EP0422190B1 - Installation for remote monitoring and control of the opening and closed state of one among a plurality of contacts - Google Patents

Abstract

PCT No. PCT/FR90/00245 Sec. 371 Date Nov. 30, 1990 Sec. 102(e) Date Nov. 30, 1990 PCT Filed Apr. 6, 1990 PCT Pub. No. WO90/12411 PCT Pub. Date Oct. 18, 1990.An apparatus for monitoring at a distance the open or closed state of at least one contact. The installation consists of a non-security control circuit made up of coder couples (such as CM1, CV1 CM2, CV2 and CM3 CV3) and a microcontroller (1), connected by a modem (2) and a data transmission link (3) to a central security control (LST). This installation is useful in the railway domain, to remotely monitor contacts.

Description

The present invention relates to a remote control and remote control installation of a plurality of devices from contacts whose open or closed position is detected and controlled.

The invention can be applied, in particular but not limited to, to apparatuses in the railway sector such as the needles of a switching station, axle counters, level crossings, or any other device to be checked and or ordered.

We already know, for example, in the field of control of railway needles, a certain number of techniques, the oldest of which, still implemented today, is control on the site, by lever, with visual control of the sticking of the needles. .

Another type of mechanical control is also used, which consists in carrying out said control of the needles from a referral station, by means of cables or rods. In this formula, the position control is no longer done by direct inspection of the bonding of the needles as previously, but from the referral station where the position of the control is visually observed. This, being still mechanical, translates into safety by its position that of the needles.

If one leaves the mechanical domain for the electrical domain, there is another family of installations in which an electrical control of the position of the needles is carried out from a station generally associated with a remote control when the needles to be maneuvered are under the control of motors.

This control combines the acquisition and transmission of information. The acquisition is generally made by closing electrical contacts by switches linked mechanically, in translation or after conversion into rotation, to the blades of the needles. Transmission is generally done in using these electrical contacts to establish or break the current flow in as many separate loops as there are contacts to control. The current source is generally located at the switching station, as well as the observation of the open or closed state of the loops. For reasons of simplicity, the transmission is not multiplexed, so that at least four contacts and five wires are required if one wishes to have loops which can individually observe the bonding and take-off of each of the blades constituting the needle. Similarly, non-multiplexing prohibits the sharing of transmission means for the remote control of several hands.

In practice, the methods listed above have many disadvantages.

In particular, with regard to the mechanical field, maneuvering and on-the-job control require the presence of a human agent, and therefore its movement towards each of the needles, resulting in a lack of flexibility and a non-negligible cost . Similarly, with regard to the remote control and the mechanical remote control of the needles, a constraint appears immediately, which results from the necessary limitation of the distance from the switching station to the different needles under control. Such a system, despite a gain in flexibility and an economy compared to the previous system, does not lend itself to the merger of several small posts into one larger one.

With regard to the electrical field, telecontrol by current loops is very safe, but costly in transmission and excludes certain acquisition techniques. Thus, the cost of transmission comes from the fact that it takes at least five wires to manage four contacts linked to the blades of a needle and that it is not possible to share the use of these wires to manage several neighboring needles. or located along the same lane. This requirement for individual wires also in practice prohibits the use of a radio link between the needle and either the switching station, or possibly a train approaching it. Transmission by current loops prohibits the use of acquisition techniques which use current or voltage levels or signal frequencies which in practice require local shaping.

Another telecontrol installation of contacts, comprising a telecontrol logic, cooperating with several satellite logics is described in document EP-A-197 835.

The present invention therefore aims to achieve a remote control system and remote control of needles which allows, for a low cost of equipment related to a needle, multiplexing the transmission of various information relating to a switch, and, if desired, several switches, under conditions which ensure railway safety.

The object of the present invention is a global remote control and / or remote control system for contacts implementing a multiplexed link between a secure control and / or command center and one or more satellite logic units, each making it possible to control one or more contacts located at a small distance from said logic.

By multiplexing is meant here any technique allowing the sharing of a transmission medium between several information flows. It can be a frequency, time or logic multiplexing. The connection can be point-to-point, multipoint (or bus) or ring.

This system is characterized in that overall security is ensured by the use of a secure information processing system in a control center, in that the transmission between the central secure control system and the individual means or means of control (or satellite logic) can implement a procedure making it possible to detect transmission errors and in that the individual control means do not need to be genuinely intrinsically safe but cooperate, in response to a control signal addressed by the central control system, by a local coded signal (which can be added to a coding emanating from the central security control system), to the transmission of information having redundancy such that, when received, the system control center can ensure, with the desired degree of security, the identity of the controlled contact, its state and possibly dat er the information provided regarding this identity and this state.

In the system according to the present invention, the transmission must, of course, be accompanied by the transmission of redundant information which would allow the appropriate procedure to verify that no error has been introduced, but we can consider that it is not necessary to implement such a procedure because, in fact, it is when the information, suitably modified, is returned to the security control center that we will implement this verification.

