1. A failure detection system comprising: a plurality of signaling systems each indicating a stop signal to a vehicle; and a plurality of control devices associated with each of the plurality of signaling systems and controlling each of the plurality of signaling systems, wherein: each of the plurality of control devices transmits vehicle control data to an associated trackside antenna beacon; the failure detection system checks consistency of a plurality of pieces of the vehicle control data of a plurality of the control devices each transmitting the vehicle control data on the basis of the same stop position information; and the failure detection system detects abnormality of the control device on the basis of a result of the check.

2. The failure detection system according to claim 1, wherein the control device checks consistency of the vehicle control data of the control device itself and the vehicle control data of the other control devices; and if abnormality of the control device itself is detected, the check result is outputted to an outside.

3. The failure detection system according to claim 2, wherein a plurality of the check results by the plurality of control devices are obtained; and abnormality of the control device is detected on the basis of the plurality of check results.

4. The failure detection system according to claim 1 or claim 3, wherein a plurality of control devices each transmitting the vehicle control data on the basis of the same stop position information are four control devices arranged continuously on a track.

5. A failure detection device comprising: a first control device for controlling a signaling system indicating a stop signal of a vehicle; one or more second control devices adjacent to the first control device and controlling the signaling systems in the rear of the vehicle in an advance direction; and a plurality of trackside antenna beacons, wherein: vehicle control data transmitted by the first control device and the second control device to the trackside antenna beacons is obtained by the respective control devices; the vehicle control data transmitted by the control device itself and the vehicle control data obtained from the other control devices are compared by the respective control devices; if a comparison result has the same value, it is determined that the first control device and the second control device are normal; and -10- if the control device not having the same value is present, the control device is determined to be failed.

6. The failure detection device according to claim 5, wherein the vehicle control data is position information of a stop point.

7. The failure detection device according to claim 6, wherein the failure detection device has one or more maintenance terminals for monitoring a state of the first control device and the second control device; and the maintenance terminal obtains failure information including the determination result from the first control device or the second control device.

8. The failure detection device according to claim 7, wherein the failure detection device further includes a vehicle operation monitoring device for monitoring an operation of a vehicle and obtains the failure information from the maintenance terminal.

9. The failure detection device according to claim 6, wherein: the failure detection device has one or more maintenance terminals for monitoring states of the first control device and the second control device; the maintenance terminal obtains vehicle control data transmitted by the first control device and the second control device to the trackside antenna beacon; and the maintenance terminal compares the obtained vehicle control data and determines whether the first control device and the second control device are normal or failed.

10. A failure detection method of a failure detection device, wherein the failure detection device has: a first control device for controlling a signaling system indicating a stop signal of a vehicle; one or more second control devices adjacent to the rear of the first control device and controlling the signaling systems in the rear; and a plurality of trackside antenna beacons, wherein: vehicle control data transmitted by the first control device and the second control device to the trackside antenna beacons is obtained by the respective control devices; the vehicle control data transmitted by the control device itself and the vehicle control data obtained from the other control devices are compared by the respective control devices; if a comparison result has the same value, it is determined that the first control device and the second control device are normal; and if the control device not having the same value is present, the control device is determined to be failed.

