When it is determined, the electronic device 20-1 monitored by the signal monitoring unit 51 is synchronized with the timing of the synchronization signal Ss from the other processing unit 11-2 (main system) monitored by the signal monitoring unit 51. The state signals C1 to Cn from ~ 20-n are adopted as input data. Then, the control signal generation unit 56 generates a control signal Sc1 for executing interlocking control according to the contents of the adopted state signals C1 to Cn, and transmits the control signal Sc1 to the communication network 1 at a predetermined cycle. To do. An invalid flag can be set in this control signal Sc1. The control signal Sc1 set with the invalid flag shall be discarded without being used for controlling the operation of the electronic devices 20-1 to 20-n and the field device 30 that are the targets of the interlocking control.

An example of the format of the control signal Sc1 is shown in FIG. This control signal Sc1 has a DIX-specification frame format based on the UDP / IP protocol as a communication protocol. In such a format, the information that identifies the electronic device 20-1 to 20-n to be controlled or the field device 30 is indicated in the destination MAC address, and the information that identifies the processing unit 11-1 is the source MAC address. The specific contents of the interlocking control will be shown in the user data. The invalid flag can be indicated by using a specific area in the user data. The communication method used for transmitting and receiving the control signal and the format of the control signal and the like are not limited to the above example.

In the above-mentioned multicast method communication, when the timings when the processing units 11-1 and 11-2 start the arithmetic processing are different, the information (from the electronic devices 20-1 to 20-n) adopted as the input data of the arithmetic by each is different. The state signals C1 to Cn) of the above are different, and the contents of the control signals Sc1 and Sc2 generated by the respective control signal generation units 56 may be different. In order to avoid such discrepancies between the control signals Sc1 and Sc2 and ensure consistency, the control signal generation units 56 of the processing units 11-1 and 11-2 are in accordance with the timing of the synchronization signal Ss, and the state signals C1 to C1 to Cn is adopted.

Further, when the failure information F is transmitted from the failure information output unit 54, the control signal generation unit 56 stops transmitting the generated control signal Sc1 to the communication network 1, or sets an invalid flag in the control signal Sc1. Do not use it for interlocking control. Further, the control signal generation unit 56 sets an invalid flag even when the state signals C1 to Cn from the electronic devices 20-1 to 20-n cannot be collected at the time of starting up the processing unit 11-1 or the like. A provisional control signal Sc1 is generated, and the control signal Sc1 is periodically transmitted to the communication network 1.

In addition to the control signal Sc1 for executing the interlocking control, an example of generating a synchronization signal Ss for matching the processing timing and transmitting it to the communication network 1 is shown here. For example, the control signal Sc1 may have a role as a synchronization signal Ss by setting a flag in the header of the control signal Sc1 for timing the processing.

Further, as another method instead of the synchronization signal Ss, for example, as shown in the schematic diagram of FIG. 5, the frame on which the state signal and the control signal are placed starts from the main system processing unit and is the slave processing unit and the electronic device 20-1. It goes around the communication network 1 so as to go around ~ 20-n, and each of the main processing unit, the slave processing unit, and each of the electronic devices 20-1 to 20-n goes around the specific areas A1 and A2 of the frame. , A3 ... may be read and written. Even in such a method, since the status signals C1 to Cn from the electronic devices 20-1 to 20-n adopted by each of the main processing unit and the slave processing unit are the same, the main processing unit and the slave system The control signals generated by each of the processing units can be matched.

Next, an example of the processing operation for master-slave determination executed by the processing units 11-1 and 11-2 at the time of starting up the electronic interlocking device 10 will be specifically described with reference to the flowchart of FIG.

When one of the processing units 11-1 and 11-2 constituting the dual system of the electronic interlocking device 10 is turned on, the processor 41 of the processing unit uses the master-slave determination program stored in the storage device 43. And execute the interlocking processing program. In order to complete the startup of the electronic interlocking device 10 according to these programs, it is necessary that at least one device connected to the communication network 1 is operating.

