EP3895958A1

EP3895958A1 - Method for processing train interface data of hot-standby vehicle-mounted device

Info

Publication number: EP3895958A1
Application number: EP20785425.8A
Authority: EP
Inventors: Xiaona YU; Jianmin Wang; Zhiqiang Chen; Youbing Zhang
Original assignee: CRSC Research and Design Institute Group Co Ltd
Current assignee: CRSC Research and Design Institute Group Co Ltd
Priority date: 2020-03-06
Filing date: 2020-08-17
Publication date: 2021-10-20
Anticipated expiration: 2040-08-17
Also published as: RS64526B1; HUE063550T2; CN111003024A; CN111003024B; EP3895958C0; WO2021174769A1; EP3895958A4; EP3895958B1

Abstract

This invention provides a method for processing train interface data of hot standby on-board equipment, wherein a second main control unit is used for hot backup of a first main control unit, power is supplied to the first main control unit and the second main control unit concurrently; the first main control unit and the second main control unit receive input signals transmitted by a train interface, and control the input signals to maintain consistent. The problems that when the first main control unit which is operating fails, the trains are required to stop so as to switch from the first main control unit to the second main control unit due to that existing on-board equipment generally adopts the second main control unit for cold backup or warm backup of the first main control unit are solved.

Description

TECHNICAL FIELD

The present invention relates to the field of train control technology, and more particularly, to a method for processing train interface data of hot standby on-board equipment.

BACKGROUND

The train operation control system is a system to ensure safe and fast operation of trains. The main function of the train operation control system is to complete interval control and speed control of the trains. The complete train operation control system consists of on-board equipment and ground equipment.
Existing on-board equipment generally adopts a second main control unit for cold backup or warm backup of a first main control unit, which has the following problems:
when the first main control unit which is operating fails, the trains are required to stop so as to switch from the first main control unit to the second main control unit.

SUMMARY

In order to overcome the shortcomings of the prior art, the present invention provides a method for processing train interface data of hot standby on-board equipment, which solves the problem that existing on-board equipment generally adopts a second main control unit for cold backup or warm backup of a first main control unit, when the first main control unit which is operating fails, the trains are required to stop so as to switch from the first main control unit to the second main control unit.
The present invention is specifically implemented through the following technical solutions:
A method for processing train interface data of hot standby on-board equipment according to the present invention, which specifically comprises:

a second main control unit is used for hot backup of a first main control unit, power is supplied to the first main control unit and the second main control unit concurrently;
the first main control unit and the second main control unit receive input signals transmitted by a train interface, and control the input signals to maintain consistent;
when the on-board equipment loses power, or the first main control unit and the second main control unit both fail, the on-board equipment transmits a safety command to the train interface;
when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to transmit a safety command to the train interface according to an operating situation.

Further, controlling the input signals to maintain consistent specifically comprises the following steps:

S1: the second main control unit receives a currently collected first input signal transmitted by the first main control unit;
S2: the second main control unit compares the first input signal with a currently collected second input signal; if signal content of the first input signal and signal content of the second input signal are consistent, the first main control unit uses the currently collected first input signal as input and the second main control unit uses the currently collected second input signal as input; if signal content of the first input signal and signal content of the second input signal are inconsistent, the first main control unit discards the first input signal and the second main control unit discards the second input signal, the first main control unit and the second main control unit maintain previous consistent signals as input.

Further, when signal content of the first input signal and signal content of the second input signal are inconsistent, it is determined that the second main control unit fails if a time period for which signal content of the first input signal and signal content of the second input signal are inconsistent exceeds a prescribed time period.
Further, controlling the input signals to maintain consistent specifically is:

the first main control unit receives a current input signal, and transmits the input signal to the second main control unit;
the second main control unit receives the input signal as its own input signal.

Further, when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to transmit a safety command to the train interface according to an operating situation:

when the first main control unit fails or has no power, the second main control unit determines according to needs whether to transmit a safety command to the train interface;
or, when the second main control unit fails or has no power, the first main control unit determines according to needs whether to transmit a safety command to the train interface;
or, when the first main control unit and the second main control unit are both operating normally, the second main control unit continues to transmit a safety command to a circuit module within the on-board equipment; the first main control unit determines according to needs whether to transmit a safety command to the circuit module; a safety command is transmitted to the train interface if the circuit module receives the safety command of the second main control unit and the safety command of the first main control unit; no safety command is transmitted to the train interface if the circuit module only receives the safety command of the second main control unit.

when the first main control unit fails or has no power, the second main control unit determines according to needs whether to transmit a safety command to the train interface;
or, when the second main control unit fails or has no power, the first main control unit determines according to needs whether to transmit a safety command to the train interface;
or, when the first main control unit and the second main control unit are both operating normally, the first main control unit or the second main control unit determines whether to transmit a safety command to the train interface according to states of a local end and a peer end.

Further, when the first main control unit and the second main control unit are both operating normally, the first main control unit or the second main control unit determines whether to transmit a safety command to the train interface or to cancel transmitting a safety command to the train interface according to states of a local end and a peer end, which specifically comprises:

