NL2019206B1 - Control system for a railway crossing - Google Patents

Control system for a railway crossing Download PDF

Info

Publication number
NL2019206B1
NL2019206B1 NL2019206A NL2019206A NL2019206B1 NL 2019206 B1 NL2019206 B1 NL 2019206B1 NL 2019206 A NL2019206 A NL 2019206A NL 2019206 A NL2019206 A NL 2019206A NL 2019206 B1 NL2019206 B1 NL 2019206B1
Authority
NL
Netherlands
Prior art keywords
channel
signal
control system
railway crossing
logic
Prior art date
Application number
NL2019206A
Other languages
Dutch (nl)
Inventor
Edwin Van Wissen Robert
Wilhelmus Van Maarschalkerweerd Carolus
Original Assignee
Vialis B V
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Vialis B V filed Critical Vialis B V
Priority to NL2019206A priority Critical patent/NL2019206B1/en
Priority to EP18182560.5A priority patent/EP3428037A1/en
Application granted granted Critical
Publication of NL2019206B1 publication Critical patent/NL2019206B1/en

Links

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L29/00—Safety means for rail/road crossing traffic
    • B61L29/24—Means for warning road traffic that a gate is closed or closing, or that rail traffic is approaching, e.g. for visible or audible warning

Landscapes

  • Engineering & Computer Science (AREA)
  • Mechanical Engineering (AREA)
  • Train Traffic Observation, Control, And Security (AREA)
  • Electric Propulsion And Braking For Vehicles (AREA)

Abstract

Control system for a railway crossing having signal inputs (8) and signal outputs (AC), and processing logic (P). The processing logic includes a channel A part (PA) and a channel B part (PB) for each railway crossing logic function (such as controlling white and red lights). Each of the channel A part (PA) and the channel B part (PB) has an AND logic gate (AA; AB) receiving a direct signal (DI-A; Dl-B) and a cross check signal (DI-AtoB; Dl-BtoA) and outputting an internal data signal (Dll). The cross check signal (Dl-AtoB; Dl-BtoA) is provided by a first data exchange channel (SE-A) between the channel A part (PA) and the channel B part (PB). The processing logic is implemented to provide the control system with a sufficient high availability and reliability depending on the requirements ofthe specific railway crossing logic function.

