CN103612650A - Method for simplifying rail transit train operation control system - Google Patents

Abstract

The invention discloses a method for simplifying a rail traffic train operation control system and belongs to the technical field of rail traffic control. The method specifically includes: 1) improving the design method of the general safety computer platform; 2) simplifying the on-vehicle application or ground application of the rail transit train operation control system. The designed universal secure computer platform is based on the principle of hardware/software difference design and the principle of hierarchical diagnosis. The software supports the simultaneous realization of multiple application control logic functions based on the principle of dual certainty. The logic processing layer of the general security computer platform designed by this method can support multiple traditional rail transit operation control logic processing functions at the same time, which reduces the number of equipment in the traditional rail transit train operation control system and improves the reliability of the operation control system; The safety computer platform can be transplanted to rail transit train operation control systems with different requirements, which reduces the workload of development and safety assessment, and reduces the cost of development and safety assessment.

Description

A method for simplifying rail transit train operation control system

technical field

The invention belongs to the technical field of rail traffic control, and particularly designs a method for simplifying a rail traffic train operation control system.

Background technique

The rail transit system mainly includes railways and urban rail transit (hereinafter referred to as urban rail). In recent years, new rail transit train operation control systems, such as the Chinese Train Control System (CTCS) applied to railways and the Communication Based Train Control System (CBTC) applied to urban rail ) emerged as the times require, providing a solid technical foundation and safety foundation for high-speed railways and high-density and low-interval urban rails.

By analyzing the current CTCS and CBTC system structures, it is not difficult to find that these systems follow the idea of traditional signal equipment design, adopt different subsystems for different operation control functions, and realize the entire system based on the principle of superposition.

For example: CTCS-2 ground system includes computer interlocking CBI, train operation control center TCC, track circuit controlled by it, trackside electronic unit LEU (including active transponder), etc., as shown in Figure 1; CTCS-2 The on-board system includes on-board safety computer VC (including speed and distance measurement function), transponder information receiving module BTM, track circuit information receiving unit TCR, man-machine interface DMI, etc., as shown in Figure 2.

The CTCS-3 level ground system includes the radio block center RBC and the GSM-R ground equipment connected to it, the temporary speed limit server TSRS, the computer interlocking CBI, the train operation control center TCC and the track circuit controlled by it, the trackside electronic Unit LEU (including active transponder), etc., as shown in Figure 3; CTCS-3 vehicle-mounted system includes C3 vehicle-mounted ATP host, C2 vehicle-mounted ATP host, speed measurement intelligent unit SDU, transponder information receiving module BTM, track circuit information receiving unit TCR, man-machine interface DMI, GSM-R vehicle-mounted equipment, etc., as shown in Figure 4, in Figure 4, there are 2 sets of 3 vehicle-mounted ATP hosts, C2 vehicle-mounted ATP hosts, speed measurement intelligent unit SDU, and transponder information receiving module BTM. Two sets of cold standby mode is used.

A typical CBTC ground system includes zone controller ZC, data storage unit DSU, computer interlocking CBI, axle counting equipment controlled by it, wayside electronic unit LEU (including active transponder), etc., as shown in Fig. 5; typical The CBTC vehicle-mounted system includes vehicle-mounted ATP controller VOBC (including speed and distance measurement function), vehicle-mounted ATO controller, transponder information receiving module BTM, man-machine interface DMI, wireless vehicle-mounted equipment MR, etc., as shown in Figure 6.

The biggest advantage of implementing the rail transit train operation control system in the above way is that the boundaries between the subsystems are clear, and the original subsystems can be modified as much as possible without or with minimal modification, reducing the resulting research and development, testing, confirmation, verification and Reduce the workload of security assessment, etc., and reduce the possibility of errors.

But the shortcoming that realizes rail transit train operation control system in the above-mentioned way is also obvious. First of all, doing so will cause the train operation control system to contain many subsystems with a complex structure and a large number of devices. According to the basic principle of reliability, the more complex the system structure and the more devices, the lower the system MTBF. Even if the entire system complies with the relevant safety standards and meets the corresponding safety integrity level (SIL) requirements, due to the low MTBF of the system, failures will occur more frequently and the system recovery time will be longer, which not only reduces the operating efficiency of the system, but also easily induces other problems. Major accidents, in recent years, many major rail transit accidents occurred during equipment failures, which fully proves this point.

Secondly, due to the existence of many subsystems, the mutual coordination (through communication) between the subsystems will occupy a large amount of software resources of each subsystem. software and hardware resources.

Finally, the more equipment there is, the more difficult it is to deal with problems such as space occupation, high energy consumption, and heat dissipation, especially for vehicle-mounted equipment.

Therefore, it is very necessary to study the method of simplifying the structure of rail transit train operation control system and reducing the number of equipment.

In recent years, computer hardware and software technology has developed rapidly. CPUs are increasingly developing towards multi-core, low power consumption, and support for virtualization, etc., and their comprehensive processing capabilities are getting stronger and stronger. Functions that previously required multiple CPUs to be processed are now completed by a single CPU. Simultaneously, the rapid development of technologies such as memory, disk, and network also makes the processing speed and processing capability of computers stronger and stronger, and these enable the present invention to be implemented.

