WO2013026759A1

WO2013026759A1 - Signal box computer

Info

Publication number: WO2013026759A1
Application number: PCT/EP2012/065983
Authority: WO
Inventors: Thomas BOTH; Matthias Holzmüller; Jürgen REUPKE
Original assignee: Siemens Aktiengesellschaft
Priority date: 2011-08-24
Filing date: 2012-08-16
Publication date: 2013-02-28
Also published as: DE102011081477A1; CN103781691B; EP2731849A1; EP2731849B1; CN103781691A

Abstract

The invention relates, inter alia, to a method for monitoring the method of functioning of a signal box computer (5) which executes a control program (30) for controlling railway components (RK1 to RKp) of a real railway system (40), wherein the control program (30) evaluates message signals of the railway components of the real railway system (40) and generates control signals for the railway components, to be controlled, of the real railway system. The invention provides that the control program (30) controls an expanded railway system which comprises the railway components (RK1 to RKp) of the real railway system (40) and additionally at least one virtual railway component, message signals (Mp+1 to Mn) of the at least one virtual railway component are input into the signal box computer (5), the control program (30) processes the message signals (Mp+1 to Mn) within the scope of the control of the expanded railway system, the output signals (Sp+1 to Sn) which are generated at the output end by the signal box computer (5) on the basis of the message signals (Mp+1 to Mn) are checked for correctness and a fault signal (F) is generated if the control program (30) supplies incorrect output signals and/or supplies output signals with a delay.

Description

description

The invention relates to a method for monitoring the operation of an interlocking computer, which executes a control ^¬ program for controlling railway components of a real railway system, the control program Meldesig ^¬ nal of the railway components of the real railway system evaluates and control signals for the controlled Eisenbahnkom ^¬ generated components of the real railway system.

Interlocking computers are offered by Siemens AG, for example, in signal boxes of the SICAS S7 product line.

The invention has for its object to admit ^¬ a method for monitoring the operation of an interlocking ^computer , which can be particularly simple to perform, but still offers a very high reliability in detecting errors.

This object is achieved by a method having the features according to claim 1. Advantageous embodiments of the method according to the invention are specified in sub-claims.

Accordingly, the invention provides that the Steuerpro ^¬ program controls an extended railway plant, which additionally comprises the iron ^¬ railway components of the real railway plant and at least a virtual rail component are input to the interlocking computer message signals the at least one virtuel ^¬ len rail component, the control program, the message signals in the Processed within the framework of the control of the extended railway system, which are checked for correctness on the output side generated by the interlocking computer output signals due to the alarm signals and an error signal is generated when the control program supplies erroneous output ^¬ signals and / or output signals late. A significant advantage of the method according to the invention is the fact that this can be performed in parallel during normal operation of the interlocking computer, without the control of the real railway components of the real

Railway system would be affected. The idea ^according to the invention consists in the fact that the interlocking computer continuously processes or monitors an expanded railway installation which contains both the real railway components of the actual railway installation actually to be monitored and virtual (ie non-real or fictitious) railway ^{components of} a virtual railway system (ie non-real or fictitious) railway system include. By providing virtual railway components or by providing a virtual railway system, it is possible during the normal operation of the interlocking computer to feed test data in the interlocking computer in the form of signaling signals of virtual railway components and to observe whether the interlocking computer correctly responds to these message signals and output signals supplies, which match the fed-in signaling signals or represent the required response to these message signals.

To be particularly advantageous, it is considered, if the message ^¬ signals at least one virtual rail component for input to an external monitoring device that is connected via an interface with the interlocking computers, and the output side generated by the interlocking computer on the basis of the status signals output signals to the monitoring unit on Correctness to be checked.

The spatial arrangement of the external monitoring device is arbitrary: The external monitoring ^device can ^{immediacy ¬} bar in the vicinity of the interlocking computer, so for example in the interlocking itself, be housed; Alternatively, however, it is also possible to position the external monitoring device in another location, for example in a central control center, and to control the monitoring remotely. In this case, the test data or the message signals of the virtual len railway components via a communication link, for example, via radio, transmitted via the Internet or other communication methods to the interlocking computer. According to a particularly preferred embodiment of the method it is provided that the time period is monitored, which is evidence of the interlocking computers (and thus the control program) for processing the message signals are required, and an error signal he ^¬ when the response time of the interlocking computer reaches a predetermined temporal maximum duration or over ^¬ strides. In this embodiment of the method, the functioning of the interlocking computer is monitored not only with regard to the work results, but also with regard to the processing time required for this purpose. For a correct and safe control of the real

In fact, it is necessary for a railway installation to ensure that reactions to incoming signaling signals of real railway components occur correctly within a specified period of time. Due to the additional monitoring of the reaction time of the control program or the signal box computer whose operation can therefore be checked very reliable.