T1: initially, both the local end and the peer end are in an idle state;
T2: when the local end transmits a safety command to the train interface, it is determined whether a transmitting state of the safety command changes; in the case where the transmitting state of the safety command changes, a first timer is started, a state of monitoring a peer end is entered, step T3 is executed; in the case where a transmitting state of the safety command does not change, it is determined whether safety command information of the peer end is received, if safety command information of the peer end is received, an acknowledgement packet of having receipted the safety command information is transmitted to the peer end, and a second timer is started, a state of monitoring the local end is entered, step T4 is executed; if no safety command information of the peer end is received, it continues to determine whether the transmitting state of the safety command of the local end changes;
T3: it is determined whether the transmitting state of a changed safety command is to transmit a safety command to the train interface; if the transmitting state of the changed safety command is to transmit a safety command to the train interface, the local end transmits a safety command to the train interface and periodically transmits, to the peer end, information for transmitting safety command to the train interface, it continues to execute step T3-1; if the changed safety command transmitting state is to not transmit a safety command to the train interface, the local end will not transmit a safety command to the train interface temporarily, and periodically transmits, to the peer end, information for not transmitting a safety command to the train interface, it continues to execute step T3-2;
T3-1: it is determined whether safety command information of the peer end is received; if safety command information of the peer end is received, an acknowledgement packet of having receipted the safety command information is transmitted to the peer end, and it is determined whether the safety command information of the peer end and the transmitting state of the changed safety command of the local end are consistent; if the safety command information of the peer end and the transmitting state of the changed safety command of the local end are consistent, the first timer is closed, the local end enters an idle state; if the safety command information of the peer end and the transmitting state of the changed safety command of the local end are inconsistent, the local end enters a fault state; if no safety command information of the peer end is received, it is determined whether timing of the first timer expires; if timing of the first timer expires, the first timer is closed, the local end enters the idle state; if timing of the first timer does not expire, it is determined whether an acknowledgement packet for safety command information of the peer end is received; if an acknowledgement packet for safety command information of the peer end is received, it stops transmitting, to the peer end, information for transmitting safety command information to the train interface, a current state is maintained; if no acknowledgement packet for safety command information of the peer end is received, it is determined whether the information for transmitting safety command information to the train interface has been transmitted to the peer end for more than a specified number of times; if the information for transmitting safety command information to the train interface has been transmitted to the peer end for more than the specified number of times, it stops transmitting, to the peer end, information for transmitting safety command information to the train interface, and the local end enters a fault state; if the information for transmitting safety command information to the train interface has not been transmitted to the peer end for more than the specified number of times, it continues to transmit, to the peer end, information for transmitting safety command information to the train interface;
T3-2: it is determined whether safety command information of the peer end is received; if safety command information of the peer end is received, an acknowledgement packet of having receipted the safety command information is transmitted to the peer end, and it is determined whether the safety command information of the peer end and the transmitting state of the changed safety command of the local end are consistent; if the safety command information of the peer end and the transmitting state of the changed safety command of the local end are consistent, the first timer is closed, the local end enters an idle state; if the safety command information of the peer end and the transmitting state of the changed safety command of the local end are inconsistent, the local end enters a fault state; if no safety command information of the peer end is received, it is determined whether timing of the first timer expires; if timing of the first timer expires, the first timer is closed, the local end enters the idle state; if timing of the first timer does not expire, it is determined whether an acknowledgement packet for safety command information of the peer end is received; if an acknowledgement packet for safety command information of the peer end is received, it stops transmitting, to the peer end, information for not transmitting safety command information to the train interface, a current state is maintained; if no acknowledgement packet for safety command information of the peer end is received, it is determined whether the information for not transmitting safety command information to the train interface has been transmitted to the peer end for more than a specified number of times; if the information for not transmitting safety command information to the train interface has been transmitted to the peer end for more than the specified number of times, it stops transmitting, to the peer end, information for transmitting safety command information to the train interface, and the local end enters a fault state; if the information for not transmitting safety command information to the train interface has not been transmitted to the peer end for more than the specified number of times, it continues to transmit, to the peer end, information for not transmitting safety command information to the train interface;
T4: when the local end transmits a safety command to the train interface, it is determined whether a transmitting state of the safety command changes; in the case where the transmitting state of the safety command changes, it is determined whether the transmitting state of the changed safety command of the local end is consistent with the safety command information of the peer end as received; if the transmitting state of the changed safety command of the local end is consistent with the safety command information of the peer end as received, the local end maintains the transmitting state of the changed safety command, and transmits the changed safety command information to the peer end, the second timer is turned off, it enters a state of waiting for acknowledgement from the peer end, it continues to execute step T5; if the transmitting state of the changed safety command is inconsistent with the safety command information of the peer as received, the second timer is closed, the local end enters a fault state; if the answer is negative, it is determined whether the second timer expires; if the second timer expires, the second timer is closed, it enters a fault state; if the second timer does not expire, it continues to determine whether a transmitting state of the safety command changes when the local end transmits a safety command to the train interface.
T5: the changed safety command information is transmitted to the peer end periodically, it is determined whether acknowledgement information about the safety command of the peer end is received; if acknowledgement information about the safety command of the peer end is received, the local end enters an idle state; if no acknowledgement information about the safety command of the peer end is received, it is determined whether the number of times of transmitting the changed safety command information to the peer end exceeds the specified number of times; if the number of times of transmitting the changed safety command information to the peer end exceeds the specified number of times, the local end enter an idle state; if the number of times of transmitting the changed safety command information to the peer end does not exceed the specified number of times, it continues to transmit the changed safety command information to the peer end.

Further, the safety command includes a speed control command and a traction removing command.
Further, the safety command includes a train interface control command;

when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to transmit the train interface control command to the train interface according to an operating situation, which specifically comprises:
when the first main control unit fails or has no power, the first main control unit does not transmit the train interface control command to the train interface, the second main control unit determines according to needs whether to transmit the train interface control command to the train interface;
or, when the second main control unit fails or has no power, the second main control unit does not transmit the train interface control command to the train interface, the first main control unit determines according to needs whether to transmit the train interface control command to the train interface;
or, the first main control unit and the second main control unit are both in a normal operating state, the second main control unit cancels transmitting the train interface control command to a circuit module within the on-board equipment; the first main control unit determines according to needs whether to transmit the train interface control command to the circuit module; the train interface control command is not transmitted to the train interface if the circuit module does not receive the train interface control command; the train interface control command is transmitted to the train interface if the circuit module receives information for the train interface control command of the first main control unit.

Further, the method further comprises a brake test of the on-board equipment, and the brake test comprises the following steps:

D1: after the first main control unit receives a brake test request, a brake test is performed; if the brake test fails, a driver is reminded of that the brake test fails, the brake test is re-executed until the brake test is successful; if the brake test is successful, the second main control unit is instructed to perform a brake test;
D2: after the second main control unit receives the command and transmits a command receipt acknowledgement to the first main control unit, the second main control unit starts to perform a brake test; if the brake test is successful, a brake test result is transmitted to the first main control unit, the first main control unit feeds back brake test results of the local end and the second main control unit to the driver;
if the brake test fails, it is determined whether the number of times of braking exceeds a specified number of times, step D3 is executed in the case where it exceeds, step D4 is executed in the case where it does not exceed;
D3: the brake test is repeated until the brake test is successful, thereafter the brake test result is transmitted to the first main control unit, the first main control unit feeds back the brake test results of the local end and the second main control unit to the driver;
D4: the first main control unit is informed of test end, the second main control unit enters a fault state; after the first main control unit receives a test end message of the second main control unit, it will feed back the brake test result of the first main control unit to the driver.

