JP4716861B2 - Data processing system - Google Patents

Description

  The present invention relates to a data processing system that operates based on input data from an information source. In particular, the present invention monitors data input status, and when there is an abnormality, it replaces the abnormal data with a specified data processing unit. The present invention relates to a data processing system to be applied to

  A signal device that controls the operation of a railway vehicle is configured as a fail-safe system that ensures safety even when an abnormality occurs.

  For example, in the electronic interlocking system 100 shown in FIG. 5, the reception abnormality of data input through the communication network 101 from field devices such as track circuits, traffic lights, and switchboards and other devices is monitored. More specifically, the reception monitoring unit 103 of the processing device 102 monitors the reception status of data from the communication network 101 at regular intervals and performs verification of the received data. When there is no normal reception beyond the time, a predetermined safety value such as “0” is output to the data processing unit 104 as confirmed data.

  The data processing unit 104 executes a fixed process based on the set of confirmed data 105 output from the reception monitoring unit 103 and outputs a set of output data 106. Thus, even if the data processing unit 104 executes a fixed process, if there is an abnormality in the input data, the corresponding monitoring data is replaced with a safe value in the reception monitoring unit 103. The output data related to is secured to a value that controls the operation of the system to the safe side.

  In the example shown in FIG. 5, an abnormality is detected in the second data 101a, and the second confirmed data 105a is replaced with a safe value (indicated by hatching in the figure). As a result, the output data 106a and 106b related to the second confirmed data 105a are functionally safe.

  Since the signal equipment is also large-scale in vehicle depots, etc., it is possible to divide the premises into multiple areas and configure subsystems for each area, and connect the communication networks of each subsystem with repeaters to configure the system. Done. Similar to the reception monitoring unit 103 described above, the repeater of such a system ensures fail-safety by transmitting safe value data to a relay destination when information to be relayed is interrupted. (For example, refer to Patent Document 1).

JP 2001-308892 A

  As described above, if the data set to the safe value is output when an abnormality is detected in the reception monitoring unit or repeater, the system operation is controlled to the safe side. Control may unnecessarily reduce system operation efficiency.

  For example, in a depot that is divided into a main line and a base, the train travels between the main line and the base, so a chain relationship occurs between the main line and the base, and necessary linkage information is relayed. It is exchanged between systems via a container. When performing maintenance at such a vehicle base, the main line can be downed after the last train, and conversely, the base cannot be shut down after the last train due to reasons such as replacing the vehicle. For this reason, if the main line is brought down and maintained after the last train, the linkage information set on the safe side from the repeater, that is, the same linkage information as when the vehicle enters the base from the main line is sent. As a result, the system on the base side has a problem in that it impedes the vehicle replacement work because the relevant route is locked in preparation for the approach of the train from the main line under maintenance, which is not possible in practice. It was.

  The present invention is intended to solve the above problem, and provides a data processing system capable of preventing the function of a processing unit from being restricted more than necessary by data replaced with a safety value or the like due to an abnormality. The purpose is to do.

The invention according to claim 1 is a processing unit (15) that operates based on data input from a plurality of information sources (11);
Provided before the processing unit, monitors the input condition of data from each of said plurality of information sources (11), said data defining the data instead of the data from the information source with abnormal input state is A monitoring unit (14) that adds and outputs discrimination information indicating that the monitoring unit has been changed ;
When the determination information indicating that there is a change to data from a specific information source among data input from the monitoring unit to the processing unit is added, a replacement unit that replaces the data with predetermined alternative data;
It is a data processing system characterized by having .

  According to the above invention, when there is an abnormality in the data input status from the information source (11), the monitoring unit (14) outputs the prescribed data instead of the data, and the monitoring unit (14) Discrimination information indicating that the data has been changed is added to the data. As a result, it is possible to determine whether the prescribed data is sent from the information source (11) or changed by the monitoring unit (14), and the processing unit (15) responds according to the determination result. Can be changed.

The monitoring unit (14) determines that there is an abnormality in the data input status, for example, when the data to be input from the information source (11) does not arrive for a certain time or when the data has arrived but is damaged. To do. The monitoring unit (14) only needs to exist between the information source (11) and the processing unit (15). However, if the monitoring unit (14) is provided at the input stage of the processing unit (15), the monitoring unit (14) is input after passing through the monitoring unit (14). It is preferable because there is little possibility of abnormality in data.
According to the above invention, when the specific data input to the processing unit (15) is changed by the monitoring unit (14), predetermined alternative data is used instead of the data. To enter. By substituting with alternative data, it is possible to obtain different processing results while fixing the processing contents of the processing unit (15). The data targeted by the replacement unit (16) is limited to specific data among many data input to the processing unit (15). For example, it is limited to data that does not affect the safety of the system even if it is changed to alternative data.