A particularly simple and therefore advantageous can the reac tion ^¬ time of the control program or of the interlocking computer monitor, if control commands are implemented in the control program at predetermined program locations, each of which generates a control signal at from ^¬ management. Monitoring the occurrence of the control signals can be carried out when the control signals are sent from the interlocking computers to the external moni ^¬ monitoring device especially a ^¬ times and thus advantageous, for example with the already-called external monitoring device.

With a view to monitoring the response time of the manipulated factory computer, it is considered advantageous when an error signal is generated if the time interval Zvi ^¬ rule successive control signals reaches a predetermined maximum rate control signal margin or exceeds. This embodiment of the method is based on the assumption that in a correct operation of the interlocking computer, the predetermined program locations are processed within the provided time intervals and accordingly corresponding control signals are generated. If this is not the case, ie if the control signal distance becomes too large, an error is assumed and a corresponding error signal is generated. Alternatively or additionally, it is possible to detect the number of control signals which are generated during the execution of a predetermined program module; because even the number of control signals can be an indication of an error. Accordingly, it is reasonable see also be advantageous if an error signal is generated when the program module ^¬ provided for this Pro number has fallen below the control signals according to a predetermined program Abarbei ^¬ processing module. The railway components may, for example, be free-reporting devices, points and / or signals. Accordingly, it is considered advantageous if the virtual rail component is Minim ^¬ least a virtual Comp ^¬ component of the external system, in particular a virtual switch, a virtual free signaling device or a virtual Sig ^¬ naleinrichtung, and are input to the interlocking computer message signals of such a virtual railway component , To ensure that in the presence of an error signal of the interlocking computer, the real railway system can no longer control, it is considered advantageous if the interlocking computer and / or a communication interface of the interlocking computer is switched off in the presence of an error signal.

The invention also relates to a Stell ^¬ factory computer, in which a control program for controlling Railway components of a real railway system is stored, wherein the control program provides the evaluation of input data or signal signals of the real railway system and the generation of control signals for the controlled railway components of the real railway system.

As for such interlocking computer erfindungsge ^¬ Mäss is proposed that the control program provides for the control of an extended railway system, the virtual real railway plant, and additionally at least one

Rail component includes the interlocking ^{computer, the} input of signaling signals of the at least one virtual railway component allowed, and the control program is adapted to process the alarm signals within the framework of the control of the extended railway system and output to generate output signals depending on the applied alarm signals.

For the advantages of interlocking computer invention, reference is made to the above statements in connection with the present process, since the advantages of interlocking machine according to the invention correspond to those of erfindungsge ^¬ MAESSEN process substantially. The invention also relates to a moni ^¬ monitoring device for monitoring a interlocking computer. OF INVENTION ^¬ dung according to such a monitoring device is provided with respect to that the monitoring device comprises an interface that light enables a connection to the interlocking computers, and in the monitoring device, a monitoring program is stored which, when executed test data as Meldesig ^¬ tional the at least one virtual railway component in can input the interlocking computer and can check the output signals generated by the interlocking computer on the output side due to the message signals to correctness.

With regard to the advantages of the monitoring device according to the invention is based on the above statements in connection with the Referenced method according to the invention, since the advantages of the monitoring device according to the invention substantially correspond to those of erfindungsge ^¬ MAESSEN method. The invention will be explained in more detail with reference to Ausführungsbeispie ^¬ len; thereby show by way of example

1 shows a first embodiment for an arrangement with an exemplary embodiment of a inventions to the invention interlocking computer to which is connected an embodiment of an inventive About ^¬ wachungsgerät wherein the overload ^¬ wachungsgerät relies on stored reference data,

2 shows a second embodiment for a Anord ^¬ voltage with an interlocking computers and an external monitor, wherein the reference data Überwachungsge ^¬ advises itself forms, and

Figure 3 monitors a third embodiment for a Anord ^¬ voltage with an interlocking computers and an external monitor, wherein the Überwachungsge ^¬ advises exceed control signals of the interlocking computer.

For the sake of clarity, the same reference numbers are always used in the figures for identical or comparable components.