FAILURE DETECTION SYSTEM, FAILURE DETECTION DEVICE AND ITS
DETECTION METHOD
BACKGROUND OF THE INVENTION
Field of the Invention
The present invention relates to a failure detection system, a failure detection
device, and its detection method.
Description of the Related Art
Conventional technologies of a signal security device of a vehicle include
technologies described in Japanese Patent Laid-Open Publication No. 201 1-57051
and Japanese Patent Laid-Open Publication No. 2009-46035. The technology in
Japanese Patent Laid-Open Publication No. 201 1-57051 is configured such that
adjacent logical portions of digital ATC device (security control device) are connected
to each other by a dedicated LAN, a train-approach side logical portion and a
transmitter are connected in a control boundary track circuit, and a train-advance
side logical portion is connected to a receiver. Then, the train-approach side logical
portion transmits contents of a TD message transmitted to the transmitter via the
dedicated LAN to the trans-advance side logical portion, and correctness of the
contents of the TD message received from the receiver is confirmed in the trainadvance
side logical portion in this technology.
The technology in Japanese Patent Laid-Open Publication No. 2009-46035
relates to a security control device mounted on a railway vehicle and provides a
trackside antenna beacon check system for detecting abnormality of a trackside
antenna beacon for the security control device, defective installation, and abnormality
of setting data. That is, the technology provides the trackside antenna beacon
check system including: a security device mounted on a running train and executing
stop control and speed limit control of the train on the basis of the contents of a
message collected from the trackside antenna beacon during train running; and a
trackside antenna beacon data check system for comparing recorded trackside
antenna beacon data of the trackside antenna beacon sampled by a recording
function of the security device with ledger trackside antenna beacon data of the
trackside antenna beacon prepared in advance, and outputting differences of data
required for control of the security device such as an installation interval of the
trackside antenna beacons, an information type, a signaling system type, a signal
aspect code, a distance to a stop signaling system, a speed limit and the like. The
security device is a technology relating to the trackside antenna beacon check
system having an area for exclusively recording the trackside antenna beacon data
collected through running of the train on which it is mounted for trackside antenna
beacon inspection.
However, in the conventional signal security device of a vehicle, the security
control device (hereinafter referred to as a control device) does not have a function of
knowing message information outputted by the adjacent control device to the
trackside antenna beacon. Moreover, it does not have a function of determining that
a state in which states of a plurality of adjacent control devices (MA (Moving
Authority) information, for example) are not the same is a failure, either.
- 3 -
Thus, since abnormality of the control device, defective installation,
abnormality of setting data, and malfunction cannot be detected, it is likely that
problems such as an influence on the vehicle operation, stop at an unexpected
position and the like occur.
Thus, the present invention has an object to provide a failure detection device
for detecting a failurelabnormality of the control device by comparing output
information of the plurality of control devices with each other.
SUMMARY OF THE INVENTION
The failure detection device of the present invention specifies the failed control
device by comparing information transmitted by the plurality of control devices for
controlling a signaling system including the control device controlling the signaling
system indicating a stop signal to the trackside antenna beacon with each other.
In the present invention, a failurelabnormality of the control device can be
rapidly detected, and disruption of a schedule of an operated train can be
suppressed. Objects, configurations, and effects other than the above will be made
apparent from the description of an embodiment below.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is an image of a failure detection method of a control device adjacent to
an ATP system in this embodiment;
FIG. 2 is an internal configuration view of the device;
FIG. 3 is a configuration example of a first abnormality determination table;
FIG. 4 is a configuration example of a second abnormality determination table;
and
FIG. 5 is a flowchart illustrating failure determination processing.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
An embodiment will be described below by referring to the attached drawings.
In the following description, various types of information are explained in some cases
by using an expression such as a "management table" or the like, but the various
types of information may be expressed in a data structure other than the table.
Alternatively, the "management table" can be called "management information" in
order to indicate non-dependence on the data structure.
Moreover, processing is explained by using a "program" as a subject in some
cases. The program is executed by a processor such as an MP (Micro Processor)
or a CPU (Central Processing Unit), for example, and to execute determined
processing. Since the processor executes the processing by using a storage
resource (a memory, for example) and a communication interface device (a
communication port, for example) as appropriate, the subject of the processing may
be the processor. The processor may have dedicated hardware in addition to the
CPU. A computer program may be installed in each computer from a program
source. The program source may be provided by a program distribution server or a
storage media or the like, for example.
Moreover, each element such as a controller, for example, can be identified by
a number or the like, but other types of identification information such as a name may
- 4 -
be used as long as each element can be identified. In the drawings and explanation
in this embodiment, the same reference numerals are given to the same portions, but
the present invention is not limited to this embodiment and any applications matching
the idea of the present invention are included in the technical scope of the present
invention. Moreover, unless specified otherwise, each of constituent elements may
be singular or plural.
FIG. 1 is an image of a failure detection method of a control device adjacent to
an ATP system in this embodiment. In this embodiment, a method of detecting a
failure of an ATP (Auto Train Protection) device 11 in a railway signal control device
1 will be described. This ATP device 11 takes in aspect information of automatic
signaling systems 11 111 2111 311141 into control devices 112112211321142 and
