WO2007112942A1 - Device for switching on and monitoring a traffic light installation for rail traffic - Google Patents

Abstract

The inventive method for operating a signal device (2) on a railway installation, where the signal device (2) has at least a first local control unit (3) and a second local control unit (4) associated with it, each control unit (3, 4) being able to output at least one control signal, is distinguished in that - the signal device (2) is operated in a first operating state when at least one control unit (3, 4) outputs the at least one control signal, - the signal device (2) is operated in a second operating state when the first (3) and the second (4) control unit output the control signal independently of one another, and - the signal device (2) is operated in the first operating state when the control signal from the first control unit (3) and that from the second control unit (4) do not match (fault state). The inventive method and the inventive apparatus (1) advantageously allow safe operation of signal devices (2) on railway installations. The inventive method and the inventive apparatus (1) ensure that in the event of a malfunction within the control electronics the signal device (2) is always operated in a safe first operating state, for example involving a STOP signal.

Description

 "Device for connecting and monitoring a traffic light system in railway traffic"

description

The present invention is a method and an apparatus for operating a signal device of a railway system, which is based on the modular use of decentralized control units at the location of the signaling device or assigned thereto, according to the preamble of claim 1 and claim 10.

Control systems for signaling devices of railway installations are known from the prior art, in which each signaling device is controlled centrally by a central control unit. In this case, a signal device is understood to mean, in particular, a corresponding light signal with which, for example, the entry into a section is signal-technically regulated.

On this basis, the present invention seeks to provide a method and apparatus for operating a signaling device to railway system, which allow to ensure the most secure and modular operation and design of the signaling device.

This object is achieved by a method and an apparatus having the features of the respective independent claims. The respective dependent claims are directed to advantageous developments. The inventive method for operating a signal device of a railway system, wherein the signal device is assigned at least a first decentralized control unit and a second decentralized control unit and wherein each control unit can deliver at least one control signal based on the fact that the signal device is operated in a first functional state, if at least a control unit which outputs at least one control signal (OR linkage), the signal device is operated in a second functional state when the first control unit and the second control unit outputs the at least one control signal (AND operation) and the signal device is operated in the first functional state when the control signal of the first control unit and the control signal of the second control unit do not match.

In particular, a first functional state is understood to mean a safe state in which a risk to rail transport can be reliably ruled out. In particular, a safe functional state is a state in which the signal device displays a warning signal, in particular a stop signal or the like. In this way, it is always ensured by means of the method according to the invention that the signal device is operated in a safe functional state, even if only one of the decentralized control units emits the first control signal. The first control signal is the control signal, which should put the signal device in the first functional state in normal operation. The at least one second functional state comprises all further functional states of the signaling device. In particular, it may be the display of various different signals that are implemented in the signaling device. For example, each of these second functional states can also be assigned its own second control signal, so that the corresponding second functional state is then triggered with the output of the second control signal, which in turn can take place via the AND link. According to the invention, the signal device is only put into or operated in a second functional state when both control units deliver the corresponding second control signal. If there is a discrepancy between the control signal output by the first and the second control unit, In particular, one control unit emits the first control signal and the other control unit emits a second control signal, so the signal device is operated in the first functional state in order to prevent risks to rail traffic. The control units are preferably realized by a corresponding microcontroller. A control signal in the sense of this application in particular comprises a signal with which the signal device is put into a specific functional state and a signal with which a functional state determined by the control unit is transmitted.

According to an advantageous development of the method according to the invention, the control signals of the first and the second control unit are compared with one another in at least one of the control units.

Preferably, each of the control units is designed so that a comparison of the control signals can take place in it. In particular, the own control signal of the respective control unit is also understood here to mean a functional state which is determined and monitored by the control unit.

According to a further advantageous embodiment of the method according to the invention, the control signals are taken into account over a predefinable period of time in the comparison of the control signals.

Thus it can be responded to by inertias of the system by specifying a corresponding period of time. Advantageously, the period of time is predetermined so that usual reaction times of the control units can be taken into account. Thus, it can be advantageously prevented that the signal device is operated in the first functional state, although both control units emit identical control signals and these are not present in parallel due to the inertia of the system.

According to a further advantageous embodiment of the method according to the invention, a single-channel or two-channel control command is transmitted to the control units by a central signal control unit. This central signal control unit can be realized, for example, in a signal box or be part of such. From this central signal control unit, a control command is transmitted to the control units, with which, for example, the signal device is to be put into a specific second functional state. This control command is recorded in the control units and processed there. In particular, a corresponding control command is transmitted from the control unit to the signaling device in order to ensure that the signaling device is operated in the control command corresponding desired functional state.

It is particularly advantageous in this context that in the control units based on the control command, a desired functional state is determined and a corresponding control signal is emitted.

According to a further advantageous embodiment of the method according to the invention, each control unit monitors whether the signal device is operated in the desired functional state and outputs a control signal which can be assigned to the monitored functional state of the signal device.

Thus, it can advantageously be determined by the substantially continuously applied control signal which functional state of the signal device is present. By virtue of the fact that each control unit emits a corresponding control signal which corresponds to the determined setpoint functional state, it is possible to control the overall system by comparing the control signals of the individual control units. Thus, according to the invention, the signal device is then operated in the safe first functional state if a discrepancy results between the control signals of the control units.

