Classifications

• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B61—RAILWAYS
  • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
  • B61L7/00—Remote control of local operating means for points, signals, or track-mounted scotch-blocks
  • B61L7/06—Remote control of local operating means for points, signals, or track-mounted scotch-blocks using electrical transmission
  • B61L7/08—Circuitry
  • B61L7/10—Circuitry for light signals, e.g. for supervision, back-signalling
• • G—PHYSICS
  • G08—SIGNALLING
  • G08C—TRANSMISSION SYSTEMS FOR MEASURED VALUES, CONTROL OR SIMILAR SIGNALS
  • G08C25/00—Arrangements for preventing or correcting errors; Monitoring arrangements
  • G08C25/02—Arrangements for preventing or correcting errors; Monitoring arrangements by signalling back receiving station to transmitting station

Definitions

• the present invention relates to a remote control and remote control installation of a plurality of devices from contacts whose open or closed position is detected and controlled.
• the invention can be applied, in particular but not limited to, to apparatuses in the railway sector such as the needles of a switching station, axle counters, level crossings, or any other device to be checked and or ordered.
• Another type of mechanical control is also used, which consists in carrying out said control of the needles from a referral station, by means of cables or rods.
• the position control is no longer done by direct inspection of the bonding of the needles as previously, but from the referral station where the position of the control is visually observed. This, being still mechanical, translates into safety by its position that of the needles.
• This control combines the acquisition and transmission of information.
• the acquisition is generally made by closing electrical contacts by switches linked mechanically, in translation or after conversion into rotation, to the blades of the needles.
• Transmission is generally done in using these electrical contacts to establish or break the current flow in as many separate loops as there are contacts to control.
• the current source is generally located at the switching station, as well as the observation of the open or closed state of the loops.
• the transmission is not multiplexed, so that at least four contacts and five wires are necessary if one wishes to have loops "which can individually observe the bonding and the take-off of each of the blades constituting the Similarly, non-multiplexing prohibits the sharing of transmission means for the remote control of several needles.
• the present invention therefore aims to achieve a remote control system and remote control of needles which allows, for a low cost of equipment related to a needle, multiplexing the transmission of various information relating to a switch, and, if desired, several switches, under conditions which ensure railway safety.
• the object of the present invention is a global remote control and / or remote control system for contacts implementing a multiplexed link between a secure control and / or command center and one or more satellite logic units, each making it possible to control one or more contacts located at a small distance from said logic.
• multiplexing is meant here any technique allowing the sharing of a transmission medium between several information flows. It can be a frequency, time or logic multiplexing.
• the connection can be point-to-point, multipoint (or bus) or ring.
• This system is characterized in that overall security is ensured by the use of a secure information processing system in a control center, in that the transmission between the central secure control system and the individual means or means of control (or satellite logic) can implement a procedure making it possible to detect transmission errors and in that the individual control means do not need to be genuinely intrinsically safe but cooperate, in response to a control signal addressed by the central control system, by a local coded signal (which can be added to a coding emanating from the central security control system), to the transmission of information having redundancy such that, when received, the system control center can ensure, with the desired degree of security, the identity of the controlled contact, its state and possibly dat er the information provided regarding this identity and this state.
• the transmission must, of course, be accompanied by the transmission of redundant information which would allow the appropriate procedure to verify that no error has been introduced, but we can consider that it is not necessary to implement such a procedure because, in fact, it is when the information, suitably modified, is returned to the security control center that we will implement this verification.
• FIG. 1 shows the block diagram of one of the coders of Figure 1;
• Figure 4 shows a variant of the encoder of Figure 3
• FIG. 5 shows a general diagram of a remote control security logic associated with a plurality of remote control satellite logic
• FIG. 6 shows a block diagram of the position control assembly
• FIG. 7 shows a diagram of a satellite control logic and its interface with the remote control security logic.
• FIG. 1 shows the control installation according to the present invention, applied to the control of three contacts C 1 , C 2 , and C 3 by means of a single unsafe control logic or satellite logic LSC, of which the implementation does not call upon an intrinsic safety technology.
• This unsafe control logic consists of three pairs of coders CM 1 , CV 1 , CM 2 , CV 2 , and CM 3 , CV 3 and a microcontroller 1, connected by a modem 2 and a connection transmission of data 3 to a central secure LST telecontrol logic.
• Each of the pairs of coders CM i , CV i consists of two identical coders 4, CM i being the "upstream” coder and CV i the "downstream” coder, the block diagram of which is given in FIG. 2 where sees the encoder 4 which receives on its serial input DI the data to be coded and provides on its serial output DO the coded data. It also receives a power supply, represented by the 0 and V inputs and a clock on its CK input. All the coders share the same power supply and receive their clock from a common source, the power supply and clock assembly being represented by A + H in FIG. 1.
• CM i coded i , CV i
• the “upstream” coder such as CMx receives its data to be coded from the microcontroller 1, applies a first coding to them, and sends this coded data to the contact to be controlled as than C 1 . If contact is established, this data arrives at the input of the "downstream” coder such as CV 1 , which applies a second coding to them and delivers the data thus transcoded twice to the microcontroller 1.
