TWI834832B - railway control system - Google Patents

Abstract

The railway control system is equipped with an electronic linkage device that can control on-site equipment through a communication network to control the operation of the train. The electronic linkage device consists of multiple processing units arranged at different stations to form a multiple system. The plurality of processing departments respectively retain each other's information that is transmitted and received through the communication network, and each performs normal judgment based on the information it retains, and decides whether it will operate as a parent system or a subsystem. In this way, the railway control system can avoid the occurrence of system obstacles and accurately control the operation of the train.

Description

railway control system

The present invention relates to a multi-system railway control system that controls the operation of trains through a communication network.

As a railway control system that controls train operation, an electronic linkage device is known, for example. The electronic linkage device will control on-site devices such as signals and switches according to the linkage chart data to ensure the safety of train operation. Because when such an electronic linkage device fails, the train will be unable to operate, so the electronic linkage device is usually a multi-system type.

For example, Japanese Patent No. 3208060 discloses an electronic linkage device that is composed of a dual system of a working system and a standby system, allowing the two systems to continuously operate, and switching to the standby system when the working system fails. This dual system type electronic linkage device has a common part with a logic circuit that receives the operating status of the two systems and has a relay connection method for system switching. Through this common part, the active system and the standby system are connected with metal wires. .

Regarding the above-mentioned conventional electronic linkage devices, it is difficult to install the use system and the standby system that constitute a dual system at a distance away from each other (for example, at different stations, etc.). That is, if the two systems are installed at different stations, etc., the total length of the metal wire connecting the use system, the standby system, and the common part will become longer. Since the signals transmitted by such long metal wires are easily affected by external noise, there is a possibility that system switching may malfunction. Therefore, in conventional electronic linkage devices, the operating system, standby system, and common parts need to be installed in the machine room of the same station.

If the operating system, standby system, and common parts are installed in the same machine room, and the machine room encounters a disaster such as fire or water damage, it may be impossible to maintain the linked control system including the electronic linkage device. subject. In addition, in the case of an intensive or centralized linkage control system that integrates linkage logic related to multiple stations through an electronic linkage device that is concentrated at one base station, there will be a system that allows disasters to occur. There is a possibility that the impact of an obstacle may extend to the entire route area, and a system structure that can avoid such a situation is required.

In addition, such issues are not limited to the interlocking control system including the above-mentioned electronic interlocking device, but are common to various railway control systems that adopt a multi-system approach to ensure the safety of train operation.

The present invention has been accomplished in view of the above-mentioned viewpoints, and an object thereof is to provide a multi-system railway control system that can avoid the occurrence of system failures and reliably control the operation of trains.

In order to achieve the above object, one aspect of the railway control system related to the present invention has a plurality of processing units that can control the operation of the train through a communication network; the plurality of processing units each have a plurality of processing units that can transmit and receive through the communication network. Each other's information will make normal judgments based on the information they hold, and decide whether they will act as a parent system or a subsystem.

According to the above-mentioned railway control system, since the plurality of processing units constituting the multiple system will independently perform its own normal judgment and decision-making, there is no need for a common unit in the conventional relay connection method, and each processing unit can be installed at a distance. place. With this, even if one of the plurality of processing units cannot operate due to a disaster, the other processing units located far away from it can still operate as a parent system, thereby avoiding the occurrence of system failures and ensuring reliable train operation. Operation control.

Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings. FIG. 1 is a block diagram showing the schematic configuration of a railway control system according to an embodiment of the present invention. In FIG. 1 , the railway control system 100 of this embodiment includes: an electronic linkage device 10 having a plurality (here, two) processing units 11-1 and 11-2 connected to the communication network 1; These are n) electronic devices 20-1, 20-2...20-n, which are connected to the communication network 1; and the field device 30, which is connected to the electronic device 20-1.

The electronic linkage device 10 controls the operation of the train by linking and controlling the electronic devices 20-1~20-n and the field devices 30 through the communication network 1. This electronic linkage device 10 forms a dual system by using processing units 11-1 and 11-2 having the same structure, and the processing units 11-1 and 11-2 are respectively arranged at different stations. Specifically, the processing unit 11-1 is installed in the machine room of station A, and the processing unit 11-2 is installed in the machine room of station B which is some distance away from station A.

When the electronic interlocking device 10 is operating, the above-mentioned processing units 11-1 and 11-2 cause one processing unit to operate as a parent system and the other processing unit to operate as a subsystem. The above-mentioned operating system and standby system in the conventional electronic linkage device are respectively equivalent to the parent system and the subsystem in the electronic linkage device 10 of this embodiment. The processing unit (parent system processing unit) operating as a parent system generates a synchronization signal Ss and a control signal Sc1 (or Sc2) and transmits them to the communication network 1. The synchronization signal Ss is used to control the electronic devices 20-1~20- The processing timing of the interlocking control between n and the field device 30 becomes a consistent reference, and the control signal Sc1 (or Sc2) is used to implement the interlocking control. On the other hand, the processing unit (subsystem processing unit) operating as a subsystem synchronizes with the synchronization signal Ss transmitted from the parent system processing unit and received through the communication network 1, and generates a signal for executing the above-mentioned linked control. The control signal Sc2 (or Sc1) is transmitted to the communication network 1. In addition, details about the parent-child determination method or the synchronization signal Ss and the control signals Sc1 and Sc2 in the linked control will be described in detail later.