Description

Control system for a railway crossing
Field of the invention
The present invention relates to a control system for a railway crossing, wherein the control system comprises a plurality of signal inputs and a plurality of signal outputs, and processing logic connected to the plurality of signal inputs and plurality of signal outputs,
Background art
Control systems for railway crossings are still mostly based on hard-wired circuitry and logic, separate for each railway crossing function. As in other technical application areas, system integration is attempted, but difficult to achieve in view of the very high safety, reliability and availability levels now required.
Summary of the invention
The present invention seeks to provide an improved control system fora railway crossing, which is provided as an integrated and flexible system.
According to the present invention, a control system as defined above is provided, wherein the processing logic comprises a channel A part and a channel B part for each railway crossing logic function, wherein the plurality of signal inputs are each connected to both the channel A part and the channel B part of the processing logic to input a channel A signal and channel B-signal, each of the channel A part and the channel B part comprising an AND logic gate receiving a direct signal and a cross check signal and outputting an internal data signal, the cross check signal being provided by a first data exchange channel between the channel A part and the channel B part. In a further embodiment, an output signal associated with each railway crossing logic function is arranged in either a redundant availability implementation or a redundant implementation with diagnostics.
The invention embodiments allow the processing logic to be implemented in a flexible manner, in order to provide the control system with a sufficient high availability and reliability depending on the requirements of the specific railway crossing logic function.
Short description of drawings
The present invention will be discussed in more detail below, with reference to the attached drawings, in which
Fig. 1 shows a schematic diagram of a processing logic implementation for a railway crossing function according to an embodiment of the present invention;
Fig. 2 shows a schematic diagram of a processing logic implementation for a railway crossing function according to a further embodiment of the present invention;
Fig. 3 shows a schematic diagram of an output part of a processing logic implementation for a railway crossing function according to an embodiment of the present invention;
Fig. 4 shows a schematic diagram of an output part of a processing logic implementation for a further railway crossing function according to a further embodiment of the present invention;
Fig. 5 shows a schematic diagram of an output part of a processing logic implementation for an even further railway crossing function according to an even further embodiment of the present invention.
Description of embodiments
Railway crossings are nowadays guarded and monitored using warning devices (light, sound) and physical blocking devices (moving barrier), and controlled remotely and fully automatic. To allow the remote and automatic control of railway crossing devices, various sensors and data exchange to a central rail surveillance center are used. Also, for the various railway crossing related functions, the implementation is such that safety can be guaranteed to a high as possible level (e.g. using fail-safe design of equipment), but also the availability of systems (often expressed as mean time between failure MTBF) is required to be high. Using conventional control systems, it is possible that some requirements related to safety and availability cannot be met.
According to the present invention embodiments, the design of a control system for a railway crossing allows a flexible allocation of the system resources allowing to obtain a predetermined degree of safety and availability for each and every function associated with operation of a railway crossing. Functions associated with a control system of a railway crossing may include, but are not limited to actuation of the railway gate (closing actuation and opening actuation may be seen as separate functions), actuation of the red warning lights, actuation of warning sounds, actuation of white lights, actuation of a radar device, reception of sensor signals, reception of signal post signals, generation of signal post signals. The railway crossing functions may be implemented as logic functions, using one or more input parameters and providing one or more output signals.
Depending on requirements, especially the availability of different functions for the control system may vary significantly. For example, the availability for the operation of barriers of a railway crossing may be less stringent than the availability for the operation of the white lights (which indicate to users that it is safe to cross the railway crossing). If the availability is measured in mean time between failure (MTBF) figures in failures per hour, the threshold value for operation of the white lights may be orders of magnitude smaller (e.g. around 1E-10 failures/hour) compared to the function of operation of the barrier (e.g. around 1E-7 failures/hour).