Compared with the closest prior art, the technical solutions of the present invention have the following beneficial effects:
The present invention provides a method for processing train interface data of hot standby on-board equipment, a second main control unit is used for hot backup of the first main control unit, power is supplied to the first main control unit and the second main control unit concurrently, input signals of the first main control unit and the second main control unit from the train interface are controlled to maintain consistent, so as to ensure that the first main control unit and the second main control unit are synchronized in operation, so that when the first main control unit fails, an automatic switch can be made to the second main control unit without stopping the train.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or in the prior art, the drawings necessary for description of the embodiments or the prior art will be briefly introduced below, obviously, the drawings in the following description are just some embodiments of the present invention, other drawings can be obtained by those of ordinary skill in the art based on these drawings without paying creative efforts.

FIG 1 is a schematic diagram of signal transmission between the hot standby on-board equipment and the train interface of the present invention;
FIG 2 is a block diagram of overall flowchart of the method for processing train interface data of hot standby on-board equipment of the present invention;
FIG 3 is a block diagram of flowchart of Scheme 1 in the case where the input signals are maintained consistent;
FIG. 4 is a block diagram of flowchart of Scheme 2 in the case where the input signals are maintained consistent;
FIG. 5 is a block diagram of partial flowchart for Situation 3 in Scheme 2 adopted in the processing measures for the brake command;
FIG. 6 is a block diagram of partial flowchart for Situation 3 in Scheme 2 adopted in the processing measures for the brake command;
FIG. 7 is a block diagram of partial flowchart for Situation 3 in Scheme 2 adopted in the processing measures for the brake command;
FIG. 8 is a block diagram of partial flowchart for Situation 3 in Scheme 2 adopted in the processing measures for the brake command;
FIG. 9 is a block diagram of partial flowchart for Situation 3 in Scheme 2 adopted in the processing measures for the traction removing command;
FIG. 10 is a block diagram of partial flowchart for Situation 3 in Scheme 2 adopted in the processing measures for the traction removing command;
FIG. 11 is a block diagram of partial flowchart for Situation 3 in Scheme 2 adopted in the processing measures for the traction removing command;
FIG. 12 is a block diagram of partial flowchart for Situation 3 in Scheme 2 adopted in the processing measures for the traction removing command;
FIG. 13 is a flowchart of the brake test of on-board equipment.

DETAILED DESCRIPTION OF THE EMBODIMENTS

In order to make the objects, technical solutions and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings in the embodiments of the present invention, obviously, the described embodiments are only part of the embodiments of the present invention, not all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by those of ordinary skill in the art without paying creative work fall within the protection scope of the present invention.
In the embodiment of the present invention, the first main control unit may be a main system main control unit or a standby system main control unit, and the second main control unit may be a main system main control unit or a standby system main control unit, that is, the first main control unit and the second main control unit are mutual backup for each other, wherein the second main control unit is the standby system main control unit when the first main control unit is the main system main control unit, the first main control unit is the standby system main control unit when the second main control unit is the main system main control unit.
As shown in FIG. 1, it is a schematic diagram of signal transmission between the hot standby on-board equipment and the train interface of this embodiment, the hot standby on-board equipment includes a first main control unit and a second main control unit, the first main control unit and the second main control unit receive input signals transmitted by the train interface, and the first main control unit and the second main control unit transmit output signals to the train interface.
As shown in FIG. 2, it is the method for processing train interface data of hot standby on-board equipment of this embodiment, which specifically comprises: the second main control unit performs hot backup with respect to the first main control unit, power is supplied to the first main control unit and the second main control unit concurrently.
Regarding the input signals transmitted by the train interface, the first main control unit and the second main control unit process the input signals transmitted by the train interface, input signals of the first main control unit and the second main control unit from train the interface are controlled to maintain consistent.
Accordingly, the first main control unit and the second main control unit are made to maintain completely synchronized in operation, so that when the first main control unit fails, an automatic switch can be made to the second main control unit without stopping the train.
The input signals include, but not limited to, an activation state of a cab console, a position of a steering handle and a sleep signal;
Concurrently supplying power to the first main control unit and the second main control unit as described above specifically is: separate power supply modules may be used to concurrently supply power to the first main control unit and the second main control unit, or the same power supply module may be used to synchronously supply power to the first main control unit and the second main control unit.
Maintaining the input signals of the first main control unit and the second main control unit to be consistent as described above may be implemented specifically by adopting the following two schemes.
Scheme 1, as shown in FIG. 3:

S1: the first main control unit receives a current first input signal, and the second main control unit receives a current second input signal;
S2: the first main control unit transmits the first input signal to the second main control unit;
S3: the second main control unit compares signal content of the first input signal and signal content of the second input signal; if signal contents thereof are consistent, the first main control unit is notified to use the currently collected first input signal as input and the second main control unit is notified to use the currently collected second input signal as input; if signal contents thereof are inconsistent, the first main control unit is notified to discard the first input signal and the second main control unit is notified to discard the second input signal, the first main control unit and the second main control unit maintain previous consistent signals as input.

It should be noted that the "signal contents being consistent" here refers to commands being consistent. Taking signal activation as an example, the first main control unit and the second main control unit simultaneously receive an activation signal transmitted by the train interface or simultaneously receive a non-activation signal transmitted by the train interface, it means that the signal contents are consistent.
As a preferred way, in Scheme 1, in the case where signal contents of the first input signal and the second input signal are inconsistent, if signal contents of the first input signal and the second input signal are inconsistent for too long, exceeding a set time length, the second main control unit determines that the first main control unit and the second main control unit are not synchronized in operation, the second main control unit is controlled to enter a fault mode, the first main control unit continues to operate.
Scheme 2, as shown in FIG. 4:
the first main control unit receives the current input signal, and then transmits the input signal to the second main control unit; the second main control unit receives the input signal transmitted by the first main control unit, and uses the received input signal as its own input signal.
Regarding the output signal transmitted to the train interface, when the second main control unit makes hot backup with respect to the first main control unit and power is supplied to the first main control unit and the second main control unit concurrently, in order to ensure driving safety, different situations need to be addressed so as to determine the transmission measures to be taken to transmit the signal.
The output signal includes a safety command, the safety command includes a speed control command, the speed control command includes, but not limited to, a braking command, the braking command includes, but not limited to, an emergency braking command and a full service breaking command.
Processing measures of the speed control command are determined respectively for different situations below, and the braking command is taken as an example for description.
Situation 1:
when the on-board equipment loses power, or the first main control unit and the second main control unit both fail, the on-board equipment transmits a braking command to the train interface.
Situation 2:
when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to transmit a braking command to the train interface or cancel transmitting a braking command to the train interface according to an operating situation
The "operating condition" here includes three situations where the first main control unit fails or has no power, the second main control unit fails or has no power, and the first main control unit and the second main control unit both operate normally.
In Situation 2, the following two schemes are specifically adopted:

Scheme 1:

Scheme 1 includes processing of the following three cases:

Case 1: the first main control unit fails or has no power, the second main control unit determines whether to transmit a braking command to the train interface or to cancel transmitting a braking command to the train interface as required, for example, the second main control unit transmits a braking command to the train interface in the case where the train drives over a speed limit, the second main control unit does not transmit a braking command to the train interface when the train does not drive over a speed limit;
Case 2: the second main control unit fails or has no power, the first main control unit determines whether to transmit a braking command to the train interface or to cancel transmitting a braking command to the train interface as required, the example scenario of "as required" is as above;
Case 3: the first main control unit and the second main control unit are both normally operating, the second main control unit continues to transmit a braking command to a circuit module within the on-board equipment;
- the first main control unit determines whether to transmit a braking command to the circuit module or to cancel transmitting a braking command to the circuit module as required, the example scenario of "as required" is as above;
- if the circuit module receives the braking command of the second main control unit and the braking command of the first main control unit, it transmits a braking command to the train interface;
- if the circuit module only receives the braking command of the second main control unit, it cancels transmitting the braking command to the train interface.

Scheme 2:

Scheme 2 includes processing of the following three cases:

Case 1: the first main control unit fails or has no power, the second main control unit determines whether to transmit a braking command to the train interface or to cancel transmitting a braking command to the train interface as required, the example scenario of "as required" is as above;
Case 2: the second main control unit fails or has no power, the first main control unit determines whether to transmit a braking command to the train interface or to cancel transmitting a braking command to the train interface as required, the example scenario of "as required" is as above;
Case 3: the first main control unit and the second main control unit are both normally operating, the first main control unit or the second main control unit determines whether to transmit a braking command to the train interface or to cancel transmitting a braking command to the train interface according to states of a local end and a peer end, the specific processing is provided below.
- T1: as shown in FIG. 5, initially, both the local end and the peer end are in an idle state; "both the local end and the peer end are in an idle state" means that the local end and the peer end remain in the same state, that is, the local end and the peer end are in the state of transmitting the brake command at the same time, or the local end and the peer end are in the state of cancelling transmitting the brake state at the same time;
- T2: when the local end transmits a braking command to the train interface, it is determined whether a transmitting state of the braking command changes; in the case where the transmitting state of the braking command changes, a first timer is started, a state of monitoring a peer end is entered, then step T3 is executed; in the case where a transmitting state of the braking command does not change, it continues to determine whether braking command information of the peer end is received, if braking command information of the peer end is received, an acknowledgement packet of having receipted the braking command information is transmitted to the peer end, and a second timer is started, a state of monitoring the local end is entered, then step T4 is executed; if no braking command information of the peer end is received, it continues to determine whether the transmitting state of the braking command of the local end changes when the local end transmits a braking command to the train interface;
- T3: it is determined whether the transmitting state of a changed braking command is to transmit a braking command to the train interface or to cancel transmitting a braking command to the train interface; if the transmitting state of the changed braking command is to transmit a braking command to the train interface, the local end transmits a braking command to the train interface and periodically transmits, to the peer end, information for transmitting a braking command to the train interface, it continues to execute step T3-1; if the changed braking command transmitting state is to cancel transmitting a braking command to the train interface, the local end cancels transmitting a braking command to the train interface temporarily, and periodically transmits, to the peer end, information for cancelling transmitting a braking command to the train interface, it continues to execute step T3-2;
- T3-1: as shown in FIG. 6, it is determined whether braking command information of the peer end is received; if braking command information of the peer end is received, an acknowledgement packet of having receipted the braking command information is transmitted to the peer end, and it is determined whether the braking command information of the peer end and the transmitting state of the changed braking command of the local end are consistent; if the braking command information of the peer end and the transmitting state of the changed braking command of the local end are consistent, the first timer is closed, the local end enters an idle state; if the braking command information of the peer end and the transmitting state of the changed braking command of the local end are inconsistent, the local end enters a fault state; if no braking command information of the peer end is received, it is determined whether timing of the first timer expires; if timing of the first timer expires, the first timer is closed, the local end enters the idle state; if timing of the first timer does not expire, it is determined whether an acknowledgement packet for braking command information of the peer end is received; if an acknowledgement packet for braking command information of the peer end is received, it stops transmitting, to the peer end, information for transmitting braking command information to the train interface, a current state is maintained; if no acknowledgement packet for braking command information of the peer end is received, it is determined whether the information for transmitting braking command information to the train interface has been transmitted to the peer end for more than a specified number of times; if the information for transmitting braking command information to the train interface has been transmitted to the peer end for more than the specified number of times, it stops transmitting, to the peer end, information for transmitting braking command information to the train interface, and the local end enters a fault state; if the information for transmitting braking command information to the train interface has not been transmitted to the peer end for more than the specified number of times, it continues to transmit, to the peer end, information for transmitting braking command information to the train interface;
- T3-2: as shown in FIG. 7, it is determined whether braking command information of the peer end is received; if braking command information of the peer end is received, an acknowledgement packet of having receipted the braking command information is transmitted to the peer end, and it is determined whether the braking command information of the peer end and the transmitting state of the changed braking command of the local end are consistent; if the braking command information of the peer end and the transmitting state of the changed braking command of the local end are consistent, the first timer is closed, the local end enters an idle state; if the braking command information of the peer end and the transmitting state of the changed braking command of the local end are inconsistent, the local end enters a fault state; if no braking command information of the peer end is received, it is determined whether timing of the first timer expires; if timing of the first timer expires, the first timer is closed, the local end enters the idle state; if timing of the first timer does not expire, it is determined whether an acknowledgement packet for braking command information of the peer end is received; if an acknowledgement packet for braking command information of the peer end is received, it stops transmitting, to the peer end, information for cancelling transmitting braking command information to the train interface, a current state is maintained; if no acknowledgement packet for braking command information of the peer end is received, it is determined whether the information for cancelling transmitting braking command information to the train interface has been transmitted to the peer end for more than a specified number of times; if the information for cancelling transmitting braking command information to the train interface has been transmitted to the peer end for more than the specified number of times, it stops transmitting, to the peer end, information for transmitting braking command information to the train interface, and the local end enters a fault state; if the information for cancelling transmitting braking command information to the train interface has not been transmitted to the peer end for more than the specified number of times, it continues to transmit, to the peer end, information for cancelling transmitting braking command information to the train interface;
- T4: as shown in FIG. 8, when the local end transmits a braking command to the train interface, it is determined whether a transmitting state of the braking command changes; in the case where the transmitting state of the braking command changes, it is determined whether the transmitting state of the changed braking command of the local end is consistent with the braking command information of the peer end as received; if the transmitting state of the changed braking command of the local end is consistent with the braking command information of the peer end as received, the local end maintains the transmitting state of the changed braking command, and transmits the changed braking command information to the peer end, the second timer is turned off, it enters a state of waiting for acknowledgement from the peer end, it continues to execute step T5; if the transmitting state of the changed braking command is inconsistent with the braking command information of the peer as received, the second timer is closed, the local end enters a fault state; if the transmitting state of the braking command does not change, it is determined whether the second timer expires; if the second timer expires, the second timer is closed, it enters a fault state; if the second timer does not expire, it continues to determine whether a transmitting state of the braking command changes when the local end transmits a braking command to the train interface;
- T5: the changed braking command information is transmitted to the peer end periodically, it is determined whether acknowledgement information about the braking command of the peer end is received; if acknowledgement information about the braking command of the peer end is received, the local end enters an idle state; if no acknowledgement information about the braking command of the peer end is received, it is determined whether the number of times of transmitting the changed braking command information to the peer end exceeds the specified number of times; if the number of times of transmitting the changed braking command information to the peer end exceeds the specified number of times, the local end enters an idle state; if the number of times of transmitting the changed braking command information to the peer end does not exceed the specified number of times, it continues to transmit the changed braking command information to the peer end.

