JP5905697B2 - Fail-safe device - Google Patents

Description

  The present invention calculates the position of a moving body, performs a speed check between the speed limit calculated based on control information from the ground and the speed of the moving body, and outputs a brake when the speed limit is exceeded. It relates to fail-safe technology.

  As shown in Patent Document 1, a conventional ATC (Automatic Train Control) device receives a frequency-modulated ATC signal transmitted from the orbit side, and determines an ATC control speed represented by this signal; This speed limit is compared with the vehicle speed detected by the speed generator, and the speed check unit is configured to issue an ATC brake command when the vehicle speed exceeds the speed limit. A fail-safe device has been realized by performing comparison and collation of calculation results by using an asynchronous dual system in both the receiving unit and the speed checking unit.

  Further, in the digital ATC, a signal to be transmitted from the ground to the vehicle is used as digital information, so that the track circuit to be stopped can be transmitted from the ground system to the train. In the on-board controller of digital ATC, in addition to the ATC receiver and speed checker that can receive digital signals, a fail-safe that creates a one-step brake curve that stops at a stop point based on vehicle performance and route conditions By providing a calculation unit, we have tried to shorten the time interval of trains and improve riding comfort. Software processing in this fail-safe computing unit is required to be highly reliable and secure, and by adopting a dual system configuration of output collation method in the fail-safe computing unit, the reliability of software computation is increased. Yes. One of the techniques is described in Patent Document 1.

Japanese Patent Publication No. 4-46044

  In a fail-safe device for train control devices configured with a dual CPU of output collation method, output collation is inconsistent due to a difference of 1 count of speed pulse signals taken by the duplicated CPUs, and a failure is determined. Therefore, there is a problem that the operation rate is reduced by performing brake output and stopping the train.

  Furthermore, even if there is a difference in the counts of the speed pulse signals captured by the CPUs, there is a possibility that the output collation results will be determined to match if the fail-safe device itself has failed. Originally, there is a problem that it is not possible to stop the train by brake output. An object of the present invention is to provide a fail-safe device that safely performs speed control of a moving body such as a train and that does not reduce the operation rate.

In order to achieve the above object, in a fail-safe device using an output collation method in a multiplex system, a receiving unit that captures external data of a pulse count, a data exchanging unit for exchanging data between the systems, and each of the systems An operation unit for writing data to or reading data from the data exchange unit is provided, and each system inverts the data exchange area of the data and the data exchange area of the data over all bits. The data to be written is stored, and the first system confirms the first soundness by comparing the data written by the own system into the data exchange unit and the result read by the own system from the data exchange unit. Compare the data written in the exchange unit with the result of inverting the data exchange area of the data read from the data exchange unit by the local system over all bits, Ensure all sex, when the soundness of the data exchange unit the confirmation of the first health check and the second health run for each system was confirmed, the own system itself the receiving The external data captured from the communication unit is the data to be written to the data exchange unit, the external data captured by the other system itself from the reception unit is the data to be written to the data exchange unit, and the local system has written to the data exchange unit Reading the data and reading the data written by the other system to the data exchange unit, and determining that the soundness of the multiplex system is maintained if the difference between the two data comparisons is within a preset threshold value It is in.

Further, in the fail-safe device based on the output verification method in the multiplex system described above , when the soundness of the data exchange unit or the multiplex system cannot be confirmed, an abnormality detection signal or a control signal is output to the outside of the fail-safe device. .

In the present invention, when a fail-safe device based on an output verification method in a multiplex system is mounted on a train and the speed control of the train is performed, the data exchange unit exchanging the data of the arithmetic unit performs a soundness check, so that there is no error. It is possible to exchange data and ensure the safety of the system.
In addition, by preventing inconsistencies in the pulse count value due to differences in the timing at which speed signals are captured, it is possible to prevent the brake from being output when a failure is detected due to unnecessary speed difference detection, and to prevent unnecessary train operation rate declines. be able to.

1 is a system configuration diagram of an on-board device provided with a fail-safe device of the present invention. It is a whole block diagram of the fail safe apparatus of this invention. It is a figure explaining the soundness check method of the data exchange register of a fail safe apparatus. It is a figure explaining the soundness check method of a pulse count value using a data exchange register. It is a flowchart figure of the initial check method of the whole fail safe apparatus. It is a flowchart figure of the abnormality detection method at the time of train operation.

  The best mode for carrying out the present invention will be described.

  A fail-safe device according to a first embodiment of the present invention will be described with reference to FIGS. In the present embodiment, the moving body is set as a train, and the system multiplicity is 2, that is, a double system (respective systems are referred to as A system and B system).

  First, the overall configuration will be described with reference to FIGS. FIG. 1 is a system configuration diagram of an on-board device provided with the fail-safe device of the present invention. FIG. 2 is an overall configuration diagram of the fail-safe device of the present invention. Reference numeral 12 in FIG. 1 denotes a train body, which runs on a track circuit (track) 18. The ATC signal 111 transmitted from the ATC transmitter 11 during traveling is received by the ATC receiver 13 inside the train 12 via the power receiver 19 of the train 12. As shown in FIG. 2, the ATC receiver 13 has A / B DSPs (Digital Signal Processors), and the input ATC signal 191 is subjected to signal conversion processing by the DSP_A 130a and DSP_B 130b, respectively, and the train speed limit And train control information 131a and 131b such as standing line information are input to the failsafe calculation unit 14.