According to a further advantageous embodiment of the method according to the invention, the central signal control unit and the first and second control units communicate with one another via at least one of the following methods: a) electromagnetic radiation; b) light; c) Bus systems (eg RS485, TCP / IP) and d) a modulation of the supply voltage.

Here, communication via electromagnetic radiation is understood in particular to be a wireless communication, preferably based on electromagnetic radiation in the radio-frequency range. For this purpose, a data transmission via light, not bound to an optical waveguide, for example by means of a suitably operated laser, is to be understood. Data transmission with light also means the transmission of data through an optical waveguide, for example a correspondingly formed optical fiber. A modulation of the supply voltage is understood in particular to be a so-called powerline communication in which a voltage which serves to supply power to the control units is correspondingly modulated, in particular frequency-modulated.

According to a further advantageous embodiment of the method according to the invention, each control unit compares the control signal of at least one other control unit with its own control signal.

According to a further advantageous embodiment of the method according to the invention, an error check of at least part of the signal device and / or the control units takes place.

Usually, the signaling device comprises at least one light source, preferably at least one incandescent lamp or LED insert. Preferably, the signaling device comprises 4 to 10 incandescent lamps. Each of these incandescent lamps can also have a so-called secondary thread also called a main thread. The secondary thread is then turned on when it has been determined that the main thread is broken. This is a further redundancy, since in case of failure of the main thread not the signal device fails, but can continue to operate on the secondary thread to repair the main thread. In particular, the control units or at least one control unit are designed so that both the main threads and the secondary threads can be tested by corresponding light bulbs of the signaling device. In addition, at least parts of the control units can be checked. In order to further increase the operational safety of the device according to the invention, it can be provided according to a further advantageous embodiment that the second functional state is assigned a second control signal, wherein the signal device is again operated in the second functional state when the first control unit and the second control unit emit the second control signal independently.

According to a further aspect of the present invention, an apparatus for operating a signaling device of a railway system is proposed. This comprises at least a first decentralized control unit and a second decentralized control unit. Each control unit can deliver at least one control signal. According to the invention, each control unit comprises means for monitoring the functional state of the signaling device and means for comparing the determined functional state with a control signal of another control unit and means for transmitting a control signal. Each control unit is designed so that the signal device can be operated in a first functional state if at least one control unit emits the first control signal and the signal device is operable in the first functional state if the control signal of the first and second control units do not coincide.

In particular, the device according to the invention can be used for carrying out the method according to the invention. In particular, each control unit can be designed in the form of a corresponding microcontroller. The first functional state is in particular a so-called safe functional state, in which a risk to rail transport is avoided as far as possible. Particularly in the case of a light signal, the first functional state is a STOP signal. The design of two control units provides redundancy, which further increases the security of the signaling device by comparing the control signals of the two control units.

According to an advantageous embodiment of the device according to the invention, the control units are designed so that the signal device is operable in a second functional state, when the first and the second control unit the least at least one control signal independently. In particular, there may be a plurality of second functional states, to each of which an individual second control signal is assigned.

Alternatively, and with the aim of further increased reliability of the device according to the invention, the control units may be configured such that the signal device is operable in a second functional state, when the first control unit and the second control unit independently emit a second control signal.

According to a further advantageous embodiment of the device according to the invention at least one communication interface for maintaining a connection with a central control unit is formed.

Under the conversation of a connection is understood in particular that a connection is established and operated. In particular, the connection can be established wireless or wired. The central control unit may for example be part of a correspondingly formed interlocking, which can be operated manually or automatically.

According to a further advantageous embodiment of the device according to the invention, the communication interface allows a data transmission based on at least one of the following methods: a) electromagnetic radiation; b) light; c) bus systems (e.g., RS485, TCP / IP) and d) a supply voltage modulation.

This is the modulation of the supply voltage to a so-called powerline communication, in which the supply voltage of the device according to the invention or one or both control units or other components is modulated according to the signal transmission. Particularly preferred here is a frequency modulation. According to a further advantageous embodiment of the device according to the invention, at least one of the control units is designed so that an error check of at least a part of the signal device can take place.

In particular, both control units are designed so that a combination of these control units, a test of a part or the entire signal device and / or the device according to the invention can be carried out.

According to a further advantageous embodiment of the device according to the invention, the control units are formed galvanically isolated from each other.

The galvanic separation advantageously increases the safety of the device according to the invention, since an electrical influence on a control unit is prevented by one of the other control units.

According to a further advantageous embodiment of the device according to the invention, the communication interface of the control units is formed galvanically and / or optically separated.

The galvanic and / or optical separation of the communication interface from the control units advantageously reduces the possibility that disturbances are transmitted from the communication interface to the control units and vice versa.

According to a further advantageous embodiment of the device according to the invention, this has a housing which forms an electromagnetic shield at least around parts of the device. In particular, the housing forms a Faraday cage. In particular, the control units and / or communication interface are shielded electromagnetically. Preferably, this is an embodiment of the electromagnetic shield, which is protected against electromagnetic pulses or electrostatic discharges. In the following, the implementation of the method and the mode of operation of the device for operating the signal device will be explained again from the point of view of cooperation with the central signal control unit.

