CONTROL SYSTEM FOR A TRANSPORT NETWORK AND METHOD FOR PREPARING AND / OR ADJUSTING SUCH A CONTROL SYSTEM

Description

[0001] The invention relates to a control system for a traffic network, a method for preparing / adapting such a control system and the use of the control system and / or method. Background of the invention:

[0002] Control systems for transport networks are used, among other things, to set routes and control signaling. For this purpose, customer specifications for the control system are converted manually or using generators into code, which is then executed during operation. If the customer specification changes or a new customer is acquired, new code must be created. This code must first be validated and verified, which is extremely time-consuming. Such a system is known, for example, from EP 1 490 253 B1.

[0003] A control system for a traffic network, i.e., a traffic control system, controls the field elements of the traffic infrastructure, for example, setting switches, etc., and ensuring safe traffic, e.g., flank protection. Traffic control is carried out at a high safety level, preferably SIL-4.

[0004] EP3213974A1 discloses a method for validating and verifying authorizations.

[0005] EP 1 490 253 B1 discloses a method for generating logical control units for station facilities. The control and monitoring logic used to control and monitor various elements, such as signals, switches, track circuits, and the like, is generated automatically and redundantly. For this purpose, a database for the system configuration and a database for a state machine are generated. The database for the system configuration contains station-specific data or applications. Starting from the same station plan and the same state table, two logical control units are generated in parallel using two generation programs that are as different as possible. These logical control units are based on two diversified binary files with Boolean variables.

[0006] The use of a knowledge base for conflict resolution in traffic management systems for controlling rail vehicles is known from the state of the art, e.g., the ARAMIS system from Thales. The knowledge base is continuously updated during operation by evaluating solutions to conflicts already resolved during operation that are deemed to be good, and storing this evaluation in the knowledge base to better resolve future conflicts. A traffic management system handles strategic traffic planning at the timetable level. Heuristic methods can be used for this, as traffic management operates at the SIL 0 level. It has no direct access to the field elements of the traffic infrastructure, such as tracks, switches, etc. The traffic management system uses the control system to fulfill its tasks.Since such traffic management systems operate at SIL-0, their operating principles are not suitable for control systems. Therefore, such systems are not suitable as control systems. Object of the invention:

[0007] The object of the invention is to improve the safety and efficiency of a control system for a traffic network in such a way that frequent validation and verification due to changes in customer specifications can be dispensed with and a very high safety level, e.g., preferably SIL-4, can be achieved.

[0008] This object is achieved by a control system according to claim 1, by a method according to claim 11 and by a use according to claim 15. The dependent claims relate to advantageous developments of the invention. Description of the invention

[0009] The control system according to the invention for a transport network has an output interface that is configured to output outputs to the transport network during an operating phase, wherein the outputs can change states of elements of the transport network. The control system further has an input interface that is configured to receive inputs from the transport network during the operating phase, wherein the inputs relate to states of elements of the transport network. During the operating phase, inputs and outputs are processed by the system. Elements of a rail-based transport network, e.g. a train system, are, for example, field elements such as a signal, a track, a switch, a level crossing, an overhead line, an intersection or a train. So-called zones, for example for construction sites or shunting operations, are also elements of a train system.

[0010] The control system according to the invention comprises a knowledge base that was generated from a rule base during a preparation phase of the control system outside the operational phase of the control system. The knowledge base is mapped in the form of rules, whereby the rules comprise conditions that query flags and properties of the above-described elements (entities) of the rail-based transport network, as well as actions that can be executed on these elements. The data stored in the knowledge base therefore has a data structure that includes the triplet of flag, property, and action. Thus, the rules, which can be in text form, for example, are mapped to the above storage structures consisting of flags, properties, and elements of the transport network. This form allows a computer to process the rules simply and efficiently.

