Patent Grant
9751544
The present application is National Phase of International Application No. PCT/JP2013/076102 filed Sep. 26, 2013, and claims priority from Japanese Application No. 2013-008563, filed Jan. 21, 2013, the disclosure of which is hereby incorporated by reference herein in its entirety.
The present invention relates to a train traffic control inspection device, a train traffic control inspection method, and a program which serve to inspect a traffic schedule of a train traveling a previously-provided railroad.
Priority is claimed on Japanese Patent Application No. 2013-8563, filed Jan. 21, 2013, the content of which is incorporated herein by reference.
Existing systems for controlling traffic of railroad vehicles are classified into “safety related systems” for securing safety in operation thereof and “non-safety related systems” for achieving various purposes independently thereof.
“Security systems” are systems for controlling traffic of trains such that the trains neither collide nor derail. Representative examples thereof include an automatic train control (ATC) system and an “interlock system”. Here, an “interlock system” means a system that controls traffic signals and switch stands (devices that switch a route of a train in a branch) to interlock with each other.
On the other hand, “non-safety related systems” mean systems not corresponding to the “safety related systems” among systems mainly required for operating railroads as a transportation system. A representative example thereof is a “traffic control system” that causes a train to travel or stop in accordance with a train diagram. Ticket examination facilities and the like are also examples thereof.
In a train traffic control system that controls traffic of trains while causing the traffic control system which is a non-safety related system and the interlock system which is a safety related system to function independently, it is necessary to form a traffic logic which do not cause “deadlock” in a traffic processes thereof. Here, the “deadlock” means a state in communication between the traffic control system and the interlock system in which the traffic processes of trains can no longer progress.
Therefore, a designer of traffic logic needs to verify in advance whether the “deadlock” can occur in the traffic processes that are sequentially performed in accordance with the traffic logic.
Regarding the “interlock system” as the “safety related system”, a method of automating verification of such an operation and saving energy is disclosed (Patent Literature 1).
[Patent Literature 1]
Japanese Unexamined Patent Application, First Publication No. 2011-131812
However, a train does not travel merely in accordance with a train diagram and a certain degree of delay may occur. Combinations of positions and routes of the train in which the delay may occur are enormous and it is difficult for even an expert to design traffic logic that avoids the deadlock in all combinations.
The “interlock system” and the “traffic control system” control trains independently (asynchronously) based on a variety of information such as railroad topology information, positions of trains, route of trains, and train diagrams. In the method described in Patent Literature 1, although the operation of the “interlock system” can be verified, the operation of the entire train traffic control system in which the “interlock system” and the “traffic control system” are combined cannot be verified.
The “interlock system” and the “traffic control system” asynchronously control traffic of a train independently as described above. Accordingly, a very large number of combinations of instruction patterns which are transmitted therefrom can be considered for the traffic processes which progress from moment to moment. Existing inspection systems cannot verify whether there is a possibility of “deadlock” occurring in all of the very large number of instruction patterns. For example, there is actually a slight time lag between a timing at which a train enters a block and a timing at which the interlock system actually recognizes the entrance of the train. Hitherto, it has not been possible to verify problems such as what happens when a route request of another train is given from the traffic control system during the time lag.
An object of the present invention is to provide a train traffic control inspection device, a train traffic control inspection method, and a program which can solve the above-identified problems.
According to a first aspect of the present invention, there is provided a train traffic control inspection device that verifies an operation of a train traffic control system including an interlock system and a traffic control system, including: an information acquiring unit configured to acquire railroad topology information indicating a configuration of a railroad network in which a plurality of blocks are connected and which includes one or more branches, travel path information specifying a path of a train which travels in the railroad network by combination of one or more routes for each train, route setting information in which conditions to be satisfied when a route request for reserving a path on which a train will travel is given are defined for each route, and interlock system operation information in which safe operation logics of the interlock system are defined; a state transition model generating unit configured to generate a state transition model for each of the train, the branch, the interlock system, and the traffic control system based on the information acquired by the information acquiring unit; and a state transition model inspecting unit configured to determine whether a predetermined requirement is satisfied by combinations of states assumed in the train, the branch, the interlock system, and the traffic control system depending on the state transition models.
