EP3448735B1 - Server device operating a piece of software for controlling a function of a rail transport safety system - Google Patents

Description

The invention relates to a server device operating a software for controlling a function of a rail-bound transport securing system,
the software operating at least two processes physically separate from one another, the results of which are compared with one another in order to carry out the control of the function.

Rail-bound transport security systems, especially signal boxes and train protection systems, are increasingly automated via computers. The aim is to ensure a high degree of reliability, availability, maintainability and safety of persons (so-called RAMS requirements; R eliability A vailability M aintainability S afety). While software errors (programming errors) can usually be detected and eliminated through suitable planning and testing of test scenarios up to commissioning, hardware errors (in particular the failure of individual components, such as transistors) can in principle occur at any time during operation. Such hardware faults must be identified in good time so that rail-bound transport security does not endanger people (locomotive drivers, passengers) and preferably not valuable resources (locomotives, wagons) or cargo.

For safety-relevant applications in transport safety systems, multi-channel processing and checking of safety-relevant components is therefore usually carried out, cf. for example M. Schäfer, F. Schneider, "Standardized user interfaces for path control systems", Signal + Draht (98), 9/2006, pp. 50-52 .

In multi-channel processing, several processes of the same type are physically separated from one another, i.e. with different hardware, operated in parallel, and the results are compared with one another. If the results agree, it can be assumed that the hardware involved is functioning correctly. If an error occurs in the hardware involved, the results diverge, which can be identified by comparing them. The application can then take suitable safety measures, for example, to put signals on "Halt" as a precaution.

Software from the field of rail-bound transport security systems is usually installed on individual devices where the physical separation of processes can be easily ensured. For this purpose, the software and the device architecture are suitably coordinated.

In the case of computers with so-called multicore processors, it is possible to achieve a fixed assignment of individual processes to computer resources by suitable programming. When programming under Linux, the use of so-called "cgroups" has proven itself, cf. the English Wikipedia entry "cgroups" from March 31, 2016. Accordingly, different processor cores can be assigned for processes whose results have to be compared (so-called "core binding"), which ensures the physical separation of the processes.

The virtualization of applications means that the provision of individual devices can be dispensed with in many cases, and software development and integration are also simplified. The virtualization of a train control system is, for example, in the WO 2015/126529 A1 been proposed.

Through virtualization on a server cluster of several individual servers, it is also possible to migrate processes to another individual server in the event of a single server failure, thus improving the availability of an application.

When operating software on a virtualized operating level of a server cluster, however, individual processes operated by the software can no longer be assigned to specific computer resources; in particular, the individual processes are assigned to one of the individual computers essentially at random. There is then a (statistically relevant) danger that several processes, the results of which are to be compared with one another, run on the same hardware, so that a hardware error in this hardware generates the same incorrect calculations in these multiple processes, and accordingly the hardware errors can no longer be found by comparing the results of the processes. In this case, operational safety in the rail-bound transport security system is more guaranteed.

The EP 1 085 415 A2 , which is considered to be the closest prior art, discloses a program module and a method for increasing the security of a software-controlled system, in particular an electronic signal box for railway signaling technology. In the exemplary embodiment of FIG. 4 there, a computer network comprising computers R8, R9, R10, R11 and a comparator V3 is used. The computers R8 and R9 are connected in series, and the computers R10 and R11 are connected in series. The computers R10 and R11 are connected in parallel to the computers R8 and R9. The first program part of a program module is installed on computers R8 and R10, and the second program part of the program module is installed on computers R9 and R11. Both computers R8 and R10 receive the same input data. The output data of the computers R9 and R11 are checked by the comparator V3; a route is only enabled if the output data of the computers R9 and R11 match.

The US 2003/0018927 A1 describes a cluster server system with high availability. The cluster comprises several physical servers / individual servers referred to as "nodes". One or more software programs, called "virtual servers", run on each node. If a node fails, an affected virtual server is transferred to another node.

Object of the invention

The invention has for its object to provide a server device in which an improved availability of a software application can be guaranteed with high operational reliability of train traffic.

