EP0473834B1 - Electronic interlocking control system, set up according to the local processor control principle - Google Patents

Description

The invention relates to a device according to the preamble of claim 1. Such a device is known from Signal and Wire 81 (1989) 5, pages 95 to 102.

It reports on the control and monitoring of the route elements of an electronic signal box with the help of positioning computers (route element computers), via which both the command output and the receipt of messages are processed. Redundancy is provided for all devices that serve to control and monitor more than one guideway element. H. these facilities are doubled. This applies in particular to the control computer and to the adjustments to the outdoor area. Because two signaling computers are provided, a much larger number of signaling computers is required than in a signal box without signal processor redundancy. This requires a very high level of technical equipment, but with the advantage of high system availability. If only route elements in side tracks are controlled by certain route element computers, a redundant computer version can be dispensed with (Signal und Draht 78 (1986) 9, pages 175 to 184, in particular page 183). Here, the device effort is minimized; however, there is no redundancy for this.

With regard to the provision of redundancy, it is disadvantageous in the known device that the guideway elements are to be connected on the input side to the output of one or the other control computer, depending on whether one or the other associated control computer is operating; this must be done without retroactive effect and takes place via exclusion switching means. It is also disadvantageous that so far inactive control computer only after the switchover is informed of the actual status of the connected track elements. This unnecessarily delays process control. Another disadvantage of the known device can be seen in the fact that at least the feedback of the operating states to the control computer takes place only in one channel. With suitable security procedures, data falsifications can be detected and rendered ineffective on the transmission path from the route elements to an operational control computer; however, this requires the message to be retransmitted in the event of a transmission fault in order to continue the process control. Overall, this also slows down the process.

The object of the invention is to provide a device according to the preamble of claim 1, which is flexible in terms of its redundancy design. Any malfunctions in the transmission of commands and messages should be recognized as quickly as possible when they occur and should enable the controlling area computer to react immediately and appropriately to the malfunction that has occurred.

The invention solves this problem by the characterizing features of claim 1. The continuous reading of messages into the control computer in connection with the transmission of message releases allows faulty messages to be recognized immediately; reading the messages into two control computers allows the messages transmitted via the other channel to be evaluated in the event of a fault in one transmission channel, without requiring any noteworthy additional effort for switching the messages. The command route to the output switching means for the guideway elements is monitored by monitoring messages for the correct output of the commands. Only where redundant control of a process element is actually required are redundant control computer parts provided for the command output to the route elements.

Advantageous refinements of the device according to the invention are specified in the subclaims.

Claim 2 denotes the representation of the messages and the associated message releases and their transmission to the control computer and the assignment of the messages to the releases.
According to the teaching of claim 3, the area computer individually selects those message bits that were received without interference from the message bytes transmitted by two control computers. The overall message evaluation is only disrupted if the corresponding message bits are disrupted in both message bytes.
Claim 4 specifies how the area computer derives the original messages from the messages and releases transmitted to it.
Claim 5 includes the configuration of the device according to the invention with non-redundant control of a process element and claim 6 of its configuration with redundant control.
Claim 7 designates the means for blocking an actuating computer as required, via which proper access to a process element to be controlled is no longer provided.

in Figur 1

eine in Melderichtung redundante und in Kommandorichtung nicht redundante Ausgestaltung der erfindungsgemäßen Einrichtung,

in Figur 2

eine in Melderichtung und in Kommandorichtung redundante Ausgestaltung der erfindungsgemäßen Einrichtung und

in Figur 3

ein Schema zum Ermitteln des originären Meldebytes bei mit Störungen behafteten Meldebytes.

Embodiments of the invention are explained in more detail below with reference to the drawing.
The drawing shows:

in Figure 1

a configuration of the device according to the invention which is redundant in the reporting direction and non-redundant in the command direction,

in Figure 2

a configuration of the device according to the invention which is redundant in the signaling direction and in the command direction and

in Figure 3

a scheme for determining the original message byte in the case of faulty message bytes.