Contents of the invention

For the shortcoming that above-mentioned prior art exists, the present invention proposes a kind of method that simplifies rail traffic train operation control system, it is characterized in that, this method is to simplify rail traffic train operation control system based on general safety computer platform design, concrete steps are: 1 ) Improve the design method of the general security computer platform; 2) Simplify the vehicle application or ground application of the rail transit train operation control system.

In the step 1), the universal secure computer platform is implemented based on the principle of hardware/software differentiation and hierarchical diagnosis, and the software is based on the principle of dual certainty, supporting the simultaneous realization of multiple application control logic functions.

The general secure computer platform uses a 2 by 2 out of 2 structure, and mainly includes three parts: a logic processing layer, an external device management layer, a fault-tolerant and a security management layer.

The logical processing layer is composed of 2 groups of 4 logic processing units LPU in total, and each 2 LPUs constitute a group of 2-out-of-2 structure. 2 by 2 out of 2 structure; the logic processing layer provides high security, high reliability and high-performance computing processing capabilities in line with the 2 by 2 out of 2 mechanism to support the realization of multiple traditional rail transit train operation control logic functions.

The external equipment management layer is composed of 2 groups of 4 external equipment management units PMU, each 2 PMUs constitute a series of 2 out of 2 structure, and the selection of the 2 PMUs of a series conforms to the hardware/software difference design principle , the two systems constitute a hot-standby 2-out-2 redundant structure or a parallel 2-out-2 redundant structure, preferably a parallel 2-out 2 redundant structure;

The external device management layer provides: (1) general digital, analog, pulse input or general digital, analog output capabilities; (2) for track circuit, LEU, BTM, TCR applications, based on DSP or Intelligent input or output capability realized by FPGA; (3) Various external communications used by rail transit train operation control system, including: asynchronous serial communication using RS-232, RS-485, RS-422 interfaces; field bus communication : CAN, Profibus; train communication network TCN standard MVB communication; Ethernet communication; vehicle-ground mobile communication: GSM-R, wireless local area network WLAN.

In any one of the two systems of the two systems of the parallel 2-out-2 redundant structure of the management layer of the external device, each of the general-purpose digital, analog, and pulse input signals and each of the DSP or FPGA intelligent input signals are 2 simultaneous The input is sent to the four LPUs of the logical processing layer after being processed by two heterogeneous PMUs based on 2-out-2 logic.

In any one of the two systems in the parallel 2-out-of-2 redundant structure of the management layer of the external equipment, each channel of each general-purpose digital output signal is 2 channels of simultaneous output, and is formed with another system after 2-out of 2 voting Parallel redundant output, its feedback signal is sent to the four PMUs in the parallel redundant system of the external equipment management layer at the same time to ensure output safety;

In view of the common demand for general analog output signals and DSP or FPGA intelligent output signals, the main system of the two systems of the two systems of the external device management layer is hot standby 2 out of 2 redundant structures, and one PMU is used to output analog values and DSP or FPGA The intelligent output signal of the heterogeneous PMU is supervised by the other PMU to ensure the output safety; the external device management layer hot standby 2 takes the backup system of the two redundant systems, and the two heterogeneous PMUs are not Output analog and intelligent output signals of DSP or FPGA, only monitor the output signal of the main system, once the output signal of the main system is abnormal, it will take over its output and become the main system.

Aiming at the common requirement of external communication redundancy mode, in any of the two systems in the parallel 2-out-2 redundant structure of the management layer of the external equipment, one input of each external communication redundancy adopts one PMU input and the other one Heterogeneous PMU direct input or monitor input mode, two heterogeneous PMUs are processed based on 2 out of 2 logic and then sent to 4 LPUs in the logic processing layer, and the other input is another input of the external communication redundancy;

One PMU output is used for one output of each external communication redundancy, and another heterogeneous PMU directly inputs or monitors the input supervision of the external communication output to ensure output safety, and the other one outputs the other output of the external communication redundancy output and supervise the external communication output to ensure output safety.

The man-machine operation interface DMI is connected to the management layer of external equipment through redundant external Ethernet or redundant external asynchronous serial communication bus.

The fault-tolerant and safety management layer is composed of 2 or more fault-tolerant and safety management units FTSMU, preferably the scheme of 2 FTSMUs, the realization of 2 FTSMUs conforms to the hardware/software difference design principle; the fault-tolerant and safety management layer and logic processing Layers cooperate with each other to complete the 2 by 2 out of 2 mechanism, and cooperate with the external device management layer to complete the hot standby 2 out of 2 redundancy mechanism or parallel 2 out of 2 redundancy mechanism.

4 logical processing units LPU of the logical processing layer, 4 external equipment management units PMU of the external equipment management layer, 2 or more fault tolerance and security management units FTSMU of the fault tolerance and security management layer through redundant security The communication intranet VCIN communicates with each other based on the safety communication protocol of the first type of closed transmission system stipulated in EN50159.

The software running on 4 logical processing units LPU of the logical processing layer, 4 external equipment management units PMU of the external equipment management layer, and 2 or more fault-tolerant and security management units FTSMU of the fault-tolerant and security management layer, supports Simultaneously implement multiple application control logic.

The hardware/software difference design principle is to choose different processor architectures for hardware, and choose different operating systems, different compilers or different programming languages for software.