Brief description of the invention

This object is achieved by a server device of the type mentioned at the outset with the features of claim 1, which is characterized in that the software is operated on a virtual operating level of the server device,
that the server device comprises at least two physically separate server clusters,
wherein each of the server clusters of the server device comprises at least two individual servers, which allow processes to be migrated between one another if one individual server fails,
the at least two processes running on virtual machines,
and that the software comprises at least two parts that are installed on different ones of the at least two server clusters, so that the at least two processes are operated on different ones of the at least two server clusters.

On the one hand, the invention makes the increased availability in server clusters accessible to a software application, but on the other hand ensures that processes whose results have to be compared with one another in order to maintain operational security run physically separate from one another. For this purpose, the server device used to operate the software is set up with at least two server clusters. Each of the server clusters of the server device comprises at least two individual servers allow each other to migrate processes in the event of a single server failure (high availability cluster). This ensures high availability (operational readiness). On the other hand, the software is split into at least two parts, which are distributed among the at least two server clusters. Part of the software, and thus one of the processes, is permanently assigned to one of the server clusters. This ensures that the processes, the results of which are to be compared, run on different server clusters and thus on different hardware. This physical separation of the processes ensures that a single hardware fault, which causes a wrong result of a process, can be detected by comparison with the result of a similar process calculated with other (faultless) hardware.

The processes, the results of which are compared, can be special test processes that run in addition to the control function of the software application (such as the calculation of check digits / checksums), or main processes that are themselves used for the control function (such as the calculation of a track diagram). The processes to be compared with one another perform the same arithmetic operations in the same order in order to obtain the respective process result (identical processes). The same process results generally indicate that the server device is functioning correctly; uneven process results generally indicate a malfunction.

One of the processes whose results are to be compared is, for example, a master process and a second process a slave process. If the result of the slave process deviates from the previously determined result of the master process, the status of the software application is set to "not safe" (unsafe) (for example by the software part of the master process and / or the software part of the Slave process and / or another software part for the comparison process), and none the results of the processes become more familiar. In the case of an interlocking application, for example, all of the signals concerned can be set to "Halt" as a precaution.

By comparing the results of the processes, reliable operation of the server device or the software application and thus also the controlled function of the rail-based transport securing system, for example in an electronic signal box, can be guaranteed. Since the processes are strictly assigned to the individual server clusters, the physical separation of the checking mechanisms is ensured at all times. Physically separated from each other means a separation of the computing processes with regard to the hardware used.

Virtualization makes it possible to operate the software largely independently of any local, available hardware. In particular, it is easily possible to exchange individual components (such as individual servers within one of the server clusters).

Preferred embodiments of the invention

In a preferred embodiment of the server device according to the invention, the software is a signal box application. Due to the architecture of the server device according to the invention, a high level of security, as is usually required for interlocking applications, can be guaranteed. The high availability is also advantageous in order to avoid or minimize delays in the operational flow of train traffic.

A development is particularly preferred in which the software is an application for operating the user interface of a computer-controlled signal box, in particular with a functionality for connecting mobile devices Operator terminals. For example, the software may be a HIS server application (HIS = h uman machine interface for i nterlocking s ystems), in particular with MPT and / or HHT proxy function (MPT = m obile p ossession t erminal; HHT = h and h eld t erminal). The server architecture according to the invention has proven particularly useful in this application. Calculated track diagrams can be used here as the processes to be compared and their results, which are displayed on operator terminals, in particular mobile operator terminals (such as tablet computers). Since the user can temporarily assume responsibility for the release of track sections, a high security standard should be available here, which the invention can offer.

Also preferred is an embodiment in which the software is a train protection application. Due to the architecture of the server device according to the invention, a high level of security, as is also usually required for train protection applications, can be guaranteed. Train protection applications can include, for example, emergency braking systems when passing "stop" signals.

An embodiment is also advantageous in which the software is set up according to safety integrity level 2 (SIL2) or higher. This security level SIL2 is sufficient for many applications of rail-based transport security systems, and is easy to achieve with the server architecture according to the invention, while an increased availability can be made possible at the same time. The safety integrity level (SIL) is determined in accordance with EN 61508 (in particular EN 50128 and EN 50129) in the version valid on April 4th, 2016. The software can be a HIS server application, for example.