In the first step S10 in the flowchart of FIG. 6, the processor 41 performs a process of setting an invalid flag in the control signal Sc generated by its own processing unit (own system) as a process immediately after the startup. The reference numeral Sc indicates either the control signal Sc1 generated by the processing unit 11-1 or the control signal Sc2 generated by the processing unit 11-2. In the process of setting this invalid flag, since the state signals C1 to Cn from the electronic devices 20-1 to 20-n cannot be collected at the stage immediately after the start-up, the temporarily generated control signal Sc is the actual interlocking control. It is a measure to prevent it from being used in. The invalidated control signal Sc is transmitted to the communication network 1 at a predetermined cycle.

In the following step S20, the processor 41 monitors the signal received via the communication network 1 and determines whether or not any of the status signals C1 to Cn from the electronic devices 20-1 to 20-n has been received. .. When the status signal is received (Yes), it is determined that the own communication path is in a normal state, and the process proceeds to step S30. On the other hand, if the status signal is not received (No), the process waits until the reception of the status signal is determined. When the status signal cannot be received for more than the cycle in which the status signal is transmitted on the communication network 1, it is determined that a failure such as a disconnection has occurred in the own communication path, and steps S10 to S20 are performed. Keep repeating.

Next, in step S30, the processor 41 determines whether or not the control signal Sc from the other processing unit (other system) has been received. When the control signal Sc from the other system is not received (No), the power of the other system is not turned on in the following step S40, and the own system starts up before the other system (hereinafter, Recognize that it is in the "start-up state"). On the other hand, when the control signal Sc from another system is received (Yes), the process proceeds to step S70.

When the first start-up state is recognized, in the following step S50, the processor 41 determines whether or not the first start-up state is continuous for n cycles. The number of cycles n, which is a reference for this determination, is set in order to more reliably recognize the start-up state, and a value of 2 or more can be appropriately set. If the preceding start-up state is continuous for n cycles, the process proceeds to (Yes) step S60, and if the previous startup state is not continuous for n cycles, the process returns to (No) step S10 described above.

When it is confirmed that the processor 41 is in the start-up state for n consecutive cycles, the processor 41 determines in step S60 that its processing unit starts operation as the main system. As a specific operation of the main system, first, a synchronization signal Ss is generated and transmitted to the communication network 1, and the latest from the electronic devices 20-1 to 20-n is adjusted according to the timing of the synchronization signal Ss. The state signals C1 to Cn are adopted. Then, the control signal Sc is generated with reference to the interlocking chart data stored in the storage device 43 according to the contents of the latest state signals C1 to Cn. The generated control signal Sc is transmitted to the communication network 1 as a valid control signal Sc without setting an invalid flag.

When the reception of the control signal Sc from another system is determined in step S30 described above, the processor 41 determines in step S70 whether the received control signal Sc is valid or invalid. When a valid control signal Sc is received (Yes), in the following step S80, the other processing unit is already operating as the main system, and the own system has started up after the other system (hereinafter, "after". Recognize that it is in the "start-up state"). On the other hand, when an invalid control signal Sc is received, the process proceeds to (No) step S110.

When the post-startup state is recognized, in step S90, the processor 41 determines whether or not the post-startup state is continuous for n cycles. If the post-start-up state is continuous for n cycles, the process proceeds to (Yes) step S100, and if the post-startup state is not continuous for n cycles, the process returns to (No) step S10 described above.

When the post-startup state is confirmed for n consecutive cycles, in step S100, the processor 41 executes a process for operating its own processing unit as a slave system. FIG. 7 is a flowchart showing an example of processing for subordinate operation. First, the processor 41 determines in step S101 of FIG. 7 that its processing unit operates as a slave system. In the following step S102, the synchronization signal Ss from the other processing unit operating as the main system is received via the communication network 1, and the electronic devices 20-1 to 20-n match the timing of the synchronization signal Ss. The latest status signals C1 to Cn of the above are adopted. In step S103, the control signal Sc is generated with reference to the interlocking chart data stored in the storage device 43 according to the contents of the latest state signals C1 to Cn. The control signal Sc is currently flagged as invalid.

In the following step S104, the processor 41 transmits the generated control signal Sc to the communication network 1 while being invalid. In the next step S105, the processor 41 compares the generated control signal Sc with the valid control signal Sc received from the other processing unit via the communication network 1, and determines whether or not the contents of each match. judge. If they do not match (No), the process of matching the contents of the control signal Sc is executed in step S106, and then the process returns to step S102. If they match, the process proceeds to (Yes) step S107, and the invalid flag is not set in the control signal generated in the next cycle or later. As a result, the processing unit starts operating as a slave processing unit.