The principles of grading diagnosis are as follows:

(1) All input channels are diagnosed by reading the input of a specific value, and the input diagnosis is initiated by the processor; the diagnosis period is fixed, preferably the same as the processor control period, and is completed within a specific period of time within the processor control period;

(2) The input channel of 2 out of 2 structure performs a 2 out of 2 comparison of the input value in each processor control cycle. If the digital input value is inconsistent or the deviation of the analog input value and the pulse input value exceeds the predetermined range, the 2 There is a problem with the input channel of the group, and the input volume of the department is no longer recognized;

(3) All output channels complete the diagnosis by feedbacking the output of a specific value. The output diagnosis is initiated by a specific signal application, controlled by the processor, and completed within a specific period of time;

(4) The output channel performs output feedback in each processor control cycle and compares it with the actual output value. Once the digital output is inconsistent or the deviation of the analog output and pulse output exceeds the predetermined range, there is a problem with the output channel, and other This output of the system of the corresponding 2 out of 2 structure should lead to safety;

(5) The diagnosis of the processor and its related memory and other peripherals, under the supervision of the third-party FTSMU, complete the same deterministic work asynchronously and in the processor The mutual comparison of the execution results is independently completed within a specific period of time in each control cycle, and only when the diagnostic results are completely consistent can it be judged normal;

(6) At the moment when the universal secure computer platform is initially powered on, the processor completes the scan diagnosis of itself and its related memory, various inputs, outputs and other peripherals.

The dual deterministic principle respectively refers to the cyclic execution strategy based on fixed allocation and the memory protection strategy based on fixed allocation; the cyclic execution strategy based on fixed allocation ensures the execution time determinism of multiple control logics supported; the fixed allocation-based Memory protection strategy to ensure the data storage space determinism of multiple control logics supported.

For the rail transit train operation control ground system, based on the principle of distributed processing, the general security computer platform is divided into core host configuration and remote peripheral configuration;

The core host type configuration includes logical processing layer, part of external device management layer, fault tolerance and safety management layer, and safety communication intranet VCIN; part of the external device management layer only supports redundant external Ethernet communication function;

Remote peripheral configuration includes two parts: external device management layer, fault tolerance and safety management layer, and safety communication intranet VCIN.

The step 2) determines whether it is a vehicle application or a ground application:

For ground applications, divide the application logic processing functions, input and output functions, and DMI functions of the existing ground train control equipment, and then merge multiple ground train control application logic processing functions into the core host type to configure a general-purpose secure computer platform, and merge the same The different ground train control input and output functions at the site position are configured with a general-purpose secure computer platform for the remote peripheral type, and multiple remote peripheral types are configured with a general-purpose secure computer platform according to the site conditions, and finally one or more man-machine operation interfaces (DMI) are set according to the site conditions For ground train control;

On-vehicle application, divide the application logic processing function, input and output function, and man-machine interface DMI function of the existing on-board train control equipment, and then merge multiple ground train control application logic processing functions into the logic processing layer of the general security computer platform, and merge the on-board The train control input and output functions are in the external equipment management layer of the general safety computer platform, and the driver man-machine operation interface DMI is set according to the site conditions.

The vehicle-mounted or ground-based applications of the rail transit train operation control system in step 2) are CTCS-2 level ground system, CTCS-2 level vehicle-mounted system, CTCS-3 level ground system, CTCS-3 level vehicle-mounted system, CBTC ground system system, CBTC vehicle system.

Beneficial effects of the invention:

(1) By making full use of the current computer's powerful software and hardware processing capabilities, the logic processing layer of the general security computer platform can support multiple traditional rail transit operation control logic processing functions at the same time, changing the traditional operation control system that is realized by superimposing different functional subsystems. The method reduces the number of equipment and improves the reliability of the operation and control system.

(2) For the rail transit train operation control ground system, based on the principle of distributed processing, it is divided into the core host part and the remote peripheral part. The remote peripherals should be as close to the on-site control objects as possible, and the hard wiring between them should be shortened as much as possible, which reduces wiring costs, reduces the introduction of various electromagnetic interferences, reduces failure points, and improves operational reliability.

(3) The universal security computer platform has different configuration methods and can be transplanted to rail transit train operation control systems with different requirements, which reduces the workload of development and safety assessment, and reduces the cost of development and safety assessment.

(4) The rail transit train operation control system structure based on the general security computer platform is not only suitable for simplifying the current rail transit train operation control system, but also suitable for the realization of the next generation rail transit train operation control system.

Description of drawings

Figure 1 is a typical CTCS-2 ground system structure diagram;

Figure 2 is a typical CTCS-2 vehicle system structure diagram;

Figure 3 is a typical CTCS-3 ground system structure diagram;

Figure 4 is a typical CTCS-3 vehicle system structure diagram;

Figure 5 is a typical CBTC ground system structure diagram;

Fig. 6 is a typical CBTC vehicle-mounted system structure diagram;

Fig. 7 is the flow chart of the method for the simplified rail transit train operation control system that the present invention proposes;

Fig. 8 is that 2 is multiplied by 2 and gets 2 structure and is made up of the general security computer platform structure;

Fig. 9 is a functional block diagram of the input processing principle of the external equipment management layer of the universal security computer platform;

Fig. 10 is a block diagram of the general digital output processing principle of the external equipment management layer of the general security computer platform;

Fig. 11 is a block diagram of general analog quantity output and intelligent output processing of the external equipment management layer of the general security computer platform;