The decentralized light signal operating device includes two decentralized control units, which may be designed, for example, as microcontrollers (microprocessors). These two control units can communicate together via a data communication with the aid of a suitable interface with the central signal control unit in the interlocking. The system can be expanded in the form that both control units communicate independently with one another via a data communication link with the central signal control unit in the interlocking. The light signal operating device is decentralized, i. housed in the vicinity of the signaling device and communicates with the corresponding central computer unit (control card, slave card) of the central signal control unit. The communication between the decentralized light signal operating device and the central signal control unit can be effected by powerline communication, fiber optic communication, bus systems or radio communication. It can u.a. and the following signals are controlled by way of example:

Protective signals, e.g. 2 lamps are controlled simultaneously;

Main signals with e.g. 2 red, 1 green and 1 yellow lamp

• Pre-signals: yellow and green lamps

• Combination signals with white and green lamps

• Light main and light pre-signals with red, green and / or yellow lamp or light elements

• Main and pre-signal connections with white lamps

The device has in its basic equipment the ability to individually control six lamps. Of these six lamps, two lamps have a main and subsidiary thread, and the sub-thread is turned on independently of a control unit when it is detected that the main thread is broken. With a corresponding extension, up to 28 lamps can be individually switched on and monitored. In the following, the invention will be explained in more detail with reference to the attached figures, without the invention being restricted to the exemplary embodiments shown there. They show schematically:

1 shows a first embodiment of a device according to the invention;

Fig. 2 is an example of the construction of a control unit;

3 shows a second embodiment of a device according to the invention;

4 shows a first flowchart for explaining the method according to the invention;

5 shows a second flowchart for explaining the method according to the invention;

6 shows a third flow chart for explaining the method according to the invention;

7 shows a fourth flowchart for explaining the method according to the invention;

8 shows a first circuit diagram of the signaling device with a device according to the invention;

9 shows a second circuit diagram of the device according to the invention with signal device;

10 shows a third circuit diagram of the device according to the invention with signal device;

11 shows a single-channel data transmission;

FIG. 12 shows a two-channel data transmission; FIG.

Fig. 13 Flowchart: response to a command or status query; Fig. 14 Flow chart: Mutual control of μC;

Fig. 15 Flowchart: a light signal is turned on;

Fig. 16 Flow chart: a light signal remains on.

Fig. 1 shows schematically a first embodiment of a device 1 according to the invention for operating a signaling device 2 of a railway system. The device 1 comprises a first control unit 3 and a second control unit 4. These control units 3, 4 are of decentralized design, ie. H. locally associated with the signaling device 2. In particular, this means that these components are not formed in a remote interlocking, but in the vicinity of the signaling device 2. Each control unit 3, 4 can deliver a first control signal and at least a second control signal and monitor the current functional state of the signaling device 2.

Fig. 2 shows the control units 3, 4 schematically in detail. Each of the control units 3, 4 has means 5 for monitoring the functional state of the signaling device 2, means 6 for comparing the determined functional state with a control signal of another control unit 4, 3 and means 7 for transmitting a control signal.

According to the invention, each control unit 3, 4 is designed so that the signal device 2 is operable in a first functional state, if at least one control unit 3, 4 at least one control signal and the signal device is operable in the first functional state when the control signal of the first control unit 3 and second control unit 4 do not match. As shown in FIG. 2, the means 5, 6, 7 are connected to one another via signal lines 8, to the signaling device 2 and to the respective other control unit 4, 3. The result of this monitoring could be that the signal device 2 is operated in a first functional state or a second functional state or else that a defect in the signal device 2 is present , In the means 6 for comparison, a comparison of the functional state, which was determined via the means 5, with the control signal of the respective other control unit 4, 3 and optionally with its own transmitted by the means 7 control signal. If it is determined by the means 6 for comparing that the first control unit 3 and the second control unit 4 deliver unequal control signals, then it is automatically caused that the signal device 2 is operated in the first safe functional state. In addition, a corresponding warning can be sent to a central control unit so that it is informed about a malfunction of the signaling device 2 and / or one of the control units 3, 4.

The device 1 according to the invention comprises a communication interface 9, which allows data transmission by means of electromagnetic radiation, bus systems, light and / or modulation of the supply voltage of the device 1 and / or the control units 3, 4. This may be, for example, a so-called powerline modem, a fiber optic converter or a radio modem. Preferably, the communication between the control units 3, 4, which are connected to one another by means of corresponding connections 10 and to the communication interface 9, can take place via a so-called RS-485 interface. The connections 10 are preferably designed to be redundant in order to continue to be able to operate the device 1 according to the invention if one of the connections 10 fails.

Target functional states of the signaling device 2 can be transmitted to the control units 3, 4 via the communication interface 9. Based on this target functional state of the functional state of the signaling device 2 is to be set. Via the connections 10 between the signaling device 2 and the first 3 and second control unit 4, the control units 3, 4 can read the current functional state of the signaling device 2. Furthermore, corresponding control signals from the control units 3, 4 to the signal device 2 can be output via these connections 10, which effects a change in the functional state or a maintenance of an existing functional state of the signal device 2.

According to the invention, the signal device 2 is operated in a first functional state when at least one control unit 3, 4 outputs the first control signal. This means, in that, by means of a first control signal, one of the control units 3, 4 places the signal device 2 in the first safe functional state and / or operates in the same. In contrast, only both control units 3, 4 can jointly effect a second functional state of the signaling device 2, in which both control units 3, 4 consistently transmit the corresponding at least one control signal to the signaling device 2. This signal match is checked in both control units 3, 4. For this purpose, the control signals of the corresponding control unit 3, 4 are transmitted to the respective other control unit 4, 3 via the corresponding connections 10 and compared there with the own control signal and / or the functional state of the signaling device 2 determined by this control unit 4, 3. If one of the control units 3, 4 determines that the control signals of the control units 3, 4 are not identical, the signal device 2 is automatically brought into the first functional state and operated therein.

