Device for activation and monitoring of a light-signal system for railway traffic

Abstract

A method for operating the signal installation of a railroad trackage block, whereby at least one first local control unit and one second local control unit are dedicated to the signal installation. Each local control unit is capable of transmitting at least one control signal so that the signal installation is operated in a first functional mode when at least one control unit transmits the said minimum of one control signal, the signal installation is operated in a second functional mode when the first and the second control units transmit a control signal independent of each other, and the signal installation is operated in the first functional mode when the control signal of the first control unit and that of the second control unit are mutually inconsistent (malfunction). The method and the associated device advantageously permit the safe operation of the signal installation of a railroad block.

Description

The object of this invention is a method and a device for operating a signal installation within a railroad trackage block based on the modular activation of local control units either at the site of the signal installation or as locally dedicated units, as conceptually specified in claim 1 and claim 10, respectively.

Prior art has employed control devices for railroad installations where each signal installation is centrally controlled from a telecontrol master station. The term signal installation in this case refers in particular to a light signal which, for example, directs the access to a track section by appropriate signal switching.

Against that background it is the objective of this invention to introduce a method and a device for operating a signal installation of a railroad block by means of which it is possible to ensure safest, modular operation and configuration of the signal installation.

This objective is achieved by means of a method and a device with the characterizing features specified in the respective independent claims. The various dependent sub-claims are aimed at advantageous design enhancements.

According to the invention, the method for operating the signal installation of a railroad block, whereby at least one first local control unit and one second local control unit are dedicated to the signal installation, each control unit capable of transmitting at least one control signal, is based on a concept whereby the signal installation is operated in a first functional mode when

• • at least one control unit transmits a minimum of one control signal (OR-relation)
  • the signal installation is operated in a second functional mode when the first and the second control units transmit the said minimum of one control signal (AND-relation), and
  • the signal installation is operated in the first functional mode when the control signal of the first control unit and the control signal of the second control unit are mutually inconsistent.

Specifically, the term first functional mode refers to a safe condition in which any endangerment of the railroad traffic can be reliably prevented. A safe functional mode, in particular, is a state in which the signal installation displays a warning signal and especially a stop or comparable signal. In that fashion, the inventive method ensures at all times the operation in the safe functional mode even if only one of the dedicated local control units transmits the first control signal. That first control signal is the control signal which in normal operation is designed to switch the signal installation into the first functional mode. The minimum of one second functional mode encompasses all other functional modes of the signal installation. In particular, it may include the display of various different signals implemented in the signal installation. For example, each of these second functional modes may have assigned to it a second control signal of its own, so that the transmission of the second control signal triggers the corresponding second functional mode, which may in turn take place via the AND-relation. According to the invention, the signal installation will be switched into or operated in a second functional mode only when both control units transmit the appropriate second control signal. In the event of a discrepancy between the control signals transmitted by the first and the second control units, specifically if one control unit transmits the first control signal and the other control unit transmits a second control signal, the signal installation will run in the first functional mode, thus preventing any endangerment of the rail traffic. The control units are preferably implemented with a suitable microprocessor. A control signal as defined for the purpose of this patent application specifically is constituted of a signal that switches the signal installation into a particular functional mode and a signal by means of which the status of a functional mode determined by the control unit is transmitted.

In a desirable enhancement of the method according to the invention, the control signals of the first and the second control units are mutually compared in at least one of the control units.

Each of the control units is preferably designed to permit an internal comparison of the control signals. Specifically, the intrinsic control signal of each control unit also defines a functional mode determined and monitored by the control unit concerned.

In another advantageous implementation of the method according to the invention, the comparison of the control signals extends over a preselectable length of time.

It is thus possible by the selection of a suitable length of time to compensate for system lag. Advantageously, the length of time is so selected as to take into account the usual time lag of the control units. This will have the desirable effect of preventing the signal installation from being operated in the first functional mode even though both control units are transmitting identical control signals but not in parallel due to system inertia.

In another advantageous implementation of the method according to the invention, a central signal controller transmits a single- or dual-channel control command to the control units.

This central signal controller may be constituted of or integrated in a signal-and-points control box. The central signal controller transmits to the control units a control command in response to which the signal installation is to be switched into a particular second functional mode. The control units receive and process that control command. Specifically, a given control command of the controller is transferred to the signal installation to cause it to operate in the appropriate functional mode specified by that control command.

In this connection a particular advantage is offered in that, based on the control command, a setpoint functional mode is determined in the control units, triggering a corresponding control signal.

In another advantageous implementation of the method according to the invention, each control unit monitors the signal installation for proper operation in the setpoint functional mode and transmits a control signal that can be associated with the functional mode of the signal installation being monitored.

As a useful feature, the control signal, transmitted in essentially continuous fashion, thus permits the determination of the current functional mode of the signal installation. Since each control unit transmits a corresponding control signal that represents the detected setpoint functional mode, a comparison of the control signals of the individual control units permits the monitoring of the overall system. As a result, according to the invention, the signal installation will be operated in the safe first functional mode whenever there is a discrepancy between the control signals of the control units.

In another advantageous implementation of the method according to the invention, the central signal controller and the first and second control units communicate with one another via at least one of the following means:

a) electromagnetic radiation;

b) light;

c) bus systems (e.g. RS485, TCP/IP), and

d) modulation of the supply voltage.