A second aspect of the present invention provides the train traffic control inspection device according to the first aspect, wherein the state transition model generating unit generates a state transition model including at least a state in which the train is in each route element obtained by dividing the route in units of the blocks and a state in which the train crosses a boundary of each route element as the states assumed in the train.
A third aspect of the present invention provides the train traffic control inspection device according to the first or second aspect, wherein the state transition model generating unit generates a state transition model including at least a forward-opened state, an in-transition state, and a reversely opened state as the states assumed in the branch.
A fourth aspect of the present invention provides the train traffic control inspection device according to any one of the first to third aspects, wherein the state transition model generating unit generates a state transition model including at least a state indicating whether each route is locked and a state indicating whether a train is present in each block as the states assumed in the interlock system.
A fifth aspect of the present invention provides the train traffic control inspection device according to any one of the first to fourth aspects, wherein the state transition model generating unit generates a state transition model including at least a progress state of a route request step for each train and a state indicating whether a route request for each route is present as the states assumed in the traffic control system.
According to a sixth aspect of the present invention, there is provided a train traffic control inspection method of verifying an operation of a train traffic control system including an interlock system and a traffic control system, including: acquiring railroad topology information indicating a configuration of a railroad network in which a plurality of blocks are connected and which includes one or more branches, travel path information specifying a path of a train which travels on the railroad network by combination of one or more routes for each train, route setting information in which conditions to be satisfied when a route request for reserving a path on which a train will travel is given are defined for each route, and interlock system operation information in which safe operation logics of the interlock system are defined; generating a state transition model for each of the train, the branch, the interlock system, and the traffic control system based on the acquired information; and determining whether a predetermined requirement is satisfied by combinations of states assumed in the train, the branch, the interlock system, and the traffic control system depending on the state transition models.
According to a seventh aspect of the present invention, there is provided a program which causes a computer of a train traffic control inspection device, which verifies an operation of a train traffic control system including an interlock system and a traffic control system, to serve as: information acquiring means configured to acquire railroad topology information indicating a configuration of a railroad network in which a plurality of blocks are connected and which includes one or more branches, travel path information specifying a path of a train which travels on the railroad network by combination of one or more routes for each train, route setting information in which conditions to be satisfied when a route request for reserving a path on which a train will travel is given are defined for each route, and interlock system operation information in which safe operation logics of the interlock system are defined; state transition model generating means configured to generate a state transition model for each of the train, the branch, the interlock system, and the traffic control system based on the information acquired by the information acquiring unit; and state transition model inspecting means configured to determine whether a predetermined requirement is satisfied by combinations of states assumed in the train, the branch, the interlock system, and the traffic control system depending on the state transition models.
According to the train traffic control inspection device, the train traffic control inspection method, and the program, it is possible to inspect the train traffic control system to include situations with a low probability of occurring in operation of the train traffic control system.
Hereinafter, a train traffic control inspection device according to an embodiment of the present invention will be described with reference to the accompanying drawings.
The train traffic control inspection device 1 is an inspection device for verifying an operation of a train traffic control system including an “interlock system” and a “traffic control system.” In order to realize the inspection function, the train traffic control inspection device 1 includes an information acquiring unit 10, a state transition model generating unit 11, a state transition model storage unit 12, a state transition model inspecting unit 13, a counterexample analyzing unit 14, a result displaying unit 15, and a state transition model editing unit 16.
The information acquiring unit 10 is a functional unit that acquires information required for inspection of train traffic control. The information acquired by the information acquiring unit 10 includes railroad topology information, travel path information, route setting information, and interlock system operation information. Here, the “railroad topology information” is information indicating a configuration of a railroad network in which a plurality of blocks are connected and which includes one or more branches. The “travel path information” is information for specifying a “path” of a train traveling in the railroad network on a combination of one or more “routes” for each train. The “route setting information” is information for setting conditions in which a route request for causing the interlock system to reserve a path on which a train will travel is given for each route. The “interlock system operation information” is information for defining safe operation logic of the interlock system. The train traffic control inspection device 1 may include a particular storage unit for storing the variety of information. Specific meanings and details of the variety of information will be described later.