• la figure 1 représente le contrôle de trois contacts au moyen d'une logique non sécuritaire de contrôle ;
• la figure 2 représente le schéma de principe d'un des codeurs de la figure 1 ;
• la figure 3 représente une forme de réalisation d'un des codeurs précités ;
• la figure 4 représente une variante du codeur de la figure 3 ;
• la figure 5 représente un schéma général d'une logique sécuritaire de télécontrôle associée à une pluralité de logiques satellites de télécontrôle ;
• la figure 6 représente un schéma de principe du montage de contrôle de position ;
• la figure 7 représente un schéma d'une logique satellite de contrôle et son interface avec la logique sécuritaire de télécontrôle.

The above characteristics, as well as other secondary characteristics and advantages will appear in more detail in the description below of an embodiment made with reference to the plates in the appendix, in which:

• FIG. 1 represents the control of three contacts by means of an unsafe control logic;
• FIG. 2 represents the block diagram of one of the coders of FIG. 1;
• Figure 3 shows an embodiment of one of the above coders;
• Figure 4 shows a variant of the encoder of Figure 3;
• FIG. 5 represents a general diagram of a security logic of telecontrol associated with a plurality of satellite logic of telecontrol;
• Figure 6 shows a block diagram of the position control assembly;
• FIG. 7 represents a diagram of a satellite control logic and its interface with the remote control security logic.

The invention will be better understood on reading the description of a preferred embodiment of a contact controller.

FIG. 1 shows the control installation according to the present invention, applied to the control of three contacts C₁, C₂, and C₃ by means of a single unsafe control logic or satellite logic LSC, the realization of which does not does not use intrinsic safety technology.

This unsafe control logic consists of three pairs of coders CM₁, CV₁, CM₂, CV₂, and CM₃, CV₃ and a microcontroller 1, connected by a modem 2 and a link transmission of data 3 to a central secure LST telecontrol logic.

Each of the pairs of coders CM _i , CV _i consists of two identical coders 4, CM _i being the "upstream" coder and CV _i the "downstream" coder, the block diagram of which is given in FIG. 2 where sees the encoder 4 which receives on its serial input DI the data to be coded and provides on its serial output DO the coded data. It also receives a power supply, represented by the O and V inputs and a clock on its CK input. All the coders share the same power supply and receive their clock from a common source, the power supply and clock assembly being represented by A + H in FIG. 1.

The operation of a pair of coders CM _i , CV _i is as follows: The “upstream” coder such as CM₁ receives its data to be coded from the microcontroller 1, applies a first coding to them, and sends this coded data to the contact to be controlled as than C₁. If the contact is established, this data arrives at the input of the "downstream" coder such as CV₁, which applies a second coding to them and delivers the data thus transcoded twice to the microcontroller 1.

The coders CM _i , CV _i do not share any component with each other, so as to avoid common mode faults. As far as possible, the wiring connecting a contact to its "upstream" and "downstream" encoders is made so as to make a short circuit impossible which would allow the data coded by the "upstream" encoder to enter the encoder "downstream" without having passed through the contact to be checked. For this, a precaution can consist in moving the "upstream" and "downstream" encoders as close as possible to the contact to be checked.

It is necessary that the laws of coding of the different couples CM _i , CV _i are different from one couple to another (because it is they which make it possible to identify the contact C _i ). On the other hand, it is immaterial whether the coding laws of CM _i and CV _i are identical, moreover CM _i or CV _i might not exist.

In FIG. 3, the structure of an encoder 4 is shown in more detail, which comprises a shift register 5 with serial input and parallel output and a read-only transcoding memory 6.

The serial-parallel register 5 inputs the data presented on its input DI at the rate of a clock presented on its input CK. A return resistor R, upstream of DI ensures that the data presented have a constant logic value when the DI input is "in the air", which corresponds to the case of a downstream encoder whose contact to be checked is open .

The parallel output PD of the shift register 5, or at least certain wires of this output, is connected to the address input A of the read-only transcoding memory 6. It will be assumed that this transcoding memory is organized in mx 1, that is, it has only one DO data output. If it is assumed that the last n bits entered in the serial-parallel register 5 are used to address the transcoding memory 6, we see that each bit presented on the output DO results from transcoding by the content of the transcoding read-only memory 6 of the last n bits received by the serial-parallel register 5.

FIG. 4 shows a variant of the coder 4 of FIG. 3, characterized in that the transcoding read-only memory 6 has an organization by bytes. The eight data outputs D of the transcoding read-only memory 6 are connected to the data input I of a data multiplexer 7, the three selection inputs S of which are connected to three outputs PD _o-2 of the shift register 5, for example those which correspond to the last three bits presented on the input DI of register 5.

The addressing input A of the transcoding read-only memory 6 is connected to outputs of the shift register 5 which correspond to older bits, for example PD ₃₋₁₃ in the case where the transcoding read-only memory 6 is constituted an 8 K byte EPROM.

The content of the transcoding read-only memory 6 is arbitrary, but different from the transcoding memory MT _i to the transcoding memory Mt _j respectively associated with the contacts C _i and C _j , if the two contacts i and j are connected to the same unsafe control logic (or satellite logic), or to separate unsafe control logic but linked by the same data transmission link 3 to the same secure telecontrol logic (or central logic).