• the coders CM i , CV i do not share any component with each other, so as to avoid common mode faults.
• the wiring connecting a contact to its "upstream” and “downstream” encoders is made so as to make a short circuit impossible which would allow the data coded by the "upstream” encoder to enter the encoder "downstream” without having passed through the contact to be checked.
• a precaution can consist in moving the "upstream” and "downstream” encoders as close as possible to the contact to be checked.
• an encoder 4 comprises a shift register 5 with serial input and parallel output and a read-only transcoding memory 6.
• the serial-parallel register 5 inputs the data presented on its input DI at the rate of a clock presented on its input CK.
• a return resistor R, upstream of DI ensures that the data presented have a constant logic value when the DI input is "in the air", which corresponds to the case of a downstream encoder whose contact to be checked is open .
• the parallel output PD of the shift register 5, or at least certain wires of this output, is connected to the address input A of the read-only transcoding memory 6. It will be assumed that this transcoding memory is organized in mx 1, that is, it has only one DO data output. If we assume that the last n bits entered in the serial-parallel register 5 are used to address the transcoding memory 6, we see that each bit presented on the output DO results from transcoding by the content of the transcoding read-only memory 6 of the last n bits received by the serial-parallel register 5.
• FIG. 4 shows a variant of the coder 4 of FIG. 3, characterized in that the read-only transcoding memory 6v has an organization by bytes.
• the eight data outputs D of the transcoding read-only memory 6 are connected to the data input I of a data multiplexer 7, the three selection inputs S of which are connected to three outputs PD 0-2 of the shift register 5, for example those which correspond to the last three bits presented on the input DI of register 5.
• the address input A of the transcoding read-only memory 6 is connected to outputs of the shift register 5 which correspond to older bits, for example PD 3-13 in the case where the transcoding read-only memory 6 is constituted an 8 K byte EPROM.
• the content of the transcoding read-only memory 6 is arbitrary, but different from the transcoding memory MTi to the transcoding memory Mt j respectively associated with the contacts C i and C j , if the two contacts i and j are connected to the same logic non-secure control logic (or satellite logic), or to separate non-security control logic but connected by the same data transmission link 3 to the same secure remote control logic (or central logic).
• the number of bits sent by the microcontroller 1 of FIG. 1 to an upstream coder such as CM i can be arbitrary and, in particular, less than the capacity of the read-only transcoding memory MT. For example, the capacity of this one can be 64 k bits, while the message to be coded can have a length of 256 bits.
• the series of bits sent by the microcontroller 1 comprises, after this synchronization sequence, another sequence, always the same which therefore always provides the same response after transcoding successively by the upstream and downstream coders CM i and CV i associated .
• This response will therefore in a way constitute the "signature” or "imprint” of contact C i , if it is closed.
• the continuation of the sequence sent after the synchronization sequence is random, the response after transcoding will still constitute a signature, but in a way coded and not in clear.
• the advantage of having a part of the interrogation sequence that is different from one time to another is to allow the contact's response to be "dated".
• the risk against which we thus seek to protect our is that the controlled state is exact, corresponds well to the desired organ, but that it is old. This risk is real in equipment comprising a memory, which can transmit an old response instead of a fresh response.
• the data sent by the microcontroller 1 (FIG. 1) to the upstream coders CM 1 , CM 2 and CM 3 can all be different, but they can also be identical, the sending being done in parallel.
• the remote control security logic central logic
• the central logic requires a unsafe control logic LSC (satellite logic) to send the same interrogation sequence to all the upstream coders and to send back to it all the responses which do not consist of identical bits, which is the case of the response corresponding to an open contact.
• the microcontroller can distribute to the various coders a clock at a relatively slow rate, so as to make it possible to control relatively distant contacts without requiring too particular care for the wiring.
• the central station is equipped with a remote control security logic combining intrinsically safe electronics and interfaces based on safety relays.
• Each device is associated with a satellite control logic, the particularity of which is that it is made from non-secure commercial components.
• the devices considered can be, in particular but not limited to, a needle, an axle counter, a level crossing.
• the central station can be served by an agent or by wire or radio link with a tracking center, or a traction unit (a locomotive for example).
• the satellite control logic LSC 1 , LSC 2 , LSC 3 , of the various devices depending on the central station LST are connected to the central security control logic by a multipoint link which in fact comprises a power line A and a data transmission line L.
• the power line A is subdivided into a three-phase supply intended for the operation of each device and an auxiliary supply intended for supplying the satellite control logic.
• the LSC i satellite control logic and the LST - LSC i link are not intrinsically safe, however the overall security is ensured under the sole responsibility of the central LST logic, which is deemed to be safe.
• Each LSC i satellite control logic consists of two microcontrollers, responding to two different addresses on the multipoint line, the central security logic of LST telecontrol playing the role of master.
• the safety logic of LST telecontrol addresses to the LSC satellite control logic associated with the device to be controlled, a train of n pseudo-random bits. This train is therefore dated, since different from that sent during the previous check.
• the LST telecontrol safety logic receives in return from the addressed LSC control satellite logic, another train of n bits from which it is able to check unambiguously: the correlation with the bit stream sent, the number of the addressed satellite logic and the position of the controlled device.