The invention according to claim 2 is the data processing system according to claim 1, wherein the specified data is data whose operation is controlled on the safe side.

  According to the above invention, the monitoring unit (14), when there is an abnormality in the data input status, determines that the data has been changed to the prescribed data that controls the operation of the system to the safe side. Output with information added. The value of data controlled on the safe side should be determined uniformly throughout the system.

In the invention according to claim 3 , the data processing system is divided into a plurality of systems,
The replacement unit (16) replaces the data with the substitute data when discrimination information indicating that there is a change is added to the data from the information source (11) belonging to another system. Item 3. The data processing system according to Item 1 or 2 .

  According to the above invention, when the data input from the information source (11) of another system is changed to the prescribed data by the monitoring unit (14), the replacement unit (16) displays the changed data. Replace with predetermined substitute data. For example, when another system is down for maintenance or the like, the system can be operated without being affected by it.

The invention according to claim 4 is the data processing system according to claim 1, 2 or 3 , wherein the substitute data is data that does not limit a function of the processing unit (15).

  According to the above invention, the function of the processing unit (15) is not limited by replacing the prescribed data output by the monitoring unit (14) due to the abnormality with the substitute data. For example, in a fail-safe system, data that controls the operation of the system to the safe side often limits the function of the processing unit (15), so the substitute data is data that does not control the operation of the system to the safe side. The substitute data may not be a fixed value, but may be set to a value according to the processing contents of the output destination.

Invention, the information source (11), the data processing system of claim 1, 2, 3 or 4 and outputs the data in advance adding discrimination information indicating no change according to claim 5 It is.

  According to the above invention, the discrimination information indicating that there is no change is added in advance to the data sent from the information source (11). Therefore, the discrimination information is always included in the data regardless of whether or not there is a change in the monitoring unit (14). Is added, and the format of data exchanged is unified within the system.

In the invention according to claim 6 , the data processing system is divided into a plurality of systems,
A relay (30, 80) for relaying data output from the information source (11) between systems;
The data processing system according to claim 1, 2, 3, 4, or 5 , wherein the repeater (30, 80) functions as the monitoring unit (14) for data to be relayed. It is.

  According to the above invention, the repeaters (30, 80) monitor the input status of data to be relayed from the relay source system, and when there is no abnormality, send the data from the relay source system to the relay destination as it is. When there is an abnormality, it operates so as to output to the relay destination the specified data added with discrimination information indicating that there is a change. If discrimination information is added to data in advance, if there is no abnormality, the discrimination information is included and relayed.

  According to the data processing system of the present invention, when a monitoring unit or the like sends specified data instead of the abnormal data due to an input abnormality from an information source, the specified data is changed by the monitoring unit. Since the discriminating information indicating that the data has been changed is added, it can be discriminated based on the discriminating information whether the prescribed data is sent from the information source or has been changed by the monitoring unit. It is possible to change the correspondence in the processing unit according to the determination result. For example, when the specified data is data that controls the operation of the system to the safe side, whether or not safety control should actually be performed according to the input specified data is determined based on the discrimination information added to the data This makes it possible to avoid unnecessary safety control.

  In addition, when discriminating information indicating that there is a change is added to specific data input to the processing unit, the processing content of the processing unit is fixed in the case where predetermined alternative data is given to the processing unit instead of the data. Thus, different processing results corresponding to the discrimination information can be obtained, and the processing section is prevented from becoming complicated.

  If the data input from the information source of another system is changed to the specified data by the monitoring unit, the replacement of the changed data with alternative data is affected by the operation stop of the other system. The system can be operated without any problem.

  If the information source outputs discriminating information indicating that there is no change in advance, the discriminating information is added to all data regardless of whether or not there is a change in the monitoring unit. Can be unified.

  If a repeater that relays data between systems serves as a monitoring unit, the relay destination system determines whether or not the specified data output by the repeater has been changed and output by the repeater due to a relay source error. Therefore, it is possible to avoid that the relay destination system is unnecessarily restricted in function due to a relay source system error.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 shows a configuration of a data processing system 5 according to the present embodiment. The data processing system 5 includes a first system 10, a second system 20, and a repeater 30. The first system 10 is based on a plurality of information sources 11, a communication network 12 such as a LAN (Local Area Network) to which these information sources 11 are connected, and data input from each information source 11 through the communication network 12. And a processing device 13 that operates. The processing device 13 includes a monitoring unit 14 that monitors the input status of data, a processing unit 15, a replacement unit 16 that replaces data to be provided to the processing unit 15 with alternative data, and an output unit 17 that outputs a processing result of the processing unit 15. It consists of.

