JP5281566B2 - Railway security system - Google Patents

Description

  The present invention relates to configuration control of an interlocking device in a railway security system.

  In a conventional dual system interlocking device, for example, as shown in Patent Document 1, each interlocking device always performs a paired system abnormality determination, and when an abnormality is detected, the system that detected the abnormality is The standby system is switched to the active system by outputting a failure signal and switching the system.

  The present invention is different in that, in addition to the information of only the conventional interlocking device, the abnormality determination is performed based on the paired information obtained via the control device, and the configuration control is performed. An apparatus for carrying out the present invention is composed of a main system and a sub system, and performs control output in both systems.

  Further, Patent Document 2 discloses a backflow prevention circuit in which a terminal logic unit and an external output unit are dual systems with respect to an object to be controlled, and an external output unit of each system prevents a wraparound from an output circuit of another system to an output circuit. And a double fault diagnosis device is disclosed in which a first fault diagnosis circuit and a second fault diagnosis circuit are connected before and after the backflow prevention circuit.

JP-A-9-319401 JP-A-3-253903

  Conventionally, in the interlocking device, information for determining the abnormality of the paired system has been obtained from a plurality of intersystem cables that directly connect the interlocking devices. However, there was a problem that when all the cables between multiple systems were cut off at the same time, information to determine the status of the paired system could not be obtained, and both duplex systems would become the main system and safety could not be secured. .

  The present invention aims to improve the safety of the interlocking device, and can determine the abnormality of the pairing system via a third party in addition to the intersystem cable between the interlocking devices without newly adding parts such as devices and cables. The issue is to realize a railway security system.

The railroad security system according to the present invention includes a route control device that manages the operation of a railroad and instructs a route setting, a dual interlocking device that controls signal equipment of the railroad system, and an instruction from the interlocking device. An electronic terminal that performs input / output control of the signal equipment, a dual control device that transmits information for the input / output control of the electronic terminal in accordance with the state information of the signal equipment from the interlocking device, A communication control device that connects each of the dual-system interlocking devices and each of the dual-system control devices, and a monitoring terminal device that maintains the interlocking device and the control device, and one of the interlocking devices is a main system In the railway safety system that switches the other interlocking device to the main system when it is determined that the one interlocking device is stopped due to an abnormality in intersystem communication , the control device Interlocking A reception management table indicating whether or not a control message has been received from an interlocking device operating as a main system, is transmitted to both of the interlocking devices, and the interlocking device uses the received reception management table to When the interlocking device that is determined to be stopped due to an abnormality in inter-communication is detected that the control message is being transmitted, both interlocking devices of the dual system can be It is possible to avoid becoming a main system .

  Specifically, the interface between the interlocking device and each of the control devices is composed of an interface that responds to a display telegram for notifying a field device state to a control telegram from the interlocking device. Each control device possesses a table that manages whether or not a control message is received from the interlocking device as a reception state management table. By updating each control cycle, the presence / absence of control message reception from the interlocking devices 1 and 2 is managed.

  Each of the control devices responds by adding the contents of the reception state management table in a display message that responds when a control message is received from the interlocking device. Thus, each system of the interlocking device that has received the display message knows the transmission status of the control message of the partner system.

  This mechanism avoids both main system states that occur when a plurality of intersystem cables are all interrupted simultaneously. Since a control telegram is transmitted from the interlocking device 1 and 2 system, the control devices notify the state by a display telegram, so that the interlocking device systems that have become both main systems are determined to be stopped. It is known that the control message has been transmitted from the partner system. By knowing that the partner system is not stopped, both main systems are avoided by making the own system transition to the stopped system.

  According to the present invention, by using an existing control device and communication control device, it becomes possible to detect an abnormal operation of a pair system in a route other than an intersystem cable without adding a new device or cable. .

  In addition, when both main systems are generated, there are two main problems. First, since the main system originally communicates with the upper-level route control device, the main system of the interlocking device recognized by the route control device is replaced every time transmission is performed, and the serial numbers do not match, resulting in a communication error.

Secondly, in the two main systems that are generated in a state where all the communication between the systems is cut off, synchronization cannot be synchronized between the systems, so that the control data does not match or the timing shift occurs, causing an apparatus abnormality.
If the invention is used, the continuation of both main systems can be prevented, so that the above two problems can be solved.

FIG. 1 is a configuration diagram of a railway security system to which the present invention is applied. FIG. 2 is a diagram illustrating a communication sequence between the interlocking device, the control terminal, and the electronic terminal. FIG. 3 shows a conventional mechanism for detecting abnormalities in the system. FIG. 4 shows a mechanism for detecting a system abnormality in the railway security system according to the first embodiment of the present invention. FIG. 5 is a flowchart for detecting anomalies in the railway safety system according to the first embodiment of the present invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  In the dual system interlocking device, in order to ensure reliability and fail-safety, operations are performed in association with each other. The same data can be input to both systems, synchronized and processed in the same way, and the same result can be obtained in normal times. Even if an abnormality occurs in one system and it stops, the other system performs control independently and continues continuous operation.