An embodiment in which the software is set up according to safety integrity level 4 (SIL4) is particularly advantageous. So the software is enough highest security requirements. The security level SIL4 is also easy to achieve with the server architecture according to the invention, whereby an increased availability can be made possible at the same time. The safety integrity level (SIL) is determined in accordance with EN 61508 (in particular EN 50128 and EN 50129) in the version valid on April 4th, 2016. The software may, for example application of a radio block center (RBC = Radio Block Center) or an electronic signal box (interlocking module), further, a SCM application (SCM = s afe c ommunication m odule) or a FEC Application (FEC = f ield e lement c ontroller).

An embodiment is also advantageous in which the software operates exactly two processes, physically separated from one another, on exactly two different server clusters. The setup of two server clusters for only two (in a respective test process) two processes to be compared is comparatively easy to set up, but increases security considerably while at the same time being highly available.

An alternative, advantageous embodiment provides that the server device comprises three physically separate server clusters, that the software comprises at least three parts that are installed on different ones of the server clusters, so that the software operates three processes on different ones of the three server clusters, and that the Results of the processes are evaluated as part of a 2-out-of-3 decision for the control of the function of the rail-bound transport securing system. With the 2-out-of-3 decision, it is possible to identify correct process results even if one hardware fails (here an error on one of the server clusters), which further increases availability.

An embodiment is also preferred in which the server device controls at least one further software for controlling a further function of a operates rail-bound transport securing system, and that the at least one additional software is installed and operated on only one of the server clusters. The respective additional software is not broken down into different parts that have to be installed on different server clusters; this significantly simplifies the operation of the other software. The other software is typically set up according to SILO. In this embodiment, one or more individual, further software applications are typically installed and operated on each of the server clusters.

• Fahrplan-Planungs-System, insbesondere Aramis-D;
• Zugnummernverwaltungs- und Zuglenkungs-System, insbesondere ARAMIS-C;
• Daten-Analyse- und Metrik-System (Business Intelligence);
• Zugwartungs-System (Maintenance Centre);
• Zugdaten Erfassungs- und Kontroll-System (Checkpoint Master Node);
• Betriebskomponenten Erfassungs- und Auswertungs-System (Service Management Tool). Diese Anwendungen harmonieren in der Praxis gut mit der auf verscheidene Servercluster aufgeteilten Software, insbesondere wenn diese zum Betrieb einer Benutzeroberfläche eines Stellwerks, etwa mit Anbindung für mobile Endgeräte, ausgebildet ist.

In a preferred development of this embodiment, the at least one further software comprises one or more of the following software applications:

• Timetable planning system, especially Aramis-D;
• Train number management and control system, in particular ARAMIS-C;
• Data analysis and metrics system (business intelligence);
• Train maintenance system;
• Train data acquisition and control system (Checkpoint Master Node);
• Operating components acquisition and evaluation system (Service Management Tool). In practice, these applications harmonize well with the software distributed over various server clusters, especially if it is designed to operate a user interface of a signal box, for example with a connection for mobile devices.

Further advantages of the invention result from the description and the drawing. Likewise, according to the invention, the features mentioned above and those which have been elaborated further can be used individually or in combination in any combination. The embodiments shown and described are not intended to be a conclusive list understand, but rather have exemplary character for the description of the invention.

Detailed description of the invention and drawing

Fig. 1

eine schematische Übersicht des Aufbaus einer ersten Ausführungsform einer erfindungsgemäßen Servereinrichtung, mit zwei Serverclustern;

Fig. 2

eine schematische Übersicht des Aufbaus einer zweiten Ausführungsform einer erfindungsgemäßen Servereinrichtung, mit drei Serverclustern.

The invention is illustrated in the drawing and is explained in more detail using exemplary embodiments. Show it:

Fig. 1

a schematic overview of the structure of a first embodiment of a server device according to the invention, with two server clusters;

Fig. 2

is a schematic overview of the structure of a second embodiment of a server device according to the invention, with three server clusters.

Overview of the invention

The present invention is based on the distribution of processes of a software control of a rail-bound transport security system in a virtual operating level to different server clusters. As a result, the processes can be migrated to the individual servers in their server cluster to ensure high availability in the event of the failure of individual individual servers. The processes are similar and the results of the processes are compared for security purposes. The distribution of the processes across different server clusters ensures that the processes always run on different individual servers, so that individual hardware errors lead to different process results that can easily be uncovered in the course of security checks.