[0011] A property represents general data, e.g., with an integer or float as the data type. For a signal, a property is, for example, the signal color (aspect), e.g., "red," "yellow," "green." A property for a switch is, for example, the position: "left position," "right position." A bit switch represents binary information. For a switch, a bit switch represents the locking state "yes," "no." For a track, a bit switch represents the occupancy: "yes," "no." An action is an executable command. For a switch, an action is, for example, the movement "turn around." An action for a signal is, for example, "show aspect," e.g., show signal aspect "green."

[0012] A knowledge base is a database of structured, machine-interpretable knowledge. The knowledge stored in the knowledge base includes rules, sequences of rules (so-called flows), and unconditional actions—this corresponds to a rule without conditions. These are also called "degenerate" rules. Such actions are always executed.

[0013] In one embodiment of the invention, the knowledge base is structured according to an ontology. An ontology is a formally ordered representation of a set of concepts and the relationships between them. The ontology is based on data models. This allows knowledge about the transport system to be stored and used in a digitalized and formal form. The ontology contains inference and integrity rules, i.e., rules for drawing conclusions and ensuring their validity. The ontology thus represents knowledge as a network of information with logical relations and can therefore represent complex data models.

[0014] Queries can be another component of the data model. These allow the creation of loops, e.g., "foreach <element>do", as well as aggregations, e.g. "all <elements>are", which can be used within conditions. Aggregations are special queries that are used in the conditions queried by the rules to query conditions for a set of elements.

[0015] During the operating phase, the knowledge base is preferably rigid, i.e., it does not change. "Rigid knowledge base" means that the knowledge base is created or modified exclusively outside the operating phase, preferably during the preparation phase before an operating phase or between different operating phases. "Outside the operating phase" means that the operating phase and the preparation phase do not overlap in time, i.e., they are temporally disjoint. During the operating phase, the knowledge base according to the invention is not changed. This makes it possible to deterministically predict the behavior of the control system and easily meet safety requirements for a safe system (SIL 4). The control system is therefore preferably a control system for a safety-critical (i.e., critical with regard to accident prevention) system, e.g., a train control system or a train protection system.A train control system is responsible for current traffic control, and a train protection system ensures that trains are protected, especially against collisions. This can be achieved, for example, by flank protection.

[0016] If the customer specification changes or a new customer is acquired, the knowledge base can be modified accordingly during the preparation phase. This does not change the operational phase, meaning no new code needs to be generated, validated, and verified.

[0017] According to the invention, the knowledge base is a knowledge base generated from a rule base during the preparation phase. The control system is a rule-based system with a rule base from which the knowledge base is generated. The rule base is a formalized description of rules, e.g., in XML, and represents the customer specification.

[0018] In one embodiment, the control system comprises a state database. The state database contains possible, in particular all, states (properties) of the elements of the transport network.

[0019] In one embodiment, the elements of the transport network are assigned to one or more different domains. A domain is a problem area or an application area within the transport network; for example, a train system includes the domains: route control, signaling, and indications, e.g., for users such as operators or customers. The state database is preferably the same for all domains, i.e., it includes states of all elements of all domains.

[0020] In one embodiment, the control system has a condition evaluator configured to evaluate the conditions for one or more, preferably all, domains of the traffic network. The condition evaluator checks whether the conditions stored in the rules, which are formulated in so-called expressions, apply. Expressions are logical expressions that can be evaluated as "true" or "false," i.e., "applicable" or "not applicable." The current states and the properties of the elements of the traffic system are used for this purpose. This evaluation of the conditions takes place during the operating phase of the control system.

[0021] The condition evaluation unit is generic for all domains. States of elements of the traffic system are received, e.g., via a central unit (governor - see below), and evaluated against given conditions, e.g., within a flow. Depending on the evaluation result, the condition evaluation unit triggers actions (e.g., within the flow) that are issued as commands to the traffic network via the central unit and can result in changes in the state of the elements of the traffic network. The condition evaluation unit reports back to the central unit whether the flow execution was successful.

[0022] The conditions are integrated into the knowledge base. They were created during the preparation phase of the control system and are fixed during the operational phase. This means that the expressions evaluated in the condition evaluation component do not change during the operational phase. The only variable is the current states of the traffic system elements, which are received via the control system's input interface. The result of the evaluation of the expressions thus changes depending on the current states of the traffic system.