The electronic devices 20 - 1 ~ 20 - n are objects that are linked and controlled by the electronic linkage device 10 through the communication network 1 . Here, a plurality of field devices 30 are connected to the electronic device 20-1 among the electronic devices 20-1 to 20-n. The field machines 30 are machines such as signals, switches, level crossings, track circuits, etc. The electronic devices 20-1 to 20-n and the plurality of field devices 30 in this embodiment correspond to the "machine group" of the present invention.

The electronic device 20 - 1 controls the operation of each field device 30 in accordance with the synchronization signal Ss and the control signals Sc1 and Sc2 received from the electronic linkage device 10 through the communication network 1 . In addition, the electronic device 20-1 will grasp the current status of each field device 30 under management, generate a status signal C1 indicating each status information, and transmit it to the communication network 1 at a predetermined cycle. Similarly, the other electronic devices 20-2~20-n will control each action according to the synchronization signal Ss and the control signals Sc1 and Sc2 from the electronic linkage device 10, and send status signals representing their current status information in a predetermined cycle. C2~Cn are sent to communication network 1. In addition, although an example in which only the field device 30 is connected to the electronic device 20 - 1 is shown here, there may also be a plurality of electronic devices connected to the field device on the communication network 1 .

The communication network 1 can use a conventional communication mechanism capable of bidirectionally transmitting information or signals between the processing units 11-1, 11-2 of the electronic linkage device 10 and the electronic machines 20-1~20-n. In the railway control system 100 of this embodiment, the processing units 11-1, 11-2 and the electronic devices 20-1 to 20-n can exchange data with each other at any time through communication such as multicast.

FIG. 2 is a block diagram showing an example of the hardware configuration of the processing unit 11-1 of the electronic linkage device 10. In addition, since the processing unit 11-2 has the same hardware configuration as the processing unit 11-1, description thereof is omitted.

In FIG. 2 , the processing unit 11 - 1 includes a processor 41 , a memory 42 , a storage device 43 , a communication device 44 , and an input/output device 45 .

The processor 41 has a built-in CPU (Central Processing Unit) and a flash memory, and executes various programs stored in the memory device 43 .

The memory 42 is, for example, RAM (Random Access Memory), etc., and is loaded with programs executed by the processor 41 and stores data used for processing by the processor 41 .

The memory device 43 is, for example, a HDD (Hard Disk Drive) or a flash memory, and stores a mother-child determination program and a linkage processing program, as well as linkage chart data referenced during linkage processing. Refer to the priority system data, etc. The parent-child determination program stores processing algorithms related to the determination of the operation mode (parent system or subsystem) of its own processing unit at startup and the switching of the operation mode during operation after startup. In addition, the linked processing program stores an algorithm for linking with the processing of the parent and child determination programs to realize linked control corresponding to each action mode of the parent system and the subsystem.

The communication device 44 transmits various signals generated by the calculation processing in the processor 41 to the communication network 1 and receives them from other processing units 11-2 and each electronic device 20-1~20-n and transmits them to the communication network 1 Various signals are sent to the processor 41.

The input/output device 45 is, for example, a keyboard or a display, and receives the user's action commands or various setting values, etc., and outputs the calculation processing results of the processor 41 .

Each component of the above-mentioned processing unit 11-1 is connected by a bus 46.

FIG. 3 is a functional block diagram illustrating functions included in the processing unit 11-1 in block form. In addition, since the functional blocks of the processing unit 11-2 are also the same as those of the processing unit 11-1, description thereof is omitted.

In FIG. 3 , the functional blocks as the processing unit 11 - 1 include a signal monitoring unit 51 , a normality judgment unit 52 , a parent-child determination unit 53 , a fault information output unit 54 , a synchronization signal generation unit 55 and a control signal generation unit 56 .

The signal monitoring unit 51 monitors signals transmitted from the other processing units 11-2 and the electronic devices 20-1 to 20-n and received through the communication network 1. This signal monitoring unit 51 can store the presence or absence of signal reception for n cycles (where n is an integer equal to or greater than 2) and the history related to the validity/invalidity of the received signal. The monitoring results of the signal monitoring unit 51 are sent to the normal judging unit 52 and the control signal generating unit 56 respectively.

The normality judgment unit 52 judges whether its own processing unit 11-1 operates normally based on the monitoring results of the signal monitoring unit 51, and when the other processing unit 11-2 operates as a parent system (it operates as a subsystem) , to determine whether the parent system processing unit is operating normally. The judgment results of the normal judgment unit 52 are sent to the mother-child decision unit 53 and the fault information output unit 54 respectively.

The normality judgment of the processing unit 11-1 of the normality judgment unit 52 is, for example, based on the presence or absence of the status signals C1 to Cn from the electronic devices 20-1 to 20-n monitored by the signal monitoring unit 51. Whether the communication line is in normal condition. The communication line referred to here is a partial communication line connecting the processing unit 11-1 and the communication network 1. In this communication line, when a fault occurs, such as a disconnection of the communication cable or poor contact of the connector, the processing unit 11-1 is completely unable to receive the signal from the communication network 1. The status signals C1~Cn from the electronic devices 20-1~20-n will be repeatedly transmitted in a predetermined cycle as mentioned above. Therefore, as long as it monitors whether any of the status signals C1~Cn is received, it can be judged. Whether the communication line is in normal condition or has a fault. In addition, in addition to its own communication line, the normality determination unit 52 can also use the self-diagnosis function of hardware such as the processor 41, memory 42, communication device 44, etc. to determine whether there is a problem in the calculation process itself.

