KR100835383B1 - Dual System Fault Tolerance Controller for Railway Signal Using Time Spend - Google Patents

Abstract

The present invention installs a redundant management module requesting re-execution when a fault occurs in a fault tolerance controller for railway signaling, allowing intermittent faults by re-execution using time, thereby maintaining service reliability while maintaining the reliability of the controller. The present invention relates to a fault tolerance controller for railway signaling using the time margin with improved availability.

The present invention for realizing this, the fault tolerance of the dual-system structure for railroad signals comprising a first controller and a second controller of a dual system of the same structure to output a control signal according to the operation result after receiving a communication or contact input In the controller, a communication or contact input from the outside is divided between the first controller and the second controller and transmitted to the first controller and the second controller, respectively, and the operation results of the first controller and the second controller are received. After determining whether it is the same or not, the operation retry signal is transmitted to both the first controller and the second controller to output the cutoff signal only when the retry result is inconsistent, and in the case of the same, the operation result of the controller is normally output. Invention.

Description

Fault tolerance controller of double onboard equipment for railway signaling system using extra time}

1 is a configuration diagram of a dual-system controller employing a defect detection method according to a conventional software comparison;

2 is a schematic diagram of a fault tolerance controller for a dual-system structure for railway signals using time margin according to the present invention;

3 is a detailed configuration diagram of a fault tolerance controller of a dual system structure for railway signals using time margin according to the present invention;

FIG. 4 is a diagram illustrating a method for comparing intermittent faults in a dual fault controller and a conventional fault controller in accordance with the present invention.

<Description of the symbols for the main parts of the drawings>

10-first controller, 20-second controller,

30-redundant management module, 31a, 31b-combination circuit,

32a, 32b-comparison processor, 33a, 33b-breaker,

34-Fault manifest.

The present invention relates to a dual-system fault tolerance controller for railroad signals using time margin to allow intermittent faults generated inside a computerized controller mainly used in the railway signal field. By installing a redundant management module requesting the request, permitting intermittent faults by re-execution using time spares, dual system faults for railway signals using time spares with improved availability to extend service maintenance time while maintaining the reliability of the controller A permissible controller.

In general, the railway signal field uses computer-based controllers to safely and efficiently control trains. The failure of a computer-based controller reduces the availability and reliability of train control as a result of failing to meet the functional requirements expected of the controller, and there is a possibility of generating a dangerous failure that causes an accident.

Therefore, a technique generally used for detecting a defect in the controller is used to prevent a malfunction due to a defect by comparing the operation results of the same input using a controller having dual hardware having the same structure.

1 shows a schematic diagram of a conventional dual-system controller, in which a single defect is built into each of the first and second controllers 10 and 20 having the same structure by including software 11 and 21 for performing comparative logic. When the operation results are different from each other due to the occurrence, a structure that blocks the output of the controller 10, 20 has been used a lot. However, the comparison using the software 11 and 21 cannot completely eliminate the inconsistency caused by the subtle differences in the processing speeds of the controllers 10 and 20, and uses software that is not easy to quantitatively evaluate the probability of failure. This is an obstacle to the demonstration of system reliability and safety.

Defects that occur inside the computer-based controller are classified according to their symptoms and effects, but the most frequent defects are intermittent defects that occur temporarily and return to their normal state. The dual system structure that compares the calculation results using the same hardware for the purpose of defect detection for such intermittent defects has to cut off the output of the entire controller even with only one intermittent defect. Occurs.

The present invention has been invented to improve the above-mentioned disadvantages, and the availability of time is increased by retrying corresponding to the time to relieve the controller blocking against the intermittent weakness of the simple comparison logic through hardware duplication. An object of the present invention is to provide a dual-system fault tolerance controller for railway signals.