When the reception of the invalid control signal Sc is determined in step S70 of FIG. 6 described above, in step S110, the power of the other system of the processor 41 is turned on, but the operation mode of the main system or the slave system is still determined. It recognizes that an invalid control signal Sc is being transmitted, that is, a state in which the own system and another system are started up at almost the same time (hereinafter, referred to as "simultaneous start-up state").

In the master-slave determination in the simultaneous startup state, for example, the system to be started preferentially (hereinafter referred to as "priority system") is predetermined by the input / output device 45 and stored in the storage device 43, and the own system is the priority system. If it corresponds to, it can be a main system, and if it does not, it can be a subordinate system. According to this, in step S120, the processor 41 refers to the priority system data stored in the storage device 43 and determines whether or not the own system is the priority system. If it is a priority system, the process proceeds to (Yes), followed by step S130, and if it is not a priority system, the process proceeds to (No), step S150. Although an example of determining the priority system by referring to the priority system data stored in the storage device 43 is shown here, the setting method for the priority system is not limited to this, and for example, a physical switch is provided for each processing unit. It is also possible to set and refer to the priority of each processing unit by using the physical switch.

In step S130, the processor 41 determines whether or not the simultaneous start-up states are continuous for m cycles. The cycle number m, which is the reference for this determination, is set to a value smaller than the cycle number n used in the determination in step S50 or the like described above (m <n). If the simultaneous start-up states are continuous for m cycles, the process proceeds to (Yes) step S140, and if the simultaneous start-up states are not continuous for m cycles, the process returns to (No) step S10.

When it corresponds to the priority system and the simultaneous start-up state is confirmed for m consecutive cycles, the processor 41 starts operating in step S140 with its own processing unit as the main system in the same manner as the processing in step S60 described above. Decide to do.

When it is determined in step S120 that the own system is not the priority system, the processor 41 determines in step S150 whether or not the simultaneous start-up states are continuous for n cycles. If the simultaneous start-up states are continuous for n cycles, the process proceeds to (Yes) step S160, and if the simultaneous startup states are not continuous for n cycles, the process returns to (No) step S10.

When it does not correspond to the priority system and the simultaneous startup state is confirmed for n consecutive cycles, the processor 41 executes a process for operating its own processing unit as a slave system in step S160. At this point, the other system has started to operate as the main processing unit. The process for the slave operation is the same as the process in step S100 described above, and the process according to the flowchart illustrated in FIG. 7 is executed. As a result, the processing unit starts operating as a slave processing unit.

Due to the processing operation for determining the master-slave at the time of starting up the electronic interlocking device 10 as described above, one of the processing units 11-1 and 11-2 constituting the dual system operates as the main system processing unit. The other operates as a slave processing unit, and interlocking control of the electronic devices 20-1 to 20-n and the field device 30 by the electronic interlocking device 10 is started. During operation after startup, the main processing unit of the electronic interlocking device 10 transmits a synchronization signal Ss and an effective control signal Sc1 (or Sc2) to the communication network 1, and the slave processing unit sends an effective control signal Sc2. (Or Sc1) is transmitted to the communication network 1. As a specific example, in FIG. 1 described above, when the processing unit 11-1 of the electronic interlocking device 10 operates as the main processing unit and the processing unit 11-2 operates as the slave processing unit, the communication network 1 is displayed. The state of the synchronization signal Ss, the control signals Sc1 and Sc2, and the state signals C1 and Cn transmitted in both directions is shown. The notation in parentheses in the state of signal transmission illustrated in FIG. 1 is an example of a signal transmitted when a failure occurs, which will be described later.

The electronic devices 20-1 to 20-n and the field device 30 that are the targets of the interlocking control are, for example, the control signals Sc1 and Sc2 from the main processing unit and the slave processing unit received via the communication network 1. After comparing the contents and confirming that the dual system of the electronic interlocking device 10 is in a normal state by matching them, each operation is controlled according to the control signal Sc1 (or Sc2). It should be noted that confirmation that the contents of the control signals Sc1 and Sc2 match may be appropriately performed according to the reliability required for the interlocking control system, etc., and basically, the main processing unit from the main processing unit. The operation of the target device can be controlled by using only the control signal, and the operation when the contents of the control signals Sc1 and Sc2 do not match may be separately specified.

