WO1999003023A2

WO1999003023A2 - Method and device for testing a double sensor system

Info

Publication number: WO1999003023A2
Application number: PCT/DE1998/002007
Authority: WO
Inventors: Bernhard PÖSEL
Original assignee: Siemens Aktiengesellschaft
Priority date: 1997-07-09
Filing date: 1998-07-09
Publication date: 1999-01-21
Also published as: WO1999003023A3; KR20010021584A; DE19730259C1; CN1262747A; EP0996874A2

Abstract

With a double sensor system used for positioning purposes in safety applications, an operating failure, including an inadmissible increase in the sensitivity of one of the sensors (S1, S2), is made known because reference marks (RM1, RM2) each having a response section (AA1, AA2) and a test section (PA11, PA21) are provided for. If operations are proceeding correctly the sensor emits a first output signal (AS1) in the area of the response section and a second output signal (AS1) in the area of the test section. In contrast, when a maximum sensitivity threshold (P) is exceeded the sensor also produces the first output signal (AS1) in the area of the test section. If there is a known change in the signal of the other sensor this is used to test the change in the output signal of the first sensor.

Description

description

Method and arrangement for testing a double sensor system

The invention is in the field of location, in particular safe absolute location for track-guided transport systems, and relates to a method and an arrangement for testing a double sensor system.

In the case of track-bound transport systems, in particular for the transport of people, high security requirements must be met, among other things, with regard to fine location. For example, a safe change of passengers in the stop area or in the case of entry / exit locks requires precise positioning of the respective vehicle and thus the entry and exit areas (doors) in relation to the stop area. For this both a safe sensors (redundant or procedural secured system) as the fulfillment and high Genauig ^¬ is keitsanforderungen requirement.

For example, inductive sensors that react to stationary metal flags have proven to be suitable sensors for autonomous location. Double sensor systems are used, the two-channel hardware of which enables the sensor signals to be evaluated and processed in a way that is reliable in terms of signal technology, which means that relevant safety standards (e.g. DIN VDE 0801, DIN 19250, Mü 8004) can be met. Usually, sensors have an influence range, also referred to as an active sensor lobe, within which the sensor responds to a reference mark. For example, an inductive sensor that reacts to metal responds with a certain output signal when a metal flag lies in its area of influence. The area of influence of the sensor and thus the minimum sensitivity guaranteed by the manufacturer The associated data sheets or qualification data are usually available.

In safety-related applications, both the evaluation-side components - e.g. B. Computer or relay circuits ("secure link") - and the sensor function must be safe. With regard to the sensors themselves, a failure disclosure mechanism is also necessary. A complete failure of a sensor can, if necessary, be recognized by the dual-channel within permissible disclosure times Errors for the entire system remain harmless and the error must be revealed within a certain period of time. The maximum permissible disclosure time depends on the failure rate of the overall sensor system. In the case of double sensor systems - so-called 2 out of 2 systems - this time is based on the railway-specific standard Mü 8004 MTBF / 1000 (MTBF = mean time between failure).

A particular problem with double sensor systems for location in security applications can, however, result from the fact that the sensitivity of one of the sensors increases significantly during operation. Such an increase in sensitivity can be caused, for example, by aging effects. B. lie in the evaluation circuit, the sensor signal processing or the sensor itself. In this context, in the context of the present invention, the term sensor, in addition to the actual primary sensor element, is also understood to mean devices downstream thereof for evaluating and processing the sensor signal up to the interface of the two-channel signal transmission of the double sensor system. While in normal applications of sensors the focus is on guaranteeing and maintaining a minimum sensitivity of the sensor and therefore an increase in sensitivity is often uncritical, an increased sensitivity of a sensor in a double sensor system for security-related applications lead to the sensor not only recognizing the intended location marks to be detected during fault-free operation, but also, for example, incorrectly detecting objects located in the vicinity of the marks as marks. In the case of an inductive sensor, for example, metal structures located along the route could lead to incorrect location information.

The object of the invention is therefore to provide a method and an arrangement for testing a double sensor system for location in safety-related applications for an impermissible increase in sensitivity of one of the sensors.

