JPH11263226A - Fail safe system and railway crossing controller equipped with the same - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect the failure of a key switch by issuing an alarm when there is a failure in the key switch and if a state of neither a first switching state nor a second switching state occurs for a first fixed time. SOLUTION: When a use stop key switch 1 is operated after an up use stop switch 2-1 or a down use stop switch 2-2 is operated, an interface does not recognize the operation thereof. Irrespective of the state of a system, if the contact of the use stop switch 1 indicates an error state for over a fixed time, the state of the system is changed to a safety shut-down state for causing the system to output a safe side output to fix its operation. Also, before the state of the system is changed to the safety shut-down state, an alarm is issued by a means such as buzzer sounding, alarm lamp lighting, alarm message displaying or the like.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a fail-safe system capable of preventing an accident due to erroneous operation of any device, and a technology of a level crossing control device provided with the fail-safe system.

[0002]

2. Description of the Related Art Generally, a fail-safe system is used to prevent an accident due to an erroneous operation of a device.
As an example, a fail-safe system used in a railroad crossing control device will be described.

The railroad crossing control device detects a train entering or leaving a railroad crossing section by a sensor, and operates an alarm or crosses the railroad by lowering a circuit breaker while the train is present in the railroad crossing section. Block traffic. That is, when the train entry detection sensor (start point controller or starting track circuit) detects the entry of a train, the train entry detection sensor (end point controller or end track circuit) moves the train from the railroad crossing section. Activate the alarm until the is detected, and lower the circuit breaker. The above operation manages the on-line state of the train based on the characteristic of a normal train that the train always passes through the train entry detection sensor after passing the railroad crossing after passing through the train entry detection sensor.

[0004] However, a construction vehicle used for track maintenance work or the like runs in the opposite direction or turns back in the middle of a railroad crossing section, irrespective of the nature of this ordinary train. Therefore, if the on-line state of the construction vehicle is managed by the same logic as that of a normal train, inconsistency arises and hinders on-line management. Therefore, when a construction vehicle is used in a railroad crossing section for track maintenance work or the like, it is necessary to stop the operation of the railroad crossing control device by operating a switch.

Therefore, the operation of the level crossing control device itself is stopped by operating a use stop switch for stopping the operation of the level crossing control device. For this reason, if the use stop switch is operated carelessly, even if a normal train enters a railroad crossing section, the railroad crossing will not be cut off and a dangerous situation will occur. In order to prevent such a situation from occurring, a switch with a key is conventionally used as a switch for stopping use.
That is, since the use stop switch is a switch with a key, there is little danger that the operation of the railroad crossing control device will be stopped by inadvertent operation.

[0006]

However, according to the above-mentioned prior art, the following considerations must be taken in order to cope with an increase in the number of lines passing through a railroad crossing such as a double track.

First, when the number of lines buried in the railroad crossing control device increases, a plurality of keyed switches corresponding to the number of lines are required. Therefore, a staff member such as a track maintenance person must carry a plurality of keys corresponding to the number of tracks, and the management is troublesome.

Further, if a keyed switch having a plurality of switch states is used, one keyed switch can cope with the number of a plurality of lines. However, in order to control N lines independently, two N lines are required. A number of switch states are required.

In addition, it is necessary to establish a fail-safe system for a failure caused by a contact failure of the keyed switch.

The problem to be solved by the present invention is that even if the number of lines increases, the number of keys does not increase, the configuration of the keyed switch does not become complicated, and the operation of stopping the use of the railroad crossing control device is erroneously performed. Another object of the present invention is to provide a fail-safe system capable of preventing an accident due to a failure of a keyed switch, and a railroad crossing control device including the fail-safe system.

[0011]

In order to solve the above-mentioned problems, the present invention comprises a switch with a key and a plurality of switches without a key,
The operation of the keyless switch is valid only when the keyed switch is turned to a predetermined state. By doing this,
Without increasing the number of keys, without complicating the configuration of the keyed switch, the operation of the keyless switch will not be effective unless the keyed switch is turned to a predetermined state. Erroneous operation of stopping the use of the control device can be prevented without making effective operation effective.