The present invention embodiments relate to a control system for a railway crossing, wherein the control system comprises a plurality of signal inputs (S) and a plurality of signal outputs (AC), and processing logic (P) connected to the plurality of signal inputs (S) and plurality of signal outputs (AC). The processing logic comprising a channel A part (PA) and a channel B part (PB) for each railway crossing logic function. This is shown in the schematic view of an exemplary implementation in Fig. 1. The plurality of signal inputs S e.g. comprise control input signals and/or sensor input signals, and the plurality of signal outputs AC e.g. comprises signalling output signals and/or actuator drive signals. The plurality of signal inputs (S) are each connected to both the channel A part (PA) and the channel B part (PB) of the processing logic (P) to input a channel A signal (Dl-A) and channel B-signal (Dl-B). This allows two independent executions of logic functions for the railway crossing functions by a first logic server LA in the channel A part PA and a second logic server LB in the channel B part PB, resulting in an increased (redundancy based) safety level. To prevent an unwanted system behaviour if a failure would occur in the input part of the control system, the channel A part PA and channel B part PB are arranged to cross check the input signals. In each channel A, B, the logic servers LA, LB each provide an independent output signal DO-A and DO-B, respectively.
In the embodiment as shown in Fig. 1, this cross check is implemented by each of the channel A part (PA) and the channel B part (PB) comprising an AND logic gate (AA; AB) receiving a direct signal (Dl-A; Dl-B) and a cross check signal (Dl-A; Dl-B) and outputting an internal data signal (Dll). The cross check signal (Dl-A; Dl-B) is provided by a first data exchange channel (SE-A) between the channel A part (PA) and the channel B part (PB). The AND logic gates AA, AB ensure that the first channel A cannot unsafely influence the other channel B, and vice versa. In other words, a failure in an input part of one of the channels A, B can never result in using an unsafe value of the input signal Dl-A, Dl-B in the other channel B, A. The first data exchange channel SE-A is e.g. a safe-Ethernet channel as available in many present day processing logic modules, e.g. in the form of a Programmable Logic Control (PLC) unit.
As shown in the embodiment of Fig. 1, the signal input S (e.g. a sensor signal) is split in the two paths, and for each path a signal adaptation unit (TA; TB) is provided, which e.g. is used to convert an AC signal to a DC signal which can be input to the processing logic P. The signal adaptation unit may be implemented as a transformer-rectifier unit. In other words, the plurality of signal inputs (S) are each connected to both the channel A part (PA) and the channel B part (PB) of the processing logic (P) via a separate signal adaptation unit (TA; TB). If the signal input S is already compatible with the processing logic, such signal adaptation units TA, TB need not be present, or are implemented as signal converters, e.g. DC-DC converters.
In a generic group of embodiments, an output signal (DO) associated with each railway crossing logic is arranged in either a redundant availability implementation (2-out-of-2, or2oo2) or a redundant implementation with diagnostics (2-out-of-2 with diagnostics, or 2oo2d).
The exemplary embodiment of Fig. 1 is an example of a redundant availability implementation (2oo2). The output part of the processing logic P comprises an OR logic gate (OR) receiving the railway crossing logic function output signals of the channel A part (DO-A) and of the channel B part (DO-B) for a specific railway crossing logic function, and providing an associated output signal (DO). The redundant channel architecture and output combination logic, will thus ensure that if one channel A, B fails, the specific railway crossing function will still be available and function properly. Each channel A, B is arranged to provide a fail-safe implementation of the specific railway crossing function, and the output combination logic ensures that the output signal AC can have an ‘unsafe’ value if one of both channels A, B has an unsafe value.
The specific railway crossing logic function comprises one or more of actuation of railway crossing barrier closing; actuation of railway crossing barrier opening; actuation of red lights; actuation of a warning sound; actuation of a traffic radar device. These functions can then be provided with a desired level of safety in combination with a desired availability (e.g. a threshold value of less than 1E-9 failures per hour).
For railway crossing functions requiring a more stringent availability (e.g. a threshold value of less than 1E-10 failures per hour), a different implementation of the processing logic P is used, of which an exemplary embodiment is shown in the schematic diagram of Fig. 2. In this embodiment, an additional process logic unit is used in the form of diagnostic unit D. The control system as shown further comprises a diagnostic unit (D), and the redundant implementation with diagnostics comprises an OR logic gate (OR) receiving the railway crossing logic function output signals of the channel A part (DO-A) and the channel B part (DO-B) for a specific railway crossing logic function. The diagnostic unit (D) is arranged to receive the railway crossing logic function output signals of the channel A part (DO-A), the channel B part (DO-B), and to bring the signal output (DO) of the associated specific railway crossing logic function to a safe state if the railway crossing logic function output signals of the channel A part (DO-A) and the channel B part (DO-B) are different. This embodiment allows to reach a higher degree of availability than the implementation shown in Fig. 1, and thus combines a high safety level (redundancy) and high availability. It is noted that the diagnostic unit D is not executing the specific railway crossing function as executed in both channels A, B, again, but only checks whether a discrepancy exists between the channel A output part signal DO-A and channel B output part signal DO-B. In case of a detected discrepancy, the output signal DO is then brought to a safe state, enhancing the safety level of this implementation. During normal operation, the output signal DO can only have an unsafe state if the logic servers LA, LB in both channels A, B have calculated that the output should be in an unsafe state.