Fig. 12 is a functional block diagram of redundant external communication processing of the external equipment management layer of the general security computer platform;

Fig. 13 supports multiple application control logics for the general security computer platform software;

Fig. 14 is the realization of the principle of double certainty of general safety computer platform software;

Fig. 15 is the universal security computer platform under the configuration of the core mainframe;

Fig. 16 is the universal secure computer platform under the configuration of remote peripheral device;

Figure 17 is a schematic block diagram of a simplified CTCS-2 ground system based on a general-purpose security computer platform;

Figure 18 is a schematic block diagram of a simplified CTCS-2 vehicle-mounted system based on a general-purpose security computer platform;

Figure 19 is a schematic block diagram of a simplified CTCS-3 level ground system based on a general-purpose security computer platform;

Figure 20 is a schematic block diagram of a simplified CTCS-3 vehicle system based on a general-purpose security computer platform;

Figure 21 is a simplified schematic block diagram of the CBTC ground system based on a general secure computer platform; Figure 22 is a simplified schematic block diagram of a CBTC vehicle-mounted system based on a general secure computer platform.

Detailed ways

The method proposed by the invention will be further described below in conjunction with the accompanying drawings.

The present invention simplifies the rail transit train operation control system based on a general-purpose security computer platform design, as shown in FIG. The method is to design and simplify the rail transit train operation control system based on the general safety computer platform, firstly improve the design method of the general safety computer platform; and then simplify the vehicle application or ground application of the rail transit train operation control system.

The present invention improves the safe computer platform design method provided by Chinese invention patents CN201010235370.5 and CN201010241067.6. Specifically, the universal secure computer platform used in the present invention is implemented based on the principle of hardware/software differentiation and hierarchical diagnosis, and its software is based on the principle of dual certainty, supporting the simultaneous realization of multiple application control logic functions.

The hardware/software difference design principle is mainly aimed at the common cause failure caused by the common cause failure caused by the same hardware architecture and the same operating system, compiler or programming language commonly used in the current security computer platform design. Choosing different processor architectures, and at the same time choosing different operating systems, different compilers, or different programming languages for implementation can further reduce common cause failures. For example, choose different X86 architecture, PowerPC architecture, ARM architecture, etc. on the hardware, and choose different brands of operating systems and their development environments.

Considering the actual application and relevant regulations of the current rail transit train operation control system, it is recommended that the general security computer platform use a 2 by 2 out of 2 structure (note: here 2 out of 2 by 2 and 2 out of 2 have the same meaning).

The general secure computer platform with 2x2 structure mainly includes three parts: logical processing layer, external equipment management layer, fault tolerance and security management layer, as shown in Figure 8.

Among them, the logical processing layer is composed of 2 groups of 4 logical processing units LPU, each 2 LPUs constitute a group of 2 out of 2 structure, and the two systems form a 2 by 2 out of 2 structure. The selection of 2 LPUs for each series should conform to the hardware/software difference (heterogeneous) design principle, for example, one is based on the X86 architecture and the other is based on the PowerPC architecture, and at the same time choose different operating systems, different compilers or different programming language.

The logic processing layer provides high-safety, high-reliability and high-performance computing processing capabilities in line with the 2 by 2 take-2 mechanism to support the realization of multiple rail transit train operation control logic functions.

The external equipment management layer consists of 2 groups of 4 external equipment management units PMU, each 2 PMUs constitute a group of 2 out of 2 structure, and the two systems form a hot standby (2 times) 2 out of 2 redundant structure or parallel 2 Take 2 redundant structures, preferably parallel redundant structures. The selection of 2 PMUs in each series should also conform to the hardware/software difference (heterogeneous) design principle, for example, one is based on the X86 architecture and the other is based on the PowerPC architecture, and at the same time choose different operating systems, different compilers or different programming languages.

The external device management layer provides:

(1) General digital, analog, pulse input or general digital, analog output capability;

(2) For special applications such as track circuits, LEUs, BTMs, and TCRs, intelligent input or output capabilities that need to be realized based on DSP or FPGA;

(3) Various external communications used by rail transit train operation control systems, including: asynchronous serial communications using RS-232, RS-485, and RS-422 interfaces; fieldbus communications: CAN, Profibus; train communication network TCN standard MVB communication; Ethernet communication; vehicle-ground mobile communication: GSM-R, wireless local area network WLAN.

In any of the two systems of parallel redundancy of the external equipment management layer, each of the general digital, analog, and pulse input signals and each of the DSP or FPGA-based intelligent input signals is 2 simultaneous inputs, after different The two PMUs in the structure are processed based on the 2-out-2 logic and then sent to the 4 LPUs in the logic processing layer, as shown in Figure 9.

In any of the two systems of parallel redundancy in the management layer of external equipment, each channel of each general-purpose digital output signal is 2 channels of simultaneous output, and after 2 out of 2 votes, it forms a parallel redundant output with the other system. Feedback signals are sent to the four PMUs in the parallel redundant systems of the external equipment management layer at the same time to ensure output safety, as shown in Figure 10.

For the common demand of general analog output signals and intelligent output signals based on DSP or FPGA, the main system of the two series of external equipment management layer hot standby (2 times), uses 1 PMU to output analog signals and DSP or FPGA-based Intelligent output signal, another heterogeneous PMU supervises the output signal to ensure output safety. The standby system of the two systems of the external equipment management layer is hot standby (2 times). If the output signal of the system is abnormal, it will take over its output and become the main system, as shown in Figure 11.