FIG. 1 shows an interlocking computer 5 which comprises a computer 10 and a memory 20. In the memory 20, a control program 30 is stored, with which an extended railway system can be controlled. The extended railway installation is described by a topology data set TD, which is likewise stored in the memory 20. The topology dataset TD comprises a first partial dataset TDr which describes a real railway installation 40 which is to be controlled by the interlocking computer 5. The real railway line 40 is formed by real railway components RK1, RK2, ..., RKp connected to railway component terminals

AI, Kl, ..., Ap of the interlocking computer 5 are connected. The real railway components RK1, RK2,..., RKp are, for example, real components of the outdoor installation, in particular a real switch, a real free-field device or a real signal device.

The topology data set TD also comprises a second partial data set TDv in which a virtual railway installation de ^¬ is finiert. The virtual rail system comprises one or more virtual railway components, the operation of which by an external monitoring device simulated 50 or si ^¬ is formulated. The virtual railway components are, for example, virtual components of the outside installation, in particular a virtual diverter, a virtual free-field device or a virtual signaling device.

The external monitoring device 50 has a computing device 60, a memory 70 and an interface 80. In the memory 70, a monitoring program 90 is stored, the operation of the computing device 60 and thus the

Operation of the monitoring device 50 determines. In the SpeI ^¬ cher 70 test data T are stored beyond which read by the calculator 60 from the memory 70 via the interface 80 as status signals of the virtual railway components of the virtual railway system in the

Interlocking computer 5 are fed. The message signals are designated in FIG. 1 by the reference symbols Mp + 1, Mp + 2,..., Mn. For feeding the message signals Mp + 1, Mp + 2, ..., Mn, the interlocking computer 5 has railway component connections, which are designated in FIG. 1 by the reference symbols Ap + 1, Ap + 2,..., An. The railway component connections Ap + 1 to An are identical to the railway component terminals AI to Ap in terms of the processing of the signals applied to the input side; this means that, instead of virtual railway components, real railway components of the real railway system 40 could also be connected to these railway component connections. The signaling signals applied to the railway component connections Ap + 1, Ap + 2,..., An are thus treated as if they were signaling signals of a real railway installation. The interlocking computers 5 and the computing means 10 applies to the input side anlie ^¬ constricting message signals, the control program 30 and controls with this extended rail system formed from the real railway plant 40 and the virtuel ^¬ len railway system. The arrangement according to FIG. 1 can be operated, for example, as follows for testing the interlocking computer 5:

The external monitoring device 50 reads the Recheneinrich ^¬ tung 60 test data T from the memory 70 and transmits them to the interface 80, to An, a ^¬ feeds the test data as a message ^¬ signals in one or more of the terminals Ap +. 1 The signaling signals of the monitoring device 50 are processed by the control program 30 of the computing device 10 as signaling signals of real railway components. For this purpose, the control program 30 bases the topology dataset TD, in whose second partial dataset TDv the associated (virtual) railway installation with the virtual railway components is described. As part of the processing of the incoming message signals, the computing device 10 will form one or more output signals in the form of control signals at the railway component connections Ap + 1 to An, which reach the monitoring device 50. In the figure 1, the Ausgangssig ^¬ dimensional interlocking of the computer 5 to the terminals Ap + 1,

Ap + 2, ..., An denoted by the reference symbols Sp + 1, Sp + 2, ..., Sn.

The output signals Sp + 1, Sp + 2, ..., Sn of the interlocking computer 5 arrive via the interface 80 to the computing device 60, which outputs the output signals with the reference data RAD which are stored in the memory 70. The reference output data RAD describe the output signals, the monitor 50 signals in response to the turned give ^¬ NEN test data T or as a response to the transmitted notification Mp + 1, Mp + 2, ..., Mn of at correct operation

Interlocking computer 5 expected: voices coming from the signal box ^¬ calculator 5 outputs Sp + 1, Sp + 2, ..., Sn with the reference output data RAD match, determines the computing device 60 that the interlocking computers 5 properly to fed into the grid test data reacts and performs the control of the virtual railway system correctly. On the other hand, if the output signals Sp + 1, Sp + 2,..., Sn differ in content from the reference output data RAD, then the monitoring device 50 will generate an error signal F with which an error of the interlocking computer 50 is signaled.

The feeding of different test data T can be carried out regularly or irregularly in order to ensure the correct functioning of the test

Interlocking computer 5 regularly or irregularly check.

In the exemplary embodiment according to FIG. 1, it is assumed by way of example that the reference output data RAD are already determined in the memory 70 for the test data T and stored. Alternatively, it is possible to provide in the memory 70 a reference control program which permits the formation of the reference output data RAD on the basis of the test data T or the message signals Mp + 1 based on the test data T,

Mp + 2, ..., Mn itself performs. Such an embodiment is shown in FIG. 2.