Next, an example of the switching operation between the main system and the slave system in the electronic interlocking device 10 during operation after startup will be specifically described with reference to the flowchart of FIG.

During operation in which one of the processing units 11-1 and 11-2 of the electronic interlocking device 10 operates as the main processing unit and the other as the slave processing unit, the processor 41 of each processing unit operates the master-slave determination program and interlocking. According to the processing program, the operation mode switching determination processing of its own processing unit is executed. First, in step S300 of FIG. 8, the processor 41 monitors the signal received via the communication network 1 and determines whether or not the synchronization signal Ss has been received. When the synchronization signal Ss is received (Yes), in the following step S310, if the operation mode of its own processing unit is the slave system, the operation is continued as it is, and if it is the main system, the operation is switched to the slave system. If the synchronization signal Ss has not been received, the process proceeds to (No) step S320.

Regarding the processing of steps S300 and S310, the synchronization signal Ss is a signal transmitted only from the main system, and the fact that it is received means that its own processing unit is basically operating as a slave system. , In principle, it does not operate as the main system. However, the possibility that an abnormality occurs in the processing of the own system and both processing units operate as the main system cannot be excluded. Assuming such a situation, in the process of step S310, when the operation of the own system is the main system, the system is switched to the subordinate system. Depending on the content of the abnormality, the operation of the own system may be stopped instead of switching to the slave system.

In step S320, since it was confirmed that the synchronization signal Ss was not received, the processor 41 determines whether or not the control signal Sc from another processing unit has been received. If the control signal Sc is received, the process proceeds to (Yes) step S330, and if the control signal Sc is not received, the process proceeds to (No) step S420.

In step S330, the processor 41 determines whether the received control signal Sc is valid or invalid. If it is a valid control signal Sc (Yes), there is no reception of the synchronization signal Ss from the other processing unit, and there is a reception of the valid control signal Sc, that is, the other processing unit is the slave system. Judge the state of operation as. In this state, its own processing unit basically operates as the main system, and in principle it does not operate as the slave system. However, as in the case described above, there is a possibility that an abnormality has occurred in the processing of the own system and both processing units are operating as slave systems. Assuming such a situation, in the subsequent step S340, the processor 41 determines whether its own processing unit is the main system or the slave system.

If it is the main system (Yes), the operation is continued as it is as the main system in the following step S350. On the other hand, in the case of a slave system (No), the process proceeds to step S360, and the same state, that is, a state in which the synchronization signal Ss is not received from another processing unit and a valid control signal Sc is received. , It is determined whether or not it is continuous for n cycles. If the same state continues for n cycles, the process proceeds to (Yes) step S370, and if the same state does not continue for n cycles, the process proceeds to (No) step S380, and the operation continues as a slave system as it is.

In step S370, the processor 41 recognizes that both processing units are operating as slave systems, and determines whether or not the own system corresponds to the priority system described above. If the own system corresponds to the priority system (Yes), in the following step S390, the operation mode of the own processing unit is switched from the slave system to the main system. On the other hand, if the own system does not correspond to the priority system (No), the operation is continued as a slave system as it is in the same manner as in step S380 described above.

If the reception of the invalid control signal Sc is determined in step S330 described above (No), the processor 41 is in the same state in step S400, that is, the synchronization signal Ss is not received from another processing unit and is invalid. The reception of the control signal Sc determines whether or not a certain state is continuous for n cycles. Such a state may occur during the startup of another processing unit or during the occurrence of a minor failure in which the arithmetic processing itself has no problem. When the same state continues for n cycles (Yes), in the following step S410, if the operation mode of the own processing unit is the main system, the operation is continued as it is, and if it is the slave system, the operation is switched to the main system. On the other hand, if n cycles are not continuous, (No) the process returns to step S300 described above.