The method according to the invention and the device according to the invention thus enable a redundant control operation of the signal device 2, in which case the failure of a system, for example a control unit 3, 4 or one of the parts of the control unit 3, 4, automatically produces the safe first functional state of the signaling device 2 and this in this is operated.

3 shows schematically a second exemplary embodiment of a device 1 according to the invention. This differs from the first exemplary embodiment in that, instead of a communication interface 9, two communication interfaces 9 are formed which are each connected redundantly to both control devices 3, 4 via corresponding connections 10.

4 shows schematically a first flowchart for explaining the method according to the invention. In method step 100, the communication interface 9 receives a command by means of which the signal device 2 is to be set to a desired functional state. In step 100, the forwarding of this command by the communication interface 9 to the control units 3, 4. Preferably, the control units 3, 4 are addressed individually, so that in step 101, the control units 3, 4 check whether the corresponding command determines for them is. In step 102 takes place the decision that the destination address is equal to the own address of the control unit 3, 4. If the control unit 3, 4 determines that the corresponding command is not intended for it, no further action takes place. In step 103, the control unit 3 executes the corresponding command. In step 104, the corresponding command is monitored by the first control unit 3. Accordingly, the second control unit 4 executes the corresponding command in step 105 and, in step 106, monitors the execution of this command. In step 107, the second control unit 4 transmits the corresponding status of the control unit to the first control unit 3. In step 108, a comparison of the status, which the first control unit 3 has received by the monitoring of the signaling unit 2, with the status takes place in the first control unit 3 that the control unit 4 has received due to the monitoring of the signaling device 2. In this case, a predefinable period of time is taken into account for the comparison in this method step as well as in all other method steps in which a comparison takes place, ie, the system waits for the duration of the predefinable period of time and then carries out the comparison.

If method step 108 does not match the status information of first control unit 3 and second control unit 4, then in step 109 the first control unit 3 causes the signal device 2 to operate in the first functional state. In step 110, the first control unit sends its status information to the communication interface 9, via which this information is sent to a central control unit.

Step 110 is also executed if the status of the two controllers 3, 4 is identical in step 108. At the same time, in step 110, the status of the signaling device 2 determined by the first control unit 3 is transmitted to the second control unit 4. In step 111, a comparison of the status of the signaling device 2 transmitted by the first control unit 3 to the second control unit 4 ensues If the status is identical, the second control unit 4 also transmits its status to the communication interface 9 for forwarding to the central control unit in step 112. Also in method step 111, a predefinable period of time is waited until the comparison is carried out. If the comparison (step 111) carried out by the second control unit 4 has been negative, that is to say if the first control unit 3 and the second control unit 4 have determined a different status of the signal device 2, then the conversion of the signal device 4 takes place in step 113 by the second control unit 4 performed on the first functional state. In step 114, the status of the second control unit 4 is sent to the communication interface 9 via steps 114 and 110, in which the communication interface 9 and, in addition, the central control unit is informed about the present status of the control units 3, 4 in the case of a malfunction in which the signaling device 2 is placed in the first functional state and operated, the central control unit also informs, so that the present problem can be sought in a targeted manner. When operating in the first functional state, a point-shaped train protection, for example a so-called inductive train protection, can be activated in an advantageous manner.

5 shows a flowchart which describes the communication of the two control devices 3, 4. The communication between the two control units 3, 4 takes place in particular on the basis of a so-called CAN network (Controller Area Network). In step 200, the second control unit 4 sends the status of the signaling device 2 determined by it to the first control unit 3. In step 201, the first control unit 3 compares the status of the signaling device 2 determined by the first control unit 3 with the status transmitted by the second control unit 4 the signal device 2. If these two statuses correspond to one another, the first control unit 3 transmits the status of the signal device 2 determined by it to the second control unit 4.

If step 201 shows that the two statuses do not match, the first control unit 3 first of all activates the signaling device 2 in step 203 in such a way that it is operated in the first functional state and then sends the status determined by the first control unit 3 to the second control unit 4. In step 204, the second control unit 4 performs a comparison of the status of the signal device 2, which was determined by the second control unit 4, with the status of the signal device 2, which was transmitted by the first control unit 3. In step 204 and in step 201, the data from a predetermined period of time is considered or it is waited for a predetermined period of time before the corresponding comparison is performed. In this way, it can be taken into account that the different control units 3, 4 as well as the transit times from the control units 3, 4 to the signaling device 2 and back take a certain amount of time. If the comparison in step 204 reveals that the determined statuses are identical, then step 200 is continued. If the check in step 204 reveals that the determined statuses are not identical, the second control unit 4 controls the signal device 2 in step 205 in such a way that it is operated in the first functional state. Thereafter, the transition to method step 200 takes place.

FIG. 6 describes, with reference to a flowchart, how the signal device 2 is controlled in such a way that it is put into a second functional state. This is, for example, the switching on of a light signal which is not a STOP signal or the operation of this light signal. In step 300, it is initially assumed that the signal device 2 is operated in the first functional state, ie the signal device 2 is in particular HALT. In step 301, the second control unit 4 receives the command to operate the signaling device 2 in a different functional state. In step 301, therefore, a desired functional state is transmitted to the second control unit 4. Then, in step 301, the second control unit 4 causes the signal device 2 to change to the second functional state. Similarly, in step 302, the first functional unit 3 receives the command to operate the signaling device 2 in a desired functional state. The first control unit 3 causes the signal device 2 to change to the desired functional state. In steps 301, 302, the commands are sent by a central control unit and received by the communication interface 9 and transmitted via the links 10 to the control units 3, 4.