In view of the general demand for external communication redundancy, in any of the two systems of parallel redundancy of the external equipment management layer, one input of each external communication redundancy adopts 1 PMU input and the other 1 heterogeneous PMU direct input Or in the way of monitoring input, the two heterogeneous PMUs are processed based on 2 out of 2 logic and then sent to the 4 LPUs of the logic processing layer, and the other one is input to the other input of the external communication redundancy. One PMU output is used for one output of each external communication redundancy, and another heterogeneous PMU directly inputs or monitors the input supervision of the external communication output to ensure output safety, and the other one outputs the other output of the external communication redundancy output and supervise the external communication output to ensure output safety, as shown in Figure 12.

The fault-tolerant and security management layer consists of two or more fault-tolerant and security management units FTSMU. The solution of two FTSMUs is preferred, and the implementation of the two FTSMUs should also conform to the hardware/software difference (heterogeneous) design principle, for example, one based on The ARM architecture is implemented using C language, and the other one is implemented based on a programmable logic device, such as FPGA, using a hardware description language, such as VHDL.

The fault-tolerant and safety management layer cooperates with the logical processing layer to complete the 2 by 2 out of 2 mechanism, and cooperates with the external device management layer to complete the hot standby (2 by 2) 2 out of 2 redundancy mechanism or parallel 2 out of 2 redundancy mechanism. For the implementation method, please refer to Chinese invention patents CN201010235370.5 and CN201010241067.6.

The man-machine operation interface DMI is connected to the management layer of external equipment through redundant external Ethernet or redundant external asynchronous serial communication bus.

4 logical processing units LPU of the above-mentioned logical processing layer, 4 external equipment management units PMU of the external equipment management layer, and 2 or more fault-tolerant and security management units FTSMU of the fault-tolerant and security management layer through redundant secure communication The intranet VCIN communicates with each other based on the first type of closed network security communication protocol stipulated in EN50159.

The principle of hierarchical diagnosis is mainly aimed at the current situation of full diagnosis of complex processors and related memories and other peripherals caused by the more and more extensive use of COTS hardware, and solves the logic problem of "diagnosing yourself", thereby improving the diagnostic coverage.

The principles of graded diagnosis are:

(1) All input channels are diagnosed by reading the input of a specific value, and the input diagnosis is initiated by the processor; the diagnosis period is fixed, preferably the same as the processor control period, and is completed within a specific period of time within the processor control period;

(2) The input channel of 2 out of 2 structure performs a 2 out of 2 comparison of the input value in each processor control cycle. If the digital input value is inconsistent or the deviation of the analog input value and the pulse input value exceeds the predetermined range, the 2 There is a problem with the input channel of the group, and the input volume of the department is no longer recognized;

(3) All output channels complete the diagnosis by feedbacking the output of a specific value. The output diagnosis is initiated by a specific signal application, controlled by the processor, and completed within a specific period of time;

(4) The output channel performs output feedback in each processor control cycle and compares it with the actual output value. Once the digital output is inconsistent or the deviation of the analog output and pulse output exceeds the predetermined range, there is a problem with the output channel, and other This output of the system of the corresponding 2 out of 2 structure should lead to safety;

(5) The diagnosis of the processor and its related memory and other peripherals, under the supervision of the third-party FTSMU, complete the same deterministic work asynchronously and in the processor The mutual comparison of the execution results is independently completed within a specific period of time in each control cycle, and only when the diagnostic results are completely consistent can it be judged normal;

(6) At the moment when the universal secure computer platform is initially powered on, the processor completes the scan diagnosis of itself and its related memory, various inputs, outputs and other peripherals.

The software running on the logic processing unit LPU, the external equipment management unit PMU, and the fault tolerance and security management unit FTSMU based on the ARM architecture all support the simultaneous realization of multiple signal application control logics, as shown in Figure 13.

In terms of software, the dual deterministic principles that support the simultaneous implementation of multiple signal application control logics refer to the cyclic execution strategy based on fixed allocation and the memory protection strategy based on fixed allocation respectively. The cyclic execution strategy based on fixed allocation ensures the deterministic execution time of multiple supported control logics, and the memory protection strategy based on fixed allocation ensures the deterministic data storage space of multiple supported control logics, as shown in Figure 14 . These two measures can further improve software security.

For the ground system of rail transit operation control, based on the principle of distributed processing, the above-mentioned general security computer platform can also be simplified into two modes: core host configuration and remote peripheral configuration. When the core host type is configured, it includes three parts: the logical processing layer, some external device management layers, fault tolerance and security management layers, and the security communication intranet VCIN, as shown in Figure 15. Some of the external device management layers only support redundant external Ethernet communication functions. For remote peripheral configuration, it includes two parts: the external device management layer, the fault-tolerant and security management layer, and the secure communication intranet VCIN, as shown in Figure 16.

