The utility model content
At above-mentioned technical matters, the purpose of this utility model is, a kind of safety monitoring equipment is provided, to improve the safety and the reliability of row control center system platform.
Embodiment of the present utility model provides following technical scheme:
A kind of safety monitoring equipment, comprise: at least two power line voltage detection module VSM, integrity checking module I SM, at least two safety verification module SSM, dynamic security and door driver module dynamic security and a door driver module, channel switching module CSM, a synchronizing clock signal generator SCM and at least two status register SR, wherein, described at least two VSM, whether the voltage that is used for detecting respectively power subsystem unit PSU output surpasses the scope that presets, and testing result is write among each self-corresponding SR; Described ISM is used to detect main processor MP U, communications interface unit CIU and whether discrete I/O DIO is online, and testing result is write respectively among described two SR at least; Described at least two SSM, whether the synchronizing clock signals that is used for detecting respectively the dynamic security status signal of MPU and CIU output and described SCM output is correct, testing result is write among each self-corresponding SR, and whether export dynamic security according to the testing result decision of reading and keep signal with the driving clock of door driver module and the passage of CSM from described SR; Described dynamic security and door driver module are used for when the driving clock that receives from described at least two SSM is identical, and output drives the power supply of master relay, otherwise, do not export the power supply that drives master relay; Described CSM is used for keeping signal when identical when the passage that receives from described at least two SSM, and the signal that the CAN bus among the CIU is communicated with is kept in output, otherwise the signal that the CAN bus among the CIU is communicated with is switched in output.
Preferably, described ISM comprises: resistance, direct supply and voltage acquisition unit, wherein, described resistance is connected with described MPU, CIU and DIO, constitutes circuit series, described direct supply provides power supply for described circuit series, described voltage acquisition unit is gathered the voltage at described resistance two ends, and when voltage was zero, the testing result of output was not for online, otherwise the testing result of output is online.
Preferably, described SSM comprises: dynamic security status signal detecting unit, synchronizing clock signals detecting unit and first decision package, wherein, whether the cycle of the dynamic security status signal of described dynamic security status signal detecting unit detection MPU and CIU output is correct, and the output testing result; Whether described synchronizing clock signals detecting unit detects the cycle and the phase difference of synchronizing clock signals of described SCM output correct, and the output testing result; Described first decision package reads the testing result of VSM, the testing result of ISM, the testing result of dynamic security status signal detecting unit and the testing result of synchronizing clock signals detecting unit from described SR, when above-mentioned testing result all just often, export described dynamic security and keep signal with the driving clock of door driver module and the passage of CSM, otherwise, do not export described dynamic security and keep signal with the driving clock of door driver module and the passage of CSM.
Preferably, described safety monitoring equipment also comprises at least two command register CR, described SSM also comprises second decision package, and whether described second decision package is exported dynamic security according to the MPU control command decision of reading and kept signal with the passage that the driving clock of door driver module is kept signal and CSM from described CR.
Preferably, described SSM also comprises a dynamic security and a door detecting unit, and a state that is used to receive described dynamic security and door driver module feedback returns the inspection signal, and described state is returned the inspection signal writes among each self-corresponding SR of described SSM.
Preferably, described safety monitoring equipment also comprises: at least two isa bus interfaces, and an end of described isa bus interface is connected with described SR, and the other end is connected with isa bus.
Preferably, described safety monitoring equipment also comprises: at least two isa bus interfaces, and an end of described isa bus interface is connected with described CR with described SR, and the other end is connected with isa bus.
Preferably, described safety monitoring equipment also comprises: the state driver module is used for described at least two SR are done and computing by the testing result of equal modules output, and operation result driven respectively exports to corresponding LED light.
By above-mentioned embodiment of the present utility model as can be seen, safety monitoring equipment in the utility model can be realized the various states of MPU, CIU, DIO and PSU in the row control center system platform are detected, ensure that row control center can not produce wrong car controlling information, improved the safety and the reliability of row control center system platform.Simultaneously; because adopting, the safety monitoring equipment itself in the utility model gets two redundancy structure; make safety monitoring equipment have safety and reliability too; when the safety monitoring equipment with high security and reliability detects row control bus system platform; further ensure the safety and the reliability of row control center system platform, produced the safety and the reliability protection effect of " bilayer ".On the other hand, safety monitoring equipment of the present utility model is all realized by hardware, has also improved the stability that detects.