transmits a message such as a section maximum speed or MA (Moving Authority)
which is stop position information from the control devices 1 1211 2211 3211 42 to
trackside antenna beacons 11 3112311331143 installed on a railway. On-board
equipment (not shown) mounted on trains 16/17 receives the message from the
trackside antenna beacons 11 3112311331143 and uses the information from the
control devices 112112211321142 for calculation of a brake pattern or the like.
The automatic signaling systems I 1111 2111 311141 between stations have
regularity that, with the signaling system 11 I (in a rear of the train 16) in an R (Res:
stop) aspect in which the train 17 is located inside as a start point, the signaling
system 121 in one-stage rear with respect to an advance direction of the train is in an
aspect of YY (Yellow-Yellow: alarm), the signaling system 131 in another one-stage
rear in an aspect of Y (Yellow: caution), and the signaling system 141 in the rear
thereof is in an aspect of G (Green: advance). The MA outputted by the four control
devices belonging to the four signaling systems has the same value (or the same
information) from the signaling system 1 I I in the R aspect in the front to the
signaling system 141 in the G aspect in the rearmost. In this embodiment,
consistency of the MA of the four control devices is checked by using this regularity,
and if any one of the control devices does not have the same value, the control
device is determined to be failed. Then, the control device determined to be failed
notifies information that the control device itself fails to an MPC (Monitoring Personal
Computer) 151 located in an apparatus room at a station, and the MPC 151 notifies it
to a TMS (Train Monitoring System) 101 located in a main central control room
(direction room) (Operations Control Center: OCC) 10. As illustrated in FIG. 1, a
plurality of the MPC 15111 5211 53 may be provided at a station 15 so as to obtain MA
at each of the MPC.
Moreover, by obtaining the MA of the four control devices by the MPC 151 at
the station 15 via a network 154 and by checking the consistency of the MA, check of
soundness of the control device and identification of the failed control device can be
also performed.
Moreover, it is possible that the plurality of MPCs obtain the MA of the four
control devices at the same time, the respective MPCs check the consistency of the
MA and the MPCs check the result with each other. In the embodiment, the number
of the control devices is four, but failure detection can be made by two, three or five
or more control devices. The same applies to the number of the MPC.
- 5 -
FIG. 2 is an internal configuration view of the device. To a device 20, a TMS
101, the control devices 1 1 2112211321122, and the MPC 15111 5211 53 are applicable.
The device 20 includes constituent elements of a CPU 21, a memory 22, a storage
portion 23, an input portion 24, an output portion 25, a display portion 26, and a
communication portion 27.
The CPU 21 is a processor for controlling the entire device 20. The memory
22 is a device for temporarily storing various programs and various types of data.
The storage portion 23 is a device for permanently storing various programs and
various types of data and is an HDD (Hard Disk Drive) and a flash memory for storing
a device start program, a device diagnosis program and the like, for example. The
input portion 24 is a device for receiving inputs and is a keyboard, an analog signal
input device, a digital signal input device and the like, for example.
The output portion 25 is a device for outputting information or data and is a
speaker, a printer, an analog signal output device, a digital signal output device, for
example. The display portion 26 is a device for displaying information and data and
is a liquid crystal display and a small-sized liquid crystal display, for example. The
communication portion 27 is a device for connecting to a user terminal, another
server and another device via a network 1811 54. The above-described constituent
elements are connected to each other by an internal bus. There can be a
configuration in which the display portion 26 indicated by a dotted line is not provided
in the device 20. Moreover, there can be a configuration in which the other
constituent elements are omitted and simplified in order to reduce manufacturing
costs of the device 20.
FIG. 3 is a configuration example of a first abnormality determination table.
The abnormality determination table 30 is a table for determining soundness of the
control device by each MA obtained between the control devices or each MA
obtained by the MPC (MPC 151, for example). Reference character "A" denotes
MA of the control device 112, reference character "B" denotes MA of the control
device 122, reference character "C" denotes MA of the control device 132, and
reference character "D" denotes MA of the control device 142. Assume that a value
of the normal MA is "I", while a value of the abnormal MA is "0".
If "A" to "D" are all "1" (No. I in the table), each of the control devices or the
MPC 151 determines that all the control devices are normal. For example, if "B" is
"0" (No. 3 in the table), each of the control devices or the MPC 151 determines that
the control device 122 is abnormal and is likely to be failed, and the information is
notified from the control device itself which detected the failure to the MPC 151 or
from the MPC 151 to the TMS 101 of the OCC 10.
FIG. 4 is a configuration example of a second abnormality determination table.
An abnormality determination table 40 is a table for determining soundness of the
control devices by each MA of each of the control devices obtained by the MPC 151,
the MPC 152, and the MPC 153. Reference characters "A" to "D" are the same as
those defined in FIG. 3, and the definitions of the normal and abnormal MA are also
the same.
If MA of the control device 112 to the control device 142 obtained by each
MPC are all "I", each MPC determines that all the control devices are normal (No. 1-
1 in the table). There can be a case in which any one of MA obtained by the MPC is
- 6 -
"0" or "B" in the MA obtained by the MPC 153 is "0" as in No. 1-2, for example. The
MPC 153 determines that the control device 122 is abnormal. However, in the MPC
151 and the MPC 152, the obtained MA are all "I", and thus, all the control devices
are determined to be normal. Thus, the MPC determines that all the control devices
are normal by the majority logic. In this case, it can be grasped that it is likely that
the MPC 153 itself fails.
Alternatively, there can be a case in which one of the MA obtained by the MPC
is "0" or "D" in the MA obtained by all the MPC is "0" as in No. 3-1, for example.
The MPC determines that the control device 132 is abnormal. Alternatively, since
"D" in the MA obtained by the MPC 151 and the MPC 152 is "0" as in No. 3-4, the
MPC 151 and the MPC 152 determine that the control device 142 is abnormal.