In addition, the normality judgment of other processing units operating as a parent system in the above-mentioned normality judgment unit 52 is, for example, the state signals C1 to Cn from the electronic devices 20-1 to 20-n monitored by the signal monitoring unit 51. If all or part of the signal from the other processing unit 11-2 (parent system) is received, it will be determined that the parent system is faulty, or if the signal from the parent system contains the following fault information F, the parent system will also be determined. A malfunction occurs. In addition, the normality determination unit 52 in this embodiment has functions as the "first determination unit" and the "second determination unit" in the present invention.

Based on the determination result of the normal determination unit 52, the parent-child determination unit 53 determines whether its own processing unit 11-1 will operate as a parent system or a subsystem, and sends the determination results to the synchronization signal generation unit 55 respectively. and a control signal generating unit 56. The specific processing content of the mother-child determination unit 53 is divided into two situations: when the electronic linkage device 10 is started and when the electronic linkage device 10 is started and operated, and will be described in detail later with reference to the flowchart.

When the normal determination unit 52 determines that its own processing unit 11-1 (own system) is faulty, the fault information output unit 54 generates fault information F indicating that the own system is in a fault state, and transmits the fault information F. When sent to the communication network 1, it is simultaneously sent to the control signal generating unit 56. As a method of transmitting the fault information F to the communication network 1, for example, the fault information F is mounted on a signal different from the control signal Sc1 that is transmitted, and is transmitted by a flag that displays the fault in the control signal Sc1, or is transmitted. A method of notifying external fault status, etc. without transmitting a signal.

The synchronization signal generation unit 55 generates the synchronization signal Ss when the parent-child determination unit 53 determines that its own processing unit 11-1 operates as the parent system. This synchronization signal Ss is used as a basis for making the timing of the processing in the linked control consistent. Specifically, it is used to make the timing of starting the calculation processing of each of the processing units 11-1 and 11-2 constituting the dual system consistent. the benchmark signal. The synchronization signal generating unit 55 transmits the generated synchronization signal Ss to the communication network 1 in a predetermined cycle. In this way, all the machines on the communication network 1 will use the reception of the synchronization signal Ss as a trigger to start their own processing, and perform periodic operations based on this time point.

When the parent-child determination unit 53 decides to operate the processing unit 11-1 as the parent system, the control signal generation unit 56 uses the signal monitoring unit according to the timing of the synchronization signal Ss generated by the synchronization signal generation unit 55. The status signals C1~Cn from the electronic devices 20-1~20-n monitored by 51 are used as input data. On the other hand, when the parent-child determination unit 53 decides to operate its own processing unit 11-1 as a subsystem, the control signal generation unit 56 cooperates with the control signal from the other processing unit 11-2 (parent unit) monitored by the signal monitoring unit 51. The timing of the synchronization signal Ss of the system) uses the status signals C1 to Cn from the electronic devices 20-1 to 20-n monitored by the signal monitoring unit 51 as input data. Then, the control signal generating unit 56 generates a control signal Sc1 for performing linked control corresponding to the contents of the adopted status signals C1 to Cn, and transmits the control signal Sc1 to the communication network 1 in a predetermined period. This control signal Sc1 can be set with an invalid flag. The control signal Sc1 in which the invalid flag is established will not be used for controlling the operation of the electronic devices 20-1 to 20-n that are linked control objects and the field device 30, and becomes a discarded signal.

An example of the format of the above control signal Sc1 is shown in FIG. 4 . This control signal Sc1 has the format of DIX standard based on UDP/IP communication protocol as the communication protocol. In this format, the information specifying the electronic devices 20-1 to 20-n or the field device 30 as the control target is displayed as the MAC address of the receiving place, and the information specifying the processing unit 11-1 is displayed as The transmission MAC address displays the specific content of the linkage control as user data. Invalid flags can be displayed using specific areas within user data. In addition, the communication method used for transmitting and receiving control signals, etc., and the format of the control signals, etc. are not limited to the above example.

The communication using the multicast method described above is information (from the electronic devices 20-1 to 20-) that is used as input data for the calculations when the processing units 11-1 and 11-2 start the calculation processing at different timings. The status signals C1 to Cn) of n will be different, which may cause the contents of the control signals Sc1 and Sc2 generated by each control signal generating unit 56 to be different. In order to avoid such inconsistencies in the control signals Sc1 and Sc2 and achieve integrity, the control signal generation unit 56 of each processing unit 11-1 and 11-2 uses the status signals C1 to Cn in accordance with the timing of the synchronization signal Ss.

In addition, when the fault information F is transmitted from the fault information output unit 54, the control signal generation unit 56 stops the transmission of the generated control signal Sc1 to the communication network 1, or sets an invalid flag in the control signal Sc1 without using linkage control. . Furthermore, the control signal generation unit 56 generates the invalid flag establishment even when the status signals C1 to Cn from the electronic devices 20-1 to 20-n cannot be collected, such as when the processing unit 11-1 is started. a temporary control signal Sc1, and the control signal Sc1 is periodically transmitted toward the communication network 1.

In addition, although an example is shown here of generating a synchronization signal Ss for making the processing timing coincide with the control signal Sc1 for executing the linked control and transmitting it to the communication network 1, other than that, there is also an example. It is possible to create a mark for obtaining the processing timing point in the header of the control signal Sc1, so that the control signal Sc1 has the function of the synchronization signal Ss.