The term communication via electromagnetic radiation in this case refers in particular to wireless communication preferably based on electromagnetic radiation in the radio frequency range. Communication via light waves includes data transmission untethered to fiber optics conductors, for instance by means of a suitably operated laser. Communication using light waves may also be in the form of data transmission via optical conductors such as appropriately configured fiber optic cables. Modulation of the supply voltage refers in particular to so-called power-line communication where a voltage serving to power the control units is suitably modulated, especially frequency-modulated.

In another advantageous implementation of the method according to the invention, each control unit compares the control signal of at least one other control unit with its own control signal.

Yet another advantageous implementation of the method according to the invention includes an error check of at least part of the signal installation and/or of the control units.

The signal installation typically encompasses at least one light source, preferably at least one incandescent lamp or an LED array. The signal installation is preferably equipped with 4 to 10 incandescent lamps. In addition to a so-called primary filament each of these incandescent lamps may feature a so-called secondary filament. The secondary filament is switched on when a break of the primary filament has been detected. This constitutes additional redundancy, since a failure of the primary filament does not cause a failure of the signal installation, given its continued operability with the secondary filament pending repair of the primary filament. Specifically, the control units or at least one control unit are/is so designed as to permit the testing of the primary as well as the secondary filaments of the individual incandescent lamps of the signal installation. In addition, at least certain components of the control units can be tested. To further augment the operational reliability of the device [sic] according to the invention, another advantageous enhancement of the invention provides for a second control signal to be assigned to the second functional mode, whereby the signal installation will again be operated in the second functional mode when the first control unit and the second control unit transmit the second control signal in mutually independent fashion.

Another proposed aspect of this invention consists in a device for operating the signal installation of a railroad trackage block. It encompasses at least one first local control unit and one second local control unit. Each control unit is capable of transmitting at least one control signal. According to the invention, each control unit includes means for monitoring the functional condition of the signal installation and means for comparing the functional mode detected with a control signal of another control unit as well as means for transmitting a control signal. Each control unit is designed to permit the operation of the signal installation in a first functional mode when at least one control unit transmits the first control signal, and the operation of the signal installation in the first functional mode when the control signal of the first and second control units are mutually inconsistent.

Specifically, the device according to the invention can be employed for implementing the method according to the invention. In particular, each control unit can be in the form of a suitable microprocessor. The first functional mode is a so-called safe functional mode which virtually precludes any endangerment of the railroad traffic. Specifically, the first functional mode of a light signal is a STOP signal. Employing two control units provides redundancy which further enhances the dependability of the signal installation by virtue of a comparison of the control signals transmitted by the two control units.

In an advantageous configuration of the device according to the invention, the control units are so designed that they permit the signal installation to be operated in a second functional mode when the first and second control units transmit at least one control signal independently of each other. In particular, several second functional modes are possible to each of which an individual second control signal is assigned.

As an alternative aimed at further augmenting the operational reliability of the device according to the invention, the control units can be so designed as to permit the operation of the signal installation in a second functional mode when, independent of each other, the first control unit and the second control unit transmit a second control signal.

Another advantageous design version of the device according to the invention incorporates a communication interface for maintaining a link to a central controller.

Maintaining a link means that a connection is established and sustained. Specifically, the connection may be in wired or wireless form. The central controller may for instance be part of an appropriately configured signal-and-points control box permitting manual or automatic operation.

In another advantageous design version of the device according to the invention, the communication interface permits data transmission via at least one of the following means:

a) electromagnetic radiation;

b) light;

c) bus systems (e.g. RS485, TCP/IP), and

d) modulation of the supply voltage.

Modulation of the supply voltage involves so-called power-line communication whereby the supply voltage for the device according to the invention or for one or both of the control units or for other components is suitably modulated for data transmission. Particularly preferred in this context is frequency modulation.

In another advantageous implementation of the device according to the invention, at least one of the control units is so designed as to permit error-checking of at least part of the signal installation.

Specifically, both control units are so designed that, through the combined action of these control units, part or all of the signal installation and/or of the device according to the invention can be tested.

In another advantageous design implementation of the device according to the invention, the control units are electrically separated from one another.

Electrical separation advantageously enhances the reliability of the device according to the invention since it prevents electric interference of a control unit by one of the other control units.

In another desirable design configuration of the device according to the invention, the communication interface is electrically and/or optically separated from the control units. Electrical and/or optical separation of the communication interface from the control units advantageously minimizes the possibility of interference pulses traveling from the communication interface to the control units, and vice versa.

In another advantageous configuration, the device according to the invention is provided with an enclosure that forms an electromagnetic shield around at least certain components of the device. Specifically, the enclosure constitutes a Faraday cage, shielding in particular the control units and/or the communication interface against electromagnetic radiation. The electromagnetic shield preferably provides protection from electromagnetic pulses or electrostatic discharges.

The following will once more explain the implementation of the method and the functionalities of the device for operating a signal installation from the perspective of its interaction with the central signal controller.

The local light-signal operating system includes two separate control units for instance in the form of microprocessors. Data transmission via an appropriate interface allows the two control units to communicate with the central signal controller. The system can be expanded in a manner whereby both control units can individually and independently communicate, via a data transmission line, with the central signal controller in the signal-and-points control box. The light-signal operating device is installed locally near the signal installation and communicates with the central processor (control circuit board, slave board) of the central signal controller. This communication between the local light-signal operating system and the central signal controller can be implemented through power-line, fiber optic cable, databus or radio transmission. For example—among others—the following light signals can be activated:

• • Warning signals, for instance with 2 lamps simultaneously activated;
  • Main signals for instance with 2 red, 1 green and 1 yellow lamp(s);
  • Lead signals: yellow and green lamps;
  • Combination signals with white and green lamps;
  • Main and lead light signals with red, green and/or yellow lamps or light sources;
  • Main and lead signal combinations with white lamps

In its basic configuration the device is capable of individually activating six lamps. Two of these six lamps feature a primary and a secondary filament, which secondary filament is independently activated when a break in the primary filament has been detected. In a suitably expanded system as many as 28 lamps can be individually activated and monitored.