HIS application in the context of the invention

The invention is described in more detail below using the example of the architecture of a HIS application, in particular with regard to the process distribution.

The HIS application (HIS = Human machine interface for Interlocking Systems) is a SIL2 (Safety Integrity Level 2) application, especially developed and approved according to the CENELEC EN 50128 standard. It essentially has the function of the user interface of an electronic signal box (ESTW) and can be designed in different forms for different markets or applications in order to take into account particular characteristics.

Common to all versions is the basic architecture that a master process carries out calculations, which ultimately lead to the so-called illumination (= visual representation on a screen) of states of the signal box elements. These calculations are also carried out simultaneously by one or more (depending on the version) slave process (s) and the results of the calculation are compared crosswise, i.e. Both the master process and the slave process (s) compare their own calculation result with that of the other. In the event of a mismatch in the calculation results, the overall system is put into a so-called "non-safe state", which no longer permits certain, safety-relevant operating actions.

A special feature of the HIS application is the so-called HIS server, which essentially serves to supply connected operator terminals with the calculated illuminations or states of the signal box elements.

In order to meet the requirements of SIL2 from the EN 50128 standard, the HIS architecture must be designed in such a way that the master process and a slave process run on different (hardware) processors. With multi-core processors, this can be achieved by firmly binding the processes to certain processor cores (core binding; processor affinity). This ensures that a computing error in a processor (or a processor core) can never lead to the same, wrong result in the master and slave processes (simultaneous double errors are excluded from the standard).

When porting the server applications to a common virtual operating level (virtual platform), it can no longer be easily guaranteed that the master and slave processes will not run over the same computing error of a processor, since the assignment of the virtual processor to the physical processor (Core) cannot be given and proven without further ado.

The inventors have recognized that several so-called server clusters can be formed from server computers (individual servers), which offer the advantages of a virtual operating level (high availability, redundancy) and at the same time ensure a physical separation of processes. With two server clusters, each consisting of at least two server computers, the master process can run on one server cluster and the slave process on the other server cluster. While it cannot be predicted which processor (core) in the server cluster is currently being used by a process, it can be excluded that the processes on the different server clusters will ever use the same processor (core).

This is the realization of the feature of the HIS architecture described above Can also be implemented on a virtual operating level when using the HIS application.

Embodiment of a server device with two server clusters

In Fig. 1 A first embodiment of a server device 1 according to the invention with two server clusters SC1, SC2 will be described in more detail. The server device 1 is also referred to as a virtual cluster.

The server device 1 here includes a first server cluster SC1 and a second server cluster SC2, which are spatially separated from one another, which is shown in FIG Fig. 1 is illustrated by a physical limit 2. By "spatially separated" it is meant that the server computers (SRV) of the two server clusters SC1, SC2 do not consist of the same hardware, but are separate computers. The spatial separation can thus be carried out both by building the server clusters SC1, SC2 in the same frame in a server room or in different frame in the same or different server rooms, as well as at different locations with a distance of several kilometers. The limiting factor for the maximum distance between the server clusters SC1, SC2 is the speed and latency of the network in between for the synchronization of the server clusters SC1, SC2. Network connections are in Fig. 1 represented by simple connecting lines.

In the first server cluster SC1, at least two server computers (individual servers) SRV-1-1, SRV-1-2 are combined to form a cluster. In the second server cluster SC2, at least two server computers (individual servers) SRV-2-1, SRV-2-2 are also combined to form a cluster.

• HIS-Master 11a (Prozess der HIS Applikation)
• HIS-Slave 11b (Prozess der HIS Applikation)
• Stellwerks-Steuerung Prozess-1 12a (Prozess der Stellwerks-Steuerung Applikation)
  (Interlocking-Control Process-1 = IL-Ctrl Proc-1)
• Stellwerks-Steuerung Prozess-2 12b (Prozess der Stellwerks-Steuerung Applikation)
  (Interlocking-Control Process-2 = IL-Ctrl Proc-2)
• Zugsicherungs-Steuerung Prozess-1 13a (Prozess der Zugsicherungs-Steuerung Applikation)
  (Train Control-Control Process-1 = TC-Ctrl Proc-1)
• Zugsicherungs-Steuerung Prozess-2 13b (Prozess der Zugsicherungs-Steuerung Applikation)
  (Train Control-Control Process-2 = TC-Ctrl Proc-2)
• Bedienoberfläche A 14 (Human Machine Interface A = HMI A)
• Anwendung B 15 (Application B = App B)
• Bedienoberfläche C 16 (Human Machine Interface C = HMI C)
• Anwendung D 17 (Application D = App D).

