WO2003047937A1 - Method for controlling a safety-critical railway operating process and device for carrying out said method - Google Patents

Abstract

The invention relates to a method for controlling a safety-critical railway operating process in which the programme necessary for the above is divided into a system software (V,PMS) and a software (BO) specific for railway management. External commands (K) and messages (M), which affect the control, are recorded and transmitted to commercial computers (R1,R2) in which the actual process control runs, by means of the system software running in one or several secure signalling computers (SR*), as defined by the relevant railway operating condition. The processing of the programme specific for railway management can occur in two channels, parallel or serially, whereby the monitoring of whether the commercial computers have reached the same result is carried out in the secure signalling computers. The output (SB) to the process (BA) for control also occurs from there, so long as the secure comparison recognises that the commercial computers have provided the corresponding process result at least twice, otherwise the signalling connection to the process elements (W,S) is securely cut. The advantage of the invention is that the same software can always be used for the secure signalling computers and the railway management software can be separately developed and checked without being linked to the system software. Significant cost and time savings can thus be made relative to the state of the art without affecting safety.

Description

- Description ^■

Method for controlling a safety-critical rail operating process and device for carrying out this method

The invention relates to a method according to the preamble of patent claim 1 and to a device for carrying out this method according to the preamble of patent claim 12.

Railway operating processes are part of the safety-critical processes, because any malfunctions, if they are not recognized in time and their effects on the process are prevented, can lead to considerable damage to property and possibly also to persons. For this reason, signaling-safe devices have been used for the control of such processes, the task of which is to detect malfunctions both within the process to be controlled and within the process control itself, and then to lead or leave the process in a safe state. Such signal-safe controls can be implemented using different techniques, for example in relay technology or in electronic technology. Up to now, expensive special computers have been used for signal-safe process control via computers, which process the pending processing orders in two channels and continuously compare signal-wise with regard to processing sequences that match in terms of content. Issued control commands are only output to the process elements of the process to be controlled if both processing channels have each reached the same result; otherwise the connection to the process will be broken unless it is gives at least one spare computer, which can take over the functions of the failed computer and actually takes over.

The above-mentioned functions of the safe input and output of data as well as the data comparison with possibly safe shutdown of process elements are initiated by the system software of the safe computers. In addition, the secure computers also still contain the railway administration-specific software for the actual process control, e.g. interlocking operation. The railway administration-specific software is determined by the operating regulations of the respective railway administration and describes e.g. B. the predefined dependencies of the route setting and the driving street resolution (Signal + Draht, 77 (1985) 12, p.259-265). The railway administration-specific software not only differs from railway administration to railway administration, but at least partially also from installation to installation of the same railway administration. This means that the software to be loaded into and running in a signal-technically secure computer differs from application to application, whereby the freedom from errors of the loaded software must be proven or credible for each application by means of a security certificate. Due to the mixing of the system software and the course management-specific software in each computer, this leads to complex software packages that are difficult to understand and that are time-consuming and expensive to create and test.

The object of the present invention is to provide a method for

Controlling a safety-critical rail operating process according to the preamble of claim 1, which is less complex to prepare for the safe Process control required programs and that allows to react quickly and inexpensively to any changed requirements of a rail operator for process control. It is also an object of the invention to provide a device for performing this method.

The invention solves this problem by the features of claim 1 and claim 12. The basic idea of the invention is to outsource the railway management-specific software from the computer or computers that are secure in terms of signal technology to commercial computers, to process the data there at least twice and before output to check the process in the signal-safe computers for consistency. In addition to the task of data comparison, the signal-safe computers essentially also have the task of securely recording the incoming messages and commands and transmitting them to the commercial computers, as well as having a reliable effect on the process elements and, in the event of a malfunction, securely connecting the process elements interrupt.

Advantageous refinements and developments of the method according to the invention and the device according to the invention are specified in the subclaims.

The invention is explained below with reference to an embodiment shown in the drawing. The drawing shows schematically in FIG. 1 the structure of the device according to the invention for controlling a safety-critical device

Railway operating process and in Figure 2 the structure of a corresponding device designed according to the prior art. FIG. 2 shows a known, signal-technically secure computer SR for processing a process via preferably identical processing programs in two independent processing channels K1, K2. The secure computer SR stands for any number of signal-technically secure computers; their number essentially depends on the size of the process to be controlled. The process to be controlled is a railway operating process that is intended to act on a railway installation BA. Representing the process elements of