The safety command further includes a traction removing command, processing measures of the traction removing command are determined respectively for different situations below.
Situation 1:
when the on-board equipment loses power, or the first main control unit and the second main control unit both fail, the on-board equipment transmits a traction removing command to the train interface.
Situation 2:
when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to transmit a traction removing command to the train interface or cancel transmitting a traction removing command to the train interface according to an operating situation
The "operating condition" here includes three situations where the first main control unit fails or has no power, the second main control unit fails or has no power, and the first main control unit and the second main control unit both operate normally.
In Situation 2, the following two schemes are specifically adopted:

Scheme 1:

Scheme 1 includes processing of the following three cases:

Case 1: the first main control unit fails or has no power, the second main control unit determines whether to transmit a traction removing command to the train interface or to cancel transmitting a traction removing command to the train interface as required, for example, the second main control unit transmits a traction removing command to the train interface in the case where the train drives over a speed limit, the second main control unit does not transmit a traction removing command to the train interface when the train does not drive over a speed limit;
Case 2: the second main control unit fails or has no power, the first main control unit determines whether to transmit a traction removing command to the train interface or to cancel transmitting a traction removing command to the train interface as required, the example scenario of "as required" is as above;
Case 3: the first main control unit and the second main control unit are both normally operating, the second main control unit continues to transmit a traction removing command to a circuit module within the on-board equipment;
- the first main control unit determines whether to transmit a traction removing command to the circuit module or to cancel transmitting a traction removing command to the circuit module as required, the example scenario of "as required" is as above;
- if the circuit module receives the traction removing command of the second main control unit and the traction removing command of the first main control unit, it transmits a traction removing command to the train interface;
- if the circuit module only receives the traction removing command of the second main control unit, it cancels transmitting the traction removing command to the train interface.

Scheme 2:

Scheme 2 includes processing of the following three cases:

Case 1: the first main control unit fails or has no power, the second main control unit determines whether to transmit a traction removing command to the train interface or to cancel transmitting a traction removing command to the train interface as required, the example scenario of "as required" is as above;
Case 2: the second main control unit fails or has no power, the first main control unit determines whether to transmit a traction removing command to the train interface or to cancel transmitting a traction removing command to the train interface as required, the example scenario of "as required" is as above;
Case 3: the first main control unit and the second main control unit are both normally operating, the first main control unit or the second main control unit determines whether to transmit a traction removing command to the train interface or to cancel transmitting a traction removing command to the train interface according to states of a local end and a peer end, the specific processing is provided below.
- P1: as shown in FIG. 9, initially, both the local end and the peer end are in an idle state; "both the local end and the peer end are in an idle state" means that the local end and the peer end remain in the same state, that is, the local end and the peer end are in the state of transmitting a traction removing command at the same time, or the local end and the peer end are in the state of cancelling transmitting a traction removing command at the same time;
- P2: when the local end transmits a traction removing command to the train interface, it is determined whether a transmitting state of the traction removing command changes; in the case where the transmitting state of the traction removing command changes, a first timer is started, a state of monitoring a peer end is entered, then step P3 is executed; in the case where a transmitting state of the traction removing command does not change, it is determined whether traction removing command information of the peer end is received, if traction removing command information of the peer end is received, a second timer is started, a state of monitoring the local end is entered, then step P4 is executed; if no traction removing command information of the peer end is received, it continues to determine whether the transmitting state of the traction removing command of the local end changes when the local end transmits a traction removing command to the train interface;
- P3: it is determined whether the transmitting state of a changed traction removing command is to transmit a traction removing command to the train interface or to cancel transmitting a traction removing command to the train interface; if the transmitting state of the changed traction removing command is to transmit a traction removing command to the train interface, the local end transmits a traction removing command to the train interface and periodically transmits, to the peer end, information for transmitting a traction removing command to the train interface, it continues to execute step P3-1; if the changed traction removing command transmitting state is to cancel transmitting a traction removing command to the train interface, the local end cancels transmitting a traction removing command to the train interface temporarily, and periodically transmits, to the peer end, information for cancelling transmitting a traction removing command to the train interface, it continues to execute step P3-2;
- P3-1: as shown in FIG. 10, it is determined whether traction removing command information of the peer end is received; if traction removing command information of the peer end is received, an acknowledgement packet of having receipted the traction removing command information is transmitted to the peer end, and it is determined whether the traction removing command information of the peer end and the transmitting state of the changed traction removing command of the local end are consistent; if the traction removing command information of the peer end and the transmitting state of the changed traction removing command of the local end are consistent, the first timer is closed, the local end enters an idle state; if the traction removing command information of the peer end and the transmitting state of the changed traction removing command of the local end are inconsistent, the local end enters a fault state; if no traction removing command information of the peer end is received, it is determined whether timing of the first timer expires; if timing of the first timer expires, the first timer is closed, the local end enters the idle state; if timing of the first timer does not expire, it is determined whether an acknowledgement packet for traction removing command information of the peer end is received; if an acknowledgement packet for traction removing command information of the peer end is received, it stops transmitting, to the peer end, information for transmitting traction removing command information to the train interface, a current state is maintained; if no acknowledgement packet for traction removing command information of the peer end is received, it is determined whether the information for transmitting traction removing command information to the train interface has been transmitted to the peer end for more than a specified number of times; if the information for transmitting traction removing command information to the train interface has been transmitted to the peer end for more than the specified number of times, it stops transmitting, to the peer end, information for transmitting traction removing command information to the train interface, and the local end enters a fault state; if the information for transmitting traction removing command information to the train interface has not been transmitted to the peer end for more than the specified number of times, it continues to transmit, to the peer end, information for transmitting traction removing command information to the train interface;
- P3-2: as shown in FIG. 11, it is determined whether traction removing command information of the peer end is received; if traction removing command information of the peer end is received, an acknowledgement packet of having receipted the traction removing command information is transmitted to the peer end, and it is determined whether the traction removing command information of the peer end and the transmitting state of the changed traction removing command of the local end are consistent; if the traction removing command information of the peer end and the transmitting state of the changed traction removing command of the local end are consistent, the first timer is closed, the local end enters an idle state; if the traction removing command information of the peer end and the transmitting state of the changed traction removing command of the local end are inconsistent, the local end enters a fault state; if no traction removing command information of the peer end is received, it is determined whether timing of the first timer expires; if timing of the first timer expires, the first timer is closed, the local end enters the idle state; if timing of the first timer does not expire, it is determined whether an acknowledgement packet for traction removing command information of the peer end is received; if an acknowledgement packet for traction removing command information of the peer end is received, it stops transmitting, to the peer end, information for cancelling transmitting traction removing command information to the train interface, a current state is maintained; if no acknowledgement packet for traction removing command information of the peer end is received, it is determined whether the information for cancelling transmitting traction removing command information to the train interface has been transmitted to the peer end for more than a specified number of times; if the information for cancelling transmitting traction removing command information to the train interface has been transmitted to the peer end for more than the specified number of times, it stops transmitting, to the peer end, information for transmitting traction removing command information to the train interface, and the local end enters a fault state; if the information for cancelling transmitting traction removing command information to the train interface has not been transmitted to the peer end for more than the specified number of times, it continues to transmit, to the peer end, information for cancelling transmitting traction removing command information to the train interface;
- P4: as shown in FIG. 12, when the local end transmits a traction removing command to the train interface, it is determined whether a transmitting state of the traction removing command changes; in the case where the transmitting state of the traction removing command changes, it is determined whether the transmitting state of the changed traction removing command of the local end is consistent with the traction removing command information of the peer end as received; if the transmitting state of the changed traction removing command of the local end is consistent with the traction removing command information of the peer end as received, the local end maintains the transmitting state of the changed traction removing command, and transmits the changed traction removing command information to the peer end, the second timer is turned off, it enters a state of waiting for acknowledgement from the peer end, it continues to execute step P5; if the transmitting state of the changed traction removing command is inconsistent with the traction removing command information of the peer as received, the second timer is closed, the local end enters a fault state; if the transmitting state of the traction removing command does not change, it is determined whether the second timer expires; if the second timer expires, the second timer is closed, it enters a fault state; if the second timer does not expire, it continues to determine whether a transmitting state of the traction removing command changes when the local end transmits a traction removing command to the train interface;
- P5: the changed traction removing command information is transmitted to the peer end periodically, it is determined whether acknowledgement information about the traction removing command of the peer end is received; if acknowledgement information about the traction removing command of the peer end is received, the local end enters an idle state; if no acknowledgement information about the traction removing command of the peer end is received, it is determined whether the number of times of transmitting the changed traction removing command information to the peer end exceeds the specified number of times; if the number of times of transmitting the changed traction removing command information to the peer end exceeds the specified number of times, the local end enter an idle state; if the number of times of transmitting the changed traction removing command information to the peer end does not exceed the specified number of times, it continues to transmit the changed traction removing command information to the peer end.

The safety command further includes a train interface control command, the train interface control command includes, but not limited to, service breaking level 4, a routine brake level 1, Passing Neutral Section command, Passing Neutral Section selection;
Processing measures of the train interface control command are determined respectively for different situations below, description is provided with the Passing Neutral Section command as an example.
Situation 1:
when the on-board equipment loses power, or the first main control unit and the second main control unit both fail, transmitting a Passing Neutral Section command to the train interface is cancelled.
Situation 2:
when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to transmit a Passing Neutral Section command to the train interface according to an operating situation;
The "operating condition" here includes three situations where the first main control unit fails or has no power, the second main control unit fails or has no power, and the first main control unit and the second main control unit both operate normally.
The above Situation 2 specifically includes processing of the following three cases:

Case 1: the first main control unit fails or has no power, the first main control unit continues to cancel transmitting a Passing Neutral Section command to the train interface, the second main control unit determines whether to transmit a Passing Neutral Section command to the train interface as required, for example, the second main control unit transmits a Passing Neutral Section command to the train interface in a railway section that needs to execute a Passing Neutral Section command, the second main control unit does not transmit a Passing Neutral Section command to the train interface in a railway section that does not need to execute a Passing Neutral Section command;
Case 2: the second main control unit fails or has no power, the second main control unit continues to cancel transmitting a Passing Neutral Section command to the train interface, the first main control unit determines whether to transmit a Passing Neutral Section command to the train interface as required, the example scenario of "as required" is as above;
Case 3: the first main control unit and the second main control unit are both normally operating, the second main control unit continues to transmit a Passing Neutral Section command to a circuit module within the on-board equipment;
- the first main control unit determines whether to transmit a Passing Neutral Section command to the circuit module or to cancel transmitting a Passing Neutral Section command to the circuit module as required, the example scenario of "as required" is as above;
- if the circuit module does not receive a Passing Neutral Section command, transmitting a Passing Neutral Section command to the train interface is cancelled;
- if the circuit module receives a Passing Neutral Section command of the first main control unit, it transmits a Passing Neutral Section command to the train interface.