Similar as the embodiment shown in Fig. 1 and described above, this implementation allows two independent executions of logic functions for the railway crossing functions by a first logic server LA in the channel A part PA and a second logic server LB in the channel B part PB, resulting in an increased (redundancy based) safety level. The additional control of the output signals by the diagnostic unit D allows an even further increased safety level, as well as an even better availability (i.e. a lower threshold value of 1E-10 or even 1E-11 failures per hour).
In the embodiment shown in Fig. 2, the diagnostic unit (D) is connected to railway crossing logic function output signals of the channel A part (DO-A) and of the channel B part (DO-B) via a respective second data exchange channel (SD-A; SD-B). Again this data exchange channel SD-A, SD-B may be implemented as a safe Ethernet channel.
In a further embodiment, the diagnostic unit (D) is further arranged to provide an alert signal if the signal outputs of the channel A part (DO-A) and the channel B part (DO-B) are different. This alert signal may be provided locally, but can also be logged, or communicated to a remote location (e.g. a central railway monitoring station).
The specific railway crossing logic function implemented in this type of processing logic P comprises one or more of: actuation of white lights; output signals to a signal post.
The related signals as used in an exemplary embodiment of the present invention, and related to the specific railway crossing logic functions include: control signal for railway crossing DA, control signal indicating that railway crossing is safely closed KFX, control signal for deactivating railway crossing annunciation RHS, control signal for activating railway crossing annunciation, NRHS, control signal for white lights for traffic CLP, control signal for red lights for traffic CLR, control signal for barriers NCB, CB, control signal for alarm bells CSB, remote alarm signal RA/Ra, and control signal for red light monitoring of traffic Radar.
If one channel A, B would become unavailable (e.g. due to a malfunction), the processing logic for that specific railway crossing logic function is still operable, however, the diagnostic unit D can then no longer execute the monitoring function of both channels, but only of the remaining channel A, B. If the diagnostic unit D would become unavailable, the specific railway crossing logic function is still operative. In a further embodiment, the diagnostic unit (D) is further arranged to execute a self-test, e.g. using an output of the OR logic gate as shown in Fig. 2 as an additional input. This fail-operational conditions should however not last too long, in order to meet prescribed safety levels. In a further embodiment, the processing logic (P) is arranged to generate a warning signal if the diagnostic unit (D) is non-functional for more than a predetermined time period.
As shown in the exemplary embodiment of Fig. 2, the processing logic P may further comprise a switch (R) (e.g. a solid state switch such as a relais) connected to the diagnostic unit (D), wherein the switch (R) is arranged to bring the signal output (DO) of the associated specific railway crossing logic function to a safe state. To further enhance reliability (and safety), the diagnostic unit D may be arranged to periodically check the switch for proper functioning.
Fig. 3 shows an exemplary implementation of the output combinatory logic for the sound warning system S of a railway crossing. The channel A part PA of the processing logic P provides an output signal DO-A, and the channel B part PB of the processing logic P provides an output signal DO-B, both of which are input to an OR gate, which then provides the output signal AC for the sound warning system S. The warning sound will thus be generated in one of the channels A, B or both channels A, B have established that a warning sound must be generated.
Fig. 4 shows an exemplary implementation of the output combinatory logic for the barrier operation CB, NCB of a railway crossing, which is a complementary function (close barrier signal, or a not close barrier (open barrier) signal. The channel A part PA of the processing logic P in this case provides an output signal DO-A+ and an inverted output signal DO-A-, and the channel B part PB of the processing logic P provides an output signal DO-B+ and an inverted output signal DO-B-. For the closing barrier function CB, the inverted output signals DO-A- and DO-B- are combined in an OR gate, and for the open barrier function NCB, the output signals DO-A+ and DO-B+ are combined in an OR gate. The respective signals CB, NCB are then provided to the barrier actuators.
Fig. 5 shows an exemplary implementation of the output combinatory (and diagnostic) logic for the output of signals to a (remote) signal post, which requires the highest level of safety and availability. The output signal AC is eventually provided as an actuation of a relais DA. The channel A part PA of the processing logic P provides an output signal DO-A, and the channel B part PB of the processing logic P provides an output signal DO-B, both of which are input to an OR gate and to the diagnostic unit D via safe Ethernet channels SD-A, SD-B. Furthermore, an output of the diagnostic unit D is connected to relais R, which would allow the diagnostic unit to bring the output signal AC to a safe state. Furthermore, the output signal AC is also fed back to the diagnostic unit D, as indicated here via a transformer TO.