Railway system a switch W and a signal S are indicated in the drawing. The process elements are controlled and monitored by control and monitoring circuits developed for this purpose, which are not explicitly shown in the drawing and via which the safe computer SR issues control commands SB to the process elements and from there messages M are entered into the safe computer ,

The signal-safe computer SR sends the messages M transmitted to it by the process via a communication bus

KB to an input and display computer EAR. This serves, among other things, to monitor the railway operating process in accordance with the rules of presentation laid down in the respective railway operating regulations; it is preferably designed as a computer which is procedurally secure. The commands K for controlling the railway operating process are also generated via the input and display computer EAR and transmitted to the signal-safe computer SR. The input can be done by an operator, e.g. B. a dispatcher, or by an automatic z. B. for self-service or pass-through operation. The messages and commands are processed on two channels in the signal-safe computer according to the conditions and dependencies specified in the respective operating regulations of a railway operator. The data, addresses and control signals present on the buses of the two processing systems are constantly compared with one another in terms of signal technology so that any deviations can be recognized immediately. Test programs ensure that the input / output registers of the secure computer, as well as its program and work memory and its address register, are checked within a specified minimum period of time to determine whether their memory can be in one or the other state. Any malfunctions are detected in an event or time-controlled manner and lead to the safe shutdown of the outdoor facilities: control commands on turnouts can then no longer be issued and the signals stop.

Due to the fact that the conditions and dependencies specified by the respective operating regulations of a railway administration, represented in the drawing by elliptical placeholders BO, are stored in the program memories of the secure computer SR and are mixed with the system software, the one for controlling the railway operating process is stored in the secure computers Software is an individual software that is very complex and extremely complex to create and test.

In the device according to the invention for controlling a railroad operating process shown in FIG. 1, there is also at least one signal-safe computer SR * with two processing channels K1 * and K2 * which are preferably constructed identically and operated identically. His job is it, similar to that of the signal-technically secure computer SR according to the state of the art, reliably detects all the messages M and commands K supplied to it and feeds them for processing. Furthermore, it is his task to issue control commands SB, which have been developed in a signal-safe manner, to the process elements W, S of the respective rail system BA, or to ensure that the output of such control commands in the event of a fault does not occur, in terms of signaling. In contrast to the state of the art, the processing of the conditions and dependencies for the control and monitoring of the railway operating process defined by the respective Railway Operating Regulations BO does not take place in or in the signal-safe computers SR *, but in commercial computers R1, R2, ... Rn , in which the system-specific data for controlling the railway operating process are also stored; the computers R1, R2 represent one or more pairs of computers, each computer also being able to belong to several pairs; three computers could be formed from three computers. They carry out processing orders A supplied to them by the secure computer SR *, each independently of the other according to the conditions and dependencies defined for the process control in the respective rail operating regulations BO. The two computers of each commercial computer pair R1, R2 transmit their work results to the signal-technically secure computer SR *, the first computer R1 or R2 in time forcing a waiting point with time monitoring, at which the work result of the further computer or computers is waited for, or in the event of a timeout, fault handling is carried out. Test mechanisms PM for the plausibility of the messages supplied to the commercial computer pairs R1, R2 and the signatures of the outputs and memory areas they have developed are indicated schematically in FIG. 1. The input and display rights ner EAR commands K fed to the secure computer SR * are converted by the latter into processing orders A and transmitted in the form of telegrams to the commercial computers R1, R2; there they lead to processing according to the conditions and dependencies of the respective rail operating regulations BO.

In the event that the processing of the railway management-specific software is achieved by the commercial computers from these program points, which only provide for further processing of the programs after a predetermined waiting time, the signal-technically secure computer ensures that the processing programs of the processing computers are synchronized on request of the commercial computers commercial computer for further processing of the programs after the waiting time.

For example, after a waiting time of several seconds, the sensor message determined by the commercial computers should be read in and evaluated.

The processing results E determined by the commercial computer pair Rl, R2 are sent as telegrams to the signaling-safe computer SR *, where they are safely distributed over the two processing channels Kl *, K2 * and compared in terms of signaling to ensure they match. The function block V in which the relevant programs are stored as system software is shown in the drawing for the secure distribution of messages and the reliable comparison of the results worked out by the commercial computers R1, R2. In contrast to the test mechanisms PM of the commercial computers R1, R2, the test mechanisms PMS of the computer which is secure in terms of signal technology are implemented in a signal-safe manner. The particular advantage of the device according to the invention over a corresponding device designed according to the state of the art is that only the functions of safe input and output and safe data comparison can be implemented in the signal-technically safe computer, regardless of those by the operating rules of individual railway administrations each set requirements and conditions. This not only makes the system software running in the secure computer or in the secure computers simple and clear; Rather, it is the same for all applications, so it no longer has to be developed from case to case and subjected to an approval test. The railway administration-specific software, which is determined by the different operating regulations of the individual railway administrations, runs on the commercial computers. Their interaction with the system software of the secure computers does not have to be checked. Rather, it is only necessary to adhere to the specified interface between signal-safe and commercial computers and to check the functionality of the railway administration-specific software to be implemented in the commercial computers, ie to check whether certain inputs actually lead to certain outputs. This functionality check takes place separately from the check of the system software and, unlike in the prior art, is no longer integrated into the system software of the secure computers, which in turn is also clearer than in the prior art.