This object is achieved according to the invention by a method for testing a double sensor system of a vehicle containing two sensors for an impermissible increase in sensitivity of one of the sensors, in which the sensors are moved past fixed reference marks, each with a response section and at least one test section along a direction of movement, and from knowledge of the Passing an assigned reference mark is checked by the one sensor whether, when the other sensor moves past the reference mark assigned to it, during the movement of this sensor from the area of the test section into the area of the response section or vice versa, an output signal change takes place or has taken place, respectively a fixed reference mark and a sensor are assigned to each other and the sensor and assigned reference mark are dimensioned and matched to one another, taking into account the sensitivity field of the sensor that sensors working within permissible sensitivity tolerances have a first and in the area of the test section another, second provide output signal, and a sensor (Sl), the sensitivity of which exceeds a permissible sensitivity threshold, also delivers the first output signal in the area of the test section.

An arrangement for solving the aforementioned task results from claim 6.

A major advantage of the invention is that a simple disclosure also makes it possible to disclose a sensor to failure as a result of an inadmissibly increased sensitivity. For this purpose, in accordance with the invention, only reference marks are to be provided in coordination with the sensors such that sensors working within predetermined sensitivity tolerances only respond in the area of the response section, while in the area of the test section formed in a predetermined local relative position to the response section there is no response of the sensors. Since it can be reliably concluded from the output signal of the correctly working sensor that the transition of the other sensor or its sensitivity field from the test section to the response section or vice versa, which has already taken place or is to be expected immediately upon further movement of the double sensor system, can be automated and preferably cyclically a reliable and sensor testing that meets safety requirements. The frequency of the check is preferably based on the reliability data of the sensors and the respective operating conditions.

In terms of signal processing technology, the test is carried out after the defined leaving of the reference mark.

With regard to possible position tolerances of the sensors to one another or to the reference marks and in the case of possible different spatial expansions of the sensitivity fields that of the sensors provides a preferred embodiment of the invention that a check is made as to whether an output signal change of both sensors takes place within a transition time or a defined distance. In ^{addition to} the temporal monitoring of the output signal change, a route-dependent check is particularly useful in the case of track-bound transport systems, since track-bound transport systems are generally used e.g. B. have incremental displacement measuring devices.

An increase in the number of test-relevant section changes of the reference mark can be achieved according to an advantageous development of the method according to the invention in that the response section is preceded by a test section and a test section is arranged after it.

In principle, a known spacing can be provided between the test section and the response section. The processing of the output signal changes can be particularly advantageous in terms of processing technology in that the test section is immediately adjacent to the response section.

The method according to the invention is further explained below using a drawing as an example; show it:

Figure 1 shows a railway application of the method, Figure 2 shows the sensitivity field of a sensor and Figure 3 sensor output signals.

According to FIG. 1, a vehicle F traveling in the direction of movement B for the purpose of passenger transport contains a two-channel, secure link between the output signals of two inductive sensors S1, S2. In the case of security-relevant systems of the usual type, a secure computer R is provided, which provides the sensor-side output signals of a secure link (in the simplest case, an AND operation) is subjected, after an apparent position of the vehicle F with respect to a track, in particular a station BHF, indicative Or ^¬ processing signal OS from the. This locating signal OS, or or- tung criterion is used, for example, securing the driving ^¬ generating doors to allow passengers to get on or off at predetermined station-side entry or exit zones. Only if the location criterion OS is present, for example, are the doors facing the corresponding platform unlocked.

Each sensor S1, S2 is assigned a fixed reference mark RM1, RM2 arranged at the station BHF. The reference ^¬ brand can in an inductive sensor as a simple metal flag be designed. However, many other combinations of sensor and assigned reference mark, for example configurations based on optical scanning principles, are also conceivable. Each reference mark RM1, RM2 each comprises a response section (metal flag) AA1, AA2, each with a metal flag length L. When viewed in the direction of movement B, the response sections AA1, AA2 are immediately adjacent to each other on both sides of the response sections AAH, PA12 or PA21, PA22. subordinate.