The following will explain this invention in more detail with the aid of the attached figures without limiting the invention to the implementation examples illustrated therein. In schematic fashion—

FIG. 1 depicts a first design example of a device according to the invention;

FIG. 2 shows an example of the layout of a control unit;

FIG. 3 illustrates a second design example of a device according to the invention;

FIG. 4 is a first flow chart explaining the method according to the invention;

FIG. 5 is a second flow chart explaining the method according to the invention;

FIG. 6 is a third flow chart explaining the method according to the invention;

FIG. 7 is a fourth flow chart explaining the method according to the invention;

FIG. 8 is a first circuit diagram of the signal installation with a device according to the invention;

FIG. 9 is a second circuit diagram of the device according to the invention in conjunction with the signal installation;

FIG. 10 is a third circuit diagram of the device according to the invention in conjunction with the signal installation;

FIG. 11 shows a single-channel data transmission line;

FIG. 12 shows a dual-channel data transmission line;

FIG. 13 Flow chart: Response to a command or status query;

FIG. 14 Flow chart: Reciprocal check of the μ-processors;

FIG. 15 Flow chart: A light signal has been activated;

FIG. 16: Flow chart: A light signal remains activated.

FIG. 1 depicts a first design example of a device 1 according to the invention serving to operate a signal installation 2 of a railroad trackage block. The device 1 encompasses a first control unit 3 and a second control unit 4. These control units 3, 4 are designed for local operation, i.e. locally dedicated to the signal installation 2. Specifically, this means that these units are not housed in a remote signal-and-points control box but are located close to the signal installation 2. Each control unit 3, 4 is capable of transmitting a first control signal and at least one second control signal and of monitoring the functional state of the signal installation 2.

FIG. 2 is a detailed schematic illustration of the control units 3, 4. Each of these control units 3, 4 is provided with means 5 for monitoring the functional state of the signal installation 2, with means 6 for comparing the functional mode determined with a control signal of another control unit 3, 4, and with means 7 for transmitting a control signal.

According to the invention, each control unit 3, 4 is so designed as to allow the operation of the signal installation 2 in a first functional mode when at least one control unit 3, 4 transmits a control signal, and to allow the operation of the signal installation 2 in a first functional mode when the control signals of the first control unit 3 and the second control unit 4 are mutually inconsistent. As shown in FIG. 2, the means 5, 6, 7 are connected, via signal lines 8, with one another, with the signal installation 2 and with the respective other control unit 4, 3. The means 5 for monitoring the functional mode permit the continuous or discontinuous read-out of the functional mode of the signal installation 2. As a result of such monitoring, the signal installation 2 may be operated in a first functional mode or a second functional mode, or a defect is detected in the signal installation 2. The comparison means 6 perform a comparison of the functional mode detected by the means 5 with the control signal of the respective other control unit 4, 3 and, where indicated, with its own control signal transmitted by the means 7. In the event the comparison means 6 detect a discrepancy between the control signals transmitted by the first control unit 3 and the second control unit 4, the signal installation 2 will automatically be caused to operate in the first, safe functional mode. In addition, a corresponding alert message may be sent to a central controller, advising it of a malfunction in the signal installation 2 and/or one of the control units 3, 4.

The device 1 according to the invention includes a communication interface 9 permitting data transmission via electromagnetic radiation, a databus, light waves and/or a modulation of the supply voltage for the device 1 and/or the control units 3, 4. This may for instance be in the form of a so-called power-line modem, a fiber optic converter or a wireless modem. The communication between the control units 3, 4, which are connected via corresponding links 10 with one another and with the communication interface 9, preferably takes place through a so-called RS485 interface. The links 10 are preferably implemented in redundant fashion so that, if one of the links 10 were to fail, the device 1 according to the invention can still be operated.

By way of the communication interface 9, setpoint functional modes of the signal installation 2 can be communicated to the control units 3, 4. The functional mode of the signal installation 2 is to be established on the basis of this setpoint functional mode. By way of the links 10 between the signal installation 2 and the first and second control units 3, 4, the control units 3, 4 can read out the respective current functional mode of the signal installation 2. Similarly by way of these links 10, appropriate control signals can be transmitted by the control units 3, 4 to the signal installation 2 in order to change or, as the case may be, maintain the current functional mode of the signal installation 2.

According to the invention, the signal installation 2 is operated in a first functional mode when at least one control unit 3, 4 transmits the first control signal. In other words, a first control signal transmitted by one of the control units 3, 4 will switch the signal installation 2 into its first functional mode and/or will operate it in that mode. In contrast thereto, only both control units 3, 4 together can bring about a second functional mode of the signal installation 2 in that both control units 3, 4 transmit the minimum of one matching control signal to the signal installation 2. That signal congruity is verified in both control units 3, 4. To that effect the control signal of the control unit 3 or 4 concerned is transmitted via the links 10 to the respective other control unit 4, 3 for a comparison with its own control signal and/or with the functional mode of the signal installation 2 as detected by that control unit 4, 3. If one of the control units 3, 4 determines that the control signals of the control units 3, 4 are not identical, the signal installation 2 will automatically shift into the first functional mode and will be operated in that mode.