The development of the railway management-specific software does not necessarily have to be carried out by the manufacturer responsible for the signaling security of the process for the signaling-safe computer. Rather, it is possible to place orders to develop the programs for the commercial computers to qualified engineering firms or the like, which the software they have developed with the respective railway administration and z. B. an approval authority such as the Federal Railway Authority. This makes it possible to adapt the programs for controlling and monitoring a safety-critical rail operating process much faster and cheaper than before, without having to accept any loss of safety.

In the exemplary embodiment explained above, the commercial computers R1, R2 stand for one or more double computer systems or computer systems provided with redundant computers, in the individual computers of which identical programs for processing the conditions and dependencies specified by the respective railway operating regulations are to run, of which individual commercial computers, preferably either only certain sub-functions of the operating regulations are to be implemented or only certain parts of the railway systems are to be affected. However, the arrangement can also be such that the commercial computers R1, R2 are each individual computers, in which the programs of the railway administration-specific software determined by the operating regulations of a railway administration are processed independently several times, but at least twice in succession. The railway management-specific software required for this can be designed in a diversified manner or the content can be the same for both processing operations.

A non-signal-safe computer is preferably used for the transmission of the results developed by the commercial computers to the computer-safe computer Data transmission in question, in which either the two-channel serial or parallel results are transmitted on two channels to the safe computer or computers, or in which they are transmitted twice in succession over only one channel. A second or third redundant channel increases availability. Any data falsifications on the transmission path from the commercial computers to the signal-technically secure computers and vice versa can be recognized in the receiving computer by a signature entered by the sending computer, which codes the telegram content using a calculation rule. In the case of serial transmission of data to the secure computers, identifiers must be added to the data, which enable the computers with secure signals to recognize whether the transmitted data is up-to-date and actually comes from different computer channels of the commercial computers or is the result of different processing operations; in the case of data transmission via separate buses, the signal-safe computers can recognize from the data transmitted to them via one or the other bus whether or not these data actually originate from one or the other computer of a commercial computer pair.

In an advantageous embodiment of the invention, the commercial computer (s) can be designed as a so-called operator station computer, by means of which a railway operator or an automatic can issue commands for execution to the railway operating process and the feedback of the railway operating process can be visualized. The programs for entering and visualizing commands and messages and the programs that control the process elements in accordance with the railway operating regulations then run independently of one another in the operator station computers. The programs for the Command inputs and the visualization of the process can also be combined with the programs for process control as they are specified by the railway operating regulations.

The computer (s) that are secure in terms of signaling technology can also be designed as m of n computer systems, in which the decision as to whether and which control commands are to be issued to the process is made by a majority decision by at least two intact computers.

The control commands are output to the process in two channels; every computer has the option of preventing the issuing of control commands when processing errors are detected.

The method according to the invention and the device according to the invention can be used with advantage for all safety-critical railway operating processes. Such an application can e.g. B. the safe control of a railway operation through an interlocking but also z. B. the safe control of a level crossing, an Achszähl nläge and track and vehicle devices a regular train control (LZB).