Various virtual machines VM run in a server cluster SC1, SC2, in which in turn a wide variety of applications and their processes to run. These can be applications whose processes are distributed across the individual server clusters, but only when they work together to produce a common functionality, as well as applications that run individually on a server cluster and provide functionality independently of the other processes and applications. Examples of applications and processes of the VM virtual machines are:

• HIS Master 11a (process of the HIS application)
• HIS slave 11b (process of the HIS application)
• Signal box control process-1 12a (process of signal box control application)
  (Interlocking-Control Process-1 = IL-Ctrl Proc-1)
• Signal box control process-2 12b (process of signal box control application)
  (Interlocking-Control Process-2 = IL-Ctrl Proc-2)
• Train protection control process-1 13a (process of train protection control application)
  (Train Control-Control Process-1 = TC-Ctrl Proc-1)
• Train protection control process-2 13b (process of train protection control application)
  (Train Control-Control Process-2 = TC-Ctrl Proc-2)
• User interface A 14 (Human Machine Interface A = HMI A)
• Application B 15 (Application B = App B)
• User interface C 16 (Human Machine Interface C = HMI C)
• Application D 17 (Application D = App D).

The server device 1 has a common cluster control 18 and a common storage control 19 for both server clusters SC1, SC2. Each server cluster SC1, SC2 has its own high availability control (HA) 20a, 20b, with which processes of the applications between the individual computers SRV-1-1, SRV-1-2 or SRV-2-1, SRV-2-2 can be moved within the respective server cluster SC1 or SC2, especially if a defect should occur in a single computer. Furthermore, each server cluster SC1, SC2 each has its own storage (Storage Vol 1, Storage Vol2) 21a, 21b, which can be used by the individual servers of the respective cluster SC1, SC2.

In the exemplary embodiment shown, the HIS server software 11 is divided into two parts: the HIS master process 11a is implemented on the first server cluster SC1, and the HIS slave process 11b (which is identical to the HIS master process 11a) implemented on the second server cluster SC2. The HIS master process 11a will therefore always run on one of the individual servers SRV-1-1 or SRV-1-2 of the first server cluster SC1, but not on the individual servers of the second server cluster SC2. Conversely, the HIS slave process 11b will always run on one of the individual servers SRV-2-1 or SRV-2-2 of the second server cluster SC2, but not on the individual servers of the first server cluster SC1. This ensures that the HIS master process 11a and the HIS slave process 11b are always physically separate from one another. If the process results match, the matching process result can be trusted.

Likewise, the similar processes 12a and 12b of the interlocking control software 12 are physically separated from one another, and the similar processes 13a and 13b of the train protection control software 13 are physically separated from one another; in the case of matching process results, the matching process result can in turn be trusted. The other software applications 14, 15, 16, 17 or their processes here are each without a similar counterpart to the other server clusters SC1, SC2, so they are only carried out simply on one of the server clusters SC1, SC2. This is primarily intended for non-safety-related applications.

Embodiment with three server clusters

In Fig. 2 An embodiment of a server device (virtual cluster) 30 according to the invention is shown, which has three server clusters SC1, SC2, SC3. The structure of the server device 30 with three server clusters SC1, SC2, SC3 largely corresponds to the structure with two server clusters of Fig. 1 , so that only the main differences are explained below.

Applications which follow the so-called 2out3 principle (2 out of 3 = 2oo3) can run on the server device 30 with three server clusters SC1, SC2, SC3. In these applications, three processes of the same type perform the same calculation algorithms and each result in a calculation result. A comparator compares these calculation results. If at least two of the three calculation results match, this matching result is considered correct. If the comparator finds three different results, the system is marked as "not sure". The signal box application or the train protection application, for example, work according to this principle.