The inventive method and the inventive device thus permit a redundant control operation of the signal installation 2 whereby, if a system component such as a control unit 3, 4 or any part of the control unit 3 or 4 were to fail, the signal installation 2 is automatically switched into the safe first functional mode and operated in that mode.

FIG. 3 is a schematic illustration of a second design example of a device 1 according to the invention. It differs from the first design example in that instead of one communication interface 9 it is equipped with two communication interfaces 9, each of which is redundantly connected to both control units 3, 4 via appropriate links 10.

FIG. 4 is a first diagrammatic flow chart explaining the method according to the invention. In procedural step 100, the communication interface 9 receives a command intended to switch the signal installation 2 into a setpoint functional mode. Step 100 also forwards that command via the communication interface 9 to the control units 3, 4. Preferably, the control units 3, 4 are addressed individually, allowing the control units 3, 4 in step 101 to determine whether that command is intended for them. In step 102 it is decided that the target address is the address of the control unit 3, 4. If the control unit 3, 4 finds that it is not the intended recipient of the command, no further action will take place. In step 103 the control unit 3 executes the command. In step 104 the command concerned is monitored by the first control unit 3. In corresponding fashion, the second control unit 4 executes the command in step 105 and monitors in step 106 the execution of the command. In step 107 the second control unit 4 relays the respective status to the first control unit 3. In step 108, the first control unit 3 compares the status received by the first control unit 3 through the monitoring of the signal installation 2 with the status received by the second control unit 4 through the monitoring of the signal installation 2. For the comparison in this procedural step as in all other procedural steps involving a comparison, a preselectable length of time is allowed, i.e. there is a wait for the duration of the preset time period before the comparison is made.

If in procedural step 108 the status information of the first control unit 3 and that of the second control unit 4 are not identical, then in step 109 the first control unit 3 will cause the signal installation 2 to be operated in the first functional mode. In step 110 the first control unit 3 sends its status message to the communication interface 9 through which the data will be forwarded to a central controller.

Step 110 will also be performed when the status messages of both control units 3, 4 in step 108 are identical. Concurrently in step 110, the status of the signal installation 2 determined by the first control unit 3 is sent to the second control unit 4. In step 111, the second control unit 4 compares the status of the signal installation 2 reported by the first control unit 3 with the status of the signal installation 2 determined by the second control unit 4. If that status is identical, then in step 112 the second control unit 4 as well will send its status message to the communication interface 9 to be forwarded to the central controller. In procedural step 111, there is again a wait for a predefined length of time before the comparison is made.

If the comparison made by the second control unit 4 (in step 111) turns out negative, meaning that the first control unit 3 and the second control unit 4 have each arrived at a different status of the signal installation 2, then in step 113 the second control unit 4 will switch the signal installation 2 into the first functional mode. In step 114 the second control unit 4 will transmit that status to the communication interface 9. Through steps 114 and 110 in which the communication interface 9 and, beyond it, the central controller have been informed of the current status of the control units 3, 4, any malfunction that triggers the switching of the signal installation 2 into its first functional mode and its operation in that mode will come to the attention of the central processor, permitting appropriate troubleshooting. Operation in the first functional mode may in advantageous fashion allow the activation of an automatic train warning system such as a so-called inductively operated automatic train-running control.

FIG. 5 is a flow chart illustrating the communication between the two control units 3, 4. Such communication between the two control units 3, 4 is implemented in particular on the basis of a so-called CAN network (controller area network). In procedural step 200, the second control unit 4 transmits to the first control unit 3 the status of the signal installation 2 as detected by it. In step 201 the first control unit 3 compares the status of the signal installation 2 as determined by the control unit 3 with the status of the signal installation 2 as determined and forwarded by the control unit 4. If the two status messages match, the first control unit 3 will send to the second control unit 4 the status of the signal installation 2 as determined by it. If step 201 reveals that the two status messages do not match, the first control unit 3 will, initially in step 203, address the signal installation 2 so as to cause it to operate in the first functional mode, while in step 202 sending to the second control unit 4 the status information determined by it. In step 204 the second control unit 4 compares the status of the signal installation 2 as determined by the second control unit 4 with the status of the signal installation 2 forwarded by the first control unit 3. In steps 204 and 201 a comparison is made with the data from a predefined period of time, i.e. there is a wait for a preselected duration before the comparison concerned is made. This allows for the fact that the lag of the different control units 3, 4 and the run times of the signals from the control units 3, 4 to the signal installation 2 and back are of a certain duration. If the comparison in step 204 reveals identical status information, the process continues with step 200. If the check in step 204 reveals diverging status information, then in step 205 the second control unit 4 will address the signal installation 2 so as to cause it to operate in the first functional mode, proceeding from there to procedural step 200.

The flow chart in FIG. 6 shows how the signal installation 2 is switched into a second functional mode. That may for instance be the activation or retention of a light signal other than a STOP signal. The initial premise in step 300 is that the signal installation 2 is being operated in its first functional mode, meaning in particular that the signal installation 2 is in the STOP mode. In step 301 the second control unit 4 receives the command to operate the signal installation 2 in a different functional mode. In other words, step 301 relays to the second control unit 4 a setpoint functional mode. Thereupon, in step 301, the second control unit 4 causes the signal installation 2 to shift into its second functional mode. In analogous fashion, the first control unit 3 receives in step 302 the command to operate the signal installation 2 in a setpoint functional mode. The first control unit 3 causes the signal installation 2 to change over into its setpoint functional mode. In steps 301, 302 a central controller sends out the commands which are received by the communication interface 9 and forwarded via the links 10 to the control units 3, 4.