[0023] The knowledge base is created in a preparation phase that lies outside, preferably before, the operating phase of the control system. Outside the preparation phase means that the operating phase and the preparation phase do not overlap in time, i.e. they are temporally disjoint. The preparation phase serves to prepare for the operating phase. It can lie before an initial operating phase or between two operating phases of the control system. If the central unit encounters an error during the preparation phase while creating the knowledge base, e.g. an unknown element, the creation process is aborted and the error in the rule base from which the knowledge base is to be created is pointed out. This means that the correctness and therefore the consistency of the system can be ensured as early as the preparation phase. This is particularly relevant for safety-critical systems, e.g. SIL-4 systems.The selected data structure is also defined and limited in advance so that the security aspect can be even better guaranteed.

[0024] In one embodiment, the control system according to the invention comprises at least one central unit. The at least one central unit is configured to receive the inputs of the traffic network via the input interface and to output the outputs to the traffic network via the output interface. The at least one central unit is further configured, upon receipt of an input, to forward the received state of an element of the traffic network for processing. Preferably, the received state of the element of the traffic network is forwarded to the condition evaluation component for processing. The forwarding can occur, for example, via the knowledge base.

[0025] A central unit can contain both generic and domain-specific units. Generic units can be used equally for all domains. Domain-specific units are specific to each domain. Alternatively, a separate central unit specialized for the respective domain can be used for each domain of the traffic system.

[0026] At least one central unit is configured to generate the knowledge base before commissioning the control system. One knowledge base can be generated for each central unit, relating to the respective domain of the central unit. In the case of a central unit that has generic and domain-specific elements, the central unit generates a domain-specific knowledge base for each domain. The status database is the same across all domains and for all knowledge bases and central units. All central units require the factual information from the status database, e.g., possible positions of a switch, as a basis.

[0027] The commissioning point refers to the start of the operational phase after the preparation phase. Generating the knowledge base during the preparation phase provides a well-defined system that is known in advance and does not change during the operational phase. A well-defined system, for example, contains no contradictory conditions and / or no conditions that are always "true" or always "false." Generating the knowledge base during the preparation phase and making a well-defined system available enables advance testing and ensures a high level of safety. For example, it is possible to simulate operating states of the system with the system ready for operation at that time, e.g., using simulators that simulate the current states of switches, signals, etc.This allows verification that all requirements have been implemented correctly and that nothing has been overlooked. This allows undesirable system behavior to be corrected very quickly.

[0028] In one embodiment of the invention, the control system comprises a system registry database with executable files corresponding to the actions contained in the at least one knowledge base.

[0029] Preferably, the control system is a train control system for a train system and is located in a signal box. It is also applicable to systems where, for example, traffic flows must be controlled according to specific rules, such as traffic control for cars or aircraft.

[0030] The at least one central unit and other units mentioned above or below (e.g., the condition evaluation unit, knowledge base, rule base, etc.) are preferably designed as software components that run on a common hardware, e.g., a control computer, or on different hardware units.

[0031] By structuring the system into different software components, it can be quickly adapted to other circumstances, e.g., other railway systems or other operators, and individual software components can be reused.

[0032] The invention also relates to a method for preparing and / or adapting a control system. In the method according to the invention, a knowledge base is generated from a rule base during a preparation phase of the control system outside of an operating phase of the control system. The preparation phase serves to prepare for the operating phase and therefore preferably occurs before the operating phase of the control system. The period for creating the at least one knowledge base therefore does not overlap with the operating phase. This means that the at least one knowledge base is fixed and does not change during the operating phase.

[0033] With the method according to the invention, a control system can be adapted to any customer specifications by simply building / modifying the knowledge base according to the customer-specific rules. All other components of the control system can continue to be used unchanged without any security risks. Revalidation and verification are not necessary. The method according to the invention enables simple and secure individual configuration of the security system.

[0034] Preferably, at least one knowledge base is generated from a rule base during the preparation phase.