On the other hand, since "D" obtained by the MPC 153 is "I", the MPC 153
determines that all the control devices are normal. Thus, soundness determination
by the MPC 151 and the MPC 152 is different from the soundness determination at
the MPC 153, but as described above, it is determined that the control device 142 is
abnormal by the majority rule. Even in this case, a possibility that the MPC 153
itself which is a minority in the majority rule fails can be grasped. In this
embodiment, description is made by using the majority rule, but the majority rule
does not necessarily have to be used, and such a method may be used that reliability
is set for each MPC, and the MA of the MPC with high reliability is employed with
preference. Alternatively, in the case of a tie in the majority rule, both may be
determined to be abnormal, either one of them may be determined to be abnormal or
another determination of soundness may be further made.
If the MA obtained by all the MPC does not match each other, the soundness
of the control device and the MPC can be checked by obtaining and comparing the
MA again.
FIG. 5 is a flowchart illustrating the failure determination processing. An
entity of the processing is assumed to be the CPU 21 of the control device, but it may
be a CPU of the MPC. Moreover, this processing is executed in parallel in each of
the control devices and is processing for checking the soundness and for detecting
the abnormal control device.
At S501, the CPU 21 obtains an MA value from each of the control devices.
Subsequently, the CPU 21 determines whether the obtained MA are all matched with
each other (A=B=C=D). If all are matched (Yes), the CPU 21 obtains the MA value
again in order to execute S501. If all the MA are not matched (No), it is determined
that there is an abnormal control device, and the CPU 21 executes S502.
At S502, the CPU 21 checks the obtained MA with the abnormality
determination table 30 and identifies the abnormal control device. If "D" is "O", for
example, the CPU 21 determines that the control device 142 is abnormal from No. 5
in the abnormality determination table 30. When the MA value is checked in the
MPC 151, too, the abnormality determination table 30 is used. Moreover, if the MA
value is to be checked in two or more MPCs, the abnormality determination table 40
is used.
At S503, the CPU 21 performs abnormality notification of the information of the
identified abnormal control device (presence of the abnormal control device and its
- 7 -
state information and the like) to the TMS 101 of the OCC 10 (main central control
room (direction room)) via the MPC (the MPC 151, for example).
At S504, the CPU 21 of the abnormal control device executes self-reset for restart.
At S505, the CPU 21 of the abnormal control device transmits abnormal
journal information to the MPC 151 of the station 15 after re-start (after start is
completed). The MPC 151 displays the received abnormal journal information on
the display portion 26 and notifies it to a device manager such as a maintenance staff
and the like. Then, the MPC 151 analyzes a cause of the abnormality and transfers
the abnormal journal information which is the analysis information to the TMS 101.
The OCC 10 which received the abnormal journal information examines maintenance
response to the abnormality.
At S506, the CPU 21 determines whether all the MA obtained are matched
with each other (A=B=C=D) again. If all are matched (Yes), the CPU 21 determines
that all the control devices are in a normal state and executes S501. If all the MA
are not matched (No), the CPU 21 determines that there is an abnormal control
device and executes S507.
At S507, the CPU 21 checks the obtained MA with the abnormality
determination table 30 and identifies the abnormal control device. This operation is
the same as that at S502.
At S508, the CPU 21 determines whether the same control device becomes
abnormal twice consecutively. If it is the same control device (Yes), the CPU 21
executes S509. If it is not the same control device (No), the CPU 21 executes S503
and notifies the information of the abnormal control device identified at S507 to the
OCC 10.
At S509, the CPU 21 of the abnormal control device stops the operation of the
entire device.
As described above, by taking the control device for controlling the signaling
system in an aspect of the stop signal in the adjacent control devices as the start
point, using the MA information transmitted to the trackside antenna beacon by the
control device for controlling the signaling system in the rear from the start point, and
comparing the MA information of a plurality of the control devices to each other, the
failed control device can be identified. Thus, the failed control device can be rapidly
notified to the direction room, and arrival of the maintenance staff and replacement of
the control device can be performed quickly. As a result, disruption of the schedule
of the operated train can be suppressed.
In this embodiment, the soundness is determined by comparing the MA
information of the control device, but the soundness can be determined also by using
the state information of the control device such as diagnosis information including an
execution result of a diagnosis program, for example.
Moreover, the present invention is not limited to the above-described
embodiment but includes various variations.
The above-described embodiment explains the present invention in detail so
that it can be understood easily and the present invention is not necessarily limited to
that provided with all the described configurations. Moreover, a part of the
configuration of a certain embodiment can be replaced with the configuration of
- 8 -
another embodiment or the configuration of another embodiment can be added to the
configuration of the certain embodiment. Moreover, with respect to a part of the
configuration of each embodiment, addition /deletion/replacement of another
configuration is possible. Moreover, a part of or the whole of each of the above
configurations, functions, processing portions, processing means and the like may be
realized by hardware by designing with an integrated circuit or the like, for example.
Moreover, each of the above-described configurations, functions and the like may be
realized by software by a processor interpreting and executing a program for
realizing the respective functions.
Information such as a program, a table, a file and the like for realizing each of
the functions may be placed in a recording device such as a memory, a hard disk, an
SSD (Solid State Drive) and the like or in a recording medium such as an IC card, an
SD card, a DVD and the like. Moreover, a control line and an information line are
illustrated as those considered to be necessary for explanation and they do not
necessarily illustrate all the control lines or information lines on a product. Actually,
it may be considered that almost all the configurations are connected to each other.