In addition, as another method to replace the synchronization signal Ss, as shown in the schematic diagram of FIG. 5 , the frame carrying the status signal and the control signal will circle the subsystem processing unit and the electronic device 20 starting from the parent system processing unit. -1~20-n on the communication network 1, each parent system processing unit, subsystem processing unit and each electronic device 20-1~20-n will be relative to the specific area A1, A2, A3... to read and write data. Since in this method, the status signals C1 ~ Cn from each electronic device 20 - 1 ~ 20 - n used by each parent system processing unit and subsystem processing unit are the same, therefore each parent system processing unit and subsystem can obtain Integration of control signals generated by the processing unit.

Next, referring to the flowchart of FIG. 6 , an example of the processing operations performed by each processing unit 11 - 1 and 11 - 2 to determine mother and child when the electronic linkage device 10 is activated will be described in detail.

When one of the processing units 11-1 and 11-2 constituting the dual system of the electronic linkage device 10 is powered on, the processor 41 of the processing unit executes the parent-child determination program and the linkage processing program stored in the memory device 43 . In addition, in order to complete the activation of the electronic linkage device 10 according to these programs, at least one machine connected to the communication network 1 needs to be operated.

In the initial step S10 in the flowchart of FIG. 6 , the processor 41 performs a process of setting an invalid flag on the control signal Sc generated by its own processing unit (own system) as a post-startup process. In addition, the symbol Sc indicates either the control signal Sc1 generated by the processing unit 11-1 or the control signal Sc2 generated by the processing unit 11-2. Since the process of establishing this invalid flag cannot collect the status signals C1~Cn from the electronic devices 20-1~20-n in the post-startup stage, it is used to prevent the temporarily generated control signal Sc from being used for actual linkage control. measures. The invalidated control signal Sc is transmitted to the communication network 1 in a predetermined period.

In the subsequent step S20, the processor 41 monitors the signals received through the communication network 1 to determine whether any of the status signals C1~Cn from the electronic devices 20-1~20-n is received. When the status signal is received (Yes), it will be judged that the communication line is in a normal state and proceed to step S30. On the other hand, if the status signal is not received (No), it will wait until it is determined that the status signal is received. When the status signal exceeds the period of transmission to the communication network 1 and continues to be unable to receive the status signal, it will be determined that a fault such as disconnection has occurred in its own communication line, and steps S10 to S20 will continue to be repeated.

Next, in step S30, the processor 41 determines whether the control signal Sc from other processing units (other systems) has been received. If the control signal Sc from other systems has not been received (No), the following steps S40 will not turn on the power of other systems, but will recognize that its own system is in a state that needs to be started before other systems (hereinafter referred to as the "first boot state"). On the other hand, if the control signal Sc from the other system is received (Yes), the process moves to step S70.

When the first-start state is identified, in the subsequent step S50, the processor 41 determines whether the first-start state has continued for n cycles. Therefore, the number of cycles n of the judgment standard is set in order to recognize the first start-up state more reliably, and two or more values can be set appropriately. If the previously activated state continues for n cycles (Yes), the process proceeds to step S60. If the previous activation state does not continue for n cycles (No), the process returns to step S10.

When it is confirmed that the processor 41 is in the first-start state for n consecutive cycles, in step S60 , the processor 41 decides to start operating its own processing unit as the parent system. As a specific action of the parent system, the synchronization signal Ss is first generated and transmitted to the communication network 1 and the latest status signals C1 ~ Cn from the electronic devices 20 - 1 ~ 20 -n are used according to the timing of the synchronization signal Ss. Then, corresponding to the contents of the latest status signals C1 to Cn, the linkage graph data stored in the memory device 43 is referred to and the control signal Sc is generated. The generated control signal Sc will not establish an invalid flag, that is, it will be transmitted to the communication network 1 as a valid control signal Sc.

When it is determined in step S30 that the control signal Sc is received from other systems, in step S70 the processor 41 determines whether the received control signal Sc is valid or invalid. When the valid control signal Sc is received (Yes), in the subsequent step S80, it will be recognized that other processing units have operated as the parent system, and the own system will be in a state that will be started later than other systems ( Hereinafter, referred to as the "post-start state"). On the other hand, if the invalid control signal Sc is received (No), the process moves to step S110.

When the post-start state is identified, in step S90 the processor 41 determines whether the post-start state has n consecutive cycles. If the post-start state has continued for n cycles (Yes), the process will proceed to step S100. If the post-start state has not continued for n cycles (No), the process will return to step S10.

When the post-startup state is confirmed for n consecutive cycles, in step S100 the processor 41 executes processing for causing its own processing unit to operate as a subsystem. FIG. 7 is a flowchart showing an example of processing of subsystem actions. First, the processor 41 determines to operate its own processing unit as a subsystem in step S101 of FIG. 7 . In the following step S102, the synchronization signal Ss from other processing units operating as the parent system is received via the communication network 1, and the synchronization signal Ss from the electronic devices 20-1 to 20-n is used according to the timing of the synchronization signal Ss. The latest status signals C1~Cn. In step S103, the linkage chart data stored in the memory device 43 is referenced corresponding to the contents of the latest status signals C1 to Cn, and the control signal Sc is generated. This control signal Sc has an invalid flag established at the current time point.

In the subsequent step S104, the processor 41 maintains the generated control signal Sc in an inactive state and transmits it to the communication network 1. In the next step S105, the processor 41 compares the generated control signal Sc with the effective control signal Sc received from other processing units via the communication network 1 to determine whether the contents are consistent. If they are not consistent (No), the process of making the contents of the control signal Sc consistent is performed in step S106, and then the process returns to step S102. In the case of consistency (Yes), step S107 will be advanced without setting an invalid flag for control signals generated after the next cycle. Thereby, the processing unit starts operating as a subsystem processing unit.