  FIG. 1 is a configuration diagram of a railway security system to which the present invention is applied. In FIG. 1, the system includes a route control device 11, an interlocking device 12, a communication control device 13, a monitoring terminal device 14, a control device 15, and an electronic terminal 16.

  The route control device 11 is a dual system device that performs route control processing such as issuing a route setting instruction for a train based on the schedule information.

  The interlocking device 12 having the interlocking logic and the signal equipment control logic reads the instruction from the course control device 11 and the state of the signal equipment (such as the traffic light 17 and the switch 18), executes a logical operation in consideration of safety, It is a dual system device that creates state information of signal equipment (such as the traffic light 17 and the switch 18) and changes the state of the signal equipment via the communication control device 13 -the control device 15 -the electronic terminal 16.

  The control device 15 is a double device, and transmits information for controlling the facility with an electrical I / F (Interface) to the electronic terminal 16 in accordance with the signal facility state information from the interlocking device 12.

  The electronic terminal 16 is an apparatus that determines and outputs an electrical I / F from information for controlling the facility, and performs IO (Input / Output) control of the signal facility. For example, it is a device that outputs a progress indication to the traffic light 17.

  The communication control device 13 is a device that performs network control (route control and flow control) for communication between the interlocking device 12, the control device 15, and the monitoring terminal device 14. This apparatus performs communication control among the interlocking device 12, the control device 15, and the monitoring terminal device 14.

  The monitoring terminal device 14 is installed as a device that maintains the interlocking device 12 and the control device 15 that constitute the system.

FIG. 2 is a diagram illustrating a communication sequence between the interlocking device 12, the control device 15, and the electronic terminal 16. As shown in FIG. 2, normal communication is performed with the relationship between the control message with serial number 1 and the display message with serial number 1 as “exchange of control message with the same serial number and display message within the same control cycle” as shown in FIG. Judge that At this time, via the control device 15 from the interlocking device 12, control message the control instruction message to be sent to the electronic terminal 16 receives a control instruction, signal equipment state to be transmitted from the electronic device 16 via the control unit 15 to the interlock device 12 The information message is a display message.

  One control cycle is established with a display message from the electronic terminal 16 via the control device 15 for a control message from the interlocking device 12.

  IO (Input / Output) control for the signal equipment of the electronic terminal 16 is performed by a control message from the interlocking device 12, and a display message is transmitted to the interlocking device 12 as a result of the control. A control message from the interlocking device 12 is determined by “station-specific data” possessed by the interlocking device 12.

  The state in which the interlocking device 12 performs control includes a main system and a slave system. When both systems are normally activated, one of the first system and the second system is the master system, and the other is the slave system. .

  Similarly, both systems of the interlocking device 12 read the state of field devices such as the traffic light 17 and the switch 18, execute logical processing, and after all the control data are collated, both systems transmit a control message to the control device 15. To do.

  The difference between the main system and the subordinate system is that the main system performs communication with the host route control device 11 and that the main system performs a synchronous interrupt for matching the processing timing. There is no functional difference between the subordinate and the subordinate.

  When control is performed by one interlocking device 12, it operates only in the main system. For this reason, when the main system is stopped due to an apparatus abnormality, a processing abnormality, or the like during operation in the dual system, the slave system has a function of becoming the main system.

FIG. 3 is a diagram showing simplified inter-system communication of the interlocking device. Parts that are not necessary for the explanation of the decision to stop the system are omitted. Factors that determine that the paired system is stopped include the communication status of three routes between the interlocking device 12 systems. The first is an anomaly detection by an intersystem watchdog timer connected by RS-485 between data collation boards. The second is detection of reception timeout of communication between systems in which communication boards of each system are connected by ETH (ETHernet : registered trademark, referred to as “ETH” ). The third is a reception timeout detection communication between connecting I systems between the system of the general-purpose CPU (B) at ET H.

  When the interlocking device 12 actually stops, an abnormality is detected in all three. However, since the same result is obtained even if the cable body is abnormal, such as a cable disconnection or cable disconnection, the slave side is stopped if any one of the abnormality is detected for the purpose of acting on the safety side.

  When detecting an abnormality in all three routes, in addition to the case where the interlocking device 12 is stopped, it is conceivable that the three routes are simultaneously disconnected or an abnormality of the cable body such as a cable disconnection occurs simultaneously.