In step 303, the second control unit 4 determines the status of the signaling device 2 and transmits this determined status to the first control unit 3. In step 304, the first control unit 3 determines the status of the signaling device 2 and transmits it to the second control unit 4. Under the status of Signal device 2 is in particular the determined present desired functional state of the signaling device. 2 Understood. In step 305, the control units 3, 4 check their own status with the status transmitted by the respective other control unit 4, 3. If this check reveals identical statuses (step 306), the result is state 307, namely that the signaling device 2 is operated in the second functional state that corresponds to the predetermined desired functional state. If the result of the check 305 according to FIG. 306 is that the two statuses are not identical, then in step 308 the signal device 2 is brought into a second functional state by one of the control units 3, 4 and operated in this and a corresponding message via the communication interface 9 the central control unit sent.

FIG. 7 shows a further flowchart for explaining the method according to the invention. Based on the state 400 in which the signal device 2 is operated in the first functional state, the first control unit 3 checks the status of the signal device 2 in step 401. In step 402, the first control unit 3 sends this determined status at least once, preferably several times, as a control signal the second control unit 4. In step 405, the second control unit 4 checks the status of the signaling device 2. In step 406, the second control unit 4 sends this status at least once, preferably several times to the first control unit 3. In step 403, the first control unit 3 compares the through the first control unit 3 determined status of the signaling device 2 with the status of the signaling device 2, which was transmitted by the second control unit 4. If these statuses are identical, then step 400 is continued. The signaling device 2 is further operated in the second functional state.

In step 408, the second control unit 4 compares the status determined by the second control unit 4 with the status of the signaling device 2 transmitted by the first control unit 3. If these two statuses are identical, method step 400 is continued. If the two statuses are not identical in step 403 and in step 408, the signal device 2 is switched to the first functional state and a corresponding message is transmitted via the communication interface 9 to the central control unit. FIG. 8 schematically shows a schematic diagram of the circuit which is for displacing the signal device 2 into the first functional state. A power supply 11 is connected via a series resistor 12 and a first switch 13 and a second switch 14 with a light bulb 15. Here, the first switch 13 is formed by, is part of, and / or is a switch controlled by the first control unit 3. The second switch 14 is formed by, is part of, and / or is a switch controlled by the second control unit 4. In particular, these may be relays which are switched by the corresponding control unit 3, 4. The incandescent lamp 15 is an incandescent lamp which is operated in the first functional state of the signal device 2. In particular, this is a red light bulb, which represents a STOP signal. Furthermore, a first measuring resistor 16 and a second measuring resistor 17 are formed. These measuring resistors 16, 17 serve as so-called shunt resistors. In this case, the voltage drop across these measuring resistors 16, 17 or also the current flowing through these measuring resistors 16, 17 is measured. These quantities can be converted into each other according to Ohm's law. In principle, the formation of a single measuring resistor 16, 17 is possible and according to the invention, however, two measuring resistors 16, 17 have the advantage that a redundant design with a further increase in measuring reliability is possible here. On the basis of these determined measured values, various test cycles can be carried out in order to check different components of the signal device 2 and / or the device 1.

A first test cycle can be carried out during the transition from the first functional state into a second functional state of the signal device 2. Here, in addition to a main thread of the incandescent lamp 15, a so-called secondary thread is formed, which can basically be formed in the same incandescent lamp or which can form a second incandescent lamp. The control units 3, 4 in this case have a so-called automatic Nebenfadeneinschaltung, which means that when the main thread of the bulb 15 is defective, the corresponding secondary thread is automatically activated. In this case, the test cycle envisages that the first and second control units 3, 4 deactivate automatic secondary thread detection. Thereafter, the second switch 14 of the second control unit 4 turns off the main thread of the bulb 15. Here it can be checked whether the first switch 13 of the first control unit 3 closed is. This is done via the above-mentioned measured variables, since the current flowing through the measuring resistors 16, 17 must remain constant. After that, the second control unit 4 switches on the main thread of the incandescent lamp 15 again via the second switch 14. Next, the first switch 13 of the first control unit 3 turns off the corresponding main thread of the incandescent lamp 15. This makes it possible to check whether the switch 14 of the second control unit 4 is closed. Again, the current measured at the measuring resistors 16, 17 must remain constant. Thereafter, the first control unit 3 turns on the automatic Nebenfadeneinschaltung. As a next step, the second control unit 4 switches off the main thread of the incandescent lamp 15 via the second switch 14. In this way, it can be checked whether the automatic sub-threading of the first control unit is functional. This must now turn on the secondary thread. Again, the measured current should remain constant. Following this, the second control unit 4 switches on the automatic secondary yarn insertion, the first control device 3 switches off the automatic secondary yarn insertion. In this way, it can be checked whether the automatic secondary yarn insertion of the second control unit 4 is intact. With this entire test cycle, the current measured across the measuring resistors 16, 17 must remain substantially constant when all elements are functioning.