The fault tolerance controller for railway signal using the time surplus of the present invention for realizing this includes a first controller and a dual controller having the same structure configured to output a control signal according to the operation result after receiving a communication or contact input. In the dual-system fault tolerance controller for railroad signals comprising two controllers,

Between the first controller and the second controller, the communication or contact input from the outside is divided and transmitted to the first controller and the second controller, respectively, and the operation results of the first controller and the second controller are received to determine whether they are the same. In case of inconsistency after the determination, the operation management retry signal is transmitted to the first and second controllers on both sides to output the blocking signal only when the retry result is inconsistent, and in case of the same, the redundant management module configured to output the operation result of the controller normally. It has a structure that includes.

In the above, the redundant management module means for dividing the communication or contact input from the outside to the first controller and the second controller, combining means for synthesizing the calculation results of the first controller and the second controller, the combining means Comparison processing means for comparing the signals of the first controller and the second controller inputted to determine whether or not a match, and if a mismatch signal is output due to a defect of the comparison processing means of the first controller and the second controller, It includes a blocking means for blocking the final output.

In the above, it is characterized in that it further comprises a fault-presenting means for manifesting a failure when a mismatch signal is output by a defect as a result of the comparison of the comparison processing means.

Hereinafter, the configuration and operation of the preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

Figure 2 shows a schematic diagram of a fault tolerance controller for railroad signals using the extra time according to the present invention.

The first controller 10 and the second controller 20 perform arithmetic operations according to a communication or contact input received from the outside through the redundant management module 30 according to the present invention and output a control signal according to the result. As a device, it is a controller consisting of a dual system of the same structure.

The redundant management module 30 receives the communication or contact input received from the outside, divides the signal into the same signal, and transmits the same to the first controller 10 and the second controller 20, and then the first controller 10. And when the received signal coincides when the calculation result of the second controller 20 is received, the control signal according to the final output of the first controller 10 and the second controller 20 is transmitted to the outside, but does not match. If not, the operation controller retry signal is transmitted to the first controller 10 and the second controller 20 so that the first controller 10 and the second controller ( Block the final output of 20) from being transmitted to the outside.

Here, the communication or contact input or output means an input and an output generally used in railroad signal field applications using a microcontroller. For example, in the case of an electronic interlocking device, the input is a track circuit signal. Is the signal and line converter output. Similarly, for example of the onboard controller, the input is serial information input through the onboard antenna, and the output is a braking related interface.

Figure 3 shows a detailed configuration of the fault tolerance controller for dual-structure structure for railway signals using the time margin according to the present invention.

The redundant management module 30 is input to the combination circuit 31a and the combination circuit 31a, which combines the serial communication data and output data of the first controller 10 and the second controller 20, and the output data. The comparison processing unit 32a for comparing the signals of the first controller 10 and the second controller 20 to determine the inconsistency (defect of the first controller 10 or the second controller 20), and a defect is generated. Therefore, a breaker 33a is provided to cut off the output to the safety side when a mismatch occurs in the comparison processing section 32a.

Similarly, the redundant management module 30 includes a combination circuit 31b, a comparison processing unit 32b, and a breaker 33b which operate in the same manner as described above with respect to the contact input, and judges whether or not a fault is allowed according to the contact input. As it will be described later, this is the same as the operation of determining whether the defect is allowed according to the communication input. Hereinafter, only the operation of determining whether the defect is allowed according to the communication input will be described.

In the redundant management module 30 configured as described above, the communication inputs inputted from the external circuit to the redundant management module 30 are divided into two and corresponding controllers 10 through the communication ports of the first controller 10 and the second controller 20, respectively. 20, the input signal is arithmetic processing to generate a control signal, and then input to the combination circuit 31a and the comparison processing unit 32a of the redundant management module 30, respectively.

At this time, when the intermittent fault does not occur in the controller 10 or 20, the signals received from the first controller 10 and the second controller 20 to be compared by the comparison processor 32a are matched. In the combination circuit 31a, the signals received from the first controller 10 and the second controller 20 are synthesized and output to the outside.