The number of bits sent by the microcontroller 1 of FIG. 1 to an upstream coder such as CM₁ can be arbitrary and, in particular, less than the capacity of the read-only transcoding memory MT. For example, the capacity of this one can be 64 k bits, while the message to be coded can have a length of 256 bits.

It may be interesting to start the message to be coded (or to precede it) with a stable sequence, for example consisting of n zeros followed by a 1. In the case of a memory 6 of 64 k bits, the 16 first transcoded bits are unpredictable, but the following (n-16) are identical to the first bit of the memory and the (n + 1) th bit will be identical to the content of the second bit of the memory. This would allow, if necessary, to recognize the beginning of the transcoded message, to make it somehow play the role of a synchronization sequence. If the first two bits of the memory are respectively O and 1, the sequence leaving the transcoding memory 6 of the upstream coder can be used to play the same role vis-à-vis the downstream coder.

It is conceivable that the series of bits sent by the microcontroller 1 comprises, after this synchronization sequence, another sequence, always the same which therefore always provides the same response after transcoding successively by the upstream and downstream coders CM _i and CV _i associated . This response will therefore in a way constitute the "signature" or "imprint" of contact C _i , if it is closed.

If the continuation of the sequence sent after the synchronization sequence is random, the response after transcoding will still constitute a signature, but in a way coded and not in clear. The advantage of having a part of the interrogation sequence that is different from one time to another is to allow the contact's response to be "dated". The risk against which we thus seek to protect ourselves is that the controlled state is exact, corresponds well to the desired organ, but that it is old. This risk is real in equipment comprising a memory, which can transmit an old response instead of a fresh response.

To guard against this, one can explicitly date the bit stream sent, in the sense that it is made to contain in particular a time or a serial number.

We can also have an implicit date, in the sense that it is made to contain a pseudo-random sequence, making any bit stream different from the previous one. It is easy to determine whether it is the most recent bitstream or not, which is all that is generally required.

The data sent by the microcontroller 1 (FIG. 1) to the upstream coders CM₁, CM₂ and CM₃ can all be different, but they can also be identical, the sending being done in parallel. We can indeed consider that the remote control security logic (central logic) is linked to the various unsafe security logic LSC satellite logic by a data transmission link 3 whose speed is relatively fast, and that the central logic requires a unsafe control logic LSC (satellite logic) to send the same interrogation sequence to all the upstream coders and to send back to it all the responses which do not consist of identical bits, which is the case of the response corresponding to an open contact.

It will be noted that the microcontroller can distribute to the various coders a clock at a relatively slow rate, so as to make it possible to control relatively distant contacts without requiring too particular care for the wiring.

We will now describe the application of the present invention to the control and command of a certain number of satellite devices from a central station in the railway sector.

The central station is equipped with a remote control security logic combining intrinsically safe electronics and interfaces based on safety relays. Each device is associated with a satellite control logic, the particularity of which is that it is made from non-secure commercial components.

The devices considered can be, in particular but not limited to, a needle, an axle counter, a level crossing. The central station can be served by an agent or by wire or radio link with a tracking center, or a traction unit (a locomotive for example).

In FIG. 5, the satellite control logic LSC₁, LSC₂, LSC₃, of the various devices depending on the central station LST are connected to the central security control logic by a multipoint link which in fact comprises a power line A and a line of data transmission L. The power line A is subdivided into a three-phase supply intended for the operation of each device and an auxiliary supply intended for supplying the satellite control logic.

The LSC _i satellite control logic and the LST - LSC _i link are not intrinsically safe, however the overall security is ensured under the sole responsibility of the central LST logic, which is deemed to be safe.

Each LSC _i satellite control logic consists of two microcontrollers, responding to two different addresses on the multipoint line, the central security logic of LST telecontrol playing the role of master.

The principle of a telecontrol will be described with reference to FIG. 6. To perform a position control of a device, the safety logic of LST telecontrol addresses to the LSC satellite control logic associated with the device to be controlled, a train of n pseudo-random bits. This train is therefore dated, since different from that sent during the previous check.

The LST telecontrol security logic receives in return from the addressed LSC control satellite logic, another train of n bits from which it is able to check unambiguously: the correlation with the bit train sent, the number of the addressed satellite logic and the position of the controlled device.

The security of the control therefore rests on the comparison made by the security logic of telecontrol LST, in security, between the bit stream sent and the bit train received. The required level of security is obtained by varying the length n of the bit stream and the complexity of the coding function. More precisely, we seek to verify the identity, or quasi-identity, between the received bit stream and a certain local transform of the transmitted bit stream.

More specifically, the LST telecontrol security logic sends a double bit stream E₁ + E₂. The bit stream E₁ is received by the microcontroller MC₁ and the bit stream E₂ is received by the microcontroller MC₂.

Each microcontroller resends its respective bit stream E₁ or E₂ to the other microcontroller of the same satellite control logic via contacts Γ₁ or Γ₂ of the device controller.

As the device controller can only be in one of the two possible stable positions, a single microcontroller can transmit its bit stream. During the time which normally corresponds to the opening of the needle, neither of the two microcontrollers can manage to transmit its bit stream.