As a result of this test cycle, when the first functional state of the signal device 2 is switched off, a check of further parts of the corresponding control units 3, 4 can take place automatically. When the signal device 2 is put into the first functional state, ie, for example, when a HALT signal is switched on, further functions can be checked. In this case, for example, both the first control unit 3 and the second control unit 4 switch off the automatic auxiliary thread switching. The second control unit 4 then switches on the main thread of the incandescent lamp 15 by means of the second switch 14. This makes it possible to check whether the second switch 14 is closed. The first control unit 3 then also switches on the main thread of the incandescent lamp 15. Subsequently, the second control unit 4 switches off the main thread of the incandescent lamp 15 via the second switch 14. This makes it possible to check whether the first switch 13 of the first control unit 3 is closed. Subsequently, the second control unit 4 switches on the main thread of the incandescent lamp again via the second switch 14. This is followed by again an activation of the automatic Nebenfadeneinschaltung the first 3 and second control unit 4. About this test cycle, the measured current across the measuring resistors 16, 17 must remain substantially constant in the transition of all elements involved.

With this second test cycle can be carried out during the switching off of the second functional level advantageously an examination of the elements used.

A third test cycle can be performed while the signaling device 2 is in the first functional state. For this purpose, the automatic Nebenfadeneinschaltung the first 3 and the second control unit 4 is turned off during operation. Thereafter, the second control unit 4 switches off the main thread of the incandescent lamp 15 via the second switch 14. This makes it possible to check whether the switch 13 of the first control unit 3 is closed. In this case, the current through the measuring resistors 16, 17 remains substantially constant. Following this, the first control unit 3 switches on the automatic auxiliary thread switching. Subsequently, the first control unit 3 switches off the main thread of the light bulb 15. In this way, it can be checked whether the automatic secondary yarn insertion of the first control unit 3 is intact.

In a further step, the second control unit 4 switches on the automatic secondary yarn insertion and the first control unit 3 switches on the automatic secondary yarn insertion. This makes it possible to check whether the automatic sub-threading of the second control unit 4 is intact. Subsequently, the first control unit 3 turns on the auxiliary thread turn on. As the next step, the second control unit 4 turns on the main thread of the incandescent lamp 15. This makes it possible to check whether the second switch 14 of the second control unit 4 is intact. Subsequently, the first control unit again switches on the main thread of the incandescent lamp 15. For intact components to be tested, the measured current across the measuring resistors 16, 17 must remain essentially constant over this entire test cycle. 9 shows schematically a schematic diagram of a circuit arrangement for switching on a further light signal, ie for operating the signal device 2 in a second functional state. In principle, several functional states of the signaling device 2 are possible. In contrast to the schematic diagram shown in Fig. 8 here a third switch 18 in the first control unit 3 and a fourth switch 19 in the second control unit 4 are formed, which are connected in series, so that when simultaneously closed switches 18 and 19, a connection of the second light bulb 20 takes place.

10 shows a further schematic diagram of a circuit for the signal device 2 in a second functional state. According to this schematic diagram is to be shown how a further incandescent lamp 20 in the off state by means of the control units 3, 4 can be tested. Here, the functions of the first switch 18 and second switch 19 are checked. For this purpose, the second control unit 4 has a fifth switch 21 and the first control unit 3 has a sixth switch 22. The test takes place in that the second control unit 4 opens the fifth switch 21 and the first control unit 3 closes the sixth switch 22. Now the first control unit 3 switches on the third switch 18. As a result, a short circuit in the fourth switch 18 can be detected. Subsequently, the second control unit 4 switches on the fourth switch 19. As a result, a thread break in the second light bulb 20 can be detected. Subsequently, the first control unit turns off the third switch 18. As a result, a short circuit in the third switch 18 can be detected. As the next step, the second control unit 4, the fourth switch

19 switched off. Thereafter, the second control unit 4 turns on the sixth switch 22, and the first control unit closes the fifth switch 21. During the test, a small test current, which is so small that the second incandescent lamp 20 is not lit, flows. With the aid of this test, both the switches 18, 19, 21, 22 of the control units of FIGS. 3, 4 and the corresponding filaments of the second incandescent lamp

20 checked. The test is also carried out here by means of a monitoring of the current flowing through the measuring resistors 16, 17 current. If intact components are present, the current should be substantially constant during the test.

In Fig. 11, the central signal control unit 23 of the signal box with PLC modem (alternatively with fiber optic converter, bus systems or radio modem) via two lines with each the first locally connected in the immediate vicinity of a signaling device (not shown) first control unit 3 (hereinafter also "microcontroller 3" or "μCl") and a second control unit 4 (hereinafter also "microcontroller 4" or "μC2"). Each of the microcontroller 3, .mu.Cl and microcontroller 4, .mu.C2 is connected via a respective connection 10 for signal transmission and transmission of the signal commands to the signal device 2 and signal control lines 8 with means 5 for Ü monitoring of the functional state. Furthermore, both microcontrollers are interconnected via connecting lines (network) 10. This facility performs the following functions:

1.) Both μC independently monitor the status of the light signal. 2.) Both μC communicate with each other via a CAN interface (s): the current status is communicated to the other μC.

3.) Each μC can independently of the other μC bring the light signal into the safe state in which the light signal indicates the HALT signal. 4.) To be able to display the TRAVEL signal, both μC must perform the same corresponding control.

5.) Both μC receive from the central signal control unit 23 of the interlocking the commands, which are sent via a modem or also in general: via a data communication device (for example, also a RS485 communication) to the interface.