The specific embodiment
Below in conjunction with accompanying drawing content of the present utility model is described in detail, the description of this part only is exemplary and explanatory, should any restriction not arranged to protection domain of the present utility model.
The utility model provides a kind of safety monitoring equipment, is used for the various states that are listed as MPU, CIU, DIO and the PSU of controlling center system platform are detected, to ensure the safety and the reliability of row control center system platform.Simultaneously, safety monitoring equipment is as the check implement of each functional unit in the system platform, and the correctness of its testing result also needs to be ensured, occurs with the phenomenon that prevents the mistake monitoring.Therefore, for safety and the reliability that guarantees safety monitoring equipment itself, the safety monitoring equipment that the utility model provides has adopted gets two safe redundancy structure.Wherein, can be two to get two safe redundancy structure, also can be three to get two redundancy structure, or even higher level redundancy structure, specifically can be by the level of security and the reliable rank decision of row control center system platform, in that safety and reliability are had in the row control center system platform of requirements at the higher level, can adopt higher level redundancy structure.The utility model does not limit the level of the redundancy structure that adopted in the safety monitoring equipment, can adopt the redundancy structure that is fit to level according to concrete safety and reliability requirement or in conjunction with cost and dimensional characteristic to equipment.Wherein, preferred version of the present utility model is to adopt two to get two redundancy structure.
See also Fig. 1, it is the structural representation of a kind of safety monitoring equipment in the utility model, in the present embodiment, adopted two to get two redundancy structure, comprise: two VSM (Voltage SuperviseModule, the power line voltage detection module), an ISM (Integrality Supervise Module, the integrity checking module), two SSM (Safte Supervise Module, the safety verification module), a dynamic security and a door driver module, a CSM (Chunnel Supervise Module, channel switching module), a SCM (Synchronization Clock Module, synchronizing clock signal generator) and two SR (Station Register, status register).Wherein,
Described two VSM, whether the voltage that is used for detecting respectively PSU output surpasses the scope that presets, and testing result is write among each self-corresponding SR;
Described ISM, whether online, and testing result is write respectively among described two SR if being used to detect MPU, CIU and DIO;
Described two SSM, whether the synchronizing clock signals that is used for detecting respectively the dynamic security status signal of MPU and CIU output and described SCM output is correct, testing result is write among each self-corresponding SR, and whether export dynamic security and the driving clock of door driver module and the channel switching signal of CSM according to the testing result decision of reading from described SR;
Described dynamic security and door driver module are used for when the driving clock that receives from described two SSM is identical, and output drives the power supply of master relay, otherwise, do not export the power supply that drives master relay;
Described CSM is used for when when described two received passages of SSM are kept signal, and the signal that the CAN bus among the CIU is communicated with is kept in output, otherwise the signal that the CAN bus among the CIU is communicated with is switched in output.
Below in conjunction with each functional module in Fig. 1 and other accompanying drawings detailed description safety monitoring equipment.
See also Fig. 2, it is the structural representation of power line voltage detection module in the safety monitoring equipment, power line voltage detection module VSM is mainly used in detection and whether surpasses the scope that presets by the 5V and the 24V power line voltage of PSU output, and surpassing the scope that presets or in the testing result write state register SR that does not surpass the scope that presets.Wherein, two independently VSM and two SR are independently arranged in the present embodiment, VSM1 writes testing result among the cooresponding SR1, and VSM2 writes testing result among the cooresponding SR2.
See also Fig. 3, it is the principle schematic of integrity checking module in the safety monitoring equipment, integrity checking module I SM be mainly used in detect MPU, CIU and DIO whether online.Comprise: resistance, direct supply and voltage acquisition unit, wherein, resistance and MPU, CIU and DIO series connection, constitute circuit series, direct supply is as the direct supply of 5V, for the circuit series that constitutes provides power supply, voltage acquisition unit is gathered the voltage at resistance two ends in the circuit series, if voltage is zero, illustrates that circuit series is for opening circuit, and MPU, have at least among CIU and the DIO one not online, at this moment, the testing result of output is not for online, if voltage is non-vanishing, illustrate that circuit series is a path, and MPU, CIU and DIO are all online, and at this moment, the testing result of output is online.At last, testing result be written into respectively among the SR1 and SR2 in.
See also Fig. 4, it is the structural representation of safety detection module in the safety monitoring equipment, safety detection module SSM is mainly used in the dynamic security status signal that detects MPU and CIU output on the one hand and whether the synchronizing clock signals that SCM exports be correct, and the normal or abnormal testing result of signal is write among the SR; On the other hand, whether export dynamic security according to the testing result decision of reading and keep signal with the driving clock of door driver module and the passage of CSM from SR.