Further, there is a problem with the keyed switch.
When a state other than the switch state and the second switch state occurs for the first predetermined time, an alarm is issued.
As a result, it is possible to detect that a malfunction of the keyed switch has occurred.

Further, when there is a malfunction in the keyed switch and a state other than the first switch state or the second switch state occurs for a second fixed time, a safety output for guaranteeing safe operation is output. Operate. This makes it possible to avoid the danger of the function controlled by the fail-safe system even if the malfunction occurs in the keyed switch for a certain period of time or longer.

[0014]

Embodiments of the present invention will be described below with reference to FIG. FIG. 1 shows a configuration of a railroad crossing control device according to the present invention. Railroad crossing control device 10
Is a level crossing control logic 1 connected to each of the train entry detection sensors 16 and 17 and the train entry detection sensors 15 and 18.
1 and 12, and an interface 3, a use stop key switch 1, an upstream use stop switch 2-1, and a downstream use stop switch 2-2.

The railroad crossing control logic 11 includes a train entry detecting sensor 16 such as a starting point controller for an up line or a starting track circuit.
A railroad crossing is controlled based on a train detection signal from a train advance detection sensor 15 such as an end point controller or an end track circuit. The output 22 of the railroad crossing control logic 11 is a signal for controlling an alarm and a circuit breaker (not shown).

Similarly, the railroad crossing control theory 12 controls the railroad crossing based on the train detection signals from the train entrance detection sensor 17 and the train advance detection sensor 18 on the down track.
The output 23 of the railroad crossing control logic 12 is a signal for controlling an alarm and a circuit breaker (not shown).

The interface 3 includes logical products 31, 32,
When the output of the use stop key switch 1 is ON, the logical products 31 and 32 enable the operation of the up use stop switch 2-1 and the down use stop switch 2-2. Let me. The signal 41 indicating the stop of use of uplink and the signal 42 indicating stop of use of downlink, which are the outputs of the logical products 31 and 32, can stop the operations of the railroad crossing control instructions 11 and 12, respectively. The decoder 6 has logical products 61, 62 and 63, and the complementary contact 1 of the inactive key switch 1.
It is determined as shown in Table 1 below which of the switches a and 1b is located or whether the switch is in an incorrect state.

[0018]

[Table 1]

That is, only when the contact 1a is closed and the contact 1b is open, the result of the determination of the switch position is ON.
Becomes If the contacts 1a and 1b are in the same closed or open state, it is determined that an error has occurred.

Only when the use stop key switch 1 is operated to a predetermined switch position determined to be ON according to the above-described embodiment, the operation of the up use stop switch 2-1 and the down use stop switch 2-2 is not performed. Valid.

Interface 3, Level control 1
Although the functions 1 and 12 are illustrated in a hardware image, they can be actually realized by software.

FIGS. 2 and 3 show two different embodiments of the railroad crossing control theory 11, 12, respectively. Counters 100, 102
Is a counter indicating the number of trains on the line, and counts i by 1 from a signal from the train entry detection sensors 16 and 17 when the train has passed the train entry detection sensors 16 and 17.
The train is conversely increased.
Each time the vehicle passes through the trains 5 and 18, the train advance detection sensor 15
The count value i is decremented by one by the signal from 18,
When the count value i is larger than 0, signals 22 and 23 for operating the alarm and the circuit breaker are output (however, the signals 22 and 23 are actually negative logics for fail-safe, The alarm and the breaker are not operated when the signals 22 and 23 are output, and the alarm and the breaker are operated when the signals 22 and 23 are not output. Because it is expressed as positive logic).

The logical sum 101 of the embodiment shown in FIG. 2 is obtained by a signal 41 indicating suspension of upstream use and a signal 42 indicating suspension of downstream use.
Signals 22 and 23 are suppressed, and the level crossing control instruction 1
The operations 1 and 12 are stopped. Further, the counter 102 in the embodiment of FIG. 3 can be initialized by signals 41 and 42, and the operation of the railroad crossing control logics 11 and 12 is stopped by the initialization.

