Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/14—Error detection or correction of the data by redundancy in operation
  • G06F11/1497—Details of time redundant execution on a single processing unit
• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B61—RAILWAYS
  • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
  • B61L21/00—Station blocking between signal boxes in one yard
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/16—Error detection or correction of the data by redundancy in hardware
  • G06F11/1608—Error detection by comparing the output signals of redundant hardware
  • G06F11/1625—Error detection by comparing the output signals of redundant hardware in communications, e.g. transmission, interfaces
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/16—Error detection or correction of the data by redundancy in hardware
  • G06F11/1629—Error detection by comparing the output of redundant processing systems
  • G06F11/1641—Error detection by comparing the output of redundant processing systems where the comparison is not performed by the redundant processing components
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/16—Error detection or correction of the data by redundancy in hardware
  • G06F11/1675—Temporal synchronisation or re-synchronisation of redundant processing components
  • G06F11/1683—Temporal synchronisation or re-synchronisation of redundant processing components at instruction level

Definitions

• the invention relates to a method according to the preamble of patent claim 1 and to a device for carrying out this method according to the preamble of patent claim 12.
• railway operating processes are part of the safety-critical processes, because any malfunctions, if they are not recognized in time and their effects on the process are prevented, can lead to considerable damage to property and possibly also to persons.
• signaling-safe devices have been used for the control of such processes, the task of which is to detect malfunctions both within the process to be controlled and within the process control itself, and then to lead or leave the process in a safe state.
• Such signal-safe controls can be implemented using different techniques, for example in relay technology or in electronic technology.
• expensive special computers have been used for signal-safe process control via computers, which process the pending processing orders in two channels and continuously compare signal-wise with regard to processing sequences that match in terms of content.
• Issued control commands are only output to the process elements of the process to be controlled if both processing channels have each reached the same result; otherwise the connection to the process will be broken unless it is gives at least one spare computer, which can take over the functions of the failed computer and actually takes over.
• the secure computers also still contain the railway administration-specific software for the actual process control, e.g. interlocking operation.
• the railway administration-specific software is determined by the operating regulations of the respective railway administration and describes e.g. B. the predefined dependencies of the route setting and the driving street resolution (Signal + Draht, 77 (1985) 12, p.259-265).
• the railway administration-specific software not only differs from railway administration to railway administration, but at least partially also from installation to installation of the same railway administration.
• the object of the present invention is to provide a method for
• Controlling a safety-critical rail operating process according to the preamble of claim 1, which is less complex to prepare for the safe Process control required programs and that allows to react quickly and inexpensively to any changed requirements of a rail operator for process control. It is also an object of the invention to provide a device for performing this method.
• the invention solves this problem by the features of claim 1 and claim 12.
• the basic idea of the invention is to outsource the railway management-specific software from the computer or computers that are secure in terms of signal technology to commercial computers, to process the data there at least twice and before output to check the process in the signal-safe computers for consistency.
• the signal-safe computers essentially also have the task of securely recording the incoming messages and commands and transmitting them to the commercial computers, as well as having a reliable effect on the process elements and, in the event of a malfunction, securely connecting the process elements interrupt.
• FIG. 1 shows schematically in FIG. 1 the structure of the device according to the invention for controlling a safety-critical device
• FIG. 2 shows a known, signal-technically secure computer SR for processing a process via preferably identical processing programs in two independent processing channels K1, K2.
• the secure computer SR stands for any number of signal-technically secure computers; their number essentially depends on the size of the process to be controlled.
• the process to be controlled is a railway operating process that is intended to act on a railway installation BA. Representing the process elements of
• the signal-safe computer SR sends the messages M transmitted to it by the process via a communication bus
• the commands K for controlling the railway operating process are also generated via the input and display computer EAR and transmitted to the signal-safe computer SR.
• the input can be done by an operator, e.g. B. a dispatcher, or by an automatic z. B. for self-service or pass-through operation.
• the messages and commands are processed on two channels in the signal-safe computer according to the conditions and dependencies specified in the respective operating regulations of a railway operator.
• Test programs ensure that the input / output registers of the secure computer, as well as its program and work memory and its address register, are checked within a specified minimum period of time to determine whether their memory can be in one or the other state. Any malfunctions are detected in an event or time-controlled manner and lead to the safe shutdown of the outdoor facilities: control commands on turnouts can then no longer be issued and the signals stop.
• the device according to the invention for controlling a railroad operating process shown in FIG. 1 there is also at least one signal-safe computer SR * with two processing channels K1 * and K2 * which are preferably constructed identically and operated identically. His job is it, similar to that of the signal-technically secure computer SR according to the state of the art, reliably detects all the messages M and commands K supplied to it and feeds them for processing. Furthermore, it is his task to issue control commands SB, which have been developed in a signal-safe manner, to the process elements W, S of the respective rail system BA, or to ensure that the output of such control commands in the event of a fault does not occur, in terms of signaling.
• control commands SB which have been developed in a signal-safe manner, to the process elements W, S of the respective rail system BA, or to ensure that the output of such control commands in the event of a fault does not occur, in terms of signaling.