Simplify the vehicle application or ground application of the rail transit train operation control system based on the general security computer platform:

For ground applications, divide the application logic processing functions, input and output functions, and DMI functions of the existing ground train control equipment, and then merge multiple ground train control application logic processing functions into the core host type to configure a general-purpose secure computer platform, and merge the same The different ground train control input and output functions at the site position are configured with a general-purpose secure computer platform for the remote peripheral type, and multiple remote peripheral types are configured with a general-purpose secure computer platform according to the site conditions, and finally one or more man-machine operation interfaces (DMI) are set according to the site conditions For ground train control;

On-vehicle application, divide the application logic processing function, input and output function, and man-machine interface DMI function of the existing on-board train control equipment, and then merge multiple ground train control application logic processing functions into the logic processing layer of the general security computer platform, and merge the on-board The train control input and output functions are in the external equipment management layer of the general safety computer platform, and the driver man-machine operation interface DMI is set according to the site conditions.

For typical rail transit systems such as railways and urban rail, the specific implementation plan of the simplified train operation control system based on the general security computer platform is as follows:

(1) CTCS-2 ground system implementation plan

Based on the principle of distributed processing, the CTCS-2 ground system is divided into the core host part and the remote peripheral part. The core host is implemented based on a secure computer platform configured with the core host type, placed in the current signal machinery room, and supports the core control logic of the current computer interlocking CBI, train operation control center TCC, and the man-machine interface DMI that is compatible with the computer interlocking CBI Function. The remote peripherals are implemented on a secure computer platform based on remote peripheral configurations, as close as possible to on-site control objects, ensuring that the hard wiring between remote peripherals and on-site control objects is as short as possible, reducing wiring costs, and reducing the risk of various electromagnetic interferences Introduced to reduce points of failure. Remote peripherals support computer interlocking general digital input or output functions, track circuit general digital input or output functions and intelligent input or intelligent output functions, trackside electronic unit LEU general digital input or output functions and intelligent input or intelligent output functions function, as shown in Figure 17.

(2) CTCS-2 vehicle system implementation plan

The CTCS-2 vehicle-mounted system is implemented based on a general-purpose security computer platform, and its logic processing layer supports the current vehicle-mounted ATP, speed measurement and distance measurement, transponder information processing, and track circuit information processing functions. Its external equipment management layer supports the general digital input and output functions of the train interface unit, the general pulse input function of the speed sensor, the intelligent input function of track circuit information based on DSP, the intelligent input function of transponder information based on DSP or FPGA, and the human The DMI communication function of the machine operation interface, as shown in Figure 18.

(3) CTCS-3 ground system implementation plan

Based on the principle of distributed processing, the CTCS-3 level ground system is divided into the core host part and the remote peripheral part. The core host is implemented based on a secure computer platform configured with the core host type, placed in the current signal machinery room, and supports the core control logic of the current wireless block center RBC, temporary speed limit server TSRS, computer interlocking CBI, train operation control center TCC, and temporary Man-machine interface DMI function compatible with speed limit server TSRS and computer interlocking CBI. The remote peripherals are implemented on a secure computer platform based on remote peripheral configurations, as close as possible to on-site control objects, ensuring that the hard wiring between remote peripherals and on-site control objects is as short as possible, reducing wiring costs, and reducing the risk of various electromagnetic interferences Introduced to reduce points of failure. Remote peripherals support computer interlocking general digital input or output functions, track circuit general digital input or output functions and intelligent input or intelligent output functions, trackside electronic unit LEU general digital input or output functions and intelligent input or intelligent output functions function, as shown in Figure 19.

(4) CTCS-3 vehicle system implementation plan

The CTCS-3 vehicle-mounted system is realized based on a general-purpose security computer platform, and its logic processing layer supports the current C3 vehicle-mounted ATP, C2 vehicle-mounted ATP, speed and distance measurement, transponder information processing, and track circuit information processing functions. Its external equipment management layer supports the general digital input and output functions of the train interface unit, the general pulse input function of the speed sensor, the intelligent input function of track circuit information based on DSP, the intelligent input function of transponder information based on DSP or FPGA, and the human The communication functions of the machine operation interface DMI, the GSM-R wireless communication unit RTU, and the train communication network MVB are shown in Figure 20.

(5) CBTC ground system implementation plan

Based on the principle of distributed processing, the CBTC ground system is divided into the core host part and the remote peripheral part. The core host is implemented based on a secure computer platform configured with a core host type, placed in the current signal machine room, and supports the core control logic of the current zone controller ZC, data storage unit DSU, computer interlocking CBI, and interlocking with the data storage unit DSU and computer Man-machine interface DMI function compatible with CBI. The remote peripherals are implemented based on a secure computer platform configured with remote peripherals, and are as close as possible to the on-site control objects to ensure that the hard wiring between the remote peripherals and the on-site control objects is as short as possible, reducing wiring costs and reducing the risk of various electromagnetic interferences Introduced to reduce points of failure. Remote peripherals support computer interlock general digital input or output functions, axle counting equipment general digital input or output functions, and intelligent input or intelligent output functions, as shown in Figure 21.

(6) CBTC vehicle system implementation plan

The CBTC vehicle-mounted system is realized based on a general-purpose security computer platform, and its logic processing layer supports the current vehicle-mounted ATP, vehicle-mounted ATO, speed measurement and distance measurement, and transponder information processing functions. Its external equipment management layer supports the general digital input and output functions of the train interface unit, the general pulse input function of the speed sensor, the intelligent input function of transponder information based on DSP or FPGA, and the man-machine operation interface DMI, wireless vehicle equipment MR, The communication function of the train communication network MVB is shown in Figure 22.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (17)

1. a method of simplifying Introduction of Train Operation Control System, it is characterized in that, the method is that concrete steps are based on universal safety computer platform design simplification Introduction of Train Operation Control System: 1) improve universal safety computer platform method of designing; 2) simplify vehicular applications or the Ground Application of Introduction of Train Operation Control System.