However, when the signals received from the first controller 10 and the second controller 20 to be compared in the comparison processing unit 32a do not match, the redundant controller module 30 may control the first controller 10 and the second controller. At 20, the retry request is continued for the operation, and accordingly, the first controller 10 and the second controller 20 calculate a signal input from the redundant management module 30, and again, the redundant management module 30. Are input to the combination circuit 31a and the comparison processing section 32a, respectively. At this time, if it is determined that the result of the comparison process is consistent, it is determined that an intermittent defect has occurred in one controller, and after that, the output of the controllers 10 and 20 are normally combined and transmitted to the outside. In order to prevent the diffusion of a defect by determining that the failure is not, the signal of the controller is blocked from being transmitted to the outside through the breaker 33a.

Thereafter, the combination circuit 31a in the redundant management module 30 processes to maintain the last control command that is performed when the comparison result of the communication or contact output between the first controller 10 and the second controller 20 is inconsistent. Prevents malfunction due to faulty control information. This maintenance of the last state is a safety side operation generally used in railroad signals, and devices such as signal, line changers, and brake control devices maintain the last state so that safety is secured by other safety acquisition logic.

In addition, the comparison processing unit 32a measures the number of times that a re-run is required when the comparison result is inconsistent, and if the inconsistency of the comparison result persists for a predetermined number of times, the final output of the controller is shut off, and the safety that indicates the failure in the failure display unit 34 is shown. Side-action logic can be included.

FIG. 4 is a diagram illustrating a method for comparing intermittent faults in a dual fault controller and a conventional fault controller in accordance with the present invention.

As shown in the accompanying drawings, if an intermittent defect occurs, for example, as a result 2 time point in the second controller 20, a mismatch in communication or contact output occurs. When such inconsistency occurs, the dual system structure for existing defect detection immediately cuts off the final output of the controller as in the "existing dual system output" of FIG. 4, but in the redundant management module 30 according to the present invention, FIG. Request for re-execution to the first controller 10 and the second controller 20, as in "Time extra multi-system retry request", and the control output including the defect as "Time extra multi-structure output" of FIG. Is ignored and again compares the outputs of the first controller 10 and the second controller 20 so that the normal control signal can be continuously output.

As described above, the present invention can improve the reliability and availability of the system by preventing the controller from malfunctioning or blocking against defects intermittently generated in the controller of the railway signal field.

In addition, the redundant management module can be implemented as a logic circuit having a lower probability of failure than a microprocessor or a microcontroller, and there is an advantage in that a general-purpose commercial controller using communication and input / output of a contact point can be used.

Claims (5)

In the fault tolerance controller for railway signal structure comprising a first controller and a second controller having a dual system of the same structure to output a control signal according to the operation result after receiving a communication or contact input, Between the first controller and the second controller, the communication or contact input from the outside is divided and transmitted to the first controller and the second controller, respectively, and the operation results of the first controller and the second controller are received to determine whether they are the same. In case of inconsistency after the determination, the operation management retry signal is transmitted to the first and second controllers on both sides to output the blocking signal only when the retry result is inconsistent, and in case of the same, the redundant management module configured to output the operation result of the controller normally. Dual-system fault tolerance controller for railway signal using the extra time included. The apparatus of claim 1, wherein the redundant management module comprises: means for dividing a communication or contact input from the outside into a first controller and a second controller, and combining means for synthesizing arithmetic results of the first controller and the second controller; Comparison processing means for comparing the signals of the first controller and the second controller input to the combination means to determine whether or not, if the mismatch signal is output due to a result of the comparison of the comparison processing means, the first controller and the second to the outside Dual fault structure fault tolerance controller for railway signals using time margin, characterized in that it comprises a blocking means for blocking the final output of the controller. The fault tolerance controller of claim 2, further comprising fault indicating means for indicating a fault when a mismatch signal is outputted by a fault as a result of the comparison of the comparison processing means. The method of claim 3, wherein the comparison processing unit measures the number of times that a re-execution is required when the comparison result is inconsistent, and if the inconsistency of the comparison result persists for a predetermined number of times, shuts down the final output of the first controller and the second controller and displays a fault. Dual fault structure fault tolerance controller for railway signals using time margin, characterized in that the safety side operation logic is included. 2. The fault tolerance controller of claim 1, wherein the redundant management module comprises a logic circuit.

Images