High-Reliability Vehicle Control System

The present invention relates to a vehicle control system comprising at least one contive center and a plurality of track-bound vehicles with on-board control equipment which exchanges data telegrams with a computer system located at the contive center.

U.s. Pat. No. 4,015,804, whose disclosure is incorporated herein by reference, having a Claim for Priority based on German Patent Application No. 2,423,490, filed May 15, 1974, discloses a hierarchically organized, demand-controlled vehicle control system wherein the individual vehicles are controlled from, and safety responsibility lies with, so-called command and control centers, while a higher-level operation control center takes care of demand control and of the station equipment.

The operational reliability of such a system is dependent primarily on the reliability of the on-board control equipment. This equipment has so far been built with fail-safe circuits which are developed specifically for conventional continuous (long-have) automatic train control systems. Such fail-safe circuits require that the on-board control equipment made redundant by providing duplicate functional units, with each of the duplicated units performing only a relatively few functions.

The demand-controlled vehicle control system of the above-cited U.S. Patent uses unmanned vehicle units which are smaller and run at much shorter headways (distance between adjacent vehicle units) than those employed in the conventional continuous automatic train control system. Since the data transmission time available to the individual vehicle is much shorter, the on-board control equipment must, on its own responsibility, perform many functions previously implemented in the control center of the conventional continuous automatic train control systems, as well as additional tasks resulting from the demand control and the receipt of passenger requests. If of conventional design, such on-board control equipment would be much too expensive to implement an economically efficient demand-control, short-distance traffic system, the more so since the number of vehicles and, consequently, the number of on-board control units required, related to the number of passengers transported, is much greater than in the conventional continuous automatic train control system.

Another problem, which is caused by the absence of staff on the vehicles, is the risk of controlled track sections being blocked in the event of a failure of on-board equipment. The only solution to this is the additional provision of automatically connectable standby equipment or, if the existing on-board control equipment consists of two identical units, the provision of at least a third such unit which can be automatically put into operation in the event of a failure. This further increases the cost of the on-board control equipment and, thus, of the whole vehicle control system and requires a considerable amount of on-board circuitry whose performance, like that of the standby circuits, cannot be checked before it is put into operation in the event of a malfunction, which results in a relatively high probability of section blockings.

The object of the invention is to provide a safe and extremely reliable vehicle control system which is much more efficient and lower in cost than conventional vehicle control systems and, therefore, is especially suited for a demand-controlled traffic system comprising many unmanned vehicle units.

A feature of the present invention is the provision of a vehicle control system comprising: at least one control center having a first computer system capable of generating first control data telegrams and responding to second control data telegrams; and a plurality of track-bound vehicles each having on-board control equipment in two-way communication with the first computer system to receive the first telegrams and to transmit the second telegrams; the equipment including first means to receive the first telegrams, second means to transmit the second telegrams, on-board units to be controlled, third means to determined the speed and position of an associated one of the vehicles, two identical computer systems each coupled to the first, second and third means and the units, the two computer systems receiving the first telegrams, status reports from the units and speed and position information from the third means to generate the second telegrams and to control the units in response to the first telegrams, and switching logic coupled to each of the two computer systems, the units and the second means responsive to a first output signal of one of the two computer systems selected by the first telegrams for control of the units and for delivery of the second telegrams to couple the second telegrams from the selected one of the two computer systems to the second means for transmission, to couple a second output signal of the selected one of the two computer systems to the units for control thereof, and to enable the first computer system to check the operation of each of the two computer systems by means of information contained in the second telegram.

Thus, each vehicle carries two inherently safe on-board computer systems which are identical, i.e. can perform all essential control functions independently of each other, and which are continuously monitored by the computer system located at the center, regardless of whether or not an on-board computer system has been selected for the delivery of data telegrams and control commands to the on-board units. In addition, in the event of a malfunction, it is possible to switch from one on-board computer system to the other while the vehicle is moving, so a failure of the computer system in charge of data telegram delivery and vehicle control will no longer result in the vehicle being brought to a stop and will hardly be perceived by the passengers. Since the computer system at the center is apprised of each malfunction, it can also cause the vehicle to be sent to the maintenance shop, thereby keeping the risk of a failure of both on-board computer systems, which would result in section blocking, very small.

A development of the vehicle control system according to the invention is characterized in that, as a sign of its perfect condition, each on-board computer system delivers like signals at regular intervals, that the presence of such live signals from both on-board computer systems is communicated to the computer system at the center within the data telegrams, which receives the live signal from the on-board computer system selected for data telegram delivery, and that the on-board computer system not selected for data telegram delivery delivers its live signals to the on-board computer system selected for data telegram delivery.

Thus, there is a safe and simple way for the computer system at the center of continuously checking whether the two on-board computer systems are functioning correctly.

Another development of the vehicle control system according to the invention relates to the system's operation in the selection of the individual on-board computer systems and is characterized in that the selection of an on-board computer system is effected by the computer system at the center by means of a special bit in each data telegram intended for the respective vehicle, that this bit enables the selected on-board computer system to also deliver its live signal to the switching logic, and that the switching logic switches through that on-board computer system for data telegram delivery and for control of the on-board units which is delivering live signals to the switching logic.

A further development of the vehicle control system according to the invention is characterized in that each vehicle carries an emergency brake circuit which receives the live signals of the on-board computer system selected for data telegram delivery and for control of the on-board units, that if the live signals fail to appear, the emergency brake is activated and not released again until the live signals of the other on-board computer system are received after switchover to this other system, that a failure of one on-board computer system or of an important on-board unit controlled by this on-board computer system as well as disagreement determined at least twice in a row between the results computed by the computers of an on-board computer system results in discontinuance of the delivery of live signals from the respective on-board computer system, and that the computer system at the center, if necessary, then causes the other on-board computer system to be switched through, and sends a trouble message to a higher-level operation control center which directs the vehicle to the maintenance shop at the end of its scheduled service. This ensures that a vehicle can continue its movement only if at least one on-board computer system and all important on-board units are functioning properly, and that a vehicle is withdrawn from service as soon as possible if a malfunction is detected, even if this malfunction occurs in a portion of the equipment which is not in use at that time.