FIG. 4 is a diagram of another embodiment showing only a portion different from the embodiment of FIG. 1. Momentary such as a push-button switch of an up-use stop switch 2-1 and a down-use stop switch 2-2. It has an interface 3 'for connecting to a switch. The output of the deactivation key switch 1 and the output of the uplink deactivation switch 2-1 and the downlink deactivation switch 2-2 are interpolated 31 by the interface 3 '.
Then, the RS flip-flops 34 and 35 are set. Further, the inverted signal of the output of the inactive key switch 1 resets the RS flip-flops 34 and 35. The RS flip-flops 34 and 35 output a signal 41 indicating suspension of upstream use and a signal 42 indicating suspension of downstream use.

Although the function of the interface 3 'is illustrated by a hardware image, it can be realized by software.

According to the embodiment shown in FIG. 4, only when the use stop key switch 1 is operated to a predetermined switch position, when the up use stop switch 2-1 or the down use stop switch 2-2 is depressed, The alarm and the circuit breaker can be set to the stop position. Further, the use stop state can be held until the use stop key switch 1 is returned to the original switch position.

FIG. 5 is a state transition diagram for functions relating to the upstream use stop switch 2-1 of the embodiment of FIG. In FIG. 5, the "waiting for use stop key switch ON" state S1 is a state immediately after the apparatus is started up. In the state S1, when the use stop key switch 1 is operated to a predetermined switch position and turned on, the "up use stop switch O"
Then, the state becomes the "waiting N" state S2. Subsequently, when the upstream use stop switch 2-1 is operated and becomes 0N, the state becomes "the upstream use stop switch ON recognition" state S3.
When the use stop key switch 1 is returned to the original switch position and turned off, the state transits to the state S1.

Similarly, as shown in FIG. 6, the same state transition is performed for the downstream use stop switch 2-2.

FIGS. 7 and 8 show the use stop key switch 1, the use stop switch 2-1 and the use stop switch 2-
6 is a time chart showing ON and OFF operation levels of the second and the recognition results at the interface 3;

As shown in FIG. 7, the interface 3
After operating the use stop key switch 1, when the up use stop switch 2-1 or the down use stop switch 2-2 is operated, the operation is recognized. Also, as shown in FIG.
The interface 3 recognizes that the operation has been operated even if the use stop key switch 1 is operated after operating the up use stop switch 211 or the down use stop switch 2-2.

However, in FIG. 9, unlike FIG. 8, the interface 3 operates when the use stop key switch 1 is operated after the up use stop switch 2-1 or the down use stop switch 2-2 is operated. , A state transition diagram of an embodiment that does not recognize that an operation has been performed is shown. According to the embodiment shown in FIG. 9, the interface 3 does not recognize that the switch has been operated unless the switches are operated in a predetermined order. Accordingly, even if the use stop key switch 1 is operated when the use stop switch 2-1 or the use stop switch 2-2 is operated by mistake, an accident due to the erroneous operation can be prevented.

In the state transition diagrams of the embodiments of FIGS. 10 and 11, a condition that there is no train on the railroad crossing section is added as a condition for transition to the state S3 of FIGS.
According to this embodiment, even if the use stop operation is performed by mistake while the train is entering the railroad crossing section, the use stop state does not occur, so that a dangerous situation due to the erroneous operation can be prevented beforehand.

FIG. 12 shows an embodiment in which the use stop key switch 1 and the decoder 6 are different from the embodiment shown in FIG. In FIG. 12, a deactivation key switch 1 'is a decoder 6' having redundant contacts 64, 65, and 66, which have redundant contacts 1a and 1a 'when the switch is closed.
The state of the inactive key switch 1 'is determined as shown in Table 2 below.

[0034]

[Table 2]

That is, only when both of the contacts 1a and 1a 'are closed, the result of the switch position determination is ON. If the contacts 1a and 1a 'are in different states, it is determined that an error has occurred.

In the embodiment shown in FIG. 12, only when the operation stop key switch 1 'is operated to determine that the predetermined switch position is ON, the upward use stop switch 2-1 and the downward use stop switch 2-2 are turned off. Enable the operation.