If - as shown in Fig.l - for data transmission of the central signal control unit 23 to the microcontroller uses a common modem, then: 1.) Both μC send their status to the interlocking via the single modem. 2.) Both μC receive what the other μC sends to the modem on one of their

RS-485 ports.

3.) If the status sent to the modem does not match its own status, then the corresponding μC will automatically switch the light signal to the HALT signal. This is then noticed by the other μC. If, as shown in FIG. 12, one respective total of two modems is used for data transmission of the central signal control unit 23 to the microcontroller, the following applies:

1.) Both μC send via separate transmission paths their status to the interlocking. 2.) Both μC receive what the other μC sends to the modem on one of their

RS-485 ports.

3.) If the status sent to the modem does not match its own status, then the corresponding μC will automatically switch the light signal to the HALT signal. This is then noticed by the other μC. 4.) The further procedure is decided in the signal box in the central office.

Once the remote signal operation device 1 determines that the communication with the signal control unit 23 is no longer present (e.g., timer has expired), the remote signal operation device must transition to the signal safe state. That is, the HALT signal is displayed when there is no communication between the distributed light signal operation device 1 and the signal control unit 23. Also, the HALT signal is displayed when there is no communication with the signal control unit. This is detected by the signal control unit 23 and passed by command to the decentralized signal operating device 1. In addition, the HALT signal is displayed when the two μC have different monitoring results. This is set independently of the commands of the central signal control unit 23.

If the decentralized Lichtsignalbetrieb s device 1 should be de-energized, so is the signal dark, which also equals a HALT signal.

The decentralized light signal switching device will continuously check the various "filaments" (HfR, NfR, HfW, beacon), so that in the event of an error an immediate message to the central signal control unit 23 is possible even before the signal is required for the activation of a guideway.

The control of an Indusi unit assigned to the signal system (inductive safety system for automatic signal actuation by the train) is also carried out via the decentralized Trale light signal operating device 1. With the help of the Indusi unit learns a train passing by a HALT pointing signal, an emergency braking. The Indusi unit is then activated when the signal indicates the HALT term. The Indusi unit consists of a track magnet: in an upward "electrically open" light metal housing.The track magnet is connected to a parallel resonant circuit of coil and capacitor, which is tuned to a certain frequency of eg f _t = 500 Hz a drive of the vehicle, which emits a signal of the same frequency, undergoes an emergency braking when the track magnet is driven in. However, this may also lead to a HALT-indicating disturbed main signal due to a substitute signal or a written command without emergency braking is triggered, the frequency influence can be bridged with a special Indusi command key.

The command and signal flow between the central signal control unit 23, the microcontrollers 3, 4 and the signal operating device 1 and the signal control will now be illustrated and explained with reference to the flow charts according to FIGS. 13 to 16.

Communication between the two μCs takes place via the CAN interface. Since both μCs independently control the signals and monitor them, a permanent communication between the two μC must take place. As soon as one μC informs the other of its status, the other must check its own status for equality: if the same monitoring result is not detected within a given time, the μC must put the signal into the safe state:

It should be noted that each of the two μC can independently set the safe state. Driving terms (e.g., HpI, Hp2, beacon, ...) can only be set together. Therefore, in the process before each mutual status check, a period of time must be waited for the other μC to get the chance to perform the drive accordingly:

The circuit is designed according to the principle of "non-reaction and high insulation between the outdoor installation and the indoor installation." For this reason, optically controlled components are preferably used for the circuit, in particular MOSFET photovoltaic devices. taische relays, opto-couplers, linear opto-couplers, current sensor units, each with a linear opto-coupler.

Parallel 2um shunt resistor precautions will be necessary, so there is a high EMC resistance. This ensures a high level of insulation between the outdoor unit and the indoor unit.

The HALT signals should be switched on or off in a sequence so that it is possible to check whether both switches are still working. During a long active phase it is possible to check the individual switches without being visible from the outside.

The inventive method and the device 1 advantageously allow the safe operation of signaling devices 2 of railway systems. The method according to the invention and the device 1 according to the invention ensure that, in the event of a malfunction within the control electronics, the signal device 2 is always operated in a safe first functional state, which consists for example in a HALT signal.

Abküt index

bps bits per second (transmission speed)

CAN Controller Area Network

COMPEX computer, explosion-proof

CRC Cyclic Redundancy Code

DSG decentralized light signal connection, decentralized light signal switching device, decentralized light signal interface module

EN European standard

ESD Electro Static Discharge

HfR main thread red

HfW main thread White

Hl light main and light forward signal

Hp main signal

ID Identifier, identifier

Indusi Inductive Train Protection kbps 1024 bits per second (transmission speed)

Ks combination signal kV 1000 volts (electrical voltage)

LED light emitting diode

Fiber Optic Fiber Optic Cable

Mbps (1024) ² bits per second (transmission speed)

NfR Secondary Thread Red

P2P point-to-point, direct communication

PLC Powerline Communication, communication via high-performance cables

RS-485 Recommended Standard - 485

SIL Safety Integration Level (English), safety level

Sh protection (railway signals, e.g. Sh_0, Sh_l)