Figure 1 shows schematically an area computer BR together with two control computers STR1 and STR2 for controlling a light signal S and other process elements of an interlocking, not shown in the drawing. The area calculator and the two control computers represent only a small section of the control elements of an interlocking. The light signal is shown in Command direction controlled in a non-redundant manner exclusively via the control computer STR2. Redundancy is not necessary because if the signal cannot be controlled via the control computer, the signal goes to a stop (safe state) and because this signal can be passed by turning on the beacon or by written command. The disruption that occurs does not in principle make the adjacent section of the route impassable; Redundancy is therefore not absolutely necessary.
The light signal is controlled via assigned actuators K2.1 and K2.2; K2.1 essentially contains the output gates of the control computer STR2 for the light signal, K2.2 essentially the adaptations for converting control instructions originating from the associated control computer into connection orders for the power switching means of the light signal. Monitoring messages Ü2 for identifying the respective switching state of the power switching means in the external control element are transmitted via the control computer STR2 to the area computer, which is then able to monitor the correct operation of the control elements. Only as long as the monitoring messages indicate that the commands issued via the control computer STR2 have been properly executed by the control unit K2.2, does the area computer use the control computer STR2 to issue further commands to this control unit; otherwise the correct command output is no longer guaranteed, the command output is omitted and the signal automatically stops and thus in a safe state. When the control of a process element is started via one or the other control computer, a start-up procedure ensures that the presence of monitoring messages can be temporarily dispensed with.
The respective operating state of the light signal is supplied in the form of operating state messages both to the signaling part M2.1 of the controlling control computer STR2 and to the signaling part M1.1 of a control computer STR1 provided for controlling other process elements. Both control computers independently check the transmitted messages for proper receipt and transmit them separately to the controller Area calculator BR. In doing so, they provide messages M1 and M2 with message releases F1 and F2, respectively, which indicate to the area computer whether the associated messages have been properly received or not. On the basis of the message releases sent to it, the area computer decides which of the two-channel messages sent to it are to be recognized as correct and which are not. If there are messages on both message channels, each with a message release that characterizes the proper receipt of messages, these are read into one or the other processing channel of the area computer; If a message is only present on one message channel and has a positive message release, it is read into both processing channels of the area computer.
Each message preferably consists of a bit of one or a different value and in the control computers, message bytes for transmission to the associated area computer are formed from the messages, possibly also from the messages of several controlled process elements. Each control computer generates an enable bit with the value L if the signal bit is received undisturbed, and an enable bit with the value O if the message bit is disrupted. These bits are transferred to the area computer together with the associated message byte as a message enable byte. There is a fixed assignment between the bit positions of the message bytes and those of the Maldefreigsbebytes. The area computer individually selects from the messages transmitted to it byte by byte by both control computers those bits to which message releases with the value L are assigned and discards all messages that are not provided with message releases of this value.

FIG. 2 includes the use of the invention in the control of a guideway element for which redundancy is required both in the message and in the command direction. This should be a switch W, which can be reversed by a drive A if necessary. This switch must remain controllable, even if it can no longer be controlled by a control computer normally responsible for it. For that then failed control computer jumps in, another control computer provided for this purpose, which has always been supplied with the status messages from the switch.
It is assumed that the switch W is usually controlled via the control computer STR1. For this purpose, the area computer BR supplies the control computer STR1 with appropriate commands K1. These commands are transmitted via a computer-internal control part K1.1 to a computer-external control part K1.2, in which the commands are converted into switching orders for power switching devices for controlling the point machine A. The drive is supplied with power in a known manner, for example via four-wire lines from the computer-external control part K1.2. This control unit transmits monitoring messages Ü1 about the switching position of its power switching means to the control computer STR1, which either forwards these monitoring messages to the area computer BR or compares them beforehand with the command commands pending and forwards the comparison results to the area computer. The area computer recognizes from the monitoring messages whether the commands initiated by it are carried out or not. He only tries to access drive A via the control computer STR1, as long as the control computer sends him the corresponding monitoring messages about the correct output of commands. If these monitoring messages fail to appear, or if they show that proper command output is no longer possible, the control computer STR1 locks the command parts assigned to it against further exposure and informs the area computer of this. This then causes the drive to be controlled via the control computer STR2. For this purpose, it supplies the control computer with the corresponding commands K2, which are output to the drive via computer-internal and external control components K2.1 and K2.2. Here too, constant monitoring of the command path up to the control part K2.2 external to the computer is provided, with corresponding monitoring messages U2 being sent to the control computer STR2 and from there directly or in processed form to the area computer.

The operating status messages of the switch are fed to the message parts M1.1 and M2.1 of the two control computers STR1 and STR2. There they are provided with message releases F1 and F2 and transmitted to the area computer BR. The area computer selects from the messages transmitted to it by the two control computers those with message releases for the correct receipt of the messages.

In the exemplary embodiment in FIG. 2, the process element to be controlled, the switch W, is accessed either via the control computer STR1 or the control computer STR2. However, there are also process elements that can be accessed simultaneously without interruption from two control computers. This happens, for example, with level crossing protection systems that are designed so that the failure of the control system automatically leads to the lowering of the barrier booms. Here the barriers can be controlled simultaneously from both computers via two parallel connection circuits, one of which remains effective if one fails. Switch-on of a point heater can also be initiated simultaneously via two control computers. Things are different when it comes to controlling a point machine; here, two actuators must not act on the drive at the same time, otherwise there is a risk that both actuators, e.g. due to different switching times of your computer-external actuators could temporarily use the drive in both directions at the same time. This could result in permanent damage to the actuator control circuit and thus to a total failure of the actuator; however, this should be avoided by keeping redundant control parts available.