[0035] If the central unit encounters an error during the preparation phase of creating the knowledge base, such as an unknown element, the creation process is aborted and the error is pointed out in the rule base from which the knowledge base is to be created. This ensures that the system is well-defined even during the preparation phase. This is particularly relevant for safety-critical systems, such as SIL-4 systems. Furthermore, the selected data structure is predefined and limited, thus further ensuring safety.

[0036] Preferably, at least one knowledge base is checked for consistency and completeness during the preparation phase. This check is performed using a state database. The state database contains the possible states of the elements of the transport network.

[0037] In particular, it checks whether the states defined by properties and bit switches from the knowledge base are stored in the state database, and whether the actions from the knowledge base, as well as any queries, are stored in the system register database. During the preparation phase, it is checked whether all actions, properties, bit switches, and any queries present in the knowledge base are available in the respective databases. This step ensures that all states for which rules are stored in the knowledge base are defined in advance.

[0038] In addition, the preparation phase checks whether the data stored in the knowledge base has a data structure that preferably only includes the triple bit switch, property and action or the quadruple bit switch, property, action and query.

[0039] In one variant of the process, the condition evaluation component evaluates the conditions for one or more, preferably all, domains of the transport network. The condition evaluation component is activated during the execution of a knowledge base flow and reacts to inputs from the transport network that affect the states of elements of the transport network.

[0040] The control system and / or the method described above are advantageously used in a safety-critical system with safety level SIL4.

[0041] Further advantages of the invention emerge from the claims, the description, and the figures. Likewise, the features mentioned above and those further described can be used individually or in combination, in any desired manner. The embodiments shown and described are not to be understood as an exhaustive list, but rather as examples for describing the invention.

[0042] They show schematically: Fig. 1 shows an inventive control system for a traffic network; Fig. 2 shows elements of a knowledge base of a control system according to the invention.

[0043] Fig. 1 shows a schematic control system 10 for a transport network 50. Via an input interface 28 The control system 10 receives inputs from the traffic network 50. The inputs concern states of elements of the traffic network 50, in particular the change of states. Via an output interface 26 The control system 10 outputs outputs to the traffic network 50. The outputs are suitable for changing states of elements of the traffic network.

[0044] A central unit 12 receives the inputs of the traffic network 50 via the input interface 28. The central unit 12 outputs the outputs to the traffic network 50 via the output interface 26. The control system 10 can also have multiple central units 12 (not shown). For example, different central units 12 can be provided for different domains. However, it is also possible to cover multiple domains in one central unit 12. In this case, the central unit 12 has generic units (the same for all domains) and specific units (specific to one domain).

[0045] The central unit 12 is the central instance of the control system 10. In a preparation phase, it loads rules from a rule base 18 and generates a knowledge base 16. The rules define the conditions under which actions Ac ( Fig. 2 ) that refer to the rules are executed. Actions Ac are executable files that are stored in a system registry database 24 are stored.

[0046] In the preparation phase, the knowledge base 16 can be updated via the input interface 28. During the preparation phase, the central unit 12 also ensures that the actions Ac stored in the system register database 24 match the rules of the rule base 18 and the context of the control system 10. The system register database 24 also contains queries Qu stored. Queries Qu are queries to the knowledge base 16 that the central unit 12 can execute. For example, a query Qu can be executed on the topology of the traffic network 50. This allows, for example, static information to be requested in order to determine a start signal for a route.

[0047] Actions Ac are executed in an operating phase following the preparation phase when the associated rule "fires," ie, the associated condition is evaluated to "true." In the operating phase, the central unit 12 triggers a condition evaluation component 14 when it receives notification of a change in a state in the traffic network 50 via the input interface 28. The condition evaluation component 14 evaluates the state change. If a condition associated with a rule evaluates to "true," the rule fires, and the associated action Ac or actions Ac are executed.