To be able to have sufficiently high reliability of the control system for the railway crossing, the processing logic (P) comprises a programmable logic control (PLC) unit having a reliability level in accordance with a safety integrity level SIL-4. In an embodiment, each of the channel A part PA, channel B part PB, and the diagnostic unit D are implemented in a separate SIL-4 PLC unit. Each PLC unit may be connected to one or more remote I/O units, if the available number of I/O ports on the PLC unit are not sufficient to implement all needed railway crossing functions and associated signal inputs S and signal outputs AC. The interconnection between a PLC unit and remote I/O unit can be bus based, e.g. using a safe Ethernet connection. In a further embodiment the PLC units may also be connected to a (local) data logging module via a separate local network connection.
Above, present invention exemplary embodiments have been described with reference to the accompanying drawings. The invention embodiments may be summarized as follows: Embodiment 1. Control system for a railway crossing, wherein the control system comprises a plurality of signal inputs (S) and a plurality of signal outputs (AC), and processing logic (P) connected to the plurality of signal inputs (S) and plurality of signal outputs (AC), the processing logic comprising a channel A part (PA) and a channel B part (PB) for each railway crossing logic function, wherein the plurality of signal inputs (S) are each connected to both the channel A part (PA) and the channel B part (PB) of the processing logic (P) to input a channel A signal (Dl-A) and channel B signal (Dl-B), each of the channel A part (PA) and the channel B part (PB) comprising an AND logic gate (AA; AB) receiving a direct signal (Dl-A; Dl-B) and a cross check signal (DI-AtoB; DI-BtoA) and outputting an internal data signal (Dll), the cross check signal (DI-AtoB; DI-BtoA) being provided by a first data exchange channel (SE-A) between the channel A part (PA) and the channel B part (PB).
Embodiment 2. Control system according to embodiment 1, wherein an output signal (DO) associated with each railway crossing logic function is arranged in either a redundant availability implementation (2oo2) or a redundant implementation with diagnostics (2oo2d).
Embodiment 3. Control system according to embodiment 2, wherein the redundant availability implementation (2oo2) comprises an OR logic gate (OR) receiving the output signals of the channel A part (DO-A) and the channel B part (DO-B) for a specific railway crossing logic function, and providing an associated output signal (DO).
Embodiment 4. Control system according to embodiment 3, wherein the specific railway crossing logic function comprises one or more of: actuation of railway crossing barrier closing; actuation of railway crossing barrier opening; actuation of red lights; actuation of warning sound; actuation of traffic radar device.
Embodiment 5. Control system according to embodiment 2, wherein the control system further comprises a diagnostic unit (D), and the redundant implementation with diagnostics comprises an OR logic gate (OR) receiving the output signals of the channel A part (DO-A) and the channel B part (DO-B) for a specific railway crossing logic function, and wherein the diagnostic unit (D) is arranged to receive the railway crossing logic function output signals of the channel A part (DO-A) and the channel B part (DO-B), and to bring the signal output (DO) of the associated specific railway crossing logic function to a safe state if the railway crossing logic function output signals of the channel A part (DO-A) and the channel B part (DO-B) are different.
Embodiment 6. Control system according to embodiment 5, wherein the diagnostic unit (D) is connected to railway crossing logic function output signals of the channel A part (DO-A) and of the channel B part (DO-B) via a respective second data exchange channel (SD-A; SD-B).
Embodiment 7. Control system according to embodiment 5 or 6, wherein the diagnostic unit (D) is further arranged to provide an alert signal if the signal outputs of the channel A part (DO-A) and the channel B part (DO-B) are different.
Embodiment 8. Control system according to any one of embodiments 5-7, wherein the specific railway crossing logic function comprises one or more of: actuation of white lights; output signals to a signal post.
Embodiment 9. Control system according to any one of embodiments 5-8, wherein the diagnostic unit (D) is further arranged to execute a self-test.
Embodiment 10. Control system according to any one of embodiments 5-9, wherein the processing logic (P) is arranged to generate a warning signal if the diagnostic unit (D) is nonfunctional for more than a predetermined time period.
Embodiment 11. Control system according to any one of embodiments 5-10, further comprising a switch(R) connected to the diagnostic unit (D), wherein the switch (R) is arranged to bring the signal output (DO) of the associated specific railway crossing logic function to a safe state. Embodiment 12. Control system according to any one of embodiments 1-11, wherein the plurality of signal inputs (S) are each connected to both the channel A part (PA) and the channel B part (PB) of the processing logic (P) via a separate signal adaptation unit (TA; TB).
Embodiment 13. Control system according to any one of embodiments 1-12, wherein the processing logic (P) comprises a programmable logic control (PLC) unit having a reliability level in accordance with SIL-4.
Embodiment 14. Control system according to embodiment 13, wherein a PLC unit is connected to one of more remote I/O units.
The present invention has been described above with reference to a number of exemplary embodiments as shown in the drawings. Modifications and alternative implementations of some parts or elements are possible, and are included in the scope of protection as defined in the appended claims.