The state transition model generating unit 11 generates a state transition model for each of a train, a branch, the interlock system, and the traffic control system based on the variety of information acquired by the information acquiring unit 10. The train traffic control inspection device 1 according to this embodiment can inspect the entire train traffic control system in which the “interlock system” and the “traffic control system” work in cooperation depending on various state transition models generated by the state transition model generating unit 11.
The state transition model storage unit 12 temporarily stores the state transition models for repeated verification of the state transition models generated by the state transition model generating unit 11. The train traffic control inspection device 1 according to this embodiment may not include the state transition model storage unit 12 and the state transition model generating unit 11 may directly output a state transition model to the state transition model inspecting unit 13.
The state transition model inspecting unit 13 determines whether predetermined conditions are satisfied by combinations of states which are assumed in the train, the branch, the interlock system, and the traffic control system depending on the state transition models generated by the state transition model generating unit 11. A user of the train traffic control inspection device 1 can determine whether details of the variety of originally-provided information such as the “railroad topology information,” the “travel path information,” the “route setting information,” and the “interlock system operation information” satisfy requirements based on the inspection result by the state transition model inspecting unit 13.
When a counterexample not satisfying the requirements occurs in the inspection result by the state transition model inspecting unit 13, the counterexample analyzing unit 14 facilitates detailed tracking of reasons for the occurrence of the counterexample. The counterexample analyzing unit 14 corresponds to a so-called debugging tool. The train traffic control inspection device 1 according to this embodiment may not include the counterexample analyzing unit 14 and the result displaying unit 15 may merely display the inspection result through the state transition model inspecting unit 13.
The result displaying unit 15 outputs the counterexample analysis result from the counterexample analyzing unit 14 or the inspection result from the state transition model inspecting unit 13 in a form which can be visually recognized by a user. In this embodiment, the result displaying unit 15 is, for example, a general-purpose display monitor.
The state transition model editing unit 16 constructs a desired state transition model by allowing a user to directly edit the state transition models temporarily stored in the state transition model storage unit 12. The state transition model editing unit 16 allows the user to freely edit the state transition model when the state transition model constructed by the state transition model generating unit 11 is not intended by the user, or the like. In this embodiment, this editing function is not necessary.
Now, before the train traffic control inspection device 1 is described, the “interlock system” and the “traffic control system” which are assumed to be included therein will be described.
The “interlock system” is a representative example of a “safety related system” and is a device that controls traffic lights and switch stands (devices that switch a route of a train in a branch) to interlock with each other. For example, if a train passes through a place while a switch stand is moving, the train will derail. Accordingly, the interlock system performs interlock control for displaying “red” with a predetermined traffic light such that the train does not enter the place of the switch stand while the switch stand is moving. When a train is present in a certain “block” (to be described later) the interlock system controls a traffic light such that no other train enters the block. The interlock system prevents collision or derailment of trains and secures safety as a transportation system by performing this control.
The interlock system receives a route request from the traffic control system (the “traffic control system” and the “route request” will be described later). The interlock system secures the route in response to the received route request. This is called route reservation. For example, when the interlock system receives a route request for a “route” (to be described later) on which train A will travel from the traffic control system, the interlock system establishes the route reservation of train A for the route by controlling the traffic lights and the switch stands such that train A can safely travel in the route (and no other train enters the route) in response to the route request. When a route request for another train includes a section competing with the route reserved for train A, the interlock system does not receive the route request. The interlock system determines whether the route reservation is established in accordance with a predetermined “safe operation logic” (to be described later).
A “block” means a section when a given railroad network is partitioned into regular sections. The interlock system allocates a unique identifier to each block to identify and manage the blocks. The interlock system prevents collision of trains by preventing two or more trains from entering one block. In general, the interlock system uses a track circuit as means for determining whether a train is present in a block. The track circuit is a device that electrically detects whether two rails constituting a railroad are short-circuited due to presence of a train. Accordingly, the interlock system can determine whether a train is present in the block.
The “traffic control system” is a system that performs control for causing a train to travel in accordance with a predetermined train diagram. The traffic control system has a function (referred to as a “route request” function) of identifying a path on which a train will travel based on a scheduled train diagram (1) and an actual train state and position (2) for each train and requesting reservation of a route for each train for the interlock system. Here, an “automatic route setting” function to be described later is a representative function of the traffic control system. The traffic control system is a system that gives an instruction to a train such that the train merely travels in accordance with the train diagram and does not consider safety such as whether the train will collide. Safe traveling in which a train avoids collision and derailment is secured by allowing the interlock system as the “safety related system” to monitor a train traffic situation independently of the traffic control system.