If the two bit streams were to be transmitted simultaneously, we would be in an exceptional abnormal situation corresponding for example to a state in which the two blades of the needle would be stuck, denouncing a mechanical break.

ou $\text{S₂ = f₂ (E₁)}$

. Chacune des fonctions f₁ et f₂ est caractéristique du microcontrôleur traversé.In the normal situation, the most common, that of the two microcontrollers MC₁ or MC₂ of the satellite logic LSC which received the bit stream from the other, transmits in return to the safe logic of telecontrol LST a bit stream S₁ or S₂ which is a function of the bit stream received from the other microcontroller $\text{S₁ = f₁ (E2)}$

or $\text{S₂ = f₂ (E₁)}$

. Each of the functions f₁ and f₂ is characteristic of the microcontroller crossed.

The remote control security logic LST therefore receives in return from the double bit stream E₁ + E₂ a bit stream S₁ and / or S₂, which is characteristic of both the bit stream transmitted and the path traveled between the two microcontrollers of this logic LSC control satellite through the contacts to be controlled.

If we refer to the example in FIG. 6, we see that it is the train E₁ which cannot be transmitted from the microcontroller MC₁ to the microcontroller MC₂, owing to the position of the contacts Γ₁ and Γ₂ to be checked.

et $\text{S₂ = Σ (E₁(i) + R₂(i))}$

.We determine mathematically the functions f₁ and f₂ according to the error rate that we consider acceptable. As for example, the function can be an exclusive OR performed bit by bit (or byte by byte) between the train of n bits E₁ or E₂ and a train of n reference bits R₁ or R₂, of the form $\text{S₁ = Σ (E₂ (i) + R₁ (i))}$

and $\text{S₂ = Σ (E₁ (i) + R₂ (i))}$

.

The "distance" between two trains of n bits is generally defined as the number of bits of the same rank different in the two messages.

The bit streams are chosen so that the "distance" between them is as large as possible. Each reference bit stream will therefore be characteristic of the microcontroller where the function f is performed. It is fixed in the PROM programmable read-only memory of the card.

The LST knows the transcoding law associated with the contact it wishes to control. Knowing the contents of the pseudo-random bit stream it sent, it absolutely knows what the bit stream it receives should be.

If it compares this received train to the expected train, it can determine the distance between them.

In the absence of any error, this distance should be zero.

Security will be maximum if we consider as closed only a contact such that the measured distance is zero.

However, if the length of the bit stream is large and if the number of different contacts to be checked through the same data transmission link is not too large, security is still important if a distance less than a certain threshold which is not zero.

After resetting to zero, each microcontroller initializes its buffer registers, so as to send back to the security logic of telecontrol a bit stream significant of its good reset and of its identity. It can be the same R bitstream.

The principle of a remote control will be described with reference to Figure 7. The motor Mo for operating the device is remotely powered from the safety logic of LST remote control by the three-phase power supply described below.

The power line consists of a five-conductor cable (F₁ to F₅) grouping two separate supplies, firstly a three-phase supply of devices using the wires F₁ to F₃ (whose cross section is determined by the consumption of only one device at a time), on the other hand an auxiliary power supply using the wires F₄ and F₅ for the remote supply of the LSC satellite control logic and the locking of the RA needle relay.

Depending on the security software of the central LST remote control logic, this auxiliary power supply can take three different states depending on the states of the Rx and Ry relays: continuous if the Ry relay is at work, alternating if Ry is at rest and Rx at work, zero if Rx and Ry are at rest.

The electronics of the satellite control logic can be supplied both continuously and alternately, using a power supply converter block "direct power cut" BC. Its inertia is sufficient to cover the AC-DC switching times and vice versa at the level of the LST telecontrol safety logic.

The RA device relays, which are prepositioned in the satellite control logic in the first step of a device command, as seen above, are under the control of an RC bonding relay and a take-off relay RD which responds only to the supply of alternating current.

The momentary absence of any supply on the wires F₄ and F₅ of the auxiliary supply causes the relays RA to drop and causes all the microcontrollers of the LSC control satellite logic to reset.

The solution of the data transmission line separate from the power line was chosen for various reasons, including mainly the freedom of technological evolution of the data transmission (optical fibers, etc.) and security for the teams of 'maintenance which do not have to work under dangerous tension.