In step S70 of FIG. 6 , when it is determined that the invalid control signal Sc is received, in step S110 the processor 41 recognizes that although the power of other systems is turned on, it will not determine the operation of the parent system or subsystem. The state in which the invalid control signal Sc is transmitted is a state in which the own system and other systems are activated almost simultaneously (hereinafter referred to as the "simultaneous on state").

The determination of the parent and child in the simultaneous open state is, for example, to give priority to the input/output device 45 and store the startup system (hereinafter referred to as the "priority system") in the memory device 43 in advance, and the parent system can be the case where the own system is equivalent to the priority system. If not, it is the subsystem. In this manner, in step S120, the processor 41 will refer to the priority system data stored in the memory device 43 to determine whether its own system is a priority system. If the system is a priority system (Yes), the process proceeds to step S130. If the system is not a priority system (No), the process proceeds to step S150. In addition, although an example of determining the priority system by referring to the priority system data stored in the memory device 43 is shown here, the setting method of the priority system is not limited to this. For example, physical switches can also be set in each processing unit in advance. Use this physical switch to set and refer to the priority of each processing unit.

In step S130, the processor 41 determines whether the simultaneous startup state has m consecutive periods. For this reason, the period number m of the judgment criterion is set to a smaller value (m<n) than the period number n used for the judgment in step S50 and the like. If the simultaneous activation state has continued for m periods (Yes), the process proceeds to step S140. If the simultaneous activation state has not continued for m periods (No), the process returns to step S10.

When it corresponds to the priority system and continues for m cycles and confirms the simultaneous start-up state, in step S140, the processor 41 determines to start operating its own processing unit as the parent system in the same manner as the above-mentioned step S60.

When it is determined in step S120 that the own system is not a priority system, in step S150, the processor 41 determines whether the simultaneous startup state lasts for n consecutive periods. If the simultaneous activation state has continued for n cycles (Yes), the process proceeds to step S160. If the simultaneous activation state has not continued for n cycles (No), the process returns to step S10.

When the system is not a priority system and the simultaneous start-up state is confirmed for n consecutive cycles, in step S160, the processor 41 executes a process of causing its own processing unit to function as a subsystem. In addition, at this time, other systems will start operating as the parent system processing unit. The processing of the subsystem action is the same as the processing of step S100 described above, and the processing will be executed according to the flowchart illustrated in FIG. 7 . This causes the processing unit to start operating as a subsystem processing unit.

Through the above-mentioned processing operation for determining the parent and child when the electronic interlocking device 10 is activated, one of the processing units 11-1 and 11-2 constituting the dual system operates as the parent system processing unit, and the other acts as the child system processing unit. The system processing unit operates to start interlocking control of the electronic devices 20-1 to 20-n and the field device 30 using the electronic interlocking device 10. During operation after startup, the synchronization signal Ss and the effective control signal Sc1 (or Sc2) will be transmitted from the main system processing part of the electronic linkage device 10 to the communication network 1, and the effective control signal Sc2 (or Sc1) will be transmitted from the subsystem processing part. Sent to communication network 1. As a specific example, the above-mentioned FIG. 1 shows a case where the processing unit 11-1 of the electronic linkage device 10 is used as the main system processing unit and the processing unit 11-2 is operated as a subsystem processing unit. On the communication network 1 The status of bidirectional transmission of synchronization signal Ss, control signals Sc1, Sc2 and status signals C1~Cn. In addition, the symbols in brackets in the signal transmission status illustrated in Figure 1 are examples of signals transmitted when a fault occurs, which will be described in detail later.

The electronic devices 20-1~20-n and the field device 30 that are the objects of linked control will, for example, compare the contents of the control signals Sc1 and Sc2 received from the parent system processing unit and the subsystem processing unit through the communication network 1. After confirming that the dual systems of the electronic linkage device 10 are in a normal state based on the coincidence, respective actions will be controlled according to the control signal Sc1 (or Sc2). In addition, the confirmation that the contents of each control signal Sc1 and Sc2 are consistent only needs to be appropriately performed in accordance with the reliability required by the linked control system. Basically, only the control signal from the parent system processing unit can be used. To control the operation of the target machine, it is also possible to separately specify the operation when the contents of the control signals Sc1 and Sc2 are inconsistent.

Next, an example of the switching operation between the parent system and the subsystem of the electronic linkage device 10 during operation after startup will be described in detail with reference to the flow chart of FIG. 8 .

When one of the processing units 11-1 and 11-2 of the electronic interlocking device 10 is operated as a parent system processing unit and the other one is operated as a subsystem processing unit, the processor 41 of each processing unit operates in accordance with the parent and subsystem processing unit. The decision program and the linkage processing program execute the switching judgment processing of the operation mode of the own processing unit. First, in step S300 of FIG. 8 , the processor 41 monitors the signal received through the communication network 1 to determine whether the synchronization signal Ss is received. When the synchronization signal Ss is received (Yes), in the following step S310, the operation mode of the processing unit itself will continue to operate if it is a subsystem, or it will switch to a subsystem if it is a parent system. If the synchronization signal Ss is not received (No), the process moves to step S320.