Claims

claims 1. A method for controlling a safety-critical rail operating process using at least one signal-technically safe computer which, from incoming commands in accordance with a rail operating order, outputs control commands which have been developed in a signal-safe manner to process elements and feeds messages from there to a process status monitoring and process control, characterized in that in secure computer (SR *), only a system software (V, PMS) is stored, the programs of which enable the secure computer to carry out a signal-safe input / output and signal-safe data comparison, and that the railway management-specific software (BO) that the contains a condition given by a railway administration through its railway operating regulations and dependencies for the railway operation process, is stored in at least one non-signal-safe commercial computer (R1, R2) that the signaling techni secure computers are generated from the commands (K) and messages (M) it receives and processing orders (A) are sent to the commercial computer (s) so that the processing orders are processed there at least twice independently of one another, so that the results obtained ( E) and / or intermediate results are transmitted to the secure computer and there are signal-technically checked for conformity in terms of content, with only such results and / or intermediate results being accepted by the secure computer and setting instructions derived therefrom failures (SB) are signaled safely to the process (BA), which were made available by the commercial computer at least twice in accordance. 2. The method according to claim 1, which also means that identical or diverse software is used for the processing of processing orders in the commercial computer at least twice. 3. The method according to claim 1 or 2, so that the time events resulting from the processing of the railway management-specific software (BO) are synchronized by the signal-technically secure computer (SR *) at the request of the commercial computer. 4. The method according to any one of claims 1 to 3, so that the results and / or intermediate results determined by the commercial computer are transmitted to the secure computer via communication channels that are not secure in terms of signal technology. 5. The method according to any one of claims 1 to 4, that data transmission is provided and that the telegrams are accompanied by signatures from which the receiving computer can recognize whether these telegrams have been transmitted in an unadulterated manner. 6. The method according to any one of claims 1 to 5, characterized in that data transmission by telegram is provided and that the telegrams are accompanied by signatures from which the signal-safe computer can recognize whether falsifications have occurred in the program and data memories of the commercial computers or whether the CPU of a commercial computer no longer works correctly. 7. The method according to any one of claims 1 to 6, characterized in that the processing orders in at least two commercial computers (R1, R2) are processed essentially at the same time or serially in time in only one computer and that the results and / or intermediate results determined secure computers for comparison can be fed in pairs. 8. The method according to claim 7, so that the telegrams are given identifiers from which the secure computer can recognize whether these telegrams were actually processed separately. 9. The method as claimed in claim 7, so that the secure computer recognizes whether the telegrams originate from different computers on the basis of the result reports of the commercial computers fed to it via various inputs. 10. The method according to any one of claims 1 to 9, characterized in that systematic errors in the operating system software (BO) of the commercial computer through the use of diverse loading drive systems on the computers involved (Rl to Rn) can be excluded. 11. The method according to any one of claims 1 to 10, so that systematic errors in the hardware of the commercial computers are excluded by using diverse computer components (motherboard, CPU, memory) on the computers involved (Rl to Rn). 12. Device for carrying out a method for controlling a safety-critical railroad operating process with at least one computer that is secure in terms of signal technology and that provides control commands for signals that have been safely generated from incoming commands in accordance with a railroad operating code Outputs process elements and feeds messages from there to process status monitoring and process control, characterized in that only system software is implemented in the signal-safe computer (SR *), the programs of which enable the safe computer to perform the signal-safe input / output (K, E, M, A, SB) and the signal-related secure data comparison, and that at least one non-signal-secure commercial computer (Rl, R2) is provided, in which the railway management-specific software is implemented, which is used by a railway administration through its railway operating regulations (BO ) Predefined conditions and dependencies for the control of the railway operating process include that the secure computer and the commercial computer are connected to a communication system (BUS), via which the secure computer processes processing orders (A) to the commercial len computer and from there results (E) and / or Intermediate results are obtained, with the commercial computer being set up to execute each processing job at least twice independently of one another, so that the secure computer uses signals to reliably check the results and / or intermediate results transmitted to it by the commercial computer in pairs, depending on the content, and depending on the test - Result of this, control commands (SB) for process elements (W, S) derives and arranges their output to the process via dedicated drivers. 13. The device as claimed in claim 12, so that only programs (BO) are installed in the commercial computer, the functionality of which has been demonstrated. 14. Device according to claim 12 or 13, so that the commercial computer processes the processing orders with identical or diversified software at least twice in each case. 15. Device according to one of claims 12 to 14, so that at least two commercial computers which process the same processing orders in pairs independently of one another are provided. 16. Device according to one of claims 12 to 15, characterized in 17 that for the processing of different functionalities or partial functionalities or for the control and monitoring of different system parts, several commercial computers (Rl, R2) are provided in single-computer or multi-computer versions. 17. Device according to one of claims 12 to 16, so that the at least one commercial computer is a workstation computer, via the commands (K) to the secure ones Enter the computer and display messages (M). 18. Device according to one of claims 12 to 17, d a d u r c h g e k e n n z e i c h n e t that the secure computer is a m v n computer system. 19. Device according to one of claims 12 to 18, characterized in that the secure computer is set up to recognize from identifiers that are added to the results transmitted by the at least one commercial computer and / or intermediate results, whether these results and / or Interim results come from different processing processes. 20. The device as claimed in claim 12, so that the secure computer outputs any control commands to the process in two channels.