As shown in Figure 4, SSM comprises: dynamic security status signal detecting unit, synchronizing clock signals detecting unit and first decision package, wherein,
Dynamic security status signal detecting unit, whether the cycle of the dynamic security status signal of detection MPU and CIU output is correct, and the output testing result;
For example, the LIFE_CLK1/2/3/4 among Fig. 4 is that whether dynamic security status signal detecting unit detects the cycle of each status signal correct from the dynamic security status signal of MPU and CIU output, and the testing result of output is write among the SR by SSM.
The synchronizing clock signals detecting unit, whether the cycle and the phase difference of synchronizing clock signals that detects described SCM output be correct, and the output testing result;
For example, the SYN_CLK1/2 among Fig. 4 is the synchronizing clock signals of VSU output, and whether the synchronizing clock signals detecting unit detects the cycle and the phase difference of each clock signal correct, and the testing result of output is write among the SR by SSM.
First decision package, from SR, read the testing result of VSM, the testing result of ISM, the testing result of dynamic security status signal detecting unit and the testing result of synchronizing clock signals detecting unit, when above-mentioned testing result all just often, export described dynamic security and keep signal with the driving clock of door driver module and the passage of CSM, otherwise, do not export described dynamic security and keep signal with the driving clock of door driver module and the passage of CSM.
For example, when first decision package detect that voltage exceeds standard or MPU, CIU and DIO in the not online or dynamic security status signal in any one unit when producing deviation or synchronizing clock signals and producing deviation, stop to export described dynamic security and keep signal CHANNEL_SEL1/2/3/4 with the driving clock AQY_CLK of door driver module and the passage of CSM, otherwise, export described dynamic security and keep signal with the driving clock of door driver module and the passage of CSM.
Wherein, two independently SSM are arranged in the present embodiment, SSM1 writes testing result among the cooresponding SR1, and SSM2 writes testing result among the cooresponding SR2.Simultaneously, SSM1 reads testing result from cooresponding SR1, and SSM2 reads testing result from cooresponding SR2.Standard clock source is as high accuracy clock, for the detection of above-mentioned signal provides standard.
Further, safety monitoring equipment in the present embodiment also comprises two command register CR, SSM also comprises second decision package, and whether described second decision package is exported dynamic security according to the MPU control command decision of reading and kept signal with the driving clock of door driver module and the passage of CSM from CR.Wherein, two independently CR are arranged in the present embodiment, SSM1 is reading order from cooresponding CR1, and SSM2 is reading order from cooresponding CR2.
Further again, SSM also comprises a dynamic security and a door detecting unit, and a state that is used to receive dynamic security and door driver module feedback returns the inspection signal, and state is returned the inspection signal writes among the SR.Wherein, the dynamic security among the SSM1 returns state to the inspection signal with the door detecting unit and writes among the SR1, and the safety among the SSM2 is returned state to the inspection signal with the door detecting unit and write among the SR2.
See also Fig. 5, its be in the safety monitoring equipment dynamic security with the door driver module structural representation, dynamic security is mainly used in when the driving clock that receives from two SSM is identical with door driver module dynamic security and door driver module, output drives the power supply of master relay, otherwise, do not export the power supply that drives master relay.Dynamic security is that the nucleus module of two functions is got in final realization two with the door driver module, is mainly realized by AND circuit.When SSM received from two driving clock is identical, illustrate that SSM output result be safe and reliable result, the power supply of output driving master relay; When the driving clock that SSM received from two is inequality, illustrate that the result of SSM output is dangerous and insecure result, do not export the power supply that drives master relay.As shown in Figure 5, RELAY_STATUS delivers to respectively among SSM1 and the SSM2 for safety and door state return the inspection signal, writes among the SR after being detected by dynamic security and door.
For example, after dynamic security receives the dynamic security status signal of two-way 2KHz with the door driver module, if two-way dynamic security status signal is identical, the 24V power drives master relay of output safety then, the deviation of any one road dynamic security status signal all will make the 24V out-put supply close, and realize fault-safety principle.Wherein, described master relay can adopt safety relay, in the row control center system platform of two-node cluster hot backup structure, is used to discern active and standby machine, have only the master relay in the main frame just can pick up, simultaneously it picks up the master relay that will cause in the standby host and can not pick up.The power supply that DIO in the system of main frame place externally exports I/O is a safety power supply, seal in the upper contact of master relay in the native system in its current supply circuit, if the master relay in the native system falls, then will switch the power supply of I/O among the DIO, to reach fault-safety principle.