• the processing of the conditions and dependencies for the control and monitoring of the railway operating process defined by the respective Railway Operating Regulations BO does not take place in or in the signal-safe computers SR *, but in commercial computers R1, R2, ... Rn , in which the system-specific data for controlling the railway operating process are also stored; the computers R1, R2 represent one or more pairs of computers, each computer also being able to belong to several pairs; three computers could be formed from three computers. They carry out processing orders A supplied to them by the secure computer SR *, each independently of the other according to the conditions and dependencies defined for the process control in the respective rail operating regulations BO.
• the two computers of each commercial computer pair R1, R2 transmit their work results to the signal-technically secure computer SR *, the first computer R1 or R2 in time forcing a waiting point with time monitoring, at which the work result of the further computer or computers is waited for, or in the event of a timeout, fault handling is carried out.
• Test mechanisms PM for the plausibility of the messages supplied to the commercial computer pairs R1, R2 and the signatures of the outputs and memory areas they have developed are indicated schematically in FIG. 1.
• the input and display rights ner EAR commands K fed to the secure computer SR * are converted by the latter into processing orders A and transmitted in the form of telegrams to the commercial computers R1, R2; there they lead to processing according to the conditions and dependencies of the respective rail operating regulations BO.
• the signal-technically secure computer ensures that the processing programs of the processing computers are synchronized on request of the commercial computers commercial computer for further processing of the programs after the waiting time.
• the sensor message determined by the commercial computers should be read in and evaluated.
• the processing results E determined by the commercial computer pair Rl, R2 are sent as telegrams to the signaling-safe computer SR *, where they are safely distributed over the two processing channels Kl *, K2 * and compared in terms of signaling to ensure they match.
• the function block V in which the relevant programs are stored as system software is shown in the drawing for the secure distribution of messages and the reliable comparison of the results worked out by the commercial computers R1, R2.
• the test mechanisms PMS of the computer which is secure in terms of signal technology are implemented in a signal-safe manner.
• the particular advantage of the device according to the invention over a corresponding device designed according to the state of the art is that only the functions of safe input and output and safe data comparison can be implemented in the signal-technically safe computer, regardless of those by the operating rules of individual railway administrations each set requirements and conditions.
• This not only makes the system software running in the secure computer or in the secure computers simple and clear; Rather, it is the same for all applications, so it no longer has to be developed from case to case and subjected to an approval test.
• the railway administration-specific software which is determined by the different operating regulations of the individual railway administrations, runs on the commercial computers. Their interaction with the system software of the secure computers does not have to be checked.
• the development of the railway management-specific software does not necessarily have to be carried out by the manufacturer responsible for the signaling security of the process for the signaling-safe computer. Rather, it is possible to place orders to develop the programs for the commercial computers to qualified engineering firms or the like, which the software they have developed with the respective railway administration and z. B. an approval authority such as the Federal Railway Authority. This makes it possible to adapt the programs for controlling and monitoring a safety-critical rail operating process much faster and cheaper than before, without having to accept any loss of safety.
• the commercial computers R1, R2 stand for one or more double computer systems or computer systems provided with redundant computers, in the individual computers of which identical programs for processing the conditions and dependencies specified by the respective railway operating regulations are to run, of which individual commercial computers, preferably either only certain sub-functions of the operating regulations are to be implemented or only certain parts of the railway systems are to be affected.
• the arrangement can also be such that the commercial computers R1, R2 are each individual computers, in which the programs of the railway administration-specific software determined by the operating regulations of a railway administration are processed independently several times, but at least twice in succession.
• the railway management-specific software required for this can be designed in a diversified manner or the content can be the same for both processing operations.
• a non-signal-safe computer is preferably used for the transmission of the results developed by the commercial computers to the computer-safe computer Data transmission in question, in which either the two-channel serial or parallel results are transmitted on two channels to the safe computer or computers, or in which they are transmitted twice in succession over only one channel.
• a second or third redundant channel increases availability. Any data falsifications on the transmission path from the commercial computers to the signal-technically secure computers and vice versa can be recognized in the receiving computer by a signature entered by the sending computer, which codes the telegram content using a calculation rule.
• the commercial computer can be designed as a so-called operator station computer, by means of which a railway operator or an automatic can issue commands for execution to the railway operating process and the feedback of the railway operating process can be visualized.
• the programs for entering and visualizing commands and messages and the programs that control the process elements in accordance with the railway operating regulations then run independently of one another in the operator station computers.
• the programs for the Command inputs and the visualization of the process can also be combined with the programs for process control as they are specified by the railway operating regulations.
• the computer (s) that are secure in terms of signaling technology can also be designed as m of n computer systems, in which the decision as to whether and which control commands are to be issued to the process is made by a majority decision by at least two intact computers.
• control commands are output to the process in two channels; every computer has the option of preventing the issuing of control commands when processing errors are detected.
• the method according to the invention and the device according to the invention can be used with advantage for all safety-critical railway operating processes.
• Such an application can e.g. B. the safe control of a railway operation through an interlocking but also z.
• LZB regular train control