In step 303 the second control unit 4 determines the status of the signal installation 2 and forwards that status information to the first control unit 3. In step 304 the first control unit 3 determines the status of the signal installation 2 and forwards that status information to the second control unit 4. The term status of the signal installation 2 refers in particular to the detected setpoint functional mode of the signal installation 2. In step 305 the control units 3, 4 compare the status determined by them with the status information received from the respective other control unit 3, 4. If there is a match (step 306), the result will be the state shown in 307, whereby the signal installation 2 is operated in its second functional mode that corresponds to the predefined setpoint functional mode. If the result of the comparison in step 305 is as shown in 306, meaning that the two status messages are not identical, then in step 308 one of the control units 3, 4 will switch the signal installation 2 into a second [sic] functional mode, operate it in that mode and send a corresponding message to the central controller via the communication interface 9.

FIG. 7 is another flow chart explaining the method according to the invention. Following the state shown in 400 where the signal installation 2 is operated in the first functional mode, the first control unit 3 checks the status of the signal installation 2 in step 401. In step 402, the first control unit 3 transmits that status information, constituting a control signal, to the second control unit 4 at least once but preferably several times. In step 405 the second control unit 4 checks the status of the signal installation 2. In step 406 the second control unit 4 transmits that status information to the first control unit 3 at least once but preferably several times. In step 403 the first control unit 3 compares the status of the signal installation 2 as determined by the first control unit 3 with the status of the signal installation 2 as received from the second control unit 4. If there is a match, the process continues with step 400, with the operation of the signal installation 2 continuing in the second functional mode.

In step 408 the second control unit 4 compares the status determined by the second control unit 4 with the status of the signal installation 2 reported by the first control unit 3. If the two status messages are identical, the process continues with procedural step 400. If in step 403 and in step 408 the status messages are not identical, the signal installation 2 will be switched into its first functional mode and a corresponding message will be transmitted to the central controller via the communication interface 9.

FIG. 8 is a schematic diagram of the circuitry that serves to shift the signal installation 2 into its first functional mode. A power supply 11 connects to an incandescent lamp 15 via a drop resistor 12, a first switch 13 and a second switch 14. The first switch 13 consists of the first control unit 3 or is a component of it and/or is a switch controlled by it. The second switch 14 consists of the second control unit 4 or is a component of it and/or is a switch controlled by it. Specifically, these may be relays that are activated by the associated control unit 3, 4. The incandescent lamp 15 is an incandescent lamp that is lit in the first functional mode of the signal installation 2. Specifically, this is a red incandescent lamp constituting a STOP signal. The circuitry further includes a first precision resistor 16 and a second precision resistor 17. These precision resistors 16, 17 function as so-called shunt resistors. Measured in this process is the voltage drop across these precision resistors 16, 17 or the current flowing through these precision resistors 16, 17. Applying Ohm's law, the measured variables can be mutually converted. In principle it is possible to provide one single precision resistor 16, 17; however, using two precision resistors 16, 17 according to the invention offers the advantage of a redundant design permitting a further improvement of the measuring accuracy. With the measured variables thus established, various test cycles can be run for testing different components of the signal installation 2 and/or of the device 1.

A first test cycle can be run during the transition from the first functional mode to a second functional mode of the signal installation 2. In addition to a primary filament of the incandescent lamp 15 there is a so-called secondary filament which could be incorporated in the same incandescent lamp or it could constitute a second incandescent lamp. The control units 3, 4 are equipped with a so-called automatic secondary-filament activation circuit which in the event of a defective primary filament in the incandescent lamp 15 will automatically activate the secondary filament assigned to it. The test cycle initially causes the first and the second control units 3, 4 to deactivate the automatic secondary-filament detection. Next, the second switch 14 of the second control unit 4 turns off the primary filament of the incandescent lamp 15. At that point it is possible to check whether the first switch 13 of the first control unit 3 is closed. This is accomplished by means of the above-mentioned measured variables, given that the current flowing through the precision resistors 16, 17 must remain constant. Next, the second switch 14 of the second control unit 4 reactivates the primary filament of the incandescent lamp 15. Thereupon the first switch 13 of the first control unit 3 turns off the corresponding primary filament of the incandescent lamp 15. It can now be checked whether the switch 14 of the second control unit 4 is closed. In this case as well the current measured at the precision resistors 16, 17 must remain constant. The first control unit 3 then turns on the automatic secondary-filament activation circuit. As the next step, the second switch 14 of the second control unit 4 deactivates the primary filament of the incandescent lamp 15. This permits verification of the proper operating condition of the automatic secondary-filament activation circuit in the first control unit 3 which must now turn on the secondary filament. Again, the measured current should remain constant. Next, the second control unit 4 turns on the automatic secondary-filament activation circuit while the first control unit 3 turns off its automatic secondary-filament activation circuit. This allows verification of whether the automatic secondary-filament activation circuit of the second control unit 4 is intact. Throughout this test cycle, assuming proper operating condition of all elements, the current measured across the precision resistors 16, 17 must remain essentially constant.