Regarding the processing of the above-mentioned steps S300 and S310, the synchronization signal Ss is a signal transmitted only from the parent system. The so-called reception means that the processing unit itself basically operates as a subsystem and does not operate as the parent system in principle. However, it cannot be ruled out that an abnormality occurs in the processing of the own system, causing both processing units to operate as the parent system. Assuming this situation, in the process of step S310, if the operation of the own system is the parent system, it will be switched to the subsystem. In addition, depending on the content of the exception, it is possible to stop the operation of the own system without switching to a subsystem.

Since it is confirmed in step S320 that the synchronization signal Ss has not been received, the processor 41 determines whether the control signal Sc from other processing units has been received. If the control signal Sc is received (Yes), the process proceeds to step S330. If the control signal Sc is not received (No), the process proceeds to step S420.

In step S330, the processor 41 determines whether the received control signal Sc is valid or invalid. In the case where the control signal Sc is valid (Yes), it will be judged that the synchronization signal Ss from other processing units will not be received, and there is a state of receiving the valid control signal Sc, that is, the other processing units will operate as subsystems. state. In this state, the processing unit itself basically operates as a parent system and does not operate as a subsystem in principle. However, as in the above case, there is still a possibility that an abnormality occurs in the processing of the own system, causing both processing units to operate as subsystems. Assuming this situation, in the following step S340, the processor 41 will determine whether its processing unit is a parent system or a subsystem.

If it is the parent system (Yes), in the following step S350, the system continues to operate as the parent system. On the other hand, if it is a subsystem (No), it will move to step S360 and determine whether there is the same state for n consecutive periods, that is, the synchronization signal Ss from other processing units is not received, and the synchronization signal Ss from other processing units is received. Effectively control the state of signal Sc. If the same state continues for n cycles (Yes), the process proceeds to step S370. If the same state does not continue for n cycles (No), the process proceeds to step S380 and continues to operate as a subsystem.

In step S370, the processor 41 recognizes that both processing units are operating as subsystems, and determines whether its own system is equivalent to the above-mentioned priority system. If the own system corresponds to the priority system (Yes), in subsequent step S390, the operation mode of the own processing unit is switched from the subsystem to the parent system. On the other hand, if the own system is not a priority system (No), it will continue to operate as a subsystem in the same manner as in step S380.

If it is determined in step S330 that the invalid control signal Sc is received (No), in step S400, the processor 41 determines whether there is the same state for n consecutive cycles, that is, the synchronization signal Ss from other processing units is not received. , and there is a state of receiving invalid control signal Sc. Such a state may occur when other processing units are starting up, or when a minor glitch causes a minor problem in the calculation process itself. If the same state has continued for n cycles (Yes), in the following step S410, if the operation mode of the processing unit is the parent system, it will continue to operate, and if it is the subsystem, it will switch to the parent system. On the other hand, if n cycles are not continued (No), the process returns to step S300.

After receiving the determination that the control signal Sc from other systems in step S320 has not been received, in step S420, the processor 41 will determine whether the status signals C1~Cn from the electronic devices 20-1~20-n have been received. Either. If the status signal is received (Yes), the process proceeds to step S430. If the status signal is not received (No), the process proceeds to step S450.

In step S430, the processor 41 determines whether there are n consecutive periods of the same state, that is, it does not receive both the synchronization signal Ss and the control signal Sc from other processing units, and it receives the same state from the electronic devices 20-1~20- The state of any status signal of n. In the case of the same state for n consecutive cycles (Yes), in the subsequent step S440, it will be determined that a communication line failure has occurred or stopped operating in other processing units, and the operation mode of the own processing unit will be switched from the subsystem to the parent system. On the other hand, if n cycles are not continued (No), the process returns to step S300.

In step S450, the processor 41 determines whether there is the same state for n consecutive cycles, that is, the synchronization signal Ss and the control signal Sc from other processing units and any one of the electronic devices 20-1 to 20-n are not received. The status of the status signal. If the same state is continued for n cycles (Yes), the process proceeds to step S460. If the state is not continued for n cycles (No), the process returns to step S300.

In step S460, the processor 41 will recognize that its own communication line is faulty because it is completely unable to receive signals from the communication network 1. Then, it stops transmitting the control signal Sc from its own system. If the operation mode of its own processing unit is the parent system, it also stops transmitting the synchronization signal Ss, and transmits the fault information F indicating the fault of its own communication line to the communication network 1. All machines above. As a specific example, the parentheses in FIG. 1 show a case where the processing unit 11-1 of the electronic linkage device 10 is used as a parent system and the processing unit 11-2 is operated as a subsystem. In the processing unit of the parent system, 11-1 When a communication line fault occurs, the fault information F, control signal Sc2 and status signals C1~Cn are sent to the communication network 1. Thereby, the processing unit 11-2 operating as a subsystem is switched to the parent system. Then, when the processing unit 11-1 has repaired the fault, the processing after step S10 will be sequentially executed again according to the startup sequence shown in FIG. 6 . Therefore, if the processing unit 11-2 continues to operate normally as a parent system, the processing unit 11-1 with the fault repaired will resume operation as a subsystem.

In addition, in the above description, although an example has been shown that the processing unit 11-1 will stop transmitting the control signal Sc1 when a communication line failure has occurred, but in addition, an invalid flag can also be set in the control signal Sc1 to invalidate it. The control signal Sc1 is then sent to the communication network 1. When a fault occurs, it can be appropriately selected whether to stop the control signal Sc1 or to invalidate it.

Hereinafter, the switching operation between the parent system and the subsystem when a communication line failure occurs in the processing unit 11-1 operating as the parent system will be described in detail with reference to FIG. 9 .