In Figure 2 we see an interlocking computers 5 and an external monitor 50 to which can monitor the signal box ^¬ computer. 5 In contrast to the exemplary embodiment according to FIG. 1, a reference control program 30 'is stored in the memory 70 instead of reference output data RAD, the function of which corresponds to the control program 30 of the interlocking computer 5. In addition, one recognizes in the figure 2, that in the memory 70 of the second partial data set TDv is stored, with which the virtual railway system ^¬ or the virtual railway components of the virtual railway system are described.

For testing the operation of the interlocking computer 5, the monitoring device 50 and the computing device 60 read the test data T from the memory 70 and transmit as Meldesignals Mp + 1, Mp + 2, ..., Mn to the interlocking computer 5, as related has already been explained with the figure 1. The output signals Ap + 1 generated by the interlocking computer 5 in response to the inputted message signals,

Ap + 2,..., An arrive via the interface 80 to the computing device 60, which executes the reference control program 30 'in parallel and to the test data T or to the message signals Mp + 1, Mp + 2,..., Mn and reference output data RAD 'by means of the reference control program 30' itself forms.

The monitoring program 90 of the monitoring device 50 then compares the output signals Ap + 1, Ap + 2,..., An supplied by the interlocking computer 5 with the corresponding reference output data RAD ', which have been formed by the reference control program 30'. If the reference output data RAD 'match the output signals supplied by the interlocking computer 5, the interlocking computer 5 will work correctly. The data is different, however, the monitor 50 produce an error signal F, with a Def ^¬ ler of the interlocking computer 5 is signaled. A not shown in Figures 1 and 2 shutoff power to the signal box computer 5 can be turned off in the presence of the error signal F to disable ^¬ sen completely and safely. If a power supply is missing, the interlocking computer 5 can not provide any output signals for controlling the real railway components

RK1, RK2, ..., RKp generate more. Alternatively, it is possible to switch off only subcomponents of the interlocking computer 5, for example the computing device 10, one in the interlocking computer 5 existing data bus 100 or not shown in the figure 1 interface of the interlocking computer 5. These measures also ensure that no control of the real railway components of the real railway system 40 through the interlocking computer 5 can be made more.

3 shows an embodiment for an arrangement with an interlocking computer 5 and a monitor 50, 5 is closed at the ^¬ to the data bus 100 of the interlocking computer 5, a control signal terminal K5 of the interlocking computer is. The data bus 100 connects the control signal ^¬ terminal K5 with the computing device 10 and allows a connection to the monitoring device 50. In the embodiment according to Figure 3 ^¬ grams provide control commands in the control ^¬ program 30 of the interlocking computer 5 at predetermined Pro implemented that at exporting ^¬ tion in each case generate a control signal KS. The Kontrollsig ^¬ dimensional KS arrive via the data bus 100 and the Kontrollsig- nalanschluss K5 of the interlocking computers 5 to the surveil ^¬ monitoring device 50 and computing device 60. The surveil ^¬ monitoring program 90 of the monitoring device 50 is so designed from ^¬ that of the input Control signals KS ^monitored over ^¬ and generates an error signal F when the time interval between successive control signals KS reaches or exceeds a predetermined maximum time control signal interval. The computing device 60 assumes that the control signals CS are generated regularly at a correct operation of the actuator ^¬ factory computer 5, so that a regular input of control signals KS is an indication of a correct operation of the interlocking computer. 5 On the other hand, if control signals are missing or are not generated in time, this is an indication that the computing device 10 is working incorrectly and has to be switched off.

The monitoring program 90 of the monitoring device 50 is furthermore configured in such a way that it can preset monitored in the control program 30 of the interlocking computer 5. Here, the monitoring program 90 assumes that when supplying predetermined test data T and the corresponding status signals called in the interlocking computers 5 predetermined program modules of the control program 30 who must ^¬ whose execution is in each case produce a predetermined number of control signals CS. The monitoring program 90 is configured in such a way that it counts the number of control signals KS sent to the control signal connection K5 for the respective program modules and generates an error signal F when, after execution of a predetermined program module, the program module provided with this program module and stored in a control signal data set KSD of the memory 70 respective program module stored number of control signals KS is reached. In this case, the monitoring program 90 assumes that a correct execution of the predetermined program module imperatively requires the execution of the predetermined program locations in the control program 30, so that the corresponding control signals and the correspondingly provided number of control signals must be generated. If this is not the case, then this is a sign for an incorrect functioning of the interlocking computer 5, which is accordingly preferably switched off. While the invention has been further illustrated and described in detail by the preferred embodiments, the invention is not limited by the disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