The embodiment of FIG. 13 is different from the embodiment of FIG.
Indicators 38 and 39 for displaying the recognition state of the operation of the up use stop switch 2-1 and the down use stop switch 2-2 are added, and the alternating signal generation functions 51 and 53 and the rectification circuit 5
An interface 3 ″ is added to the interface 3 and 2. The alternation signal generation functions 51 and 53 are controlled by a signal 41 indicating suspension of use of the uplink and a signal 42 indicating suspension of use of the downlink, respectively. Does not generate an alternating signal.
The rectifier circuits 52 and 54 clean the alternation signals generated by the alternation signal generation functions 51 and 53 and turn on the indicators 38 and 39.

Therefore, the interface 3 ″ is connected to the upstream use stop switch 2-1 and the downstream use stop switch 2-2.
If it is not recognized that 2 has been operated, the corresponding indicators 38 and 39 are turned on. When it is recognized that the use is stopped, the corresponding indicators 38 and 39 are turned off. By turning off the light in this way, the display 3
When the indicators 38 and 39 do not light up due to the failure of the switches 8 and 39 due to a failure or the like, the operator is prevented from recognizing that they are in the normal use state despite the use stop state.

In other words, contrary to the embodiment shown in FIG. 13, the interface 3 does not recognize that the upstream use stop switch 2-1 and the downstream use stop switch 2-2 have been operated (the use has been stopped). In the case, the corresponding indicator 3
When the man-machine interface is specified so that the corresponding indicators 38 and 39 are turned on when it is recognized that the buttons 8 and 39 have been turned off and operated (the use has been stopped),
When the indicators 38 and 39 are cut off due to a failure or the like, the indicators 38 and 39 do not light up. Therefore, the operator recognizes that the operator is in the normal use state (non-use stop state) even though the use is stopped. There is a risk that it will.

When the indicators 38 and 39 are driven by logic gates and transistors and turned on, the indicators 38 and 39 are stuck-at-1 failures (ON fixed failures) of the logic gates and transistors. It remains lit, and the operator may recognize that the vehicle is in the normal use state that is not in the use stop state although it is in the use stop state.

However, the rectifier circuit is a circuit that converts the energy of the input alternating signal into direct current and outputs it, and is a passive circuit or a unity circuit that does not output energy unless energy is externally input. Therefore, unless the alternation signal is supplied from the alternation signal generation functions 51 and 53, it is impossible to turn on the indicators 38 and 39 without outputting the DC voltage. Therefore, in the embodiment of FIG. 13, the alternation signal generated by the alternation signal generation functions 51 and 53 is rectified and the indicators 38 and 39 are turned on.

As described above, the active element stuck-at-1
Due to the failure (ON fixed failure), the indicators 38 and 39 are not turned on, which may cause the operator to recognize that the operator is in the normal use state (non-use stop state) even though it is in the use stop state. Never do.

In the embodiment shown in FIG.
Although the case where a light emitting diode is used is illustrated as 8 and 39, it is needless to say that the present invention can be applied to a case where another light emitting element, a light bulb or the like is used.

FIG. 14 shows an embodiment of an operation panel according to the fail-safe system of the present invention. In FIG. 14, the operation panel includes a use stop key switch 1, an up use stop switch 2-1, a display 38, a down use stop switch 2-2, and a display 39.

The use stop key switch 1 has two switch positions, a normal use and a stop. Upward use stop switch 2-
1 and the operation of the down use stop switch 2-2 are effective only when the use stop key switch 1 is at the stop switch position. That is, when the stop key switch 1 is in the stop switch position, the upstream stop switch 2-
By depressing the downshift switch 1 or the downshift switch 2-2, the corresponding line is put into a stoppage state.

FIG. 15 shows that the indicators 38 and 39 incorporated in the upward use stop switch 2-1 and the lower use stop switch 2-2 are lit when in the normal state.