  In addition to the converted ATC signal, the fail safe calculation unit 14 takes in the speed pulse signal 161 by the speed generator 16 provided in the wheel 17. As shown in FIG. 2, the fail safe arithmetic unit 14 includes CPU_A 207a and CPU_B 207b which are arithmetic units, timer_A 205a and timer_B 205b which measure the count and time of the speed pulse signal 161, RAM_A 206a and RAM_B 206b which are storage units, and a bus connecting them. _A 204a and bus_B 204b are provided in each of the A system and the B system. Further, a data exchange register 210 for accessing and exchanging data by the CPU_A 207a and the CPU_B 207b, and a bus verification circuit 208 for monitoring the states of the bus_A 204a and the bus_B 204b are provided.

  The bus verification circuit 208 outputs the speed limit information 141 to the speed check unit 15, and when an abnormality is detected by monitoring the bus state, the error signal 2081 is sent to the CPU_A 207 a and CPU_B 207 b, and the failure detection signal 142 is sent to the other in the train 12. Output to the outside of the functional part of the system and ground equipment. The bus verification circuit 208 has a connection side confirmation register_A surface 212a and a connection side confirmation register_B surface 212b shown in FIG. 3, and the CPU_A 207a and the CPU_B 207b are connected to either system (A system or B system). It is possible to determine whether it belongs. The data exchange register 210 also has an A-system data exchange register_A surface 210a and a B-system data exchange register_B surface 210b.

  The speed checking unit 15 includes a speed checking circuit 152 that compares the speed of the train 12 calculated from the speed pulse signal 161 with the speed limit information 141 that is one of the train control information of the ATC signal 191. When the current speed exceeds the speed limit, the brake output 151 decelerates.

  Next, the operation will be described. If the count error of the pulse count due to the difference in reading timing is within the threshold value by the dual CPU and the data exchange register 210 between them, it is judged that it is healthy, and the failure detection and data exchange of the timer_A 205a, the timer_B 205b and the pulse input circuit are determined. The failure detection of the register 210 is performed by each CPU and the bus verification circuit 208 to improve the operation rate and safety of the train. More specifically, each CPU calculates the speed, position, and speed limit of the train, and if the actual speed of the train exceeds the speed limit, the CPU outputs a brake.

  In the dual system configuration of the output verification type, the bus verification circuit verifies the output results of the A system / B system. If the output results of the A system / B system do not match, it is determined that there is a failure and the brake The system is secured by outputting power and stopping the train. On the other hand, when the pulse count is read by the A / B timer, an error of 1 count or more occurs in the read count value in the A / B system depending on the reading timing of the speed pulse signal. If the output verification of the calculation results of each system is carried out with this difference apparent, a failure due to the output verification mismatch results in a train stop and a reduction in operating rate.

  Therefore, before the output verification, each pulse count value captured by the A / B CPU is exchanged by the data exchange register, and whether the captured value in the A / B system has a count error of 2 counts or more. Check. An error of 1 count is allowed. When there is a count difference of 2 counts or more, it is determined that the timer or the input stage circuit has failed, and the entire apparatus is determined to be defective. In this check processing, the soundness of the duplicated pulse count reading portion is checked. If there is no problem in this processing, the A system / B system CPU uses the pulse count value acquired in the A system for the subsequent control processing (even if the pulse count value acquired in the B system is used). It doesn't matter)

  As a result of the above processing, a difference of 1 count in the pulse count due to a difference in reading timing in the A system / B system does not result in an output collation mismatch, and when a difference of 2 counts or more occurs in the pulse count. By outputting the brake as a failure, it is possible to ensure safety while ensuring the operating rate. In the above description, it has been determined that a failure is 2 counts or more, but a preset threshold value can also be used.

  The data exchange register 210 used in the above process is a common unit accessible from the A / B CPU. Therefore, it is necessary to confirm the data exchange operation of the data exchange register and diagnose in advance (for example, before starting train operation) that there is no potential failure in the data exchange register. Therefore, before exchanging pulse count data using the data exchange register (for example, at the time of starting up the apparatus), by exchanging special value data that changes all the bits of the data exchange register Check for failure. That is, the data A written by the A system CPU_A 207a to the data exchange register and the data written by the B system CPU_B 207b to the data exchange register are all bit exclusive, and the A system CPU_A 207a and the B system CPU_B 207b read and compare the data. And confirm that they match.

  The detailed operation will be described with reference to FIGS. FIG. 3 is a diagram for explaining the soundness check method of the data exchange register of the fail-safe device. FIG. 5 is a flowchart of an initial check method for the entire fail-safe device.

  An initial check of the fail-safe calculation unit is performed before the train operation. First, the CPU itself performs self-diagnosis inside itself (S1000). If it is sound (branch to Yes in S1001), then RAM check (S1002), counter (timer) check (S1003), DSP check (S1004), bus verification circuit check (S1005) are performed, and all are checked (S1006). If it is healthy (branch to