• the security of the control therefore rests on the comparison made by the security logic of telecontrol LST, in security, between the bit stream sent and the bit train received.
• the required level of security is obtained by varying the length n of the bit stream and the complexity of the coding function. More precisely, we seek to verify the identity, or quasi-identity, between the received bit stream and a certain local transform of the transmitted bit stream. More specifically, the LST telecontrol security logic sends a double bit stream E 1 + E 2 .
• the bit stream E 1 is received by the microcontroller MC 1 and the bit stream E 2 is received by the microcontroller MC 2 .
• Each microcontroller redirects its respective bit stream E 1 or E 2 to the other microcontroller of the same satellite control logic via contacts r or of the device controller.
• a single microcontroller can transmit its bit stream.
• neither of the two microcontrollers can manage to transmit its bit stream.
• the safety logic of telecontrol LST therefore receives in return from the double bit stream E 1 + E 2 a bit stream S 1 and / or S 2 , which is characteristic both of the bit stream transmitted and of the path traveled between the two microcontrollers of this LSC control satellite logic through the contacts to be controlled.
• the functions f 1 and f 2 are determined mathematically according to the error rate which is deemed acceptable.
• the "distance" between two trains of n bits is generally defined as the number of bits of the same rank different in the two messages.
• bit streams are chosen so that the "distance" between them is as large as possible.
• Each reference bit stream will therefore be characteristic of the microcontroller where the function f is performed. It is fixed in the PROM programmable read-only memory of the card.
• the LST knows the transcoding law associated with the contact it wishes to control. Knowing the contents of the pseudo-random bit stream it sent, it absolutely knows what the bit stream it receives should be.
• each microcontroller After resetting to zero, each microcontroller initializes its buffer registers, so as to send back to the security logic of telecontrol a bit stream significant of its good reset and of its identity. It can be the same R bitstream.
• the power line consists of a five-conductor cable (F 1 to F 5 ) grouping two separate supplies, firstly a three-phase supply of devices using the wires F 1 to F 3 (the cross section of which is determined by the consumption of only one device at a time), on the other hand an auxiliary power supply using the wires F 4 and F 5 for the remote supply of the LSC satellite control logic and locking the RA needle relays.
• F 1 to F 5 The power line consists of a five-conductor cable (F 1 to F 5 ) grouping two separate supplies, firstly a three-phase supply of devices using the wires F 1 to F 3 (the cross section of which is determined by the consumption of only one device at a time), on the other hand an auxiliary power supply using the wires F 4 and F 5 for the remote supply of the LSC satellite control logic and locking the RA needle relays.
• this auxiliary power supply can take three different states depending on the states of the Rx and Ry relays: continuous if the Ry relay is at work, alternating if Ry is at rest and Rx at work, zero if Rx and Ry are at rest.
• the electronics of the satellite control logic can be supplied both continuously and alternately, using a power supply converter block "direct power cut" BC. Its inertia is sufficient to cover the AC-DC switching times and vice versa at the level of the LST telecontrol safety logic.
• the RA device relays which are prepositioned in the satellite control logic in the first step of a device command, as seen above, are under the control of an RC bonding relay and a take-off relay RD which responds only to the supply of alternating current.
• the solution of the data transmission line separate from the power line was chosen for various reasons, including mainly the freedom of technological evolution of the data transmission (optical fibers, etc.) and security for the teams of maintenance that does not have to work under dangerous voltage.
• a remote control of a single motor M 0 breaks down into three stages:
• the order of bonding is given by the data transmission line 3 to the single relay RA of the device concerned, which self-maintains;
• the resting of the RA relays is carried out by means of the same succession of operations as during prepositioning and the take-off of the RA relays is controlled while the auxiliary supply is in alternation.
• the RA device relay is mounted as a sticker. Its bonding is ensured by a bonding relay RC, controlled by the microcontroller MC 2 of the satellite control logic LSC while its takeoff is ensured by a take-off relay RD, controlled by the microcontroller MC 1 .
• the two relays RC and RD are supplied from the auxiliary supply supplied by F 4 and F 5 , via a transformer TR which constitutes an intrinsic safety device for the transmission of alternative energy. Even in the event of microcontroller failure With their LSC satellite control logic, the bonding and take-off relays can only be actuated while the auxiliary supply is in alternation.
• the RC control is made impulse by a capacitive assembly which does not have to be security.
• the RC bonding relay can only intervene when the auxiliary supply is alternative, and, what matters most at the level of the RA device relay, it is not its command, not safe, but the control from its safe position before sending the three-phase.
• the security of the order rests, in a way, on the security of the control of the pre-order.
• the solution described above for satellite control logic applied to a needle has a significant economic advantage in terms of wiring.
• the point-to-point connection between the station and each needle comprises at least four conductors of large section (so-called "4-wire" assembly)
• the solution proposed in the invention derives its benefit from a continuous monitoring of the circulations, avoiding the accumulation points in the operation of the needles whose average utilization rate over a long period is in fact close to zero.
• the data transmission line 3 selected is a double twisted and shielded pair, used under the BITBUS protocol of INTEL, in differential mode (RS485) whose main characteristics of the chosen option are as follows:
• the same LST telecontrol security logic can manage several BITBUS, the devices being distributed so as to always have a minimum number of "routes", even in the event of a BITBUS failure.