The upper part of FIG. 9 illustrates the transition of operations when viewed from the processing unit 11-1 of the parent system, and the lower part of FIG. 9 illustrates the transition of operations when viewed from the processing unit 11-2 of the subsystem. Here, the processing units 11-1 and 11-2 of the parent system and the subsystem and the electronic devices 20-1 to 20-n respectively perform repeated processing in a fixed cycle of 200 ms, and the first step shown on the left side of Figure 9 is During the periodic processing, assume that a communication line failure (× mark in the figure) occurs in the parent system.

Under this assumption, in the first processing cycle, the processing unit 11-1 of the parent system will transmit the synchronization signal Ss and receive the control signal Sc2 from the processing unit 11-2 of the subsystem and the electronic device 20-1~ 20-n status signals C1~Cn. However, in the periodic processing (the second time) after the fault occurs, although the synchronization signal Ss is generated, the synchronization signal Ss cannot be transmitted to the communication network 1, and the processing unit 11 from the subsystem cannot be received. -2 and the signals of electronic devices 20-1~20-n (dashed arrows in the figure). Then, when this state continues for 3 cycles (n=3), the processing unit 11-1 of the parent system will stop outputting the synchronization signal Ss and also stop outputting the control signal Sc (or invalidate), and synchronize with the subsystem. Detached during operation.

At this time, although the processing unit 11-2 of the subsystem can receive signals from the electronic devices 20-1~20-n during the periodic processing (the second time) after the communication line failure of the processing unit 11-1 of the parent system occurs, status signals C1~Cn, but cannot receive the synchronization signal Ss and control signal Sc1 from the parent system. Then, when this state continues for three cycles, the processing unit 11-2 of the subsystem will determine that the processing unit 11-1 of the parent system has failed, and switch its operation mode from the subsystem to the parent system. Thereby, the switched processing unit 11-2 will transmit the synchronization signal Ss and the control signal Sc2 to the electronic devices 20-1~20-n through the communication network 1, and become a new parent system processing unit.

As explained above, according to the railway control system 100 of this embodiment, each processing unit 11-1 and 11-2 of the electronic linkage device 10 uses the synchronization signal Ss transmitted and received through the communication network 1 (during operation after startup) As well as control signals Sc1, Sc2 and status signals C1~Cn (when starting and running after starting), it can independently carry out its own normal judgment and mother-child decision, so there is no need to use a common relay connection method like previous electronic linkage devices. The part also uses metal lines to connect the operating system (parent system) and the standby system (subsystem) to switch between the two systems. Thereby, the processing units 11-1 and 11-2 constituting the dual system of the electronic linkage device 10 can be arranged at a certain distance in each machine room of different stations A and B. Therefore, even if the machine room of one of the stations encounters a disaster such as fire or flood, the processing unit in the machine room of the other station can still operate as a parent system to maintain the linked control system and avoid the disaster. System failures are caused and the train operation is controlled reliably. In addition, since no common parts are required and the number of components can be reduced, the frequency of failure of the electronic linkage device 10 can be reduced.

Furthermore, according to the railway control system 100 of this embodiment, the distance between the processing units 11-1 and 11-2 constituting the dual system of the electronic linkage device 10 can be freely set. In other words, the processing units 11-1, 11-2 can be 11-2 is arranged anywhere on the communication network 1, thereby increasing the design freedom of the electronic linkage device 10 and enabling a design that reduces equipment costs. For example, if there is a difference between the old and new hardware constituting each of the processing units 11-1 and 11-2, the priority of the processing unit configured with the new hardware will become higher, and the priority of the processing unit configured with the old hardware will be higher. The input/output device 45 or physical switch is set in such a way that the priority of the processing unit is lowered. If the processing unit (priority system) with a higher priority is placed in a place where maintenance is easier, efficient maintenance can be achieved. System design and movement for efficiency. This effect is particularly effective in an intensive or centralized linkage control system that collectively handles linkage logic related to a plurality of stations.

In addition, in the above embodiment, an example in which the processing units 11-1 and 11-2 of the electronic linkage device 10 are respectively arranged in the machine rooms of different stations has been described. However, even if the processing units 11-1, 11-2, 11-2 By arranging two machine rooms at a distance away from each other in the hinterland of the same station, system obstacles caused by disasters can still be avoided. Furthermore, although an example of the electronic linkage device 10 constituting a dual system with two processing units 11-1 and 11-2 has been shown, when three or more processing units are used to configure a multiple system, the present invention Also valid. When the electronic linkage device has three or more processing units, the priority of each processing unit, that is, the order of the system to be activated first, can be determined in the input/output device 45 and stored in advance in the input/output device 45 according to each processing unit. The memory device 43 can be pre-set using a physical switch or the like, so that each processing unit can independently determine its own mother-child action mode, similar to the case of the above embodiment. In this case, one processing unit operates as a parent system, and the remaining processing units operate as subsystems.

Furthermore, in the above embodiment, although it has been explained that the electronic linkage device 10 can perform linkage control of the electronic devices 20-1~20-n and the field device 30 through the communication network 1 as an example, the present invention does not The present invention is limited to the interlocking control system including such electronic interlocking device 10, but can be applied to any railway control system that adopts a multi-system approach in order to ensure the safety of train operation.