FIG. 3 shows a diagram according to which the area computer selects the original messages from the messages and message releases transmitted to it by the individual signaling computer pairs without the value of individual message bits having to be corrected. It is assumed that the two control computers the area computer two message bytes M1 and M2 and two message release bytes F1 and F2 have transmitted. It is also assumed that the fourth message bit of the message byte M1 and the third message bit of the message byte M2 are documented by the message enable byte F1 as incorrectly received by the message enable byte F2. The area computer first links the message and message enable bytes transmitted to it according to an AND condition. The original message byte is not yet recognizable from the respective result of the AND operation. The area computer therefore inverts the message enable byte of one computer, eg message byte M1, and thus knows the bit position at which the message byte of the other computer must be accessed. In the example, this is the case at the fourth position of message byte M1. By ANDing the inverted message enable byte F1 of the one computer with the AND link from message enable byte F2 and message byte M2 of the other computer, the actual value of this bit, in the example "O", can be determined for the corrupted bit of the first message byte M1; all other bits of the AND link must be zero because of the inversion of the bits of the message enable byte F1 indicating the correct receipt of messages. If you now link the byte found by the two AND operations with the byte found by the AND operation of the message byte M1 with the message enable byte F1 according to an OR condition, this byte can only be modified by the OR operation where the message byte M1 was marked as incorrect by the associated message enable byte F1. In the present case, however, such a modification does not occur because the message bit to be corrected happens to have the value "O". By ORing the AND link from message byte M1 and message enable byte F1 with that by twice AND linking the message byte M2 and the message enable byte F2 of the other computer and the inverted message enable byte F1 the value found on your own computer can be simulated in the area computer.

Claims (7)

1. Device for the control of the process elements (S, W) of an electronic interlocking system set up according to the local processor control principle, having a plurality of interlock processors (STR1, STR2) which are supplied by the local processors (BR) with commands (K₁, K₂) and by the process elements (S, W) with messages (M₁, M₂) and which act via output switching means on associated process elements, characterized in that the process elements (S, W) feed the messages (M1, M2) originating from them in each instance to two interlock processors (STR1, STR2) and in that, in the case of procedurally correct reception of the messages, these interlock processors allocate clearance identifiers (F1, F2) and transmit these together with the messages to an associated local processor (BR), in that the local processor acknowledges only messages provided with clearance identifiers, and in that the local processor distributes the commands (K1, K2) formulated by it individually via such interlock processors to the associated process elements, from which, in the event of the prior transmission of commands, it has received appropriate supervision messages (Ü1, Ü2) for the procedurally correct output of these commands by the output switching means of the pertinent interlock processor.
2. Device according to Claim 1, characterized in that each message (M1, M2) comprises a bit of one numerical level or the other, in that the bits of a plurality of messages form a message byte, in that, dependent upon the procedurally correct reception of the messages, for each message (M1, M2) the interlock processors (STR1.1, STR1.2) generate as clearance identifiers (F1.1, F1.2) a bit of the numerical level L or a bit of the numerical level 0 and transmit these bits, in each instance following the associated message byte, as clearance identifier byte to the associated local processor (BR), in which case a fixed allocation exists between the bit positions of the message bytes and those of the clearance identifier bytes.
3. Device according to Claim 2, characterized in that the local processor (BR) selects from the messages (M1, M2) transmitted bytewise to it from the two interlock processors, individually in each instance those to which clearance identifiers have been allocated by an interlock processor.
4. Device according to Claim 3, characterized in that the local processor (BR) links the messages (M1, M2) transmitted to it from in each instance two interlock processors (STR1, STR2) with the respectively associated clearance identifiers (F1, F2) in accordance with an AND condition, in that the local processor inverts the clearance identifiers (F1) transmitted to it from in each instance one of the interlock processors (e.g. STR1) and links them with the byte formed by the AND link of messages (M2) and clearance identifiers (F2) of the respective other interlock processor (STR2) in accordance with an AND condition, and in that the local processor links this byte with the byte formed by the AND link of messages (M1) and clearance identifiers (F1) of the one interlock processor (STR1), in accordance with an OR condition and acknowledges the result as message byte.
5. Device according to Claim 1, characterized in that the control of a process element (S) takes place by a local processor in non-redundant manner via only one individual interlock processor (STR2), and in that, to this end, this process element is connected via appropriate output switching means (K2.2) to only this interlock processor.
6. Device according to Claim 1, characterized in that the control of a process element (W) takes place by a local processor in redundant manner via two interlock processors (STR1, STR2), in that, to this end, this process element is connected via two appropriate output switching means (K1.1, K2.1) to the one and the other interlock processor, and in that the control of the process element takes place via one or the other interlock processor or via both interlock processors, as a function of whether, for the process element, non-uninterrupted or uninterrupted redundancy is required and permissible.
7. Device according to Claim 5 or 6, characterized in that in the event of the recognition of the non-controllability of a process element (W), an interlock processor (e.g. STR1.1) blocks, within the processor, the command parts allocated to this process element and communicates this to the associated local processor (BR).

Images