Sv main and pre-signal connections

TE graduation unit μC microcontroller

V AC electrical AC voltage V DC DC electrical voltage

Vr Vorsignal

ZBA train formation facility

LIST OF REFERENCE NUMBERS

1 device

2 Signaleinrichtung, Lichtsignalanschaltung light signal switching device

3 first control unit, microcontroller, μCI

4 second control unit, microcontroller, μC2

5 means for monitoring the functional state

6 means of comparison

7 means for transmitting the control signal

8 signal line

9 communication interface

10 Connection, network, connection of the microcontroller, lines for signal transmission, signal commands

11 power supply

12 resistor

13 first switch

14 second switch

15 light bulb

16 first measuring resistor

17 second measuring resistor

18 third switch

19 fourth switch

20 second light bulb

21 fifth switch

22 sixth switch

23 central signal control unit (central computer)

100 ... 408 process steps

Claims

claims 1. A method for operating a signaling device (2) of a railway system, wherein the signaling device (2) at least a first decentralized control unit (3) and a second decentralized control unit (4) is assigned, each decentralized control unit (3, 4) at least one control signal can deliver, characterized in that the signal device (2) is operated in a first functional state, when at least one control unit (3, 4) outputs the control signal for the safe signaling state (eg Haltbegriff), the signaling device (2) in a second functional state is operated when the first control unit (3) and the second control unit (4) the at least one control signal independently deliver (driving concept) and the signaling device (2) is operated in the first functional state, when the control signal of the first control unit (3) and that of the second control unit (4) do not match (fault). 2. The method of claim 1, wherein the control signals of the first control unit (3) and the second control unit (4) in at least one of the control units (3, 4) are compared. 3. The method of claim 2, wherein the comparison of the control signals over a predetermined period of time takes place. 4. The method according to any one of the preceding claims, wherein from a central signal control unit (23) a one- or two-channel control command to the control units (3, 4) is transmitted. 5. The method of claim 4, wherein in the control units (3, 4) based on the control command, a desired functional state is determined and a corresponding control signal is delivered. 6. The method of claim 5, wherein each control unit (3, 4) monitors whether the signal device (2) is operated in the desired operating state and outputs a control signal, which is the monitored functional state of the signaling device assignable. 7. The method according to any one of claims 4 to 6, wherein the central signal control unit and the first control unit (3) and second control unit (4) communicate with each other via at least one of the following methods: a) electromagnetic radiation; b) light; c) Bus systems (e.g., RS 485, TCP / IP) c) a modulation of the supply voltage. 8. The method according to any one of the preceding claims, wherein each control unit (3, 4) compares the control signal of at least one other control unit (4, 3) with its own control signal. 9. The method according to any one of the preceding claims, in which an error check at least a part of the signaling device (2) and / or the control units (3, 4) takes place. 10. The method according to any one of the preceding claims, wherein the second functional state, a second control signal is assigned, wherein the signal device (2) is again operated in the second functional state, when the first control unit (3) and the second control unit (4) the second Deliver control signal independently. 11. Device (1) for operating a signaling device (2) of a railway system, comprising at least a first decentralized control unit (3) and a second decentralized control unit (4), wherein each control unit (3, 4) can deliver at least one control signal, characterized in that each control unit (3, 4) has means (5) for monitoring the functional state of the signaling device (2), means (6) for comparing the determined functional state with a control signal of another control unit (3, 4) and means (7) for transmitting The control unit (3, 4) is designed so that the signal device (2) is operable in a first functional state when at least one control unit (3, 4) outputs a first control signal, and the signaling device ( 2) is operable in the first functional state when the control signals of the first control unit (3) and the second controller (4) do not match. 12. Device (1) according to claim 11, wherein the control units (3, 4) are designed such that the signal device (2) is operable in a second functional state when the first control unit (3) and the second control unit (4) the deliver at least one control signal independently. 13. Device (1) according to claim 11, in which the control units (3, 4) are designed such that the signal device (2) is operable in a second functional state when the first control unit (3) and the second control unit (4) independently deliver a second control signal. 14. Device (1) according to one of claims 11 to 13, wherein at least one communication interface (9) is designed to maintain a connection with a central signal control unit. 15. Device (1) according to claim 14, wherein the communication interface (9) permits data transmission based on at least one of the following methods: a) electromagnetic radiation; b) light; c) bus systems (e.g., RS485, TCP / IP) and c) supply voltage modulation. 16. Device (1) according to one of claims 11 to 15, wherein at least one of the control units (3, 4) is designed so that a fault check of at least a part of the signaling device and / or the device (1) can take place. 17. Device (1) according to any one of claims 11 to 16, wherein the decentralized control units (3, 4) are formed galvanically isolated from each other. 18. Device (1) according to any one of claims 14 to 17, wherein the communication interface (9) of the decentralized control units (3, 4) is formed galvanically and / or optically separated. 19. Device (1) according to one of claims 11 to 18, wherein the device (1) has a housing which forms an electromagnetic shield at least around parts of the device. 20. Device for switching on and monitoring a signal device (2) in railway traffic, with a central signal control unit (23), and with transmission lines (8, 10) to the signaling device (2) for switching on or monitoring the signals, characterized in that a decentralized light signal operating device (1) is arranged in the vicinity of the signal device (2), which has two decentralized control devices (3, 4), each of which is connected at least by a transmission line (10) to the central signal control unit (23) and on the other hand to the Signal device (2) and means (5) for monitoring the functional state is connected such that each Control means (3, 4) independently of the other signal control means (4, 3) performs the switching on and off of the signaling device (2) and their monitoring, and that both control means (3, 4) are interconnected and programmed such that each Control means (3, 4) monitors the status of the other control means (4, 3) and the signal means (2) switches to a first functional state when the switching status of the other control means does not correspond to its own switching status within a predetermined time after each switching operation.