FIG. 2 schematically shows a sensor corresponding to the sensors S1 and S2 with a three-dimensionally extending so-called active lobe, which is referred to below as the sensitivity field EF. The height H is preferably greater than the width B of the sensitivity field EF.

Referring again to FIG. 1, it can be seen that each sensor S1, S2 and the respectively assigned reference mark RM1 or RM2 are dimensioned, positioned and coordinated with one another taking into account the sensitivity field EF (FIG. 2) of the respective sensor S1, S2 be that the sensors S1, S2 deliver a first output signal AS1, AS2 in the area of the response section AA1, AA2. Characterized Each sensor has a sensitivity tolerance range TB, which is dimensioned so that a properly operating sensor is off sig at a distance of a detectable reference mark portion above a Ansprechschwellenabstandes S reliabil ^¬, that a second sensor signal ASl,

AS2 delivers. This sensor signal ASl, AS2 differs from the first sensor signal ASl, AS2 and would be emitted as soon as the (correctly working) sensors with their sensitivity fields would no longer be in the area of the respective response sections AA1 or AA2. Furthermore, the coordination between the sensor and reference marks is selected such that the reference mark with its respective response section is at a working switching distance from the sensor such that its sensitivity field in the position shown in the figure hits the response section and the sensor thus the sensor signal AS1 or AS2 delivers. With correctly working sensors (in the failure-free state), the response threshold distance S lies between the working switching distance A and a test threshold distance P. If the sensors work within the tolerance range TB, each sensor would then emit the other output signal ASl or AS2 if metal parts are further away than the response threshold distance S are.

For a further explanation of the method according to the invention it is now assumed that the sensor S1 exceeds a predetermined maximum sensitivity threshold (response threshold distance S) due to failure to such an extent that it also detects metal parts lying in the test threshold distance P. In this case, the sensor S1 also delivers the output signal ASl if it is opposite, for example, the upstream test section PA11. Thus, although the sensor S1 does not yet actually detect the response section AA1, it signals incorrectly reaching the position to be located due to inadmissibly increased sensitivity (e.g. stopping area for the vehicle doors). Due to the secure link by the computer R, the opening of the would in this case due to the missing output signal AS2 of the sensor S2 (which actually has not yet reached the response range AA2, but is working correctly and therefore does not also output an output signal AS2 due to increased sensitivity) Door prevented.

With the inventive method is in the manner described Fitted de hereinafter ^¬ a failure disclosure of such hypersensitivity of the sensor Sl possible. For this purpose, the output signal behavior of the sensor S1 is checked as it passes the reference mark RM2 assigned to the sensor S2 when the other sensor S1 moves past the response section AA1 of the reference mark RM1 assigned to it. It is determined in the assumed example that the sensor S 1 when passing out of the area of the test section PA 11 over a defined distance or a defined distance

Transition time in the area of the response section AAl has not undergone a signal change (from the output signal ASl to the output signal ASl). The same could be seen from the fact that when the vehicle moves further from the position shown in FIG. 1 at the moment when the sensor S2 leaves the range of the response section AA2, no change in the output signal of the sensor S1 is recognizable. For here the sensor Sl would because of its illegal siege überstei ^¬ sensitivity also deliver the output ASl in the area of the test sequence section PA12. In contrast, a correctly working sensor would change from the output signal ASl to the output signal ASl in this case.

FIG. 3 shows various positions of the sensors S1, S2 in detail to explain the processes just described in relation to the respectively assigned reference mark RM1, RM2. In line (1) of Figure 3 shows a situation, in which the sensors Sl, S2 still cut respectively in the Prüfab ^¬ are PA11, PA21 response portion of each AAl, AA2. If sensors S1, S2 work correctly, they do not give a response signal, but the second signal

ASl or AS2 from (see columns under S1 and S2 in Figure 3). Line (2) of FIG. 3 shows the transition phase in which the sensors are shown at the transition area between the test section and the response section. Due to internal component tolerances and / or positioning tolerances, sensor S2 has not yet changed its output signal, whereas sensor S1 has already responded. The sensor S2 then also changes its output signal within a predetermined transition time and / or a path section, which is indicated in the table with the transition time Δt. While both sensors are in the response section AA1, AA2, they retain their output signal AS1, AS2 (third sensor position according to line (3)). The sensor positions shown in lines (4) and (5) of FIG. 3 show the leaving of the response sections and the associated signal transition. A transition time interval Δt can also be tolerated here, the sensor S1 in the exemplary embodiment being the first to change from the first to the second output signal ASl.