• 1°) le prépositionnement du relais d'appareil RA concerné, qui met sucessivement en oeuvre les opérations suivantes :
  • . On autorise le collage des relais RA de toutes les logiques satellites de contrôle LSC reliées à la ligne multipoint grâce à l'alimentation auxiliaire en alternatif ;
  • . On donne par la ligne de transmission de données 3 l'ordre de collage au seul relais RA de l'appareil concerné, qui s'auto-maintient ;
  • . On interdit par la ligne de puissance toute nouvelle modification d'état des relais RA (par alimentation auxiliaire en continu).
  • . On vérifie que seul le relais RA concerné est collé, en utilisant le principe des télécontrôles précédemment décrits.
• 2°) l'exécution de la commande s'effectue, les relais RA étant positionnés et verrouillés par l'alimentation auxiliaire en continu, en envoyant sur la ligne de puissance l'alimentation triphasée (par F₁, F₂ et F₃) destinée au mouvement de l'appareil. Le sens du mouvement est obtenu par inversion de deux phases au niveau de la logique sécuritaire de télécontrôle LST, qui est seule à travailler en sécurité intrinséque. La manoeuvre de l'appareil est assimilée à une "commande perdue". En conséquence, l'appareil doit être protégé par des contacts de fin de course ou un dispositif à friction renforcée. Toutefois, si le contrôle d'aiguille détecte correctement la fin de course, la commande perdue peut être interrompue prématurément par le logiciel de la logique sécuritaire de télécontrôle LST.
• 3°) La remise au repos des relais RA est effectuée au moyen de la même succession d'opérations que lors du prépositionnement et l'on commande le décollage des relais RA pendant que l'alimentation auxiliaire est en alternatif.

A remote control of a single motor M _o breaks down into three stages:

• 1) the prepositioning of the RA device relay concerned, which successively implements the following operations:
  • . The bonding of the relays RA of all the satellite control logic LSCs connected to the multipoint line is authorized by means of the auxiliary AC supply;
  • . The order of bonding is given by the data transmission line 3 to the single relay RA of the device concerned, which self-maintains;
  • . Any new modification of the state of the RA relays is prohibited by the power line (by continuous auxiliary supply).
  • . It is checked that only the RA relay concerned is bonded, using the principle of the remote controls previously described.
• 2 °) the execution of the command is carried out, the relays RA being positioned and locked by the continuous auxiliary power supply, by sending on the power line the three-phase power supply (by F₁, F₂ and F₃) intended for the movement of the device. The direction of movement is obtained by reversing two phases at the level of the LST telecontrol security logic, which is the only one to work in intrinsic security. The operation of the device is assimilated to a "lost command". Consequently, the device must be protected by limit switches or a reinforced friction device. However, if the needle control correctly detects the limit switch, the lost command can be interrupted prematurely by the LST remote control safety logic software.
• 3 °) The resting of the RA relays is carried out by means of the same succession of operations as during prepositioning and the take-off of the RA relays is controlled while the auxiliary supply is in alternation.

The RA device relay is mounted as a sticker. Its bonding is ensured by a bonding relay RC, controlled by the microcontroller MC₂ of the satellite control logic LSC while its takeoff is ensured by a takeoff relay RD, controlled by the microcontroller MC₁.

The two relays RC and RD are supplied from the auxiliary supply supplied by F₄ and F₅, via a transformer TR which constitutes an intrinsic safety device for the transmission of alternative energy. Even in the event of microcontroller failure of the LSC satellite control logic, the bonding and take-off relays can only be actuated while the auxiliary supply is in alternation.

There is thus the certainty, in intrinsic safety, that an RA relay cannot stick while the auxiliary power supply is continuous, a condition imposed by the LST telecontrol security logic before delivering the three-phase power supply to the only RA relay which will have was glued during the authorized prepositioning phase.

To prevent a breakdown of an LSC satellite control logic, the MC₂ microcontroller of which would present permanent control of the RC bonding relay, does not block the other satellite control logic of the multipoint line, the RC command is made impulse by a capacitive assembly which does not have to be security.

No other precaution should be taken when controlling the RC and RD relays.

Indeed, the RC bonding relay can only intervene when the auxiliary supply is alternative, and, what matters most at the level of the RA device relay, it is not its command, not safe, but the control from its safe position before sending the three-phase. The security of the order rests, in a way, on the security of the control of the pre-order.

The solution described above for satellite control logic applied to a needle has a significant economic advantage in terms of wiring. In fact, use is made of a single power line with five conductors and a data transmission line, both in multipoint, between the station where the remote control security logic is located and all of the needles. On the contrary, in the embodiments currently used, the point-to-point connection between the station and each needle comprises at least four conductors of large section (so-called "4-wire" assembly)

Since only one device is controlled at a time, the power consumed at the power line is very low compared to that of conventional stations for which no logic device prohibits the simultaneous operation of several hands. The solution proposed in the invention derives its benefit from a continuous monitoring of the circulations, avoiding the accumulation points in the operation of the needles whose average utilization rate over a long period is in fact close to zero.

Another financial advantage comes from the very low cost of satellite control logic based on commercial microcontrollers. Only the central telecontrol logic is carried out in safety and its interface with the power line by safety relay is extremely simplified.

The data transmission line and the satellite control logic will be described successively with reference to FIG. 7.

• vitesse de transmission à 62,5 kbit/s
• longueur maximum d'un segment entre répéteurs : 1200 m
• nombre maximum de noeuds par segment : 28
• nombre maximum de répéteurs traversés : 10
• nombre maximum total de noeuds : 250, ce qui correspond à un maximum théorique de 125 aiguilles puisque les deux microcontrôleurs d'une même logique satellite de contrôle constituent chacun un noeud au sens de l'adressage du BITBUS.