• Galvanically isolated repeaters are available as standard as BITBUS accessories. They require a double continuous 12V supply for upstream and downstream, which can be supplied locally by supplying the LSC satellite control logic or by transmitting, in the BITBUS cable, an additional 12V remote supply , which is part of the BITBUS standard.
• the LSC needle control satellite logic consists of two microcontrollers MC 1 and MC 2 produced from DATEM DCB 220 commercial cards.
• BITBUS cards use the INTEL 8044 micro-controller, which is an 8052 to which is added a high speed Data Link Control (HDLC) serial interface at high speed (up to 2.4 Mbit / s).
• Each microcontroller is connected to the BITBUS with a specific address and constitutes a node of the BITBUS.
• the programmable read only memory (PROM) associated with each microcontroller MCx, MC 2 contains on the one hand the system core and the local program, common to all the cards, and on the other hand the tables used for transcoding the trains of specific R bits of the card. There must therefore not be two identical PROMs.
• the physical address of the microcontroller is "strapped" on the card.
• the LST telecontrol security logic can check by reading on the PROM a particular bit stream (which may be the R bit stream used previously) the correlation between the microcontroller addressed on the BITBUS (physical address) and the bit stream received from the corresponding PROM.
• the random access memory (RAM) associated with each microcontroller MCx and MC 2 constitutes the buffer registers for transmitting and receiving trains of n bits, transmitted at high speed on the multi-point data transmission line or transmitted at speed weaker to the other microcontroller of the same LSC satellite control logic via the needle controller or via the RA relay.
• serial needle control or RA relay links are made by a double UART (Universal Asynchronous Receiver Transmitter) or Link Controller (figure 6) available on each DATEM DCB 220 micro-controller card. Needle control is done + 12V current loop on a port and the RA relay control, which is local in the satellite control logic, is done in RS 422 (+ 5V) on another port.
• Transmissions to the needle controller and to the RA relay are done at medium speed (19200 bit / s maximum), while the transmission speed on the BITBUS is 62.5 kbit.
• the speed adaptation is done at the level of the buffer registers of the microcontrollers MC 1 , MC 2 of the satellite control logic LSC.
• the other input-output ports available on DATEM cards are used for controlling the bonding and take-off relays RC and RD of the relay RA, as well as for unsafe input-outputs, needle heaters for example.
• the RA relay is a relay with six reversers, three of which (a 1 , a 2 , a 3 ) are used to control the three-phase motor of the needle, two (a 4 and a 5 ) to control the position of the RA relay itself. same and the last one has 6 to self-maintain.
• the contacts of the RA relay must be capable of withstanding the current supplied to the motor Mo; however, they should not be calibrated to commonly cut such intensity. Indeed, the relay RA is prepositioned before the three-phase is established by the breaker relay RU of the satellite control logic LSC.
• the RA relay can in no case inadvertently stick, on the other hand, it can exceptionally take off incorrectly at the time of a + 12V failure of the supply of the LSC satellite control logic.
• the RC and RD relays are two DIL (Dual In Line) relays which respond to the stresses of the MC 1 and MC 2 microcontrollers only if the auxiliary supply is AC.
• DIL Double In Line
• the supply of satellite control logic is in two parts:
• a regulated power supply consisting of a converter block with direct switching AC sector accepting both DC and AC voltage at the input, and guaranteeing the maintenance of the nominal outputs during switching AC-DC and DC-AC of the auxiliary power supply.
• a TR transformer safely prevents the passage of a continuous supply.
• a capacitor C is connected in series with TR to avoid short-circuiting the continuous auxiliary supply by the primary of the transformer TR.
• the resonant frequency of the filter constituted by the capacitor C and the primary of the transformer TR must be very low compared to the operating frequency of 50 Hz.
• the interfaces of the LST control security logic will be described with reference to FIG. 7. It has already been said that the remote control security logic was designed as intrinsic security.
• the interface between said security logic and satellite logic must also be intrinsically safe. Although very simplified, it must be carried out with safety relays, of the NSI type for example.
• a conventional AC device control relay ensures, by the inverters C 1 and C 2, the inversion of two of the phases Ph2 and Ph3 of the three-phase supply, to reverse the direction of rotation of the motor Mo of the device.
• a conventional Ru device breaking relay ensures the establishment and cutting of the three-phase on the power line, via the inverters u 1 , u 2 , u 3 and u 4 .
• a Ry relay ensures AC-DC switching of the auxiliary power supply. By switching the relays together, it is guaranteed that the AC relay can only switch if the Ru relay is at rest, that the Ru relay can only intervene if the Ry relay is in the high position (which corresponds to a continuous auxiliary supply ) and that the relay Ry self-maintains as long as the relay Ru remains high, which avoids an untimely return of the auxiliary supply in alternating mode, as long as the three-phase is on line.
• the continuous auxiliary supply can be obtained by any device, in particular by simple rectification and filtering of the alternative supply.
• the filtering must be safe, because it must be certain that the residual alternative ripple rate cannot bring back to the secondary of the transformers of the satellite control logic a voltage capable of actuating an RC relay. The locking of the RA relays during a continuous auxiliary supply would then no longer be guaranteed.
• the additional Rx relay makes it possible, when Rx and Ry are both in the low position, to cut off any auxiliary power supply and therefore to cause a fall of the RA relay which remains stuck due to a failure of the LSC satellite control logic
• control and command set out in conjunction with a needle control, apply in the same way for a satellite level control logic. With the necessary specific adaptations, they can also be applied to the control and / or the safe command of any device encountered in the field such as announcements at construction sites or axle counting, or in a switching station.