The “automatic route setting” is one function of the traffic control system. In a train diagram, it is assumed that train A starts from block T2 (
Here, the “path” is the overall road connecting a current position of a train to a destination thereof and is specified by a combination of one or more “routes.” The “route” means a predetermined traveling section of a train including one or more adjacent blocks. A traffic light of the interlock system is generally installed in an entrance of a route and the interlock system sequentially gives instructions indicating whether a train may travel on the respective routes using the traffic lights.
The “deadlock” means a state in which the exchange of a route request and a route reservation between the interlock system and the traffic control system no longer progresses in a traffic process of a train. A situation in which the deadlock occurs will be specifically described below with reference to
Hereinafter, specific details of the “railroad topology information,” the “travel path information,” the “route setting information,” and the “interlock system operation information” which are acquired by the information acquiring unit 10 of the train traffic control inspection device 1 will be described with reference to the drawings.
The “railroad topology information” used in this embodiment is information indicating a configuration of a railroad network in which a plurality of blocks are connected and which includes one or more branches. Here, the railroad topology information according to this embodiment is constructed by extracting “route elements” (to be described later) in units of blocks constituting the railroad, defining mutual connection relationships between the route elements and a correspondence relationship with the route, and specifying the overall railroad network. The railroad topology information to be described below is an example and this embodiment is not limited to this example.
Here, a “route element” means a section corresponding to one block from a boundary of a block to a boundary of a block in this embodiment. That is, route elements are the smallest units for defining a route by combination thereof. All routes are defined by combinations of route elements obtained by dividing the routes into units of blocks.
Here, it is assumed that a given railroad network is a railroad shown in
The railroad topology information according to this embodiment specifies the overall railroad network using the route elements obtained by dividing each route into units of blocks as the smallest units, as shown in
Specifically, the railroad topology information is information constructed in tables shown in
The “travel path information” used in this embodiment will be described below. The “travel path information” is information for defining a traffic pattern of a train which is assumed to be inspected. For example, the “travel path information” specifies a path of a train, which travels in the railroad network, on a combination of one or more routes for each train. More specifically, a path of each train is specified by giving an initial position (initial route element) and permutations of routes through which a train passes for each train. For example, it is assumed that train A and train B travel on the paths indicated in Table 5A. Then, the initial position (initial route element) of train A is S6 (see
The “route setting information” used in this embodiment will be described below. The “route setting information” is information in which conditions to be satisfied when a route request for reserving a path on which a train will travel is given are defined for each route. More specifically, the “route setting information” is constituted by a table in which conditions under which a route request can be given when the traffic control system gives the route request to the interlock system in the automatic route setting function of the traffic control system are arranged and combined. For example, the dead lock described with reference to
The route setting information according to this embodiment is constituted by a condition correspondence table shown in
First, in the table shown in
In the table shown in
For example, when the traffic control system instructs the interlock system to cancel the route request for route 3R, it means that the route request is cancelled only when a condition that “a train is present in block T1 and a train is also present in block T3” is satisfied as the request cancellation condition. Here, when the traffic control system cancels a route request for route 3R on the condition that “trains are present in block T1 and block T3,” it is assumed that a train which will travel in route 3R enters block T3 from block T1 and thus the route request for the route is cancelled.
In the table shown in
Like the route request condition for route 4L (
The “interlock system operation information” is information in which a safe operation logic of the interlock system is defined. The safe operation logic of the interlock system determines whether a route reservation should be established in response to the route request from the traffic control system based on various conditions. When a route request for requesting a reservation of a route is transmitted from the traffic control system, the interlock system determines whether a route competing therewith has already been reserved. When a route has been completely reserved, the interlock system does not reserve the route in response to the request until the request condition is satisfied. For example, when a request for route 3R is transmitted, the interlock system starts control of route 3R on the condition that other routes 3AL, 3BL, 5L, and 4BR which compete with route 3R are not being controlled. These conditions are expressed and arranged using logical expressions, whereby the interlock system operation information shown in
The safe operation logic of the interlock system includes various definitions in addition to the above-identified definitions for the route reservation. For example, the interlock system detects whether a train is present in a predetermined block using the above-identified track circuit, and defines the safe operation logic in which two or more trains do not enter one block. Since the safe design logic of the interlock system is a limitation for defining whether a route should be reserved in response to a route request received from the traffic control system so as to secure safe traveling, whether the deadlock occurs as a result of the safety control is not considered and is not set. The avoidance of the deadlock is achieved by causing the traffic control system to transmit the route request after the condition determined by the route setting information is satisfied as described above.