With the first functional mode of the signal installation 2 turned off, this test cycle permits the automatic testing of other components of the control units 3, 4. Additional functions can be tested when the signal installation 2 is shifted into its first functional mode, for instance when the STOP signal is activated. To that effect, for example, both the first control unit 3 and the second control unit 4 turn off the automatic secondary-filament activation circuit. Next, the second switch 14 of the second control unit 4 turns on the primary filament of the incandescent lamp 15. This allows verification of whether the second switch 14 is closed. The first control unit 3 on its part then activates the primary filament of the incandescent lamp 15. Next, the second switch 14 of the control unit 4 turns off the primary filament of the incandescent lamp 15. This permits verification of whether the first switch 13 of the first control unit 3 is closed. Thereupon the second switch 14 of the second control unit 4 reactivates the primary filament of the incandescent lamp. Next, the automatic secondary-filament activation circuits of the first and second control units 3, 4 are turned on again. During the switching of all elements involved throughout this test cycle the current measured across the precision resistors 16, 17 must remain essentially constant.

This second test cycle, with the second functional mode turned off, lends itself very well to the testing of the elements involved.

A third test cycle can be run while the signal installation 2 is in its first functional mode. To that effect, with the system in operation, the automatic secondary-filament activation circuits of the first and second control units 3, 4 are turned off. Next, the second switch 14 of the second control unit 4 deactivates the primary filament of the incandescent lamp 15. This allows verification of whether the switch 13 of the first control unit 3 is closed. In that case the current across the precision resistors 16, 17 will remain essentially constant. Thereupon, the first control unit 3 turns on the automatic secondary-filament activation circuit. Next, the first control unit 3 deactivates the primary filament of the incandescent lamp 15. This permits verification of whether the automatic secondary-filament activation circuit of the first control unit 3 is intact.

In a subsequent step the second control unit 4 turns on the automatic secondary-filament activation circuit while the first control unit 3 turns its automatic secondary-filament activation circuit off. This permits verification of whether the automatic secondary-filament activation circuit of the second control unit 4 is intact. Following that, the first control unit 3 turns on its automatic secondary-filament activation circuit. Next, the second control unit 4 activates the primary filament of the incandescent lamp 15. This permits verification of whether the second switch 14 of the second control unit 4 is intact. Thereupon the first control unit 3 reactivates the primary filament of the incandescent lamp 15. Throughout this entire test cycle, if all components tested function properly, the current measured across the precision resistors 16, 17 must remain essentially constant.

FIG. 9 is a schematic diagram of a circuit system serving to activate an additional light signal, i.e. to operate the signal installation 2 in a second functional mode. In principle, the signal installation 2 can be operated in several different functional modes. In contrast to the schematic diagram shown in FIG. 8, this circuitry includes a third switch 18 in the first control unit 3 and a fourth switch 19 in the second control unit 4. These switches are connected in series so as to activate the second incandescent lamp 20 when both switches 18 and 19 are closed at the same time.

FIG. 10 is another schematic diagram of a circuit system for the signal installation 2 operating in a second functional mode. This schematic diagram will show how an additional incandescent lamp 20, when turned off, can be tested via the control units 3, 4. Here, the function of the first switch 18 and the second switch 19 is tested as well. To that effect the second control unit 4 is provided with a fifth switch 21 and the first control unit 3 is provided with a sixth switch 22. For the test, the second control unit 4 opens the fifth switch 21 while the first control unit 3 closes the sixth switch 22. Next, the first control unit 3 activates the third switch 18. This allows the detection of a short-circuit in the fourth switch 18 [sic]. Next, the second control unit 4 activates the fourth switch 19. This permits the detection of a broken filament in the second incandescent lamp 20. Thereupon the first control unit 3 deactivates the third switch 18. That permits the detection of a short-circuit in the third switch 18. As the next step, the second control unit 4 deactivates the fourth switch 19. Next, the second control unit 4 opens the sixth switch 22 while the first control unit 3 closes the fifth switch 21. During the test a low test current flows through the circuit, low enough not to light up the incandescent lamp 20. This test serves to check the switches 18, 19, 21, 22 of the control units 3, 4 as well as the corresponding filaments of the second incandescent lamp 20. This test as well is based on the monitoring of the current that flows through the precision resistors 16, 17. If all components are intact, the current should remain essentially constant throughout the test.

In FIG. 11, the central controller 23 in the signal-and-points control box with its PLC modem (or alternatively with a fiber optics converter, a bus system or a wireless modem) is connected via two conductors with both the first control unit 3 (hereinafter also referred to as “microprocessor 3” or “μC1”) and the second control unit 4 (hereinafter also referred to as “microprocessor 4” or “μC2”), locally installed in immediate proximity to a signal installation (not illustrated). For signal transmission and for transferring the command signals each of the microprocessors 3/μC1 and 4/μC2 connects to the signal installation 2 via a link 10 and to function-mode monitoring means 5 via signal control lines 8. In addition, both microprocessors are interconnected via (network) links 10. This circuit configuration performs the following functions:

• • 1.) In mutually independent fashion, both μCs monitor the status of the light signal.
  • 2.) By way of (a) CAN interface(s) both μCs communicate with each other, reporting to the respective other μC the current status/functional mode.
  • 3.) In mutually independent fashion, each of the μCs is capable of switching the light signal into the safe mode in which the light signal indicates STOP.
  • 4.) To activate a GO signal both μCs must perform identical activation routines.
  • 5.) Both μCs receive from the central signal controller 23 in the signal-and-points control box the commands transmitted to the interface via a modem or in general via a data communication device (or even for instance an RS485 port).