Upon receiving the determination that the control signal Sc from the other system is not received in step S320 described above, in step S420, the processor 41 is one of the state signals C1 to Cn from the electronic devices 20-1 to 20-n. Is received or not. If the status signal is received, the process proceeds to (Yes) step S430, and if the status signal is not received, the process proceeds to (No) step S450.

In step S430, the processor 41 is in the same state, that is, there is no reception of both the synchronization signal Ss and the control signal Sc from the other processing unit, and the state signal from any of the electronic devices 20-1 to 20-n. It is determined whether or not the state in which there is reception of is continuous for n cycles. If the same state continues for n cycles (Yes), in the following step S440, it is determined that a communication path failure or operation stop has occurred in another processing unit, and the operation mode of its own processing unit is subordinated. Switch to the main system. On the other hand, if n cycles are not continuous, the process returns to (No) step S300.

In step S450, the processor 41 is in the same state, that is, the state in which the synchronization signal Ss and the control signal Sc from the other processing unit and the state signal from any of the electronic devices 20-1 to 20-n are not received. , It is determined whether or not the n cycles are continuous. If the same state continues for n cycles, the process proceeds to (Yes) step S460, and if the same state does not continue for n cycles, the process returns to (No) step S300 described above.

In step S460, the processor 41 recognizes its own communication path failure because it is in a state where it cannot receive any signal from the communication network 1. Then, the control signal Sc transmitted from the own system is stopped, and if the operation mode of the own processing unit is the main system, the transmission of the synchronization signal Ss is also stopped, and the failure information F indicating the own communication path failure is transmitted to the communication network. 1 Tell each device above. As a specific example, in the parentheses of FIG. 1 described above, when the processing unit 11-1 of the electronic interlocking device 10 is operating as the main system and the processing unit 11-2 is operating as the slave system, the processing of the main system is performed. The state of the failure information F, the control signal Sc2, and the state signals C1 to Cn transmitted on the communication network 1 when a communication path failure occurs in the unit 11-1 is shown. As a result, the processing unit 11-2 operating as the slave system is switched to the main system. Then, when the processing unit 11-1 recovers from the failure, the processes after step S10 are sequentially executed again in accordance with the procedure at the time of startup shown in FIG. As a result, if the processing unit 11-2 continues to operate normally as the main system, the processing unit 11-1 recovered from the failure returns as the slave system.
In the above description, an example is shown in which the processing unit 11-1 in which the communication path failure has occurred stops the transmission of the control signal Sc1, but in addition to this, the control signal Sc1 is invalidated by setting an invalid flag. The control signal Sc1 may be transmitted to the communication network 1. Whether to stop or invalidate the control signal Sc1 when a failure occurs can be appropriately selected.

In the following, the switching operation between the main system and the sub system when a communication path failure occurs in the processing unit 11-1 operating in the main system will be described in detail with reference to FIG.
The upper part of FIG. 9 exemplifies the transition of the operation seen from the processing unit 11-1 of the main system, and the lower part of FIG. 9 exemplifies the transition of the operation seen from the processing unit 11-2 of the slave system. There is. Here, the processing units 11-1 and 11-2 of the main system and the slave system and each of the electronic devices 20-1 to 20-n repeat the processing at a fixed cycle of 200 ms, and are shown on the left side of FIG. It is assumed that a communication path failure occurs in the main system (x mark in the figure) during the initial periodic processing.

Under such an assumption, the main processing unit 11-1 transmits the synchronization signal Ss in the first processing cycle, and the control signal Sc2 and the electronic device 20- from the slave processing unit 11-2. The status signals C1 to Cn from 1 to 20-n could be received. However, in the periodic processing (second time) after the failure occurs, although the synchronization signal Ss is generated, the synchronization signal Ss cannot be transmitted to the communication network 1, and the slave processing unit 11-2 and Signals from electronic devices 20-1 to 20-n can no longer be received (dashed arrow in the figure). Then, when the state continues for three cycles (n = 3), the processing unit 11-1 of the main system stops the output of the synchronization signal Ss and also stops (or invalidates) the output of the control signal Sc, and follows. Break away from parallel operation with the system.