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Quality & Reliability (AREA)
• Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Mechanical Engineering (AREA)
• Train Traffic Observation, Control, And Security (AREA)
• Safety Devices In Control Systems (AREA)
• Electric Propulsion And Braking For Vehicles (AREA)

Priority Applications (9)

Applications Claiming Priority (1)

Related Child Applications (2)

Publications (1)

Family

ID=5648319

Family Applications (1)

Country Status (8)

Cited By (2)

Families Citing this family (4)

Citations (3)

• 2001
  • 2001-11-22 AU AU2002224742A patent/AU2002224742A1/en not_active Abandoned
  • 2001-11-22 JP JP2003549144A patent/JP4102306B2/ja not_active Expired - Fee Related
  • 2001-11-22 CA CA002467972A patent/CA2467972A1/en not_active Abandoned
  • 2001-11-22 WO PCT/DE2001/004485 patent/WO2003047937A1/de active Application Filing
  • 2001-11-22 MX MXPA04004840A patent/MXPA04004840A/es active IP Right Grant
  • 2001-11-22 KR KR10-2004-7007825A patent/KR20040063935A/ko not_active Application Discontinuation
  • 2001-11-22 CN CNB018238238A patent/CN1289345C/zh not_active Expired - Fee Related
• 2005
  • 2005-03-09 HK HK05102045A patent/HK1069363A1/xx not_active IP Right Cessation

Patent Citations (3)

Also Published As

Similar Documents

Legal Events