Claims (14)

1. Besturingssysteem voor een spoorwegovergang, waarbij het besturingssysteem een veelvoud signaalingangen (S) en een veelvoud signaaluitgangen (AC) omvat, en verwerkingslogica (P) verbonden met het veelvoud signaalingangen (S) en veelvoud signaaluitgangen (AC), waarbij de verwerkingslogica een kanaal-A-deel (PA) en een kanaal-B-deel (PB) omvat voor elke logische functie van de spoorwegovergang, waarbij het veelvoud signaalingangen (S) elk zijn verbonden met zowel het kanaal-A-deel (PA) als het kanaal-B-deel (PB) van de verwerkingslogica (P) om een kanaal-A-signaal (Dl-A) en een kanaal-B-signaal (Dl-B) in te voeren, waarbij elk van het kanaal-A-deel (PA) en het kanaal-B-deel (PB) een logische EN-poort (AA; AB) omvat die een direct signaal (Dl-A; Dl-B) en een kruiscontrolesignaal (DI-AtoB; DI-BtoA) ontvangt en een intern datasignaal (Dll) uitvoert, waarbij het kruiscontrolesignaal (DI-AtoB; DI-BtoA) wordt verschaft door een eerste datauitwisselkanaal (SE-A) tussen het kanaal-A-deel (PA) en het kanaal-B-deel (PB).A railway crossing control system, wherein the control system comprises a plurality of signal inputs (S) and a plurality of signal outputs (AC), and processing logic (P) connected to the plurality of signal inputs (S) and multiple signal outputs (AC), wherein the processing logic is a channel -A part (PA) and a channel B part (PB) for each logical function of the railway crossing, the plurality of signal inputs (S) being each connected to both the channel A part (PA) and the channel -B part (PB) of the processing logic (P) to input a channel A signal (D1-A) and a channel B signal (D1-B), each of the channel A part (PA) and the channel B part (PB) includes a logical AND gate (AA; AB) that receives a direct signal (D1-A; D1-B) and a cross-check signal (DI-AtoB; DI-BtoA) and outputs an internal data signal (D11), the cross control signal (DI-AtoB; DI-BtoA) being provided by a first data exchange channel (SE-A) between the channel A part (PA) and the channel B part (PB). 2. Besturingssysteem volgens conclusie 1, waarbij een uitvoersignaal (DO) behorend bij elke logische functie van de spoorwegovergang is ingericht hetzij in een redundante-beschikbaarheidimplementatie (2oo2) hetzij in een redundante implementatie met diagnostiek (2oo2d).The control system according to claim 1, wherein an output signal (DO) associated with each logical function of the railway crossing is arranged either in a redundant availability implementation (2000) or in a redundant implementation with diagnostics (2000d). 3. Besturingssysteem volgens conclusie 2, waarbij de redundant-beschikbaarheidsimplementatie (2oo2) een logische OF-poort (OR) omvat die de uitvoersignalen van het kanaal-A-deel (DO-A) en het kanaal-B-deel (DO-B) ontvangt voor een specifieke logische functie van de spoorwegovergang, en een bijbehorend uitvoersignaal (DO) verschaft.The operating system according to claim 2, wherein the redundant availability implementation (2002) comprises a logical OR gate (OR) that outputs the channel A part (DO-A) and channel B part (DO-B) output signals ) receives for a specific logical function of the railway crossing, and provides an associated output signal (DO). 4. Besturingssysteem volgens conclusie 3, waarbij de specifieke logische functie van de spoorwegovergang één of meer omvat van: bediening van sluiten van een slagboom van een spoorwegovergang, bediening van openen van een slagboom van een spoorwegovergang; bediening van rode lampen; bediening van waarschuwingsgeluid; bediening van verkeersradarinrichting.The control system of claim 3, wherein the specific logical function of the railway crossing comprises one or more of: operating closing a barrier of a railway crossing, operating opening a barrier of a railway crossing; operation of red lights; operation of warning sound; operation of traffic radar equipment. 5. Besturingssysteem volgens conclusie 2, waarbij het besturingssysteem verder een diagnose eenheid (D) omvat, en de redundante implementatie met diagnostiek omvat: een logische OF-poort (OR) die de uitvoersignalen of het kanaal-A-deel (DO-A) en het kanaal-B-deel (DO-B) ontvangt voor een specifieke logische functie van de spoorwegovergang, en waarbij de diagnose eenheid (D) is ingericht om de uitvoersignalen van het kanaal-A-deel (DO-A) en het kanaal-B-deel (DO-B) te ontvangen, en om de signaaluitvoer (DO) van de bijbehorende specifieke logische functie van de spoorwegovergang naar een veilige status te brengen indien de uitvoersignalen van het kanaal-A-deel (DO-A) en het kanaal-B-deel (DO-B) van de logische functie van de spoorwegovergang verschillend zijn.The control system according to claim 2, wherein the control system further comprises a diagnostic unit (D), and the redundant implementation with diagnostics comprises: a logical OR gate (OR) that outputs the output signals or the channel A part (DO-A) and receives the channel B part (DO-B) for a specific logical function of the railway crossing, and wherein the diagnostic unit (D) is arranged to output the channel A part (DO-A) and channel output signals -B part (DO-B), and to bring the signal output (DO) from the associated specific railway crossing logic function to a safe state if the channel A part output signals (DO-A) and the channel B part (DO-B) of the logical function of the level crossing is different. 