When the existing on-board equipment is started, the brake loop needs to be tested to ensure that the braking command is accurately transmitted during operation. Therefore, the second main control unit performs hot backup with respect to the first main control unit, in the case where power is supplied to the first main control unit and the second main control unit concurrently, a method for brake test of the vehicle equipment is provided, the method specifically comprises the following steps, as shown in FIG. 13.

D1: the first main control unit receives a brake test request in real time, after the first main control unit receives a brake test request, the first main control unit starts to perform a brake test; if the brake test fails, a driver is reminded of that the brake test fails, the brake test is re-executed until the brake test is successful; if the brake test is successful, the second main control unit is instructed to perform a brake test;
D2: after the second main control unit receives a command of performing a brake test transmitted by the first main control unit, it transmits a command receipt acknowledgement to the first main control unit, the second main control unit starts to perform a brake test; if the brake test is successful, a brake test result is transmitted to the first main control unit, the first main control unit feeds back brake test results of the local end and the second main control unit to the driver;
if the brake test fails, it is determined whether the number of times of braking test exceeds a specified number of times, step D3 is executed in the case where it does not exceed, step D4 is executed in the case where it exceeds;
D3: the brake test is repeated until the brake test is successful, thereafter the brake test result is transmitted to the first main control unit, the first main control unit feeds back the brake test results of the local end and the second main control unit to the driver;
D4: the first main control unit is informed of test end, the second main control unit enters a fault state; after the first main control unit receives a test end message of the second main control unit, it will feed back the brake test result of the first main control unit to the driver.

Using the above method, when the on-board equipment is started, the braking loops of the first main control unit and the second main control unit are tested, so as to ensure that the braking command is accurately transmitted during the operation of the on-board equipment.
Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or equivalently replace some of the technical features; and these modification or replacement does not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention

Claims

A method for processing train interface data for a hot standby on-board equipment, wherein
a second main control unit is used for hot backup of a first main control unit, power is supplied to the first main control unit and the second main control unit concurrently;

the first main control unit and the second main control unit receive input signals transmitted by a train interface, and control the input signals to be consistent;

when the on-board equipment loses power, or the first main control unit and the second main control unit both fail, the on-board equipment transmits a safety command to the train interface;

when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to transmit a safety command to the train interface according to an operating situation.
The method for processing train interface data for the hot standby on-board equipment according to claim 1, wherein controlling the input signals to be consistent specifically comprises the following steps:
S1: the second main control unit receives a currently collected first input signal transmitted by the first main control unit;

S2: the second main control unit compares the first input signal with a currently collected second input signal; if signal content of the first input signal and signal content of the second input signal are consistent, the first main control unit uses the currently collected first input signal as input and the second main control unit uses the currently collected second input signal as input; if signal content of the first input signal and signal content of the second input signal are inconsistent, the first main control unit discards the first input signal and the second main control unit discards the second input signal, the first main control unit and the second main control unit remain using previous consistent signals as input.
The method for processing train interface data for the hot standby on-board equipment according to claim 2, wherein when signal content of the first input signal and signal content of the second input signal are inconsistent, it is determined that the second main control unit fails if a time period for which signal content of the first input signal and signal content of the second input signal are inconsistent exceeds a prescribed time period.
The method for processing train interface data for the hot standby on-board equipment according to claim 1, wherein controlling the input signals to be consistent is specifically:
the first main control unit receives a current input signal, and transmits the input signal to the second main control unit;

the second main control unit receives the input signal as its own input signal.
The method for processing train interface data for the hot standby on-board equipment according to claim 1, wherein when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to transmit a safety command to the train interface according to an operating situation:
when the first main control unit fails or has no power, the second main control unit determines according to needs whether to transmit a safety command to the train interface;

or, when the second main control unit fails or has no power, the first main control unit determines according to needs whether to transmit a safety command to the train interface;

or, when the first main control unit and the second main control unit are both operating normally, the second main control unit continues to transmit a safety command to a circuit module within the on-board equipment; the first main control unit determines according to needs whether to transmit a safety command to the circuit module; a safety command is transmitted to the train interface if the circuit module receives the safety command of the second main control unit and the safety command of the first main control unit; no safety command is transmitted to the train interface if the circuit module only receives the safety command of the second main control unit.
The method for processing train interface data for the hot standby on-board equipment according to claim 1, wherein when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to transmit a safety command to the train interface according to an operating situation:
when the first main control unit fails or has no power, the second main control unit determines according to needs whether to transmit a safety command to the train interface;

or, when the second main control unit fails or has no power, the first main control unit determines according to needs whether to transmit a safety command to the train interface;

or, when the first main control unit and the second main control unit are both operating normally, the first main control unit or the second main control unit determines whether to transmit a safety command to the train interface according to a state of a local end and a state of a peer end.
The method for processing train interface data for the hot standby on-board equipment according to claim 6, wherein when the first main control unit and the second main control unit are both operating normally, the first main control unit or the second main control unit determines whether to transmit a safety command to the train interface or to cancel transmitting a safety command to the train interface according to a state of a local end and a state of a peer end, which specifically comprises:
T1: initially, both the local end and the peer end are in an idle state;

T2: when the local end transmits a safety command to the train interface, it is determined whether a transmitting state of the safety command changes; in the case where the transmitting state of the safety command changes, a first timer is started, a state of monitoring a peer end is entered, step T3 is executed; in the case where a transmitting state of the safety command does not change, it is determined whether safety command information of the peer end is received, if safety command information of the peer end is received, an acknowledgement packet of having receipted the safety command information is transmitted to the peer end, and a second timer is started, a state of monitoring the local end is entered, step T4 is executed; if no safety command information of the peer end is received, it continues to determine whether the transmitting state of the safety command of the local end changes;

T3: it is determined whether the transmitting state of a changed safety command is to transmit a safety command to the train interface; if the transmitting state of the changed safety command is to transmit a safety command to the train interface, the local end transmits a safety command to the train interface and periodically transmits, to the peer end, information for transmitting a safety command to the train interface, it continues to execute step T3-1; if the changed safety command transmitting state is to not transmit a safety command to the train interface, the local end will not transmit a safety command to the train interface temporarily, and periodically transmits, to the peer end, information for not transmitting a safety command to the train interface, it continues to execute step T3-2;