At this time, the slave processing unit 11-2 receives a status signal from the electronic devices 20-1 to 20-n in the periodic processing (second time) after the occurrence of the communication path failure of the main processing unit 11-1. Although C1 to Cn can be received, the synchronization signal Ss and the control signal Sc1 from the main system cannot be received. Then, when the state continues for three cycles, the slave processing unit 11-2 determines that a failure has occurred in the main processing unit 11-1, and switches its operation mode from the slave system to the main system. As a result, the processing unit 11-2 after switching transmits the synchronization signal Ss and the control signal Sc2 to the electronic devices 20-1 to 20-n via the communication network 1, and becomes a new main processing unit. Become.

As described above, according to the railway control system 100 of the present embodiment, each of the processing units 11-1 and 11-2 of the electronic interlocking device 10 sends and receives synchronization signals Ss (startup) via the communication network 1. Because it will be able to independently make its own normal judgment and master-slave decision by using the control signals Sc1 and Sc2 and the status signals C1 and Cn (at the time of startup and at the time of operation after startup). It is not necessary to connect the used system (main system) and the standby system (subordinate system) with a metal line via a common part of the relay connection system to switch between the two systems as in the conventional electronic interlocking device. As a result, the processing units 11-1 and 11-2 constituting the dual system of the electronic interlocking device 10 can be arranged at different distances from each device room of the different A station and B station. Therefore, even if the equipment room of one station is hit by a disaster such as a fire or flood, the processing unit in the equipment room of the other station operates as the main system, and the interlocking control system can be maintained. It is possible to reliably control train operation by avoiding the occurrence of system failures due to the above. Further, since the number of parts is reduced by eliminating the need for the common portion, the failure frequency of the electronic interlocking device 10 can be reduced.

Further, according to the railway control system 100 of the present embodiment, the distance between the processing units 11-1 and 11-2 constituting the dual system of the electronic interlocking device 10 can be freely set, in other words, on the communication network 1. Since the processing units 11-1 and 11-2 can be arranged at any place in the above, the degree of freedom in designing the electronic interlocking device 10 is increased, and the design can be performed while suppressing the equipment cost and the like. For example, if there is a difference between the old and new hardware constituting each of the processing units 11-1 and 11-2, the processing unit composed of the new hardware has a higher priority and is composed of the old hardware. It is efficient if the input / output device 45, the physical switch, etc. are set so that the priority of the processing unit is low, and the processing unit (priority system) having a high priority is placed in a place where maintenance is easier. System design and operation can be realized. Such an effect is particularly effective in an centralized or centralized interlocking control system that collectively processes interlocking logics related to a plurality of stations.

In the above-described embodiment, an example in which the processing units 11-1 and 11-2 of the electronic interlocking device 10 are arranged in the equipment rooms of different stations has been described. For example, the distances within the premises of the same station are different. Even if the processing units 11-1 and 11-2 are separately arranged in two equipment rooms provided at distant places, it is possible to avoid the occurrence of a system failure due to a disaster. Further, although an example in which the electronic interlocking device 10 constitutes a dual system by two processing units 11-1 and 11-2 is shown, the present invention is also effective when a multiple system is formed by three or more processing units. Is. Even when the electronic interlocking device includes three or more processing units, the priority of each processing unit, that is, the order of the system to be started preferentially is determined by the input / output device 45 for each processing unit and stored in the storage device 43. By storing it or setting it using a physical switch or the like, each of the processing units can independently determine its own master-slave operation mode as in the case of the above-described embodiment. .. In this case, one processing unit operates as a main system, and the remaining processing units operate as a slave system.

Further, in the above-described embodiment, an example of a system configuration in which the electronic interlocking device 10 performs interlocking control of the electronic devices 20-1 to 20-n and the field device 30 via the communication network 1 has been described. The present invention is not limited to an interlocking control system including such an electronic interlocking device 10, and the present invention is applied to an arbitrary railway control system that employs a multiplex system in order to ensure the safety of train operation. Is possible.