A criterion for approval according to the EN 50128 standard for the 2oo3 systems is that the individual processes run on different hardware. This can be ensured by the server device 30 according to the invention (virtual cluster), which is based on three server clusters SC1, SC2, SC3 separated by physical limits 2. The interlocking application processes, for example, run embedded in a virtual machine VM distributed over the three server clusters and thus never use the same processors or processor cores. The safety standard according to SIL4 can also be achieved with 2003 systems.

• Bedien Prozess-1 31a (Prozess der Bedienoberfläche) (Operation Control Process-1 = OC Proc-1)
• Bedien Prozess-2 31b (Prozess der Bedienoberfläche) (Operation Control Process-2 = OC Proc-2)
• Bedien Prozess-3 31c (Prozess der Bedienoberfläche) (Operation Control Process-3 = OC Proc-3)
• Stellwerks Prozess-1 32a (Prozess der Stellwerks Applikation) (Interlocking Process-1 = IL Proc-1)
• Stellwerks Prozess-2 32b (Prozess der Stellwerks Applikation) (Interlocking Process-2 = IL Proc-2)
• Stellwerks Prozess-3 32c (Prozess der Stellwerks Applikation) (Interlocking Process-3 = IL Proc-3)
• Zugsicherungs Prozess-1 33a (Prozess der Zugsicherungs Applikation) (Train Control Process-1 = TC Proc-1)
• Zugsicherungs Prozess-2 33b (Prozess der Zugsicherungs Applikation) (Train Control Process-2 = TC Proc-2)
• Zugsicherungs Prozess-3 33c (Prozess der Zugsicherungs Applikation) (Train Control Process-3 = TC Proc-3)

Typical applications of 2003 systems and their processes are:

• Operating process-1 31a (process of the user interface) (Operation Control Process-1 = OC Proc-1)
• Operating process-2 31b (process of the user interface) (Operation Control Process-2 = OC Proc-2)
• Operating process-3 31c (process of the user interface) (Operation Control Process-3 = OC Proc-3)
• Signal box process-1 32a (process of the signal box application) (Interlocking Process-1 = IL Proc-1)
• Signal box process-2 32b (process of the signal box application) (Interlocking Process-2 = IL Proc-2)
• Signal box process-3 32c (process of the signal box application) (Interlocking Process-3 = IL Proc-3)
• Train protection process-1 33a (process of the train protection application) (Train Control Process-1 = TC Proc-1)
• Train protection process-2 33b (process of train protection application) (Train Control Process-2 = TC Proc-2)
• Train protection process-3 33c (process of train protection application) (Train Control Process-3 = TC Proc-3)

In the present case, the similar processes 31a, 31b, 31c or associated parts of the operating software 31 are distributed among the three server clusters SC1, SC2, SC3, so that the processes 31a, 31b, 31c are never on the same processor or run on the same hardware, and thus their process results cannot be wrong in the same way due to a single hardware fault. The same applies to the processes 32a, 32b, 32c of the interlocking software 32 and also the processes 33a, 33b, 33c of the train protection software 33. Others can also be used in a virtual cluster or a server device 30 with three server clusters SC1, SC2, SC3 , individual applications or other processes are running that are independent of the 2003 systems, here the other software applications HMI A 34, App B 35, HMI C 36, App D 37, HMI E 38, App F 39.

Reference list

1

Server setup

2nd

physical limit

11a, 11b

similar processes

11

Software (HIS server)

12a, 12b

similar processes

12th

Software (signal box control)

13a, 13b

similar processes

13

Software (train protection control)

14-17

other software

18th

Cluster control

19th

Memory control

20a-20c

High availability control

21a-21c

Storage

30th

Server setup

31a-31c

similar processes

31

Software (operation)

32a-32c

similar processes

32

Software (signal box)

33a-33c

similar processes

33

Software (train protection)

34-39

other software

SC1-SC3

Server cluster

SRV-1-1

Server computer (single server)

SRV-1-2

Server computer (single server)

SRV-2-1

Server computer (single server)

SRV-2-2

Server computer (single server)

SRV-3-1

Server computer (single server)