The data transmission line 3 selected is a double twisted and shielded pair, used under the BITBUS protocol of INTEL, in differential mode (RS485) whose main characteristics of the chosen option are as follows:

• transmission speed at 62.5 kbit / s
• maximum segment length between repeaters: 1200 m
• maximum number of nodes per segment: 28
• maximum number of repeaters crossed: 10
• total maximum number of nodes: 250, which corresponds to a theoretical maximum of 125 needles since the two microcontrollers of the same satellite control logic each constitute a node in the sense of addressing the BITBUS.

• 1) La consommation des alimentations des noeuds sur la ligne d'alimentation auxiliaire, surtout en continu, ce qui est son état le plus fréquent (le taux d'ondulation résiduel de l'alimentation auxiliaire en continu ne doit en aucun cas permettre une réalimentation des relais RC à travers les transformateurs).
• 2) Le temps de réponse, limité en pratique à 5 ou 6 commandes d'aiguille par minute, une seule aiguille pouvant être commandée à la fois.

Two limitations are involved in the maximum practical number of nodes connectable to the BITBUS:

• 1) The consumption of the node power supplies on the auxiliary power supply line, especially continuous, which is its most frequent state (the residual ripple rate of the continuous auxiliary power supply must in no case allow a replenishment RC relays across transformers).
• 2) The response time, limited in practice to 5 or 6 needle commands per minute, only one needle can be controlled at a time.

The same LST telecontrol security logic can manage several BITBUS, the devices being distributed so as to always have a minimum number of "routes", even in the event of a BITBUS failure.

Galvanically isolated repeaters are available as standard as BITBUS accessories. They require a double continuous 12V supply for upstream and downstream, which can be supplied locally by supplying the LSC satellite control logic or by transmitting, in the BITBUS cable, an additional 12V remote supply , which is part of the BITBUS standard.

The LSC needle control satellite logic consists of two microcontrollers MC₁ and MC₂ produced from DATEM DCB 220 commercial cards.

BITBUS cards use the INTEL 8044 micro-controller, which is an 8052 to which is added a high speed Data Link Control (HDLC) serial interface at high speed (up to 2.4 Mbit / s). Each microcontroller is connected to the BITBUS with a specific address and constitutes a node of the BITBUS.

The programmable read only memory (PROM) associated with each microcontroller MC₁, MC₂, contains on the one hand the system core and the local program, common to all the cards, and on the other hand the tables used for transcoding the bit streams Card specific Rs. There must therefore not be two identical PROMs.

The physical address of the microcontroller is "strapped" on the card. The LST telecontrol security logic can check by reading on the PROM a particular bit stream (which may be the R bit stream used previously) the correlation between the microcontroller addressed on the BITBUS (physical address) and the bit stream received from the corresponding PROM. The random access memory (RAM) associated with each microcontroller MC₁ and MC₂ constitutes the buffer registers for transmitting and receiving trains of n bits, transmitted at high speed on the multi-point data transmission line or transmitted at higher speed weak to the other microcontroller of the same satellite logic LSC control via the needle controller Γ or via the relay RA.

The serial needle control or RA relay links are made by a double UART (Universal Asynchronous Receiver Transmitter) or Link Controller (Figure 6) available on each DATEM DCB 220 micro-controller card. The needle control is done + 12V current loop on a port and the RA relay control, which is local in the satellite control logic, is done in RS 422 (+ 5V) on another port.

Transmissions to the needle controller Γ and to the RA relay are at medium speed (19200 bit / s maximum), while the transmission speed on the BITBUS is 62.5 kbit. The speed adaptation is done at the level of the buffer registers of the microcontrollers MC₁, MC₂ of the satellite control logic LSC. The other input-output ports available on DATEM cards are used for controlling the bonding and take-off relays RC and RD of the relay RA, as well as for unsafe input-outputs, needle heaters for example.

The RA relay is a relay with six reversers, three (a₁, a₂, a₃) used to control the three-phase motor of the needle, two (aiguille and a₅) to control the position of the RA relay itself and the last a₆ to its self-maintenance.

The contacts of the RA relay must be capable of withstanding the current supplied to the motor Mo; however, they should not be calibrated to commonly cut such intensity. Indeed, the relay RA is prepositioned before the three-phase is established by the breaker relay RU of the satellite control logic LSC.

The RA relay can in no case inadvertently stick, on the other hand, it can exceptionally take off incorrectly at the time of a + 12V failure of the supply of the LSC satellite control logic.

The RC and RD relays are two DIL (Dual In Line) relays which respond to the stresses of the MC₁ and MC₂ microcontrollers only if the auxiliary supply is alternating.

Relays RA, RC, RD do not have to be safety; however they must in no case be able to stick under the sole effect of vibrations.