In the application of the present invention to any railway control system as described above, the plurality of processing units constituting the multiplex system each possess each other's information transmitted and received via the communication network. This possessed information is information on what kind of signal each processing unit on the communication network transmits to the communication network and what kind of signal is received from the communication network. Then, each of the plurality of processing units makes a normal judgment based on the possessed information, and determines whether it operates in the main system or the sub system. The normal judgment here is, for example, that the other processing unit should receive three types of signals from the communication network from the possessed information, but only two types of signals are received, and the signal transmitted by its own processing unit is If it is known that the signal has not been received by another processing unit, it is possible to determine its own communication path failure. Further, the determination of the master-slave operation mode of itself is performed, for example, from the possessed information, even though another processing unit transmits a signal generated only by the main system, the signal is processing other than the main system including itself. If it is found that the signal has not been received by the unit, it is possible to determine the failure of the main system processing unit and switch its own operation mode from the slave system to the main system. By providing each of the plurality of processing units with such a function, it is possible to obtain the same action and effect as in the case of the above-described embodiment.

Although the embodiments of the present invention and application examples thereof have been described above, the present invention is not limited to the above-described embodiments and application examples thereof, and further modifications and changes can be made based on the technical idea of the present invention. It is possible.

1 ... Communication network, 10 ... Electronic interlocking device, 11-1, 11-2 ... Processing unit, 20-1 to 20-n ... Electronic device, 30 ... Field device, 41 ... Processor, 42 ... Memory, 43 ... Storage device , 44 ... communication device, 51 ... signal monitoring unit, 52 ... normal judgment unit, 53 ... master-slave determination unit, 54 ... failure information output unit, 55 ... synchronous signal generation unit, 56 ... control signal generation unit, 100 ... railway control system , Ss ... Synchronous signal, Sc, Sc1, Sc2 ... Control signal, C1-Cn ... State signal

Claims (8)

It has multiple processing units that can control train operation via a communication network.
Each of the plurality of processing units holds each other's information transmitted and received via the communication network, and each makes a normal judgment based on the held information, and either operates in the main system or operates in the slave system. A railroad control system that decides what to do. The railway control system according to claim 1, wherein the plurality of processing units are arranged at different stations. The railway control system according to claim 1, wherein the plurality of processing units are arranged in two or more equipment rooms provided at a distance from each other. Among the plurality of processing units, the main system processing unit determined to operate in the main system is configured to determine the timing of the operation control and execute the operation control, and is determined to operate in the slave system. The subordinate processing unit is configured to be able to execute the operation control according to the timing determined by the main system processing unit.
The railway control system according to any one of claims 1 to 3. Including a group of devices connected to the communication network
At least the main processing unit among the plurality of processing units controls train operation by interlocking control of the equipment group.
The railway control system according to claim 4. The main processing unit generates a synchronization signal as a reference for matching the timing of the interlocking control and a control signal for executing the interlocking control, and transmits the control signal to the communication network.
The slave processing unit generates a control signal for executing the interlocking control in synchronization with the synchronization signal received from the main processing unit via the communication network, and transmits the control signal to the communication network. ,
The railway control system according to claim 5. The main processing unit stops the synchronization signal when a failure occurs, and the main processing unit stops the synchronization signal.
When the synchronization signal is no longer received via the communication network, the slave processing unit changes its operation to the main system and becomes a new main processing unit.
When the synchronization signal from the new main system processing unit is received via the communication network after the failure is recovered, the original main system processing unit resumes operation as a slave system and becomes a new slave system processing unit. Become,
The railway control system according to claim 6. Each of the plurality of processing units
A synchronization signal generator that generates the synchronization signal,
A signal monitoring unit that monitors signals transmitted from the equipment group and other processing units and received via the communication network, and
A first determination unit that determines the state of its own communication path according to the presence or absence of a signal from the device group monitored by the signal monitoring unit.
A control signal generation unit that generates the control signal according to the content of the signal from the device group monitored by the signal monitoring unit.
A second determination unit that determines the state of the main processing unit based on signals from other processing units monitored by the signal monitoring unit.
It is provided with a master-slave determination unit that determines whether it operates in the main system or the slave system according to each determination result of the first and second determination units.
When the master-slave determination unit determines that the system operates in the main system, the synchronization signal generated by the synchronization signal generation unit and the control signal generated by the control signal generation unit are transmitted to the communication network to determine the master-slave. When it is determined by the unit to operate in the slave system, the control signal generated by the control signal generation unit is transmitted to the communication network.
The railway control system according to any one of claims 5 to 7.