Another development of the vehicle control system according to the invention is characterized in that for checking the switching logic, the computer system located at the center, switches the data telegram delivery and the on-board units at regular intervals to the other on-board computer system and subsequently the switching logic, too, is checked at regular intervals for correct operation, so that any failure of this logic will be noticed before a switchover has to be performed because one of the on-board computer systems is defective.

Above-mentioned and other features and objects of this invention will become more apparent by reference to the following description taken in conjunction with the accompanying drawing, in which, the single FIGURE is a block diagram of the vehicle on-board equipment and control center of the vehicle control system in accordance with the principles of the present invention.

The Figure shows on-board vehicle equipment including the computer systems RS1 and RS2 each including two computers, such as an ITT 1650-65 stored-program digital computer, and a comparator as disclosed in the above-identified U.S. patent.Each of the computer systems RS1 and RS2 is permanently coupled to an associated one of the receiving equipment E1 and E2 for receiving data telegrams from a control center CC, position-determining and speed-measuring equipment OG1 and OG2, and transmitting equipment TS1 and TS2 for transmitting data telegrams to the control center CC, the control center CC being implemented as disclosed in the above-cited U.S. patent. Electromechanical switches S1 to S4, such as relays, are controlled from a switching logic UL and switch the data telegram delivery and the on-board units to one or the other of the on-board computer systems RS1 and RS2. The switch S1 switches the reporting path, and the switch S2 the command path, to the on-board units FA between the on-board computer systems RS1 and RS2. The switch S3 connects the data telegram outputs of the on-board computer systems RS1 and RS2 to the associated transmitting equipment or disconnects these outputs from this equipment, and the switch S4 switches the trouble reporting path between the two on-board computer systems RS1 and RS2.

In operation, a computer system located at control center CC cyclically transmits to all vehicles data telegrams which are received by both on-board computer systems RS1 and RS2 via the receiving equipment E1 and E2 associated with them. The on-board computer systems RS1 and RS2 also receive status reports from the position-determining and speed-measuring equipment OG1 and OG2 associated with them. The on-board computer system switched through for data telegram delivery and vehicle control additionally receives status reports from the switchable on-board units FA. Both on-board computer systems RS1 and RS2 generate control commands from the data telegrams, received from control center CC by receiving equipment E1 and E2 and the selected on-board computer system switched through to the command path via the switch S2 delivers these control commands to the on-board units FA. From the status reports provided by on-board units FA and equipments OG1 and OG2, the selected on-boardcomputer system RS1 and RS2 compiles data telegrams for the center CC which are delivered to the transmitting equipment TS1 and TS2 associated with it via switch S3 for transmission to control center CC.

All operations of an on-board computer system are performed in both computers independently of each other. At the end of each arithmetic operation, the results are exchanged and compared in the two computers. If the results agree and both the received data telegrams and the status reports are acceptable, the on-board computer system RS1 and RS2 generates a live signal, e.g. a sequence of pulses, which is continued until an error occurs. The presence of such live signals in both on-board computer systems is communicated to the center CC. To this end, special bits are provided in the data telegrams delivered by one of the two on-board computer systems to the centre, and there is provided a data line which is switchable with the switch S4 and over which the two on-board computer systems can deliver their live signals to each other.

The selection of an on-board computer system for data telegram delivery and the control of the on-board units are effected by means of a selection bit in all data telegrams from the center CC which are addressed to the respective vehicle. The selection bit enables an on-board computer system to deliver its live signal to the switching logic UL, too. The switching logic UL then switches the switches S1 to S4 so that the on-board computer system RS1 or RS2 delivering its live signal to the switching logic UL is switched through for data telegram delivery and for the control of the on-board units FA.

The fact that switchover has taken place is communicated to the center CC by means of a special bit within the transmitted data telegrams which informs the center CC which on-board computer system has delivered the respective data telegram. If no switchover has taken place, a movement to the maintenance shop is initiated.

Among the on-board units FA receiving control commands from the on-board computer systems is an emergency brake circuit, which is not shown in the Figure. This circuit holds off the emergency brake as long as it receives a live signal from the selected on-board computer system. If a failure occurs in the on-board computer system switched through to the on-board units, this system discontinues the delivery of life signals, and the emergency brake circuit activates the emergency brake. As soon as switchover to the other on-board computer system has taken place and the emergency brake circuit receives the live signals of that other computer system, the emergency brake is released, and a fault message is sent to the center CC with the next data telegram. The center CC, in turn, informs a higher-level operation control center which directs the vehicle to the maintenance shop at the end of a running command which the vehicle has started to execute.

It is also possible, however, that a malfunction occurs in that on-board computer system not presently switched through for data telegram delivery and for vehicle control. In this case, the emergency brake will not be activated. However, the on-board computer system concerned stops the delivery of life signals, which is noticed by the other on-board computer system and, as in the above case, triggers an error message to the center CC.

Malfunctions resulting in controlled track section blocking can occur only at the common on-board units, mainly in the propulsion and brake systems of the vehicles, and in rare cases when both on-board computer systems fail simultaneously or in rapid succession.

While we have described above the principles of our invention in connection with specific apparatus it is to be clearly understood that this description is made only by way of example and not as a limitation to the scope of our invention as set forth in the objects thereof and in the accompanying claims.