  Similar to the first system 10, the second system 20 includes a plurality of information sources 11, a communication network 12, and a processing device 13. The communication network 12 of the first system 10 and the communication network 12 of the second system 20 are connected via a repeater 30.

  The information source 11 sends out unit data 40 in which a valid flag 42 as discriminating information indicating the presence or absence of the change is added to the data 41. When the valid flag 42 is “1” (set), it indicates that there is no data change, and when the valid flag 42 is “0”, it indicates that there is a data change. Each information source 11 sends unit data 40 in which the valid flag 42 is set to “1” at regular intervals. Further, among the unit data 40 transmitted from the information source 11 of the second system 20, data to be relayed to the first system 10 is transmitted to the communication network 12 of the first system 10 via the relay 30.

  The monitoring unit 14 of the processing device 13 is connected to the communication network 12, has a function of receiving the unit data 40 sent from each information source 11 through the communication network 12, and an input status of unit data from each information source 11 ( Unit that includes a function that monitors the reception status) and a valid flag set to “1” (data changed) instead of the unit data in which there is an abnormality in the input status. It has a function of outputting data (hereinafter referred to as prescribed unit data). Here, the prescribed data is a safe value that controls the operation of the system to the safe side, and data that is composed of N bits (N is an integer equal to or greater than 1) is all “0”. .

  The monitoring unit 14 determines a set of unit data 40 to be received from each information source 11 in advance, monitors their reception status at regular intervals, and determines the unit data 40 received normally. As unit data (hereinafter referred to as “determined unit data”), with respect to unit data 40 having an abnormality in the reception status, the prescribed unit data 40 generated internally is determined as unit data instead of the unit data 40 having the abnormality. To do. A set of determined unit data arranged in this way is output to the subsequent stage at a constant cycle. The case where there is an abnormality in the reception status includes a case where the scheduled unit data 40 is not received for a certain period of time or a case where the received unit data 40 is damaged.

  Most of the determined unit data output by the monitoring unit 14 is input to the processing unit 15 only in the data included therein. Among the determined unit data output by the monitoring unit 14, specific data is input to the replacement unit 16. The replacement unit 16 checks the valid flag of the confirmed unit data input from the monitoring unit 14, and when the valid flag is “1”, outputs the data included in the confirmed unit data to the processing unit 15 as it is, and validates the valid flag. When “0” is “0”, predetermined alternative data is output to the processing unit 15.

  The processing unit 15 executes a predetermined process based on a set of data input from the monitoring unit 14 and the replacement unit 16 and outputs the result to the outside via the output unit 17. A part of the data output from the output unit 17 is output to the outside in the form of unit data 40 in which the valid flag 42 is set to “1”. In this case, the output unit 17 is connected to another device. And functions as a source of information for the system.

  The repeater 30 has a function of relaying unit data, and is configured to perform the same function as the monitoring unit 14 of the processing device 13 for data to be relayed. That is, the reception status of the unit data scheduled to be relayed is monitored, and when the unit data is received normally, the unit data is sent to the relay destination as it is, and when there is a reception abnormality, the specified unit data is replaced with the abnormal unit data. It has a function to output unit data to the relay destination.

  FIG. 2 exemplifies the transition of data exchanged. In the example shown in the figure, there are two types of data, a safety value “SF” and a non-safety value “NS”, the specified data is the safe value “SF”, and the alternative data is the non-safety value “NS”. It is set to.

  FIG. 2A shows a case where unit data is normally received. The unit data 40a normally received by the monitoring unit 14 is output as it is to the subsequent replacement unit 16 as confirmed unit data 40b. Since the valid flag 42b of the fixed unit data 40b is “1”, the data 41b included in the fixed unit data 40b is output to the processing unit 15 as it is. In FIG. 2A, the data “SF” is input to the processing unit 15 without being changed midway.

  FIG. 2B shows a case where there is a reception abnormality in the monitoring unit 14 of the processing device 13. The monitoring unit 14 generates prescribed unit data inside instead of the unit data having a reception abnormality, and outputs this to the subsequent replacement unit 16 as the determined unit data 40c. The determined unit data 40c has a safe value “SF” and a valid flag 42c “0”. Therefore, the replacement unit 16 outputs predetermined alternative data 41 d to the processing unit 15 instead of the data “SF” of the input fixed unit data 40 c. In this example, the substitute data 41d has a non-safety value “NS”.