Next, FIGS. 16 to 19 show a method of operating the operation panel according to the fail-safe system of the present invention. FIG.
As shown in FIG. 6, a key is inserted into the stop key switch 1 and turned to the stop switch position in order to set the stop state. In this state, the up line 13 and the down line 14 are still in a normal state, and the corresponding indicators 38 and 39 are also lit. Thereafter, as shown in FIG.
When -1 is depressed, the up line 13 is put into a useless state,
Display 3 built in the upper use stop switch 2-1
8 goes out. As shown in FIG. 18, when the downstream use stop switch 2-2 is further pressed, the use of the downstream line 14 is also stopped, and the display 39 built in the downstream use stop switch 2-2 is also turned off. As shown in FIG. 19, when the use stop key switch 1 is in the normal switch position, the use stop state is not obtained even if the up use stop switch 2-1 or the down use stop switch 2-2 is pressed. Instead, the indicators 38 and 39 also remain lit.

Since the embodiments shown in FIGS. 4 to 19 involve state transitions, it is easier to realize them using software than to realize them all in hardware.

FIG. 20 shows a hardware embodiment in which the functions of the interfaces 3 'and 3''are realized by software. In this embodiment, a microprocessor 200 for performing arithmetic processing and a storage device 2 for storing data
02, an interface circuit 3 ′ ″, a data bus 201 connecting the microprocessor 200, the storage device 202, and the interface circuit 3 ″ ″, an inactive key switch 1,
Uplink use stop switch 2-1, Downlink use stop switch 2
-2, rectifier circuits 52 and 54, and indicators 38 and 39.

Use stop key switch 1, upstream use stop switch 2-1, downstream use stop switch 2-2, display 3
8, 39 are the data bus 2 of the microprocessor 200.
01 is connected to each of the rectifier circuits 52 and 54 and the interface circuit 3 ′ ″. The microprocessor 200 refers to a specific address and a specific bit corresponding to each of the suspension key switch 1, the upstream suspension switch 2-1 and the downstream suspension switch 2-2, and thereby the suspension key switch 1 and the upstream suspension switch 2-1. Stop switch 2-
1. The microprocessor 200 can recognize the 0N, OFF state of the downstream use stop switch 2-2.

In the embodiment shown in FIG. 20, rectifier circuits 52 and 54 are provided instead of the alternating signal generation function shown in FIG.
1 and 0 are periodically and alternately written to a specific address and a specific bit corresponding to the input of, and the indicators 38 and 39 can be turned on and off. Programs for realizing the functions of the interfaces 3 ′ and 3 ″ and the alternating signal generation functions 51 and 53 in FIG. 13 are stored in the storage device 202, and the microprocessor 200 performs arithmetic operations according to these programs. The functions of the interfaces 3 ′ and 3 ″ of the embodiment shown in FIGS. 4 to 19 are realized.

As shown in FIG. 20, the alternating signal generation functions 51 and 53 are controlled by software (a rectifier circuit 52,
(By periodically and alternately writing 1s and 0s to a specific address and a specific bit corresponding to the input of 54), a stuck-at-1 failure (ON fixed failure) or a stuck-at- When a 0 failure (OFF fixed failure) occurs, it is possible to prevent the output of the alternating signal. That is,
Stuck-at-1 failure of active element (ON fixed failure) or stuc
The alternation signal does not remain output from the alternation signal generation functions 51 and 53 due to the k-at-0 failure (OFF fixed failure).

FIG. 21 shows an incorrect state of the contacts (contacts 1a and 1b in the embodiment of FIG. 1 and contacts 1a and 1a 'in the embodiment of FIG. 12) of the deactivation key switch 1. Or, if the state determined to be an error has continued for a certain period of time or more based on Table 2, the system outputs a safe output (in any case, an output that guarantees safe operation from the next stage on). Is fixed, that is, the system is safely shut down.
Even if the system is in any of the states S1, S2, and S3, if the contact of the deactivation key switch 1 indicates an error state for a certain period of time or more, the system outputs a safe side output to fix the operation. The state of the system is transited to the safety shutdown state S4.

Before the state of the system is shifted to the safety shutdown state S4, an alarm is generated by means such as a buzzer, an alarm lamp, an alarm message display, and the like. Is changed to FIG.
In the case of a human error as shown in (1), recovery from an erroneous operation state can be prompted.