Claims

claims

A method of monitoring the operation of an interlocking computer (5) that executes a control program (30) for controlling railway components (RK1 to RKp) of a real railroad facility (40), the control program (30) being mel ^¬ designale of the railroad components of the real railroad facility (40) evaluates and produces control signals for the iron to be controlled ^¬ railway components of the real railway plant,

d a d u r c h e c e n c i n e s that

the control program (30) controls an extended railway installation comprising the railway components (RK1 to RKp) of the real railway installation (40) and additionally at least one virtual railway component,

- in the interlocking system computer (5) status signals (Mp + 1 to Mn) of at least a virtual railway component inputted ^¬,

the control program (30) processes the signaling signals (Mp + 1 to Mn) within the framework of the control of the extended railway installation,

- The output signals (Sp + 1 to Sn) generated on the output side by the interlocking computer on the basis of the message signals (Mp + 1 to Mn) are checked for correctness and

- An error signal (F) is generated when the control program (30) delivers erroneous output signals and / or output signals late.

Method according to claim 1,

a d u r c h e c i n c e s that

the signaling signals (Mp + 1 to Mn) for the at least one virtual rail component with an external surveil ^¬ monitoring device (50) is input, which is connected via an interface ^¬ point (80) to the interlocking computer (5), and

the basis of the status signals (Mp + 1 to Mn) on the output side of the interlocking computer (5) generated output signals (Sp + 1 to Sn) and the monitoring device (50) to be checked for correct ^¬ ness.

3. Method according to one of the preceding claims, characterized in that

- The period is monitored, the interlocking computer (5) for processing the message signals (Mp + 1 to Mn) needed, and

- An error signal (F) is generated when the reaction time of the interlocking computer (5) reaches or exceeds a predetermined time Ma ^¬ ximaldauer.

4. Method according to one of the preceding claims, characterized in that

- In the control program (30) at predetermined program points control commands are implemented, which each generate a control signal (KS) when executed.

5. The method according to claim 4,

d a d u r c h e c e n c i n e s that

- An error signal (F) is generated when the time interval between successive control signals (KS) reaches or exceeds a predetermined maximum time control signal distance.

6. The method according to claim 4 or 5,

d a d u r c h e c e n c i n e s that

- An error signal (F) is generated when, after execution of a predetermined program module, the number of control signals (KS) intended for this program ^{module has been} undershot.

7. Method according to one of the preceding claims, characterized in that

- the at least one virtual railway component one

is virtual component of the outdoor facility, in particular a virtual switch, a virtual free-field device or a virtual signaling device, and - Signaling signals (Mp + 1 to Mn) of such a virtual railway component are entered into the interlocking computer (5).

8. The method according to any one of the preceding claims, d a d u r c h e c e n e c e s in that e

in the presence of an error signal (F) of the interlocking computer (5) and / or a communication interface of the interlocking ^¬ computer is turned off.

9. interlocking computers (5), in which a control program (30) for controlling railway components (RK1 to RKp) a real railway plant (40) is stored, wherein the Steuerpro ^¬ program (30), the evaluation of status signals of the real railway plant ( 40) and the generation of control signals for the railway components of the real railroad system (40) to be controlled,

d a d u r c h e c e n c i n e s that

- the control program (30) provides for the control of an extended railway installation, which is the real railway installation

(40) and additionally at least one virtual railway ^¬ component comprises

- the interlocking computer (5) allows the input of signaling signals (Mp + 1 to Mn) of the at least one virtual railway component, and

- The control program (30) is suitable, the message signals

(Mp + 1 to Mn) as part of the control of the extended railway system to process and output depending on the applied message signals output signals (Sp + 1 to Sn) to produce.

10. Monitoring device (50) for monitoring an interlocking computer (5) according to claim 9,

d a d u r c h e c e n c i n e s that

- The monitoring device (50) has an interface (80) ^¬ , which allows a connection to one or more iron ^¬ web component connections (Ap + 1 to An) of the interlocking ^¬ computer (5), and - in the monitoring device (50) a monitoring program (90) is stored, the test data (T) as reporting signals (Mp + 1 to Mn) of at least one virtual railway component in the interlocking computer (5) can enter and due to the message signals (Mp + 1 to Mn) on the output side of the interlocking computer (5) generated output signals (Sp + 1 to Sn) can check for accuracy.