A “requirement” input from the state transition model inspecting unit 13 is information serving as a condition for causing the state transition model inspecting unit 13 to determine whether the inspection of a given state transition model is appropriate. Specifically, the requirement regards whether a train travels without causing the deadlock in any state transition pattern in the state transition models generated by the state transition model inspecting unit 13 based on a variety of information acquired by the information acquiring unit 10.
Various state transition models generated by the state transition model generating unit 11 of the train traffic control inspection device 1 will be specifically described below with reference to the drawings.
The actual train traffic control system has to satisfy requirements given in operation of a train regardless of a train speed. Accordingly, the state transition model inspecting unit 13 of the train traffic control inspection device 1 verifies the state transition model of a train shown in
The actual train traffic control system has to satisfy conditions given in operation of a train regardless of a switching speed of a branch. Accordingly, the state transition model inspecting unit 13 verifies the state transition model of a branch shown in
The state transition model generating unit 11 constructs a state transition model of the interlock system based on the interlock system operation information (security operation logic) (
First, the state transition model generating unit 11 constructs a state transition model of a route lever relay that determines whether each route is locked (whether a reservation thereof is established). The route lever relay is a relay constituting the interlock system and is a relay that determines whether a route is locked. The state transition model of the route lever relay is constructed for each route on a railroad. As shown in
The state transition model generating unit 11 constructs a state transition model for a train-presence detection relay, separately from the route lever relay. The train-presence detection relay is a relay (a track circuit) that is installed in each block to detect whether a train is present in the corresponding block (whether a train is present). For example, the state transition model of the train-presence detection relay corresponding to block T1 is shown in
The state transition model generating unit 11 constructs a state transition model of a branch detection relay. The branch detection relay is a relay which is used for the interlock system to detect and recognize set routes in each branch. Here, a state of a branch and recognition of a state of a branch by the interlock system are separate matters. Accordingly, the state transition model generating unit 11 constructs the state transition model of the branch detection relay shown in
As described above, by causing the state transition model generating unit 11 to abstract the actual interlock system as a set of various electrical circuits (relays), the train traffic control inspection device 1 can verify an operation pattern which has not been verified through the existing operation verification. For example, the state transition model inspecting unit 13 can perform the inspection to include the time lag until the interlock system actually recognizes the entrance after a train enters a block and a time lag until a switch stand starts its operation after the interlock system reserves a route.
The state transition model generating unit 11 constructs a state transition model of the traffic control system based on the travel path information (
For example, the state transition model generating unit 11 constructs a state transition model of the traffic control system with the route request step shown in
The state transition model generating unit 11 constructs a state transition model in which the traffic control system actually transmits a route request to the interlock system, regardless of the state of the route request step. Here, the state transition diagram shown in
When a predetermined request cancellation condition (
As described above, by causing the state transition model generating unit 11 to abstract the actual traffic control system independently of the interlock system, the traffic control system and the interlock system asynchronously perform processes and it is thus possible to verify the operation patterns which have not been verifiable hitherto. For example, the state transition model inspecting unit 13 can verify a problem with what happens when a new route request is transmitted in the time lag until the interlock system actually recognizes a route request after the traffic control system transmits the route request to the interlock system. That is, by constructing the entire state transition models such that only one of the train, the interlock system, and the traffic control system causes the transition at certain timing, it is possible to perform the inspection to include the time lag and the like.
A specific verification flow using the train traffic control inspection device 1 according to this embodiment will be described below with reference to
The state transition model inspecting unit 13 verifies the state transition patterns which can be assumed in the real world based on the given state transition models and the “requirements” thereof using a predetermined model inspection method, and determines whether the given “requirements” are satisfied in all the state transition patterns which can be taken by the train traffic control system (step ST5). Since the number of combinations of states in the state transition models is vast, inspection using simulation is not possible, but it is possible to logically determine whether the state transition model is appropriate using a model inspection method.
In this embodiment, the state transition model generating unit 11 independently defines the states which can be taken by the interlock system (various relays) and the states which can be taken by the traffic control system as described above. Then, the state transition model inspecting unit 13 can inspect problems with what happens when a new route request for another train is transmitted from the traffic control system in the time lag until the interlock system actually recognizes a route request after the traffic control system transmits the route request to the interlock system.
Through this comprehensive inspection, it is possible to verify all combinations which can occur in the asynchronous state transitions of the interlock system and the traffic control system without being limited to the test patterns of the interlock system and the traffic control system.
When the requirements are satisfied, the train traffic control inspection device 1 determines that the given information does not have an error and ends the processes. On the other hand, when a state transition not satisfying the requirements is present, the initially-prepared information (particularly the route setting information) is considered to include a defective that may cause the deadlock. Accordingly, the user finds the defect using the counterexample analyzing unit 14 and corrects the information (step ST7). The corrected information is input to the information acquiring unit 10 again and the inspection processes are repeated subsequently.
Hereinafter, an example of verification which is performed by the train traffic control inspection device 1 will be specifically described.
The requirements added in
Subsequently to the state shown in
Train A travels in route 4BR as scheduled in the state shown in
Basically, the route setting information is prepared on the assumption that train B crosses between block T6 and block T4 and thus the request cancellation condition is satisfied. However, the deadlock described with reference to
As described above, according to the train traffic control inspection device 1, it is possible to verify cases which have not been verifiable by independently constructing the state transition model of the interlock system and the state transition model of the traffic control system and giving the causal relationships to only the state transition conditions. For example, it is possible to verify even the above-identified case (a new event occurs in a time zone in which the traffic control system transmits a route request but the interlock system does not recognize the route request).
According to this embodiment, it is possible to perform the inspection to include situations with a low probability of occurring in operation of the train traffic control system.
The train traffic control inspection device 1 according to this embodiment may have a configuration in which the above-identified state transition models are described in a predetermined model inspection language. In this case, for example, a state transition model of the interlock system is described with source codes shown in
The train traffic control inspection device 1 has a computer system therein. The processes of the train traffic control inspection device 1 are stored in a computer-readable recording medium in the form of a program and the processes are performed by causing the computer to read and execute the program. Here, examples of the computer-readable recording medium include a magnetic disk, a magneto-optical disc, a CD-ROM, a DVD-ROM, and a semiconductor memory. The computer program may be transmitted to a computer via a communication line and the computer having received the computer program may execute the program.
According to the train traffic control inspection device, the train traffic control inspection method, and the program, it is possible to inspect the train traffic control system to include situations with a low probability of occurring in operation of the train traffic control system.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2013-008563 | Jan 2013 | JP | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2013/076102 | 9/26/2013 | WO | 00 |
| Publishing Document | Publishing Date | Country | Kind |
|---|---|---|---|
| WO2014/112159 | 7/24/2014 | WO | A |
| Number | Name | Date | Kind |
|---|---|---|---|
| 9403545 | Pirtle | Aug 2016 | B2 |
| 20150108284 | Pirtle | Apr 2015 | A1 |
| Number | Date | Country |
|---|---|---|
| 2003-063398 | Mar 2003 | JP |
| 3572479 | Oct 2004 | JP |
| 2010-215158 | Sep 2010 | JP |
| 2011-131812 | Jul 2011 | JP |
| GB 2497228 | Jun 2013 | JP |
| 2012176348 | Dec 2012 | WO |
| Entry |
|---|
| Japan Patent Office, “Office Action for JP 2013-008563,” dated Nov. 17, 2015. |
| PCT/ISA/210, “International Search Report for International Application No. PCT/JP2013/076102,” dated Dec. 17, 2013. |
| PCT/ISA/237, “Written Opinion of the International Searching Authority for International Application No. PCT/JP2013/076102,” dated Dec. 17, 2013. |
| Number | Date | Country | |
|---|---|---|---|
| 20150344050 A1 | Dec 2015 | US |