  FIG. 2C shows a case where there is a reception abnormality in the repeater 30. The repeater 30 internally generates prescribed unit data 40e instead of unit data having a reception abnormality, and outputs it to the relay destination system. The unit data 40e has a safe value “SF” and a valid flag 42e “0”. The monitoring unit 14 normally receives the unit data 40e output from the repeater 30, and outputs the unit data 40e including the valid flag as it is to the subsequent replacement unit 16 as the determined unit data 40f. Since the valid flag 42f of the fixed unit data 40f is “0”, the replacement unit 16 outputs predetermined alternative data 41g to the processing unit 15 instead of the input fixed unit data 40f.

  Thus, even if the data of the same safety value “SF” is input, the replacement unit 16 has been output by the information source 11 itself, whether it has been changed and output by the monitoring unit 14 or the repeater 30 due to reception abnormality. Whether or not the data is valid can be determined by the value of the valid flag 42, and is replaced with alternative data only when the value is changed by the monitoring unit 14 or the like (the valid flag is "0").

  As shown in FIG. 1, since most of the data output from the monitoring unit 14 is input to the processing unit 15 as it is, the monitoring unit 14 or the repeater 30 changes the data to a safe value in the case of reception abnormality. The operation of the system is controlled to the safe side, and fail-safety is ensured. On the other hand, when a reception abnormality occurs, specific safety data that is clearly not required to be controlled on the safe side is replaced with alternative data via the replacement unit 16 so that unnecessary safety control is not performed. The processing unit 15 does not need to receive unnecessary function restrictions due to the fail-safe function for reception abnormality.

  For example, when the second system 20 goes down for maintenance, the specified unit data is sent from the repeater 30. While the second system 20 is down, the first system 10 side receives the second unit 20 from the second system 20. It may be obvious from the system configuration that data can be ignored. In such a case, if the unit data received from the second system 20 is input as specific data to the processing unit 15 via the replacement unit 16, the system of the first system 10 is down due to the system down of the second system 20. Functions can be prevented from being unnecessarily restricted.

  FIG. 3 shows an example when the present invention is applied to an electronic interlocking system 50 configured by dividing it into a plurality of systems. The electronic interlocking system 50 includes a first system 60, a second system 70, and a repeater 80. The first system 60 includes a communication network 61 similar to the communication network 12 of FIG. 1 and an interlocking logic unit 62 corresponding to the processing device 13 of FIG. The second system 70 includes a communication network 71 similar to that in FIG. 1 and a plurality of interlocking logic units 72 that function as the information source 11 and the processing unit 13 in the second system 20 in FIG. The repeater 80 performs the same function as the repeater 30 of FIG.

  For example, as shown in FIG. 4, the track circuit 204T of the second system 70 and the track circuit 59T of the first system 60 are connected, and the train is connected to the first system 60 side and the second system 70 side through these. Shall come and go. When the train travels from the track circuit 204T of the second system 70 to the track circuit 59T of the first system 60 in a normal operation state, the value of the route lock information 204TRSR is obtained as the unit data 91 from the second system 70 side of FIG. This unit data 91 is relayed to the first system 60 via the repeater 80, and the interlocking logic unit 62 of the first system 60 tracks the path lock information 204 TRSR included in the received unit data 91. The route of the circuit 59T is locked. The course lock for the track circuit 59T is performed by the relay circuit 59TRSR.

  When the second system 70 is brought down for maintenance or the like, the repeater 80 detects a reception abnormality and sends prescribed unit data to the first system 60. Since the prescribed unit data is data for which the operation of the system is controlled on the safe side, the route lock information 204TRSR similar to the case where the train travels from the track circuit 204T of the second system 70 to the track circuit 59T of the first system 60 is obtained. If this is output and processed as it is, the track circuit 59T of the first system 60 is locked. That is, although the train cannot enter the first system 60 from the second system 70 under maintenance, the track circuit 59T is locked, and the route setting on the first system 60 side is performed. It will be restricted unnecessarily.

  Therefore, in the configuration shown in FIG. 3, unit data 91 relating to 204TRSR is input to the processing unit 15 via the replacement unit 16 in FIG. 1 in the interlocking logic unit 62 of the first system 60. . Specifically, as shown in the blowing unit 65 in FIG. 3, a localization contact 66 that is turned on / off by the value of the path lock information 204TRSR, which is the data of the unit data 91, is provided in the middle of the circuit that supplies the exciting current of the relay circuit 59TRSR. In parallel with this, a reverse contact 67 that turns on and off according to the value of the valid flag of the unit data 91 and a localization contact 68 that holds 59TRSR are provided.