[0048] For example: Rule when Condition1 then Action1 when Condition2 then Action2, Action3 otherwise ActionN End Rule

[0049] A rule describes a condition under which an action Ac is executed, as a Boolean expression with comparison operations for the properties. The Boolean expressions refer to the states and properties of the traffic network 50. During the preparation phase and before the creation of the knowledge base 16, the rules in the rule base 18 are checked for consistency to ensure that the rules are actually needed in the system and to optimize them for efficient processing. This consistency check is preferably performed by separate software that performs this check automatically.

[0050] The system register database 24 ensures that the relationships between the rules and the actions Ac and, if applicable, requests Qu are defined, that the actions Ac and, if applicable, requests Qu are unique, and that the central unit 12 has access to the actions Ac and, if applicable, requests Qu.

[0051] The condition evaluation component 14 stores the rules in an optimized form, ensures that all states checked by the rules are stored in a state database 22 are present and optimizes the evaluation of the conditions of a rule. The state database 22 stores all possible states of all elements of the traffic network.

[0052] State changes in the transport network 50 can be caused, for example, by participants in the transport network 50, i.e., elements such as trains. Examples include a section of track being occupied or left by a train, or a train hitting a switch. State changes in the transport network 50 can also be caused, for example, by field elements (elements in the field). Examples include a switch losing monitoring, i.e., being defective in some way, or a signal being set. State changes in the transport network 50 can also be caused, for example, by commands from an operator. Examples include an emergency stop, i.e., a signal being set hard to "red." This state change of the signal in the transport network 50 triggers an event, which in turn leads to a reaction from the control system 10. State changes in the transport network 50 can also be commands from the control system 10 itself. Examples include setting a route, which mayleads to the switching of a switch. This switching of the switch, in turn, triggers events that are monitored by the control system 10.

[0053] In summary, the control system 10 communicates with the traffic network 50 by the central unit 12 in the knowledge base Flows F, F.1 ( Fig. 2 ). Within flows F, F.1, rules are evaluated and the execution of actions Ac is triggered. The actions Ac, in turn, trigger commands to the traffic network 50.

[0054] The central unit 12 receives feedback from the flow F, F.1 whether its execution was successful. A flow F, F.1 is successful if all conditions could be successfully evaluated and all rules that fired (condition is "true") could be executed and all actions Ac could be executed as part of the rules.

[0055] The central unit 12 receives a negative response if, e.g. a condition was queried by an element of the traffic network 50 which, for example, does not know the bit switches / states queried in the condition, e.g. an action Ac could not be successfully processed by an element of the traffic network 50.

[0056] Such a negative response may trigger a safety response: for example, everything becomes "red," and all traffic in network 50 stops. This detects such an inconsistent state, and the system transitions to the safe state.

[0057] The control system 10 also has a user interface (not shown) through which a person, e.g., an operator, can communicate with the control system 10. A route, for example, can be set via the user interface. A display on, e.g., a screen of the user interface is the result of so-called indication rules. The display depends on the state of the traffic network 50; e.g., a switch is "left" is calculated using rules and thus displayed on the display. For more complex displays, e.g., for routes that have the "monitored" status, the result of the rules is passed to the display via actions Ac. A command from the operator is forwarded to the control system 10 via an event. This event is evaluated by the central unit 12.

[0058] The central unit 12 may include a parser, e.g., an XML parser (not shown), as well as a flow specifications loader (not shown), both of which are generic for all domains. The parser and the flow specifications loader are software components within the central unit 12. The central unit 12 uses the parser to read the rules when creating the knowledge base 16. The central unit 12 also uses the flow specifications loader to retrieve the actions Ac and queries Qu from a system registry database when creating the flows F, F.1 of the knowledge base 16. 20 to load.