2. a kind of method of simplifying Introduction of Train Operation Control System according to claim 1, it is characterized in that, in described step 1), this universal safety computer platform is realized based on hardware/software otherness principle of design, grading diagnosis principle, software, based on dual certainty principle, supports to realize a plurality of application controls logic functions simultaneously.

3. a kind of method of simplifying Introduction of Train Operation Control System according to claim 1 and 2, it is characterized in that, described universal safety computer platform is used 2 to take advantage of 2 to get 2 structures, mainly comprises logical process layer, external device management layer, fault-tolerant and three parts of safety management layer.

4. a kind of method of simplifying Introduction of Train Operation Control System according to claim 3, it is characterized in that, described logical process layer by 2 groups totally 4 Logical processing unit LPU form, every 2 LPU form 1 group 2 and get one of 2 structures, one 2 LPU that are meet hardware/software otherness principle of design, and two is to form 2 to take advantage of 2 to get 2 structures; This logical process layer provides and meets 2 and take advantage of 2 to get safe, the highly reliable and high performance computation processing capacity of the height of 2 mechanism, to support the realization of a plurality of conventional rails traffic train operation control logic functions.

5. a kind of method of simplifying Introduction of Train Operation Control System according to claim 3, it is characterized in that, described external device management layer by 2 groups totally 4 external device management unit PMU form, every 2 PMU form 1 group 2 and get one of 2 structures, the selection of one 2 PMU that are meets hardware/software otherness principle of design, two is to form hot standby 2 to get 2 redundancy structures or parallel 2 and get 2 redundancy structures, preferably parallel 2 gets 2 redundancy structures;

This external device management layer provides: the fan-out capability of the input of (1) general digital quantity, analog quantity, pulsed quantity or general digital quantity, analog quantity; (2) for track circuit, LEU, BTM, intelligence input or intelligent fan-out capability TCR application, based on DSP or FPGA realization; (3) the various communication external that Introduction of Train Operation Control System is used, comprising: use the asynchronous serial communication of RS-232, RS-485, RS-422 interface; Field bus communication: CAN, Profibus; TCN TCN standard MVB communication; Ethernet communication; Car ground mobile communication: GSM-R, WLAN WLAN.

6. a kind of method of simplifying Introduction of Train Operation Control System according to claim 5, it is characterized in that, described external device management layer parallel 2 is got in arbitrary system of 2 redundancy structures two in being, each road of every kind of general digital quantity, analog quantity, pulsed quantity incoming signal and DSP or FPGA intelligence incoming signal is all that 2 roads are inputted simultaneously, through 2 PMU of isomery, based on 2, gets 4 LPU that give logical process layer after 2 logical process.

7. a kind of method of simplifying Introduction of Train Operation Control System according to claim 5, it is characterized in that, described external device management layer parallel 2 is got in arbitrary system of 2 redundancy structures two in being, each road of every kind of general digital quantity output signal is all that export simultaneously on 2 roads, 2 to get after 2 votings be to form parallel redundancy output with another again, and its feedback signal is given 4 PMUs of external device management layer parallel redundancy two in being to guarantee output safety simultaneously;

Common requirements for general-purpose simulation amount output signal and DSP or FPGA intelligence output signal, described external device management layer hot standby 2 is got the principal series of two of 2 redundancy structures in being, the intelligent output signal that adopts 1 PMU output analog quantity and DSP or FPGA, another 1 PMU of isomery supervises to guarantee output safety to this output signal; External device management layer hot standby 2 is got the standby system of two of 2 redundancy structures in being, 2 PMU of isomery all do not export the intelligent output signal of analog quantity and DSP or FPGA, only supervise the output signal of principal series, once principal series output signal extremely, take over its output and become principal series.

8. a kind of method of simplifying Introduction of Train Operation Control System according to claim 5, it is characterized in that, common requirements for communication external redundant fashion, described external device management layer parallel 2 is got in arbitrary system of 2 redundancy structures two in being, every kind of communication external redundancy Yi road input adopts the PMU of 1 PMU input, another 1 isomery directly to input or monitor the mode of input, 2 PMU of isomery get based on 24 LPU that give logical process layer after 2 logical process, and other one is another road input of this communication external redundancy of input;

Every kind of communication external redundancy Yi road output adopts 1 PMU output, another 1 PMU of isomery directly inputs or monitors input supervision to guarantee output safety to this communication external output, and other one is export another road output of this communication external redundancy and this communication external output is supervised to guarantee output safety.

Man machine operation interface DMI is by redundant external ethernet or redundant external asynchronous serial communication bus access external device management layer.

9. a kind of method of simplifying Introduction of Train Operation Control System according to claim 3, it is characterized in that, described fault-tolerant and safety management layer consists of 2 or a plurality of fault-tolerant and safety management unit F TSMU, the preferred scheme of 2 FTSMU, the realization of 2 FTSMU meets hardware/software otherness principle of design; Fault-tolerant and safety management layer and logical process layer have cooperatively interacted and 2 have taken advantage of 2 to get 2 mechanism, have cooperatively interacted and hot standby 2 have got 2 redundancy schemes or walk abreast and 2 get 2 redundancy schemes with external device management layer.

