31.01.2014 Views

Ph.D. - geht es zur Homepage der Informatik des Fachbereiches 3 ...

Ph.D. - geht es zur Homepage der Informatik des Fachbereiches 3 ...

Ph.D. - geht es zur Homepage der Informatik des Fachbereiches 3 ...

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Chapter 10. openETCS Model<br />

Current Train Position<br />

double<br />

double<br />

Position at Entering Post Trip<br />

Check, if allowed distance for reversing in this mode<br />

(national value) was exceeded.<br />

bool<br />

double<br />

Allowed Reversing Disance in Post Trip<br />

Post Trip Entered<br />

double<br />

- ><br />

double<br />

double<br />

0.0<br />

(CONST)<br />

double<br />

><br />

double<br />

Current Train Speed<br />

Check for reverse movement/negative<br />

speed.<br />

bool<br />

bool<br />

&<br />

Check if train is moving in<br />

reverse and train already has<br />

overrun maximal allowed<br />

distance in reverse.<br />

Forward movement is never<br />

allowed.<br />

bool<br />

>=1<br />

bool<br />

Current Train Speed double<br />

><br />

double<br />

0.0<br />

(CONST)<br />

bool<br />

Check for forward movement/positive speed.<br />

Movement Supervision Failure<br />

Figure 10.22.: Reverse movement supervision in Post Trip as gSubFunctionBlock graph<br />

10.2.8. System Failure Mode<br />

System Failure is activated if an error is detected in the EVC during the execution in other ETCS<br />

Mod<strong>es</strong> that caus<strong>es</strong> a system failure [78, p. 12]. As d<strong>es</strong>cribed in Section 7.2, the corr<strong>es</strong>ponding<br />

oModeGuard object “c13” in Figure 10.1 is typically not activated by a Boolean data flow, but<br />

is used as FailureGuard property in the corr<strong>es</strong>ponding gEVCStateMachine instanc<strong>es</strong>. Since a<br />

system failure means that the system or rather the EVC cannot longer perform its required<br />

functionality, this is a threat to safety. Corr<strong>es</strong>pondingly, the SRS defin<strong>es</strong> for the System Failure<br />

Mode that the emergency brak<strong>es</strong> are permanently activated. Since an error may occur in any<br />

Mode and any Application Level, System Failure is modelled for Application Level 0 and 1.<br />

10.2.8.1. Application Level 0<br />

The model of System Failure in Level 0 is sketched in Figure 10.23. Once this Mode is entered,<br />

it can only be left by input from the driver via the DMI. It can be either switched to No Power<br />

(Subsection 10.2.1) via the “c29” oModeGuard object or to Isolation (Subsection 10.2.9) via<br />

the “c1” oModeGuard object.<br />

10.2.8.2. Application Level 1<br />

Since the failure handling do<strong>es</strong> not differ for different Application Levels, the model for Level 1<br />

match<strong>es</strong> exactly the model of Level 0 and is omitted.<br />

200

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!