6. Besturingssysteem volgens conclusie 5, waarbij de diagnose eenheid (D) is verbonden met uitvoersignalen van het kanaal-A-deel (DO-A) en van het kanaal-B-deel (DO-B) voor de logische functie van de spoorwegovergang via een respectieve tweede datauitwisselkanaal (SD-A; SD-B).The control system according to claim 5, wherein the diagnostic unit (D) is connected to output signals from the channel A part (DO-A) and from the channel B part (DO-B) for the logical function of the railway crossing via a respective second data exchange channel (SD-A; SD-B). 7. Besturingssysteem volgens conclusie 5 of 6, waarbij de diagnose eenheid (D) verder is ingericht om een alarmsignaal te verschaffen indien de signaaluitgangen van het kanaal-A-deel (DO-A) en het kanaal-B-deel (DO-B) verschillend zijn.The control system according to claim 5 or 6, wherein the diagnostic unit (D) is further adapted to provide an alarm signal if the signal outputs of the channel A part (DO-A) and the channel B part (DO-B) ) be different. 8. Besturingssysteem volgens één van de conclusies 5-7, waarbij de specifieke logische functie van de spoorwegovergang één of meer omvat van: bediening van witte lampen; uitvoersignalen naar een seinpost.A control system according to any of claims 5-7, wherein the specific logical function of the railway crossing comprises one or more of: operating white lights; output signals to a signal station. 9. Besturingssysteem volgens één van de conclusies 5-8, waarbij de diagnose eenheid (D) verder is ingericht om een zelftest uit te voeren.The control system according to any of claims 5-8, wherein the diagnostic unit (D) is further adapted to perform a self-test. 10. Besturingssysteem volgens één van de conclusies 5-9, waarbij de verwerkingslogica (P) is ingericht om een waarschuwingssignaal te generen indien de diagnose eenheid (D) langer dan een vooraf bepaalde tijdsperiode niet-functioneel is.The control system according to any of claims 5-9, wherein the processing logic (P) is arranged to generate a warning signal if the diagnostic unit (D) is non-functional for longer than a predetermined period of time. 11. Besturingssysteem volgens één van de conclusies 5-10, verder omvattende een schakelaar (R) die verbonden is met de diagnose eenheid (D), waarbij de schakelaar (R) is ingericht om de signaaluitvoer (DO) van de bijbehorende specifieke logische functie van de spoorwegovergang naar een veilige status te brengen.The control system according to any of claims 5-10, further comprising a switch (R) connected to the diagnostic unit (D), the switch (R) being arranged to control the signal output (DO) of the associated specific logic function from the level crossing to a safe status. 12. Besturingssysteem volgens één van de conclusies 1-11, waarbij het veelvoud signaalingangen (S) elk verbonden zijn met zowel het kanaal-A-deel (PA) als het kanaal-B-deel (PB) van de verwerkingslogica (P) via een afzonderlijke signaalaanpassingseenheid (TA; TB).The control system of any one of claims 1 to 11, wherein the plurality of signal inputs (S) are each connected to both the channel A part (PA) and the channel B part (PB) of the processing logic (P) via a separate signal adjustment unit (TA; TB). 13. Besturingssysteem volgens één van de conclusies 1-12, waarbij de verwerkingslogica (P) een programmeerbare logische besturingseenheid omvat een betrouwbaarheidsniveau heeft in overeenstemming met SIL-4.The control system of any one of claims 1-12, wherein the processing logic (P) comprises a programmable logic controller has a confidence level in accordance with SIL-4. 14. Besturingssysteem volgens conclusie 13, waarbij een PLC eenheid is verbonden met één of meer op afstand gelegen invoer-/uitvoereenheden.The control system of claim 13, wherein a PLC unit is connected to one or more remote input / output units.
NL2019206A 2017-07-10 2017-07-10 Control system for a railway crossing NL2019206B1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
NL2019206A NL2019206B1 (en) 2017-07-10 2017-07-10 Control system for a railway crossing
EP18182560.5A EP3428037A1 (en) 2017-07-10 2018-07-10 Control system for a railway crossing