See also Fig. 6, it is the principle schematic of channel switching module in the safety monitoring equipment, and CSM is mainly used in when the passage that receives from two SSM and keeps signal when identical, and the signal that the CAN bus among the CIU is communicated with is kept in output, otherwise the signal that the CAN bus among the CIU is communicated with is switched in output.It equally also is an AND circuit, and the CHANNEL_SEL signal that its reception SSM1 and SSM2 send here is by exporting the signal of the CAN bus connection that makes among the CIU after the NAND gate.
See also Fig. 7, it is the structural representation of synchronizing clock signal generator in the safety monitoring equipment, synchronizing clock signal generator by one independently high precision clock the clock source is provided, utilize programmable gate array (FPGA) frequency division to become clock signals of different frequencies, synchronizing clock signal generator is also exported life signal to SSM1 and SSM2 simultaneously, and whether detect synchronizing clock signal generator respectively by SSM1 and SSM2 working properly.
See also Fig. 8, it is the structural representation of status register and command register in the safety monitoring equipment, wherein, SR mainly preserves VSM, ISM and the detected voltage status of SSM difference, integraty state, the state of dynamic security status signal, the state of synchronized clocke periodic signal and the state of dynamic security and door driver module feedback.The address of SR is mapped on the isa bus, can be read by MPU, and the content of SR also can be read by SSM simultaneously, whether will close the output that this is in order to decision.
CR can be made up of one 16 word, is used to receive the control command that MPU transmits, the treater among the MPU by isa bus to CR write command position.Two independently CR are arranged, respectively corresponding SSM1 and SSM2 in the present embodiment.
Further, the safety monitoring equipment in the present embodiment also comprises: two isa bus interfaces, and an end of described isa bus interface is connected with SR, and the other end is connected with isa bus.When also further comprising CR in the present embodiment, described isa bus interface is connected with CS.Described isa bus interface and isa bus are used for the exchange of data between MPU and the safety monitoring equipment.
Further, the safety monitoring equipment in the present embodiment also comprises: the state driver module is used for two SR are done and computing by the testing result of equal modules output, and operation result driven respectively exports to corresponding LED light.For example, the testing result of the output of the VSM among two SR is done and computing, when the testing result among two SR is identical, exported to a LED light with the calculated result driving, this indicator lamp lights, and the testing result safety that VSM is described is with reliable; Testing result in two SR is not thought can not to light by the driving LED indicator lamp with calculated result simultaneously, illustrates that the testing result of VSM is dangerous, unreliable.
Need to prove, described safety monitoring equipment both can be controlled the outside of center system platform and independently existence at row, also can be integrated in row control center system platform inside, as a security monitoring unit in the system platform (VSU, Vital Supervision Unit).In addition, in the row control center system platform of two-node cluster hot backup structure, comprise two subsystems of A system and B system, safety monitoring equipment in the present embodiment is only for detecting the watch-dog of a sub-working state of system, and the safety monitoring equipment of another subsystem is identical with safety monitoring equipment in the present embodiment.
Need to prove that also the utility model embodiment does not limit and adopts two to get two redundancy structure, when adopting higher level redundancy structure, the number of VSM wherein, SSM, SR and CR is also along with the redundancy structure that is adopted correspondingly increases.
As can be seen from the above-described embodiment, safety monitoring equipment in the utility model can be realized the various states of MPU, CIU, DIO and PSU in the row control center system platform are detected, ensure that row control center can not produce wrong car controlling information, improved the safety and the reliability of row control center system platform.Simultaneously; because adopting, the safety monitoring equipment itself in the utility model gets two redundancy structure; make safety monitoring equipment have safety and reliability too; when the safety monitoring equipment with high security and reliability detects row control bus system platform; further ensure the safety and the reliability of row control center system platform, produced the effect of double-deck safety protection and reliability protection.On the other hand, safety monitoring equipment of the present utility model is all realized by hardware, has also improved the stability that detects.
The above only is the preferred implementation of utility model; should be understood that; for those skilled in the art; under the principle prerequisite that does not break away from the utility model description; can also make some improvements and modifications, these improvements and modifications also should be considered as protection domain of the present utility model.