We claim:
1. A failure detection system comprising:
a plurality of signaling systems each indicating a stop signal to a vehicle; and
a plurality of control devices associated with each of the plurality of signaling
systems and controlling each of the plurality of signaling systems, wherein:
each of the plurality of control devices transmits vehicle control data to an
associated trackside antenna beacon;
the failure detection system checks consistency of a plurality of pieces of the
vehicle control data of a plurality of the control devices each transmitting the vehicle
control data on the basis of the same stop position information; and
the failure detection system detects abnormality of the control device on the
basis of a result of the check.
2. The failure detection system according to claim 1, wherein
the control device checks consistency of the vehicle control data of the control
device itself and the vehicle control data of the other control devices; and
if abnormality of the control device itself is detected, the check result is
outputted to an outside.
3. The failure detection system according to claim 2, wherein
a plurality of the check results by the plurality of control devices are obtained;
and
abnormality of the control device is detected on the basis of the plurality of
check results.
4. The failure detection system according to claim 1 or claim 3, wherein
a plurality of control devices each transmitting the vehicle control data on the
basis of the same stop position information are four control devices arranged
continuously on a track.
5. A failure detection device comprising:
a first control device for controlling a signaling system indicating a stop signal
of a vehicle;
one or more second control devices adjacent to the first control device and
controlling the signaling systems in the rear of the vehicle in an advance direction;
and
a plurality of trackside antenna beacons, wherein:
vehicle control data transmitted by the first control device and the second
control device to the trackside antenna beacons is obtained by the respective control
devices;
the vehicle control data transmitted by the control device itself and the vehicle
control data obtained from the other control devices are compared by the respective
control devices;
if a comparison result has the same value, it is determined that the first control
device and the second control device are normal; and
-10-
if the control device not having the same value is present, the control device is
determined to be failed.
6. The failure detection device according to claim 5, wherein
the vehicle control data is position information of a stop point.
7. The failure detection device according to claim 6, wherein
the failure detection device has one or more maintenance terminals for
monitoring a state of the first control device and the second control device; and
the maintenance terminal obtains failure information including the
determination result from the first control device or the second control device.
8. The failure detection device according to claim 7, wherein
the failure detection device further includes a vehicle operation monitoring
device for monitoring an operation of a vehicle and obtains the failure information
from the maintenance terminal.
9. The failure detection device according to claim 6, wherein:
the failure detection device has one or more maintenance terminals for
monitoring states of the first control device and the second control device;
the maintenance terminal obtains vehicle control data transmitted by the first
control device and the second control device to the trackside antenna beacon; and
the maintenance terminal compares the obtained vehicle control data and
determines whether the first control device and the second control device are normal
or failed.
10. A failure detection method of a failure detection device, wherein
the failure detection device has:
a first control device for controlling a signaling system indicating a stop signal
of a vehicle;
one or more second control devices adjacent to the rear of the first control
device and controlling the signaling systems in the rear; and
a plurality of trackside antenna beacons, wherein:
vehicle control data transmitted by the first control device and the second
control device to the trackside antenna beacons is obtained by the respective control
devices;
the vehicle control data transmitted by the control device itself and the vehicle
control data obtained from the other control devices are compared by the respective
control devices;
if a comparison result has the same value, it is determined that the first control
device and the second control device are normal; and
if the control device not having the same value is present, the control device is
determined to be failed.