• 1°) une alimentation régulée, constituée d'un bloc convertisseur à découpage direct secteur BC acceptant à l'entrée aussi bien une tension continue qu'alternative, et garantissant le maintien des sorties nominales pendant les basculements alternatif-continu et continu-alternatif de l'alimentation auxiliaire.
• 2°) une alimentation redressée pour RC et RD, ne pouvant fournir de l'énergie que si l'alimentation auxiliaire, par F₄, F₅, de la ligne de puissance, est alternative. Un transformateur TR évite, en sécurité, le passage d'une alimentation continue. Un condensateur C est monté en série avec TR pour éviter de court-circuiter l'alimentation auxiliaire continue par le primaire du transformateur TR. Pour que le transformateur fonctionne aux conditions nominales, il faut que la fréquence de résonance du filtre constitué par le condensateur C et le primaire du transformateur TR soit très faible par rapport à la fréquence de fonctionnement de 50 Hz.

The supply of satellite control logic is in two parts:

• 1 °) a regulated power supply, consisting of a converter block with direct switching AC sector accepting both DC and AC voltage at the input, and guaranteeing the maintenance of the nominal outputs during switching AC-DC and DC-AC of the auxiliary power supply.
• 2 °) a rectified supply for RC and RD, being able to supply energy only if the auxiliary supply, by F₄, F₅, of the power line, is alternative. A TR transformer safely prevents the passage of a continuous supply. A capacitor C is connected in series with TR to avoid short-circuiting the continuous auxiliary supply by the primary of the transformer TR. For the transformer to operate at nominal conditions, the resonant frequency of the filter constituted by the capacitor C and the primary of the transformer TR must be very low compared to the operating frequency of 50 Hz.

The interfaces of the LST control security logic will be described with reference to FIG. 7. It has already been said that the remote control security logic was designed as intrinsic security. The interface between said security logic and satellite logic must also be intrinsically safe. Although very simplified, it must be carried out with safety relays, of the NS1 type for example.

A conventional AC device control relay ensures, by the inverters C₁ and C₂ the inversion of two of the phases Ph2 and Ph3 of the three-phase supply, to reverse the direction of rotation of the motor Mo of the device.

We have described a system in which a single motor turns, and in a direction decided by the safety logic of telecontrol LST by means of the permutation of phases PH phases and PH₃.

With this system alone, we could, if the diameter of the threads allows, control all the needles to the right. On the next move, we could command to the left all those that must be commanded to the left.

We could also send the same power command from the LST telecontrol security logic. In this case, it is necessary to defer in each of the satellite control logics, at the cost of a slightly more complicated relay assembly, the choice of the direction of supply of the motors.

A conventional Ru-device relay relay ensures the establishment and cut-off of the three-phase on the power line, via the inverters u₁, u₂, u₃ and u₄.

A Ry relay ensures AC-DC switching of the auxiliary power supply. By switching the relays together, it is guaranteed that the AC relay can only switch if the Ru relay is at rest, that the Ru relay can only intervene if the Ry relay is in the high position (which corresponds to a continuous auxiliary supply ) and that the relay Ry self-maintains as long as the relay Ru remains high, which avoids an untimely return of the auxiliary supply in alternating mode, as long as the three-phase is on line. The continuous auxiliary supply can be obtained by any device, in particular by simple rectification and filtering of the alternative supply. The filtering must be safe, because it must be certain that the residual alternative ripple rate cannot bring back to the secondary of the transformers of the satellite logic controllers a voltage capable of actuating an RC relay. The locking of the RA relays during a continuous auxiliary supply would then no longer be guaranteed.

The additional relay Rx makes it possible, when Rx and Ry are both in the low position, to cut off any auxiliary supply and therefore to cause a fall in the relay RA which remains stuck due to a failure of the satellite logic control LSC.

The satellite needle control logic described above is only a preferred embodiment intended to explain the invention. Obviously, it may be used other means or equivalent devices in particular at the level of electronic cards, without departing from the scope of the invention, defined by the claims.

In addition, the basic principles of control and command, set out in conjunction with a needle control, apply in the same way for a satellite level control logic. With the necessary specific adaptations, they can also be applied to the control and / or the safe command of any device encountered in the field such as announcements at construction sites or axle counting, or in a switching station.

Claims (20)