When the present invention is applied to any railway control system as described above, the plurality of processing units constituting the multiple systems each hold mutual information that is transmitted and received through the communication network. This retained information refers to what kind of signals each processing unit on the so-called communication network sends to the communication network and what kind of signals it receives from the communication network. Then, the plurality processing unit will perform normal judgment based on the retained information, and decide whether it will operate as a parent system or a subsystem. The normal judgment here is, for example, by retaining information and knowing that other processing units only received 2 types of signals where they should have received 3 types of signals from the communication network, and the signals sent by their own processing units did not When it is not received by other processing units, it can be judged that its own communication line is faulty. In addition, the mother-child operation mode of the self is determined by, for example, holding information that although other processing units transmit signals generated only by the mother system, the processing units other than the mother system including the self have not received the signal. When receiving a signal, it can determine that the processing unit of the parent system is faulty and switch its operating mode to the parent system. By providing each plurality of processing units with such functions, the same operational effects as those in the above-described embodiment can be obtained.

Although the embodiments and application examples of the present invention have been described above, the present invention is not limited to the above-mentioned embodiments and application examples, and can be further deformed and changed based on the technical idea of the present invention.

1: Communication network 10: Electronic linkage device 11-1, 11-2: Processing Department 20-1~20-n: Electronic equipment 30: On-site machine 41: Processor 42:Memory 43:Memory device 44:Communication device 45:Input/output device 46:Bus 51:Signal Monitoring Department 52:Normal Judgment Department 53:Mother and Child Decision Department 54:Fault information output department 55: Synchronization signal generation part 56:Control signal generation part 100:Railway control system C1~Cn: status signal F:Fault information Ss: synchronization signal Sc1, Sc2: control signal

FIG. 1 is a block diagram showing the schematic configuration of a railway control system according to an embodiment of the present invention. FIG. 2 is a block diagram showing an example of the hardware configuration of the processing unit in the above embodiment. Fig. 3 is a functional block diagram of the processing unit in the above embodiment. FIG. 4 is a diagram showing an example of the control signal format in the above embodiment. FIG. 5 is a schematic diagram illustrating another method of synchronizing signals in place of the above embodiment. FIG. 6 is a flowchart showing an example of processing operations when the electronic linkage device in the above embodiment is activated. FIG. 7 is a flowchart showing an example of processing of parent-child action. FIG. 8 is a flowchart showing an example of processing during operation of the electronic linkage device in the above embodiment. FIG. 9 is a diagram for explaining the parent-child switching operation when a communication line failure occurs in the parent system processing unit in the above embodiment.

without

1: Communication network

10: Electronic linkage device

11-1, 11-2: Processing Department

20-1~20-n: Electronic equipment

30: On-site machine

100:Railway control system

C1~Cn: status signal

F:Fault information

Ss: synchronization signal

Sc1, Sc2: control signal

Claims (7)

A railway control system has a plurality of processing units that can control the operation of trains through a communication network; the plurality of processing units are respectively arranged at different stations, and each retains mutual information that is transmitted and received through the communication network. Based on the information it holds, it will judge whether it is normal or not, and decide whether it will act as a parent system or a subsystem. For example, the railway control system of claim 1, wherein the plurality of processing units respectively performs a judgment on whether at least its own communication line is normal based on the retained information. For example, the railway control system of claim 1, wherein among the plurality of processing units, the parent system processing unit determined to operate as the parent system is configured to determine the timing of the operation control and execute the operation control; The subsystem processing unit that operates as a system is configured to execute the operation control according to the timing determined by the parent system processing unit. For example, the railway control system of claim 3 includes a group of machines connected to the communication network; at least the parent system processing unit among the plurality of processing units controls the operation of the train by interlocking the group of machines. For example, in the railway control system of claim 4, the parent system processing unit generates a synchronization signal and a control signal and transmits them to the communication network. The synchronization signal is used to make the timing of the linked control a consistent reference. The control signal It is used to implement the linked control; the subsystem processing unit is synchronized with the synchronization signal received from the parent system processing unit through the communication network, and generates a control signal used to implement the linked control and sends it to the communication network . For example, in the railway control system of claim 5, the parent system processing unit stops the synchronization signal when a fault occurs; when the subsystem processing unit cannot receive the synchronization signal through the communication network, it will change its action to The parent system becomes the new parent system processing unit; after the fault is repaired, when the original parent system processing unit receives the synchronization signal from the new parent system processing unit through the communication network, it will start operating again as a subsystem and become the new parent system processing unit. Subsystem processing department. For example, the railway control system of claim 5, wherein the plurality of processing units respectively include: a synchronization signal generation unit that generates the synchronization signal; a signal monitoring unit that monitors the signals transmitted from the machine group and other processing units through the communication network The received signal; the first judgment unit determines the status of the communication line corresponding to the presence or absence of the signal from the machine group monitored by the signal monitoring unit; the control signal generating unit determines the status of the communication line corresponding to the signal monitored by the signal monitoring unit The control signal is generated based on the content of the signal from the machine group; the second determination unit determines the status of the parent system processing unit based on the signals from other processing units monitored by the signal monitoring unit; and the parent-child determination unit , it is determined whether it will operate as a parent system or a subsystem according to each judgment result of the first and second judgment parts; when it is decided to operate as a parent system by the parent and child determination part, The synchronization signal generated by the synchronization signal generation unit and the control signal generated by the control signal generation unit will be transmitted to the communication network. When the subsystem is determined to operate by the subsystem determination unit, the synchronization signal generated by the synchronization signal generation unit will be transmitted to the communication network. The control signal generated by the control signal generating unit is sent to the communication network.