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
NL2019206A NL2019206B1 (en) 2017-07-10 2017-07-10 Control system for a railway crossing

Publications (1)

Publication Number Publication Date
NL2019206B1 true NL2019206B1 (en) 2019-01-16

Family

ID=60923848

Family Applications (1)

Application Number Title Priority Date Filing Date
NL2019206A NL2019206B1 (en) 2017-07-10 2017-07-10 Control system for a railway crossing

Country Status (2)

Country Link
EP (1) EP3428037A1 (en)
NL (1) NL2019206B1 (en)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE19832060A1 (en) * 1998-07-16 2000-01-20 Siemens Ag Double processing unit
DE102012201803A1 (en) * 2012-02-07 2013-08-08 Siemens Aktiengesellschaft Security relevant system
EP2824572A1 (en) * 2013-07-12 2015-01-14 Thales Deutschland GmbH Fail safe device and method for operating the fail safe device
WO2016142159A1 (en) * 2015-03-11 2016-09-15 Siemens Aktiengesellschaft Safety-relevant computer system

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE19832060A1 (en) * 1998-07-16 2000-01-20 Siemens Ag Double processing unit
DE102012201803A1 (en) * 2012-02-07 2013-08-08 Siemens Aktiengesellschaft Security relevant system
EP2824572A1 (en) * 2013-07-12 2015-01-14 Thales Deutschland GmbH Fail safe device and method for operating the fail safe device
WO2016142159A1 (en) * 2015-03-11 2016-09-15 Siemens Aktiengesellschaft Safety-relevant computer system

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
BRENNER K ET AL: "SIRES - Sicheres Rechnersystem als Plattform für die BÜ-Sicherungstechnik der Zukunft", SIGNAL + DRAHT, DVV, vol. 101, no. 11, 1 November 2009 (2009-11-01), pages 30 - 34, XP001549362, ISSN: 0037-4997 *
EUE W ET AL: "SIMIS-C - DIE KOMPAKTVERSION DES SICHEREN MIKROCOMPUTER-SYSTEMS SIMIS", SIGNAL + DRAHT, DVV, vol. 79, no. 4, 1 April 1987 (1987-04-01), pages 81 - 85, XP000744323, ISSN: 0037-4997 *

Also Published As

Publication number Publication date
EP3428037A1 (en) 2019-01-16

Similar Documents

Publication Publication Date Title
US10558189B2 (en) Safety control system having configurable inputs
US7252180B2 (en) Situation-dependent reaction in the case of a fault in the region of a door of an elevator system
US10715351B2 (en) Network node, control module for a component and ethernet ring
US4305556A (en) Railway control signal dynamic output interlocking systems
AU2004251797A1 (en) Safety system for an elevator structure
CA2457551A1 (en) Monitoring system
CN104272420A (en) Safety switching apparatus with a switching element in the auxiliary contact current path
CN113093612A (en) Safety instrument process control device and method
NL2019206B1 (en) Control system for a railway crossing
US10382029B2 (en) Safe control of a consumer
US8090474B2 (en) Apparatus for controlling at least one machine
US4897640A (en) Method and electrical circuit for the reliable detection of process states within freely couplable units
WO1990008092A1 (en) Detector systems
DK2559602T3 (en) A method and device for the blocking of the traction of a stationary rail vehicle
CN110512984A (en) A kind of intelligent car door redundancy control system and method based on redundancy
CA2621393A1 (en) System architecture for controlling and monitoring components of a railroad safety installation
WO2015071169A1 (en) Level crossing safety system
EP3738113B1 (en) System and method for providing a digital intersection
CN114465840A (en) Elevator communication system
JP6634701B2 (en) Switchboard control system and power receiving and distribution equipment using it
BR102019009428A2 (en) system for control, regulation and / or monitoring of an aircraft
RU2765395C1 (en) Method for preventing deactivation of unacceptable quantity of same rail vehicle components
Kantz et al. Communication in train control
JP2009538767A (en) Device with multiple electrical switches
KR102624433B1 (en) Integrated door control device for train doors

Legal Events

Date Code Title Description
PD Change of ownership

Owner name: VOLKERWESSELS INTELLECTUELE EIGENDOM B.V.; NL

Free format text: DETAILS ASSIGNMENT: CHANGE OF OWNER(S), ASSIGNMENT; FORMER OWNER NAME: VIALIS B.V.

Effective date: 20210924