Landscapes

• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Engineering & Computer Science (AREA)
• Mechanical Engineering (AREA)
• Selective Calling Equipment (AREA)
• Alarm Systems (AREA)
• Push-Button Switches (AREA)
• Maintenance And Inspection Apparatuses For Elevators (AREA)
• Remote Monitoring And Control Of Power-Distribution Networks (AREA)
• Train Traffic Observation, Control, And Security (AREA)
• Operating, Guiding And Securing Of Roll- Type Closing Members (AREA)
• Details Of Television Systems (AREA)

Applications Claiming Priority (3)

Publications (2)

Family

ID=9380484

Family Applications (1)

Country Status (10)

Cited By (5)

Families Citing this family (6)

Family Cites Families (10)

• 1989
  • 1989-04-07 FR FR8904587A patent/FR2645674B1/fr not_active Expired - Fee Related
• 1990
  • 1990-04-06 WO PCT/FR1990/000245 patent/WO1990012411A1/fr not_active Ceased
  • 1990-04-06 EP EP90907118A patent/EP0422190B1/de not_active Expired - Lifetime
  • 1990-04-06 DE DE69010132T patent/DE69010132T2/de not_active Expired - Fee Related
  • 1990-04-06 ES ES90907118T patent/ES2058913T3/es not_active Expired - Lifetime
  • 1990-04-06 AU AU55378/90A patent/AU633914B2/en not_active Ceased
  • 1990-04-06 JP JP2506623A patent/JP3023801B2/ja not_active Expired - Lifetime
  • 1990-04-06 AT AT90907118T patent/ATE107797T1/de not_active IP Right Cessation
  • 1990-04-06 US US07/613,640 patent/US5233341A/en not_active Expired - Fee Related
  • 1990-04-06 DK DK90907118.5T patent/DK0422190T3/da active

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events