In addition, in the last column in FIG. 3, under the heading S1 ', the previously described case is shown that the sensitivity of the sensor S1 is increased beyond the test threshold distance P (FIG. 1), so that the sensor S1' is already in the test area PA11 emits the first output signal ASl. This output signal is also present when the sensor S1 arrives in the response section AA1 of the reference mark RM1 assigned to it. By changing the output signal of sensor S2, the test period for fixed the sensor S1 and found that there was no change in the output signal of the sensor S1. (The checking ^¬ Fung relevant phases are indicated by transverse arrows in the table).

Claims

claims

1. Method and arrangement for testing a double sensor system of a vehicle (F) containing two sensors (S1, S2) for an impermissible increase in sensitivity of one of the sensors in which

- The sensors (S1, S2) are moved past fixed reference marks (RM1, RM2), each with a response section (AAl, AA2) and at least one test section (PA11, PA21) along a direction of movement (B) and from which

Knowledge of the passage of an assigned reference mark (RM2) by one sensor (S2) is checked whether, when the other sensor (Sl) moves past the reference mark (RM1) assigned to it, during the movement of this sensor (Sl) from the area of Test section (PA11) in the area of the response section (AAl) or vice versa an output signal change has taken place or has taken place, wherein

- A fixed reference mark and a sensor (S1, S2) are assigned to each other and the sensor and assigned reference mark are dimensioned and matched to one another, taking into account the sensitivity field (EF) of the sensor, such that sensors (S1, S2) in the area of the response section (AAl, AA2) a first (ASl, AS2) and in the area of the test section

(PA12, PA21) another, second output signal {ASl

AS2) and a sensor (S1) whose sensitivity exceeds a permissible sensitivity threshold (P) also delivers the first output signal (ASl) in the area of the test section (PA11).

2. The method according to claim 1,

- in which the test is carried out after the defined leaving of the reference mark (RM1).

3. The method according to claim 1 or 2,

- In which a test is carried out to determine whether an output signal change of both sensors (S1, S2) takes place within a transition time (Δt) or within a defined distance.

4. The method according to any one of the preceding claims,

- in which the test section (All) is preceded by a test section (PA11) and a test section (PA12).

5. The method according to any one of the preceding claims,

- in which the test section (PA11) is directly adjacent to the response section (AAl).

6. Arrangement with a double sensor system of a vehicle (F) containing two sensors (S1, S2) and two fixed reference marks for checking the double sensor system for an impermissible increase in sensitivity of one of the sensors in which

- A sensor and a fixed reference mark (S1, S2) each with a response section (AAl, AA2) and at least one test section (PA11, PA21) are assigned to each other and the sensor and assigned reference mark taking into account the sensitivity field (EF) of the sensor are dimensioned and coordinated with each other so that sensors (S1, S2) working within permissible sensitivity tolerances (TB) in the area of the response section (AAl, AA2) a first (ASl, AS2) and in the area of the test section (PA12, PA21) another, second Output signal {ASl, AS2) deliver, and a sensor (Sl) whose sensitivity exceeds a permissible sensitivity threshold (P), also in the range of the test section (PA11) delivers the first output signal (ASl), and in which a computer connected to the sensors in

A double sensor system is provided which, while the sensors are moving past the reference marks along a direction of movement (B) from knowledge of the passage of an assigned reference mark (RM2) by one sensor (S2), checks whether the other sensor (S1) is moving the reference mark assigned to it (RM1) past while the movement of this sensor (S1) from the area of the test section (PA11) to the area of the response section (AAl) or vice versa an output signal change has taken place or has taken place.