SRV-3-2

Server computer (single server)

Claims (10)

1. A server device (1; 30) operating a piece of software for controlling a function of a rail transport safety system,
   wherein the software (11, 12, 13; 31, 32, 33) operates at least two processes (11a-11b; 12a-12b; 13a-13b; 31a-31c; 32a-32c; 33a-33c) physically separated from one another, the results of which are compared to one another in order to perform control of the function,
   characterized in that
   the software (11, 12, 13; 31, 32, 33) is operated on a virtual operating platform of the server device (1; 30),
   in that the server device (1; 30) comprises at least two physically separate server clusters (SC1, SC2, SC3),
   wherein each of the server clusters (SC1, SC2, SC3) of the server device (1; 30) comprises at least two individual servers (SRV-1-1, SRV-1-2, SRV-2-1, SRV-2-2, SRV-3-1, SRV-3-2) which between them allow for a migration of processes (11a-11b; 12a-12b; 13a-13b; 31a-31c; 32a-32c; 33a-33c) in the event that an individual server (SRV-1-1, SRV-1-2, SRV-2-1, SRV-2-2, SRV-3-1, SRV-3-2) fails,
   wherein the at least two processes (11a-11b; 12a-12b; 13a-13b; 31a-31c; 32a-32c; 33a-33c) run on virtual machines (VM),
   and in that the software (11, 12, 13; 31, 32, 33) comprises at least two parts that are installed on different server clusters of the at least two server clusters (SC1, SC2, SC3), so that the at least two processes (11a-11b; 12a-12b; 13a-13b; 31a-31c; 32a-32c; 33a-33c) are operated on different server clusters of the at least two server clusters (SC1, SC2, SC3).
2. The server device (1; 30) as claimed in claim 1, characterized in that the software (11, 12, 13; 31, 32, 33) is an interlocking application.
3. The server device (1; 30) as claimed in claim 2, characterized in that the software (11, 12, 13; 31, 32, 33) is an application for the operation of the user interface of a computer-aided interlocking, in particular with a functionality for linking in mobile operating terminals.
4. The server device (1; 30) as claimed in claim 1, characterized in that the software (11, 12, 13; 31, 32, 33) is a train protection application.
5. The server device (1; 30) as claimed in one of the preceding claims, characterized in that the software (11, 12, 13; 31, 32, 33) is configured according to safety integrity level 2 (SIL2) or higher.
6. The server device (1; 30) as claimed in one of the preceding claims, characterized in that the software (11, 12, 13; 31, 32, 33) is configured according to safety integrity level 4 (SIL4).
7. The server device (1; 30) as claimed in one of claims 1 to 6, characterized in that the software (11, 12, 13) operates precisely two processes (11a-11b; 12a-12b; 13a-13b), physically separated from one another, on precisely two different server clusters (SC1, SC2).
8. The server device (1; 30) as claimed in one of claims 1 to 7, characterized in that the server device (30) comprises three server clusters (SC1, SC2, SC3) physically separated from one another, that the software (31, 32, 33) comprises at least three parts which are installed on different server clusters of the server clusters (SC1, SC2, SC3), so that the software (31, 32, 33) operates three processes (31a-31c; 32a-32c; 33a-33c) on different server clusters of the three server clusters (SC1, SC2; SC3), and that the results of the processes (31a-31c; 32a-32c; 33a-33c) are evaluated in the context of a 2-out-of-3 decision for the control of the function of the rail transport safety system.
9. The server device (1; 30) as claimed in one of the preceding claims, characterized in that the server device (1; 30) operates at least one further software (14-17; 34-39) for controlling a further function of a rail transport safety system,
   and that the at least one further software (14-17; 34-39) is installed and operated on only one of the server clusters (SC1, SC2, SC3).
10. The server device (1; 30) as claimed in claim 9, characterized in that the at least one further software (14-17; 34-39) comprises one or a plurality of the following software applications:

    - schedule planning system, in particular Aramis-D;

    - train number management and train routing system, in particular ARAMIS-C

    - data analysis and metric system (business intelligence);

    - train servicing system (maintenance center);

    - train data acquisition and control system (checkpoint master node);

    - operating component acquisition and evaluation system (service management tool).

Images