If, as depicted in FIG. 1, the data transmission between the central signal controller 23 and the microprocessors employs a common modem, the following applies:

• • 1.) Both μCs send their status information to the central controller via that sole modem.
  • 2.) Both μCs receive at one of their RS485 ports that which the respective other μC is sending to the modem.
  • 3.) If that status information sent to the modem differs from its own status information, the μC concerned unilaterally switches the light signal into the STOP state, which will be recognized by the other μC.

If, as illustrated in FIG. 12, the data transmission between the central signal controller 23 and the microprocessors employs one modem for each, meaning a total of 2 modems, the following applies:

• • 1.) Using separate transmission lines, both μCs send their status information to the signal-and-points control box.
  • 2.) Both μCs receive at one of their RS485 ports that which the respective other μC is sending to the modem.
  • 3.) If that status information sent to the modem differs from its own status information, the μC concerned unilaterally switches the light signal into the STOP state, which will be recognized by the other μC.
  • 4.) The decision as to what will take place next is made by the central controller in the signal-and-points control box.

As soon as the local signal-operating device 1 detects a disruption of the communication with the central signal controller 23 (for instance if the timer has run out), the local signal-operating device must switch over into the safe signal mode. In other words, the STOP signal will be activated when there is no communication between the local light-signal operating device 1 and the central signal controller 23. The STOP signal will also be activated when there is no communication with the signal control unit(s), which will be detected by the central signal controller 23 from where a corresponding command will be forwarded to the local signal operating device 1. Without depending on a command from the central signal controller 23, a STOP signal is also activated when the two μCs show a discrepancy in their monitoring results.

In the event the light-signal operating device 1 loses power, the signal will be dark, which is tantamount to a STOP signal.

The local light-signal activating device will continuously check the various “filaments” (PFR, SFR, PFW, position light), permitting in the event of a failure an immediate message to be sent to the central signal controller 23 before a line-clear signal for a track section is needed.

Similarly, the operation of a signal installation by an appropriately enabled automatic train stop or warning system (AWS, an inductive safety system for automatic signal activation by the train) is controlled by the local light-signal operating device 1. With the aid of the AWS, a train that runs a STOP signal will be automatically brought to a stop. The AWS is activated when the signal is set on STOP. The AWS consists of a track magnet in an aluminum housing that is “electrically open” toward the top. The track magnet connects to a parallel-resonant circuit consisting of a coil and a capacitor that is tuned to a specific frequency, for instance f₁=500 Hz. If through a contact the resonant circuit is energized, an electric locomotive that transmits at the same frequency will be automatically brought to a stop as it reaches the track magnet. However, if a substitute signal or a written command is to allow a train to pass a malfunctioning main signal that shows STOP, without being automatically halted, a special AWS command key can bypass the frequency-based stop action.

With reference to the flow charts in FIGS. 13 to 16, the following will describe and explain the flow of commands and signals between the central signal controller 23, the microprocessors 3, 4, the signal operating device 1 and the signal monitors.

The two μCs communicate with each other via the CAN interface. Since in mutually independent fashion both μCs perform the signal activation and monitoring, the communication between the two μCs must be continuous. The moment one μC reports its status to the other, that other μC must check its own status for congruity: If within a preselected time span an identical monitoring result is not found, the μC must switch the signal into the safe functional mode. In this context it should be noted that either μC can independently set the signal in the safe mode. Run-related settings (such as MS1, MS2, position light etc.) can only be made jointly. Therefore, prior to any reciprocal status check, a certain delay in the progression is needed to give the other μC enough time to perform the activation concerned.

The circuitry is laid out based on the principle of “non-reactivity and maximum isolation of the internal from the external system”. Therefore, the circuitry is preferably implemented with optically controlled components, in particular MOSFETs, photovoltaic relays, fiber-optic couplers, linear optoelectronic couplers, current sensor modules each with a linear optoelectronic coupler.

In conjunction with the shunt resistor it will be necessary to ensure a high EMC level and thus maximum isolation of the internal system from the outside system.

The STOP signals should be turned on and off along a given sequence to ascertain proper function of the two switches. During an extended On-state it is possible to test the individual switches without that being visible from the outside.

The inventive method and the inventive device 1 advantageously permit the safe operation of the signal installations 2 of railroad trackage blocks. The method and device 1 according to the invention ensure that in the event of a malfunction within the control electronics the signal installation 2 will always be operated in a safe first functional mode for instance in the form of a STOP signal.

LIST OF ABBREVIATIONS

• bps Bits per second (transmission rate)
• CAN Controller Area Network
• COMPEX Computer, explosion-proof
• CRC Cyclic redundancy code
• LLSAD Local light-signal activation device
• ES European standard
• ESD Electrostatic discharge
• PFR Primary filament, red
• PFW Primary filament, white
• MLLS Main and lead light signal
• MS Main signal
• ID Identifier
• AWS Automatic warning system
• kbps 1024 bits per second (transfer rate)
• CS Combination signal
• kV 1000 volts (electric voltage)
• LED Light-emitting diode
• FOC Fiber-optic cable
• Mbps (1024)² bits per second (transfer rate)
• SFR Secondary filament, red
• P2P Point-to-point, direct communication
• PLC Power-line communication
• RS485 Recommended Standard-485
• SIL Safety integration level
• ST Safety stop (railroad signals, e.g. ST_0, ST_1)
• MLSC Main and lead signal connections
• Div Divider
• μC Microprocessor
• VAC Volts, alternating current
• VDC Volts, direct current
• LS Lead signal
• MY Marshalling yard