10. according to a kind of method of simplifying Introduction of Train Operation Control System described in claim 4～9, it is characterized in that, between 4 external device management unit PMU of 4 Logical processing unit LPU of described logical process layer, external device management layer, fault-tolerant and safety management layer 2 or a plurality of fault-tolerant and safety management unit F TSMU, by the safety communication Intranet VCIN of redundancy, the 1st class sealing transmission system secure communication protocols based on EN50159 regulation intercoms mutually.

11. according to a kind of method of simplifying Introduction of Train Operation Control System described in claim 4～9, it is characterized in that, the software moving on 4 external device management unit PMU of 4 Logical processing unit LPU of described logical process layer, external device management layer, fault-tolerant and safety management layer 2 or a plurality of fault-tolerant and safety management unit F TSMU supports to realize a plurality of application controls logics simultaneously.

12. a kind of methods of simplifying Introduction of Train Operation Control System according to claim 2, it is characterized in that, described hardware/software otherness principle of design is on hardware, to select different processor framework, selects different operating system, different compiler or different programming languages on software.

13. a kind of methods of simplifying Introduction of Train Operation Control System according to claim 2, is characterized in that, described grading diagnosis principle is:

(1) all input channels are diagnosed by reading the input of special value, and input diagnosis is initiated by treater; Interval between diagnosis is fixed, preferably identical with treater control cycle, in the specific time period in treater control cycle, completes;

(2) 2 input channels of getting 2 structures are carried out 2 of input and are got 2 relatively in each treater control cycle, inconsistent or the analog input amount of digital input amount, pulse input deviation exceed preset range, 2 of this input groups of input channels go wrong, and no longer approve this input that this is;

(3) all delivery channels have fed back diagnosis by the output to special value, and output diagnosis is initiated by signal specific application, and treater is controlled, and within the specific period, complete;

(4) delivery channel is exported feedback in each treater control cycle, and with real output value comparison, once digital output is inconsistent or imitated output quantity, pulse output deviation exceed preset range, this delivery channel goes wrong, and 2 of its correspondence is got this this output that is of 2 structures and answered failure to the safe side;

(5) diagnosis of treater and relative memory device and other peripheral hardware, 22 groups of otherness hardware and softwares getting 2 structures coordinate and the supervision of third party FTSMU under, asynchronously complete the mutual comparison of complete independently execution result separately in identical certainty work the specific time period in each control cycle of treater, only have diagnostic result in full accord just can judge normally;

(6) universal safety computer platform initially powers on constantly, and treater completes the diagnosis of scans to himself and relative memory device and various input, output and other peripheral hardware.

14. a kind of methods of simplifying Introduction of Train Operation Control System according to claim 2, is characterized in that, described dual certainty principle refers to respectively circulation implementation strategy based on fixed allocation and the memory protect strategy based on fixed allocation; The execution time certainty of a plurality of control logics that the circulation implementation strategy based on fixed allocation is supported with assurance; The data space certainty of a plurality of control logics that the memory protect strategy based on fixed allocation is supported with assurance.

15. a kind of methods of simplifying Introduction of Train Operation Control System according to claim 2, it is characterized in that, for rail transit train fortune control ground system, based on distributed treatment principle, described universal safety computer platform is divided into the configuration of core main frame type and the configuration of long-range peripheral hardware type;

The configuration of core main frame type comprises logical process layer, portion of external facility management layer, fault-tolerant and three parts of safety management layer and safety communication Intranet VCIN; Portion of external facility management layer wherein is only supported redundant external ethernet communication function;

Long-range peripheral hardware type configuration comprises external device management layer, fault-tolerant and two parts of safety management layer and safety communication Intranet VCIN.

16. a kind of methods of simplifying Introduction of Train Operation Control System according to claim 1, is characterized in that described step 2) determine it is vehicular applications or Ground Application:

Ground Application, divide the applied logic processing capacity of existing ground row control equipment, input/output function, man machine operation interface DMI function, then merge a plurality of ground row control applied logic processing capacities in core main frame type configure generic safety computer platform, merge the Different Ground row control input/output function of identical field position in long-range peripheral hardware type configure generic safety computer platform, according to field condition, a plurality of long-range peripheral hardware type configure generic safety computer platforms are set, finally according to field condition, one or more man machine operation interface DMI are set for ground row control,

Vehicular applications, divide applied logic processing capacity, input/output function, the man machine operation interface DMI function of existing vehicle-mounted row control equipment, then merge a plurality of ground row control applied logic processing capacities in the logical process layer of universal safety computer platform, merge vehicle-mounted row control input/output function in universal safety computer platform external device management layer, according to field condition, driver's man machine operation interface DMI is set.

17. according to a kind of method of simplifying Introduction of Train Operation Control System described in claim 1 or 16, it is characterized in that described step 2) in vehicular applications or the Ground Application of Introduction of Train Operation Control System be CTCS-2 level ground system, CTCS-2 level onboard system, CTCS-3 level ground system, CTCS-3 level onboard system, CBTC ground system, CBTC onboard system.

Images