T3-1: it is determined whether safety command information of the peer end is received; if safety command information of the peer end is received, an acknowledgement packet of having receipted the safety command information is transmitted to the peer end, and it is determined whether the safety command information of the peer end and the transmitting state of the changed safety command of the local end are consistent; if the safety command information of the peer end and the transmitting state of the changed safety command of the local end are consistent, the first timer is closed, the local end enters an idle state; if the safety command information of the peer end and the transmitting state of the changed safety command of the local end are inconsistent, the local end enters a fault state; if no safety command information of the peer end is received, it is determined whether timing of the first timer expires; if timing of the first timer expires, the first timer is closed, the local end enters the idle state; if timing of the first timer does not expire, it is determined whether an acknowledgement packet for safety command information of the peer end is received; if an acknowledgement packet for safety command information of the peer end is received, it stops transmitting, to the peer end, information for transmitting safety command information to the train interface, a current state is maintained; if no acknowledgement packet for safety command information of the peer end is received, it is determined whether the information for transmitting safety command information to the train interface has been transmitted to the peer end for more than a specified number of times; if the information for transmitting safety command information to the train interface has been transmitted to the peer end for more than the specified number of times, it stops transmitting, to the peer end, information for transmitting safety command information to the train interface, and the local end enters a fault state; if the information for transmitting safety command information to the train interface has not been transmitted to the peer end for more than the specified number of times, it continues to transmit, to the peer end, information for transmitting safety command information to the train interface;

T3-2: it is determined whether safety command information of the peer end is received; if safety command information of the peer end is received, an acknowledgement packet of having receipted the safety command information is transmitted to the peer end, and it is determined whether the safety command information of the peer end and the transmitting state of the changed safety command of the local end are consistent; if the safety command information of the peer end and the transmitting state of the changed safety command of the local end are consistent, the first timer is closed, the local end enters an idle state; if the safety command information of the peer end and the transmitting state of the changed safety command of the local end are inconsistent, the local end enters a fault state; if no safety command information of the peer end is received, it is determined whether timing of the first timer expires; if timing of the first timer expires, the first timer is closed, the local end enters the idle state; if timing of the first timer does not expire, it is determined whether an acknowledgement packet for safety command information of the peer end is received; if an acknowledgement packet for safety command information of the peer end is received, it stops transmitting, to the peer end, information for not transmitting safety command information to the train interface, a current state is maintained; if no acknowledgement packet for safety command information of the peer end is received, it is determined whether the information for not transmitting safety command information to the train interface has been transmitted to the peer end for more than a specified number of times; if the information for not transmitting safety command information to the train interface has been transmitted to the peer end for more than the specified number of times, it stops transmitting, to the peer end, information for transmitting safety command information to the train interface, and the local end enters a fault state; if the information for not transmitting safety command information to the train interface has not been transmitted to the peer end for more than the specified number of times, it continues to transmit, to the peer end, information for not transmitting safety command information to the train interface;

T4: when the local end transmits a safety command to the train interface, it is determined whether a transmitting state of the safety command changes; in the case where the transmitting state of the safety command changes, it is determined whether the transmitting state of the changed safety command of the local end is consistent with the safety command information of the peer end as received; if the transmitting state of the changed safety command of the local end is consistent with the safety command information of the peer end as received, the local end maintains the transmitting state of the changed safety command, and transmits the changed safety command information to the peer end, the second timer is turned off, it enters a state of waiting for acknowledgement from the peer end, it continues to execute step T5; if the transmitting state of the changed safety command is inconsistent with the safety command information of the peer as received, the second timer is closed, the local end enters a fault state; if the answer is negative, it is determined whether the second timer expires; if the second timer expires, the second timer is closed, it enters a fault state; if the second timer does not expire, it continues to determine whether a transmitting state of the safety command changes when the local end transmits a safety command to the train interface.

T5: the changed safety command information is transmitted to the peer end periodically, it is determined whether acknowledgement information about the safety command of the peer end is received; if acknowledgement information about the safety command of the peer end is received, the local end enters an idle state; if no acknowledgement information about the safety command of the peer end is received, it is determined whether the number of times of transmitting the changed safety command information to the peer end exceeds the specified number of times; if the number of times of transmitting the changed safety command information to the peer end exceeds the specified number of times, the local end enter an idle state; if the number of times of transmitting the changed safety command information to the peer end does not exceed the specified number of times, it continues to transmit the changed safety command information to the peer end.
The method for processing train interface data for the hot standby on-board equipment according to claim 7, wherein the safety command includes a speed control command and a traction removing command.
The method for processing train interface data for the hot standby on-board equipment according to claim 1, wherein
the safety command includes a train interface control command;

when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to transmit the train interface control command to the train interface according to an operating situation, which specifically comprises:
when the first main control unit fails or has no power, the first main control unit does not transmit the train interface control command to the train interface, the second main control unit determines according to needs whether to transmit the train interface control command to the train interface;

or, when the second main control unit fails or has no power, the second main control unit does not transmit the train interface control command to the train interface, the first main control unit determines according to needs whether to transmit the train interface control command to the train interface;

or, the first main control unit and the second main control unit are both in a normal operating state, the second main control unit cancels transmitting the train interface control command to a circuit module within the on-board equipment; the first main control unit determines whether to transmit the train interface control command to the circuit module as required; the train interface control command is not transmitted to the train interface if the circuit module does not receive the train interface control command; the train interface control command is transmitted to the train interface if the circuit module receives information for the train interface control command of the first main control unit.
The method for processing train interface data for the hot standby on-board equipment according to claim 1, wherein the method further comprises a brake test of the on-board equipment, and the brake test comprises the following steps:
D1: after the first main control unit receives a brake test request, a brake test is performed; if the brake test fails, a driver is reminded of that the brake test fails, the brake test is re-executed until the brake test is successful; if the brake test is successful, the second main control unit is instructed to perform a brake test;

D2: after the second main control unit receives the command and transmits a command receipt acknowledgement to the first main control unit, the second main control unit starts to perform a brake test; if the brake test is successful, a brake test result is transmitted to the first main control unit, the first main control unit feeds back brake test results of the local end and the second main control unit to the driver;

if the brake test fails, it is determined whether the number of times of braking exceeds a specified number of times, step D3 is executed in the case where it exceeds, step D4 is executed in the case where it does not exceed;

D3: the brake test is repeated until the brake test is successful, thereafter the brake test result is transmitted to the first main control unit, the first main control unit feeds back the brake test results of the local end and the second main control unit to the driver;

D4: the first main control unit is informed of test end, the second main control unit enters a fault state; after the first main control unit receives a test end message of the second main control unit, it will feed back the brake test result of the first main control unit to the driver.