  While the valid flag of the unit data 91 is “1”, the reverse contact 67 is turned off, so that the relay circuit 59TRSR is turned on / off according to the value of 204TRSR. On the other hand, since the reverse contact 67 is turned on when the valid flag of the unit data 91 is “0”, the relay circuit 59TRSR maintains the previous state regardless of the value of 204TRSR included in the unit data 91, and the track The circuit 59T is not locked. In other words, the reverse contact 67 and the localization contact 68 function as the replacement unit 16 in FIG. 1, and when the valid flag is “0”, the non-safe side alternative data is given to the relay circuit 59TRSR.

  Thereby, even when the second system 70 is down, the track circuit 59T of the first system 60 is not locked due to the cause, and the first system 60 can set a track related to the track circuit 59. It becomes possible. Although the relay circuit has been described with reference to FIG. 3, the interlocking logic unit 62 is actually composed of a circuit having a CPU as a main part, and a similar function is realized by a program.

  The embodiment of the present invention has been described with reference to the drawings. However, the specific configuration is not limited to that shown in the embodiment, and there are changes and additions within the scope of the present invention. Are also included in the present invention.

  For example, a system configuration example in which two subsystems are connected by relays 30 and 80 has been shown. However, it may be configured by three or more subsystems, or may be configured as a single system without relays 30 and 80. Also good.

  Further, the replacement unit 16 is provided to output the substitute data when the valid flag is “0”. However, the processing unit 15 itself may be configured to change the processing content according to the value of the valid flag. Good.

  Furthermore, in the embodiment, the information source 11 outputs the unit data including the valid flag. However, the valid flag “0” is added to the data by the monitoring unit 14 or the repeater 30 only when there is a reception abnormality. You may comprise.

It is a block diagram which shows the structure of the data processing system concerning embodiment of this invention. It is explanatory drawing which shows the transition of the data exchanged in the data processing system concerning embodiment of this invention. It is a block diagram showing an example of an electronic interlocking system to which the present invention is applied. It is explanatory drawing which shows an example of a structure of the track circuit in the system boundary part of the electronic interlocking system shown in FIG. It is a block diagram which shows the structure of the conventional electronic interlocking | linkage system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 5 ... Data processing system 10 ... 1st system 11 ... Information source 12 ... Communication network 13 ... Processing apparatus 14 ... Monitoring part 15 ... Processing part 16 ... Replacement part 17 ... Output part 20 ... 2nd system 30 ... Repeater 40 ... Unit Data 41 ... Data 42 ... Valid flag 50 ... Electronic interlocking system 59T ... Track circuit 59TRSR ... Relay circuit 60 ... First system 61 ... Communication network 62 ... Interlocking logic part 66 ... Localization contact 67 ... Reverse contact 70 ... Second system 71 ... Communication network 72 ... Interlocking logic unit 80 ... Repeater 91 ... Unit data for transmitting the value of 204TRSR 204T ... Track circuit 204TRSR ... Track lock information related to track circuit 204T

Claims (6)

A processing unit that operates based on data input from a plurality of information sources;
Provided in the preceding stage of the processing unit, for monitoring the input status of data from each of the plurality of information sources, and for the specified data to be replaced by the monitoring unit instead of data from an information source having an abnormal input status A monitoring unit that adds and outputs discrimination information indicating that it has been changed , and
When the determination information indicating that there is a change to data from a specific information source among data input from the monitoring unit to the processing unit is added, a replacement unit that replaces the data with predetermined alternative data;
Data processing system, comprising a. The data processing system according to claim 1, wherein the prescribed data is data whose operation is controlled on the safe side. The data processing system is divided into a plurality of systems,
The replacement unit, wherein when the determination information indicating the change required on data from sources belonging to other system is appended to claim 1 or 2, characterized in that to replace the data to the alternate data Data processing system. The data processing system according to claim 1, 2, or 3 , wherein the substitute data is data that does not limit a function of a processing unit. The sources, the data processing system of claim 1, 2, 3 or 4 and outputs the data in advance adding discrimination information indicating no change. The data processing system is divided into a plurality of systems,
A repeater for relaying data output from the information source between systems;
The data processing system according to claim 1, 2, 3, 4, or 5 , wherein the repeater functions as the monitoring unit for data to be relayed.

Images