  In the latter case, since it cannot be distinguished from the interlocking device 12 stop, the secondary system is considered to be a counter system stop and becomes the master system, resulting in a situation of both master systems.

  FIG. 4 shows a mechanism for detecting anomalies in the system according to the present invention. In FIG. 4, reference numeral 12 denotes an interlocking device, and 15 denotes a control device.

  The control device 15 receives the control message from the interlocking device 12-1 that the interlocking device 12-2 considers to be stopped in the above-mentioned main system situation. In the reception management table of the control device 15, the control device 15 receives the control message. Set with Yes. This information is transmitted as a display message from the control device 15 to the interlocking device 12-2, and the interlocking device 12-2 transmits a message to the control device 15 from the paired interlocking device 12-1 that should have stopped. Make sure. As a result, both main systems are detected and the own system is shifted to stop.

  As a communication route other than the three intersystem cables, a proposal for using communication with the route control device 11 was also examined. When the route control device 11 receives a message from the main system other than the interlocking device 12 recognized by the route control device 11, it determines that the system switching of the interlocking device 12 has occurred. When both main systems are entered, it is determined that system switching has occurred each time a message is received from the interlocking device 12. By confirming this phenomenon by a station commander or the like, both main systems can be detected. However, between the interlocking device 12 and the control device 15 is fail-safe communication in which data check, CRC check, serial number check, and other rationality checks are performed and then transmitted and received, but the route control device 11 is not a security device. Therefore, the route control device 11 and the interlocking device 12 are not subject to fail-safe communication. In consideration of data reliability, the control unit 15 is used.

  FIG. 5 is a flowchart for detecting anomalies in the railway safety system according to the first embodiment of the present invention. In step 401 of FIG. 5, the process starts when there is an abnormality in the read data between the interlocking device 12 systems. In step 402, it is determined whether or not the operating state is a dual system operation. Judgment is made based on the result of reading the table in which the operation state is written.

  In the case of dual system operation (YES), in step 403, an abnormality determination is made for each of the three routes between the interlocking device 12 systems, and a counter system stop determination process is performed. As a result, the process proceeds to step 404 and branches depending on whether the system is stopped or not. If the system is stopped (YES), the process proceeds to step 405, where it is determined that the system has stopped and abnormality processing is performed. If it is not other than a system stop (NO), the process proceeds to step 406, and a system sudden stop stop monitoring process is performed to determine whether an abnormality has occurred continuously.

  In step 402, when the operation is other than the dual operation (NO), the same processing as in the dual operation is performed up to steps 403 and 404. If it is determined in step 404 that the system is stopped (YES), the process proceeds to step 407. If it is other than stopping the system (NO), the process proceeds to step 408.

  Hereinafter, the processing of the newly added portion relating to the present invention will be described. In step 407, it is determined whether there is a transmission from the interlocking device 12 pair system to the control device 15. If there is no transmission from the paired system to the control device 15 (NO), the process proceeds to step 408, and the paired transmission counter that counts the number of transmissions from the paired interlocking device 12 to the control device 15 is cleared.

  If there is a transmission from the counterpart system to the control device 15 (YES), the process proceeds to step 409, and it is determined how many times the transmission state is continued. If it continues for more than the specified number of times (YES), it is determined that there is a transmission from the counter system that is considered to have been stopped, and the process proceeds to step 410 to perform an abnormality process. If it is less than the prescribed number (NO), the process proceeds to step 411 to update the counter transmission counter.

DESCRIPTION OF SYMBOLS 11 Track control device 12 Interlocking device 13 Communication control device 14 Monitoring terminal device 15 Control device 16 Electronic terminal 17 Traffic light 18 Switch 19

Claims (1)

A route control device for managing the operation of the railway and instructing the route setting;
A dual interlocking device that controls the signal equipment of the railway system;
An electronic terminal that performs input / output control of the signal equipment in accordance with an instruction from the interlocking device;
In accordance with the state information of the signal equipment from the interlocking device, a dual control device that conveys information for the electronic terminal to perform input / output control;
A communication control device connecting the respective control unit of the double-system and the interlocking system wherein each of the double-system,
When the interlocking device and a monitoring terminal device that maintains the control device are provided, and one of the interlocking devices is operating as a main system, the one interlocking device is stopped due to an abnormality in intersystem communication. In the railway security system that switches the other interlocking device to the main system when it is determined that
The control device transmits a reception management table indicating whether or not a control message is received from the interlocking device operating as a main system among the interlocking devices to both of the interlocking devices,
When the interlocking device that is determined to be stopped due to an abnormality in intersystem communication is detected by the received reception management table that the interlocking device is transmitting the control message, the interlocking device is A railway security system characterized by avoiding both of the interlocking devices of the double system becoming the main system by stopping .

Images