[0059] In Fig. 2 Elements of the knowledge base 16 are shown schematically. A flow F is a rule or a sequence of rules with associated actions Ac. A flow F can execute the following elements: Activity Rule Attorney, Activity Action AcA, Activity Assignment AssA and activity request QuA. The Rule RA activity contains Boolean expressions including comparison operations for properties that are evaluated in the condition evaluation component 14. The condition evaluation component 14 accesses the state database 22 and receives information about state changes from the central unit 12. If a rule evaluates to "true" during the Rule RA activity, one of the following activities is executed: Action AcA activity, Assignment AssA activity, and Query QuA activity. During the Action AcA activity, at least one Action Ac is executed. During the Query QuA activity, at least one Query Qu is executed. Queries Qu are queries to the knowledge base 16 that the central unit 12 can execute. During the Assignment AssA activity, a new value is assigned to a piece of data in the knowledge base. A piece of data not included in Fig. 2 The activity shown can be a query that queries the conditions for a set of elements (aggregation).

[0060] Flows F.1 are structured like flows F, i.e., rules, sequences of rules, or simply actions Ac that are executed unconditionally. Flows F.1 are triggered by the condition evaluation component 14. List of reference symbols

[0061] 10Control system 12Central unit 14Condition evaluation component 16Knowledge base 18Rule base 20System register database 22State database 24Register database 26Output interface 28Input interface 50Traffic network AcAction QuRequest FFlow F.1further flow RAActivity Rule AcAActivity Action AssAActivity Assignment QuAActivity Request< / elements> < / element>

Claims

1. Control system (10) for a traffic network (50), comprising an output interface (26), which is configured to issue outputs to the traffic network (50) during an operating phase, wherein the outputs can change states of elements of the traffic network (50), further comprising an input interface (28), which is configured to receive inputs (28) from the traffic network (50) during the operating phase, wherein the inputs relate to states of elements of the traffic network (50), characterized in that the control system (10) comprises a knowledge base (16), which was generated from a rule base (18) during a preparatory phase when not in the operating phase and wherein the data stored in the knowledge base (16) have a data structure comprising a triple of bit switch, characteristic and action.

2. Control system according to claim 1, characterized in that the knowledge base (16) is fixed during the operating phase.

3. Control system according to one of the preceding claims, characterized in that the control system (10) comprises at least one state database (22), which comprises possible states of the elements of the traffic network (50).

4. Control system according to claim 3, characterized in that the elements of the traffic network (50) are assigned to one or more different domains, wherein a domain represents a problem field or an application field within the traffic network (50).

5. Control system according to claim 4, characterized in that it comprises a condition evaluation component (14), which is configured to evaluate conditions for one or more, preferably all, domains of the traffic network (50).

6. Control system according to one of the preceding claims, characterized in that it comprises at least one central unit (12), which is configured to obtain the inputs of the traffic network via the input interface (28) and issue the outputs to the traffic network via the output interface (26), wherein after receipt of an input from the traffic network (50) the at least one central unit (12) is furthermore configured to transfer the input to the knowledge base (16).

7. Control system according to claim 6 and 4, characterized in that a central unit (12) is provided for each domain.

8. Control system according to claim 6 or 7 in conjunction with claim 3, characterized in that the at least one central unit (12) is configured to generate the state database (22) prior to start-up of the control system (10).

9. Control system according to one of the preceding claims, characterized in that the control system (10) comprises a system register database (20) with executable files corresponding to the actions (Ac) contained in the knowledge base (16).

10. Control system according to one of the preceding claims, characterized in that the control system is a train control system and is arranged in particular in an interlocking.

11. Method for preparing and / or adjusting a control system (10) according to one of the preceding claims, characterized in that the knowledge base (16) is generated from a rule base (18) during the preparational phase of the control system (10) when not in the operating phase of the control system (10).

12. Method according to claim 11 in conjunction with the control system according to claim 3, characterized by the step that the knowledge base (16) is checked for consistency and completeness during the preparational phase, wherein the examination is performed by using the state database (22), wherein the state database (22) comprises possible states of the elements of the traffic network (50).

13. Method according to claim 12 in conjunction with the control system according to claim 5, characterized in that the condition evaluation component (14) evaluates the conditions for one or more, preferably all, domains of the traffic network (50).

14. Method according to one of the claims 11 to 13 for a safety-critical system with at least safety level SIL 4.

15. The use of a control system according to one of the claims 1 to 10 in a safety-critical system with at least safety level SIL 4.