LIST OF REFERENCE NUMBERS

• 1 Device
• 2 Signal installation, light signal activation system
• 3 First control unit, microprocessor, μC1
• 4 Second control unit, microprocessor, μC2
• 5 Means for monitoring the functional mode
• 6 Means for comparison
• 7 Means for transmitting the control signal
• 8 Signal cables/junctions
• 9 Communication interface
• 10 Links, network, microprocessor interconnection, signal and command transmission lines
  • 11 Power supply
• 12 Drop resistor
• 13 First switch
• 14 Second switch
• 15 Incandescent lamp
• 16 First precision resistor
• 17 Second precision resistor
• 18 Third switch
• 19 Fourth switch
• 20 Second incandescent lamp
• 21 Fifth switch
• 22 Sixth switch
• 23 Central signal controller (central processing unit/CPU)
• 100 . . . 408 Procedural steps

Claims

1. A method for operating a signal installation of a rail-road trackage block, whereby at least one first local control unit and one second local control unit are dedicated to said signal installation, each local control unit being capable of transmitting at least one control signal, characterized in that

the signal installation is operated in a first functional mode when at least one control unit transmits the control signal for the safe-state traffic signal (e.g. stop mode),

the signal installation is operated in a second functional mode when, in mutually independent fashion, the first control unit and the second control unit transmit the said minimum of one control signal (go mode), and

the signal installation is operated in the first functional mode when the control signal of the first control unit and that of the second control unit are mutually inconsistent (malfunction)

2. The method as in claim 1, whereby the control signals of the first control unit and the second control unit are compared in at least one of the control units.

3. The method as in claim 2, whereby said comparison of the control signals is performed over a preselectable time span.

4. The method as in claim 1 or 2, whereby a central signal controller transmits a single- or dual-channel control command to the control units.

5. The method as in claim 4, whereby, based on said control command, the control units determine a setpoint functional mode and transmit a corresponding control signal.

6. The method as in claim 5, whereby each control unit monitors whether the signal installation is operating in the setpoint functional mode and transmits a control signal that can be assigned to the monitored functional mode of the signal installation.

7. The method as in claim 4, whereby the central signal controller communicates with the first control unit and the second control unit via at least one of the following means:

a) Electromagnetic radiation;

b) Light;

c) Bus systems (e.g. RS485, TCP/IP);

d) Supply-voltage modulation.

8. The method as in claim 1 or 2, whereby each control unit compares the control signal of at least one other control unit with its own control signal.

9. The method as in claim 1 or 2, whereby troubleshooting is performed on at least part of the signal installation and/or on the control units.

10. The method as in claim 1 or 2, whereby a second control signal is assigned to the second functional mode and the signal installation is again operated in the second functional mode when, in mutually independent fashion, the first control unit and the second control unit transmit said second control signal.

11. The device for operating a signal installation of a railroad trackage block, encompassing at least one first local control unit and one second local control unit, each control unit being capable of transmitting at least one control signal, characterized in that each control unit comprises means for monitoring the functional mode of the signal installation, means for comparing the detected functional mode with a control signal of another control unit, as well as means for transmitting the functional mode detected in the form of a control signal, each control unit being so designed as to permit the operation of the signal installation in a first functional mode when at least one control unit transmits a first control signal while also permitting the operation of the signal installation in that first functional mode when the control signals of the first control unit and of the second control unit are mutually inconsistent.

12. The device as in claim 11, in which the control units are designed to permit the operation of the signal installation in a second functional mode when, in mutually independent fashion, the first control unit and the second control unit transmit the said minimum of one control signal.

13. The device as in claim 11, in which the control units are designed to permit the operation of the signal installation in a second functional mode when, in mutually independent fashion, the first control unit and the second control unit transmit a second control signal.

14. The device as in one of the claims 11 to 13, equipped with at least one communication interface for maintaining a connection to a central signal processor.

15. The device as in claim 14, in which the communication interface (9) permits data transmission via at least one of the following means:

a) Electromagnetic radiation;

b) Light;

c) Bus systems (e.g. RS485, TCP/IP);

d) Supply-voltage modulation.

16. The device as in one of the claims 11 to 13, in which at least one of the control units (3, 4) is so designed as to permit the troubleshooting of at least part of the signal installation (2) and/or of the device (1).

17. The device as in one of the claims 11 to 13, in which the local control units (3, 4) are electrically separated from each other.

18. The device as in claim 14, in which the communication interface (9) is electrically and/or optically separated from the local control units (3, 4).

19. The device as in one of the claims 11 to 13, in which the device (1) is provided with a housing that constitutes an electromagnetic shield at least around parts of the device.

20. A system for the activation and monitoring of a railroad-traffic signal installation, with a central signal controller and with transmission lines connecting to the signal installation for the activation and deactivation as well as the monitoring of the signals, characterized in that,

provided in close proximity to the signal installation is a local light-signal operating device comprising two local control units, each of which is connected via at least one transmission line to the central signal processor, to the signal installation at the other end as well as to means serving to monitor the functional mode, in a manner whereby each control unit, independent of the respective other control unit, can perform the activation, deactivation and monitoring of the signal installation, and that both control units are mutually interconnected and programmed in a manner whereby each control unit monitors the status of the respective other control unit and switches the signal installation into the first functional mode if within a predefined time span after each switching operation the signal status of the other control unit is not identical to its own signal status.