1. An installation for the remote monitoring of contacts, comprising a Remote Monitoring Fail-Safe Logic Unit (LST) cooperating with one or more Satellite Monitoring logic Units (LSC) via one or more point-to-point or multipoint links, characterised in that the LST determines that a contact is closed by sending a highly redundant signal to the LSC associated with the said contact, that the LSC causes the signal to pass across a contact, the open or closed status of which is to be tested, transforms the signal in a code converter according to a rule which is specific to this contact and which distinguishes it from the code conversions applied to all the other contacts monitored via the same link, and then sends the transformed signal to the LST which decides that the contact is closed if the signal it receives by return complies with that which it expects, knowing the signal which it has sent and the specific code conversion rule which it expects to see used, the guarantee that the response corresponds to the most recent status of the contact stemming from the fact that the signal transmitted by the LSC varies from one occasion to another.
2. A remote control installation, characterised in that it comprises a remote monitoring installation according to claim 1, that the LST supplies the LSCs with power via the link or links, either as DC power or as AC power, that the LSCs comprise at least one transformer (which only allows the current supply to pass if it is AC), and that the LSC comprises a configuration such that it can only change status when the supply is AC, that the LST monitors this status according to claim 1, and that it only authorises the control if it adjudges it to comply with that required by safety.
3. A remote control installation according to claim 2, characterised in that the power line (F₁ to F₅) is subdivided into a three-phase supply line (F₁ to F₃) dedicated to the operation of the apparatus to be remote-controlled and an auxiliary supply line (F₄, F₅) dedicated to supplying the satellite monitoring logic unit (LSC_i).
4. A remote monitoring installation according to claim 1 or a remote control installation according to claim 2, characterised in that the satellite logic units (LSC_i) and the links are not fail-safe, the safety of the system being under the control of the single remote monitoring fail-safe logic unit, which is fail-safe.
5. A remote control installation according to claim 2, characterised in that the link, whether it be multipoint or point-to-point, comprises a power line (A) and a data transmission line (L).
6. A remote monitoring installation according to claim 1, characterised in that an encoding element (CM_i, CV_i) which is physically independent of the other encoding elements is associated with each contact to be monitored (C_i) in order that passage of information through the encoder is only possible if the said information passes across the contact to be monitored (C_i).
7. A remote monitoring installation according to claim 1 or a remote control installation according to claim 2, characterised in that the signals sent and received are composed of a sequence of logic bits.
8. A remote monitoring installation according to claims 6 and 7, characterised in that the encoder makes use of a ROM memory contained in a microcontroller (CM_i) and that certainty of passage across the contact (C_i) is obtained by reading the stream of bits code-converted by a second microcontroller (CV_i).
9. A remote monitoring installation according to claim 1, characterised in that each satellite logic unit (LSC_i) is formed from two microcontrollers (MC₁, MC₂) associated with two different addresses on the multipoint line, which are under the control of the remote monitoring fail-safe logic unit (LST) and respectively connected to contacts (Γ₁, Γ₂) of the apparatus monitoring device.
10. A remote monitoring installation according to claim 1, characterised in that monitoring of the status of an apparatus is effected from a "dated" stream of n bits sent by the remote monitoring fail-safe logic unit (LST) to the satellite logic unit associated with the apparatus to be monitored (LSC_i), which sends another stream of n bits back to it after code conversion, the distance of which the remote monitoring fail-safe logic unit (LST) can assess compared with the bit stream which it expects, by means of its knowledge of the bit stream sent and the code conversion rule implemented in the satellite monitoring logic unit (LSC_i) associated with the contact of the apparatus which it is seeking to monitor, and that the "closed" character is recognised by the remote monitoring fail-safe logic unit (LST) at the contact which it is seeking to monitor if the measured distance is less than or equal to a certain threshold, which may be zero.
11. A remote monitoring installation according to claim 9, characterised in that the remote monitoring fail-safe logic unit (LST) sends a double stream of bits (E₁, E₂), each microcontroller (MC₁, MC₂) receiving a stream of bits which it sends to the other microcontroller (MC₂, MC₁) via contacts (Γ₁, Γ₂) of the apparatus controller, the fail-safe logic unit (LST) receiving in return a stream of bits (S₁ or S₂) which is characteristic of the status of the contacts to be monitored and of the microcontroller which is crossed.
12. A remote control installation according to claims 2 and 5, characterised in that remote control of the apparatus is effected by a motor (M₀) under the control of a relay (RA) of the apparatus concerned, which controls the three-phase supply to the said motor, the direction of movement to be effected being determined by the phases which it is possible to invert, either at the level of the remote monitoring fail-safe logic unit (LST) or at that of the satellite monitoring logic unit (LSC_i).
13. A remote control installation according to claim 12, characterised in that the relay (RA) of the apparatus is controlled by a latching relay (RC) under the control of one of the microcontrollers (MC₂) of the satellite logic unit (LSC_i) and by a drop-out relay (RD) under the control of the other microcontroller (MC₁) of the satellite logic unit (LSC_i).
14. A remote control installation according to claim 13, characterised in that the latching (RC) and drop-out (RD) relays of the relays of the apparatus (RA) are fed by the auxiliary power supply (F₄, F₅) by the intermediary of a fail-safe device (TR).
15. A remote monitoring installation according to claims 1 and 4 and a remote control installation according to claims 2, 3 and 5, characterised in that the interface between the remote monitoring fail-safe logic unit (LST) and the power line (F₁ to F₅) is fail-safe.
16. A remote monitoring and remote control installation according to claim 15, characterised in that the interface between the remote monitoring fail-safe logic unit (LST) and the power line (F₁ to F₅) is constructed with fail-safe relays (R_u, R_x, R_y, CA).
17. A remote monitoring installation according to claims 1 and 4 and a remote control installation according to claim 5, characterised in that the data transmission link employs a radio transmission.
18. A remote monitoring and remote control installation according to any one of claims 2 to 17, characterised in that it is applied to the monitoring and control of a plurality of points.
19. A remote monitoring and remote control installation according to any one of claims 2 to 17, characterised in that it is applied to the monitoring and control of level crossings.
20. A remote monitoring and remote control installation according to any one of claims 2 to 17, characterised in that it is applied to the monitoring of contacts such as route monitoring operations and to the establishment of contacts such as route control operations.

Images