In the case of the railroad crossing control device, for example, the safe side output (in any case, the output that guarantees the safe operation of the next and subsequent stages) means that the alarm is activated, the circuit breaker is lowered, and the railroad crossing is performed. This is the output that cuts off.

According to the embodiment of the state transition diagram of FIG. 21,
Failure of the contacts of the inactive key switch 1 or the interface connected thereto, or the inactive key switch 1 is placed in an incorrect switch position between "normal" and "inactive" as shown in FIG. If a human error occurs, the system can output a safe side output and perform a safety shutdown to fix the operation.
It is possible to prevent the dangerous output from being output against the operator's intention, and to ensure the safety of the system.

Before the system state is shifted to the safety shutdown state S4, an alarm is generated by means such as a buzzer, an alarm lamp is turned on, and an alarm message is displayed. Is changed to FIG.
In the case of a human error as shown in (1), recovery from an erroneous operation state can be prompted.

In FIG. 1, the description of the railroad crossing control device has been made by taking as an example the case of a double track consisting of an up line 13 and a down line 14, but it may also correspond to a single line 13 'as shown in FIG. It is possible. In this case, the train advance detection sensor 15 is shared for going up and down. Other operations are the same as those in the embodiment of FIG.

FIG. 24 shows an embodiment of an operation panel in the case where the present invention is applied to a double-track line. in this way,
The safety system of the present invention can be similarly applied to a level crossing control having a plurality of tracks.

[0060]

As described above, according to the present invention,
The use stop switch is composed of one keyed switch and a plurality of keyless switches, and the operation of the keyless switch is enabled only when the keyed switch is turned to a predetermined position, so that the number of keys is not increased. Without complicating the configuration of the keyed switch, the operation of the keyless switch is not effective unless the keyed switch is turned to a predetermined position, so that careless operation of the keyless switch is not enabled, An accident due to an erroneous operation of stopping the use of the railroad crossing control device can be prevented even for a malfunction of the keyed switch.

[Brief description of the drawings]

FIG. 1 is a diagram showing an embodiment of a railroad crossing control device according to the present invention.

FIG. 2 is a diagram showing a first embodiment of the railroad crossing control logic 11, 12 in FIG.

FIG. 3 is a diagram showing a second embodiment of the railroad crossing control logic 11, 12 in FIG.

FIG. 4 is a diagram showing an embodiment of a suspension switch interface according to the present invention.

FIG. 5 is a state transition diagram of a suspension switch interface (uplink suspension) according to the present invention.

FIG. 6 is a state transition diagram of a suspension switch interface (downstream suspension) according to the present invention.

FIG. 7 is a time chart of a use stop switch interface according to the present invention.

FIG. 8 is a time chart of the use stop switch interface according to the present invention.

FIG. 9 is a time chart of a use stop switch interface according to the present invention.

FIG. 10 is a state transition diagram of a suspension switch interface (uplink suspension) according to the present invention.

FIG. 11 is a state transition diagram of a suspension switch interface (downstream suspension) according to the present invention.

FIG. 12 shows a different embodiment of the use stop key switch 1 and the decoder 6 of FIG.

FIG. 13 is a view showing another embodiment of FIG. 4;

FIG. 14 is a diagram showing an embodiment of a switch operation panel according to the present invention.

FIG. 15 is a view showing the operation of the switch operation panel according to the present invention.

FIG. 16 is a diagram showing the operation of the switch operation panel according to the present invention.

FIG. 17 is a view showing the operation of the switch operation panel according to the present invention.

FIG. 18 is a view showing the operation of the switch operation panel according to the present invention.

FIG. 19 is a view showing the operation of the switch operation panel according to the present invention.

FIG. 20 is a diagram showing an embodiment of hardware to be realized by software according to the present invention.

21 is a state transition diagram obtained by adding a safety shutdown state S4 to the state transition diagram of FIG.

FIG. 22 is a diagram showing an embodiment when a switch operation panel according to the present invention is operated erroneously.

FIG. 23 is a diagram showing an embodiment of a single-rail level crossing control device according to the present invention.

FIG. 24 is a diagram showing an embodiment of a multiple-track switch operation panel according to the present invention.

[Explanation of Signs] 1 Key switch for suspending use 2-1 Switch for suspending use of uplink 2-2 Switch for suspending use of lower part 3 Interface 10 Railroad crossing control device 11, 12 Railroad crossing control logic 38, 39 Display

Continuing from the front page (72) Inventor Shinichiro Yamaguchi 7-1-1, Omika-cho, Hitachi City, Ibaraki Prefecture Inside Hitachi Research Laboratory, Hitachi, Ltd. (72) Inventor Tsunebu Kikuchi 2-2-2 Yoyogi Shibuya-ku, Tokyo East Inside the Japan Railway Company (72) Kyosuke Isono 2-2-2 Yoyogi, Shibuya-ku, Tokyo East Japan Railway Company (72) Takayuki Meguro 2-2-2 Yoyogi, Shibuya-ku, Tokyo No.East Japan Railway Company

Claims (4)

[Claims] 1. A switch having a key and at least one keyless switch, wherein the keyed switch has a first switch state in which the operation of the keyless switch is valid and a second switch state in which the operation of the keyless switch is invalid. 2 when the keyed switch is in the first switch state, the operation of the keyless switch is valid, and when the keyed switch is in the second switch state, If the operation of the keyless switch is invalid and the keyless switch is operated while the keyed switch is in the first switch state, the safety-side output that guarantees safe operation is stopped. In the fail-safe system, an alarm is issued when the state of the keyed switch other than the first switch state or the second switch state is longer than a first fixed time. Lumpur-safe system. 2. A switch having a key and at least one keyless switch, wherein the keyed switch has a first switch state in which the operation of the keyless switch is valid and a second switch state in which the operation of the keyless switch is invalid. 2 when the keyed switch is in the first switch state, the operation of the keyless switch is valid, and when the keyed switch is in the second switch state, If the operation of the keyless switch is invalid and the keyless switch is operated while the keyed switch is in the first switch state, the safety-side output that guarantees safe operation is stopped. In a fail-safe system, when a state in which the keyed switch is not any of the first switch state and the second switch state is equal to or longer than a second predetermined time, a safety operation for ensuring safe operation. Failsafe system characterized by but operated. 3. It has a function of detecting entry and exit of a vehicle at a level crossing section, and when detecting entry of the vehicle to a level crossing section, an alarm or shut-off until detection of entry of the vehicle from the level crossing section. A crossing control device for operating the machine, comprising a keyed switch and at least one or more keyless switches,
The keyed switch has a first switch state in which the operation of the keyless switch is valid, and a second switch state in which the operation of the keyless switch is invalid.
When the keyed switch is in the first switch state, the operation of the keyless switch is effective, and
If the keyed switch is in the second switch state, the operation of the keyless switch is invalid, and if the keyless switch is operated while the keyed switch is in the first switch state, the entry is disabled. Or, in the railroad crossing control device provided with a fail-safe system that recognizes that the vehicle that has entered is a construction vehicle, a state in which the keyed switch is not in either the first switch state or the second switch state A level crossing control device that issues an alarm when the time exceeds a first fixed time. 4. A function for detecting entry and exit of a vehicle at a railroad crossing section, and when detecting the advancement of the vehicle to a railroad crossing section, an alarm or shut-off until detection of the advancement of the vehicle from the railroad crossing section. A crossing control device for operating the machine, comprising a keyed switch and at least one or more keyless switches,
The keyed switch has a first switch state in which the operation of the keyless switch is valid, and a second switch state in which the operation of the keyless switch is invalid.
When the keyed switch is in the first switch state, the operation of the keyless switch is effective, and
If the keyed switch is in the second switch state, the operation of the keyless switch is invalid, and if the keyless switch is operated while the keyed switch is in the first switch state, the entry is disabled. Or, in the railroad crossing control device provided with a fail-safe system that recognizes that the vehicle that has entered is a construction vehicle, a state in which the keyed switch is not in either the first switch state or the second switch state A level crossing control device characterized in that when the time is equal to or longer than a second predetermined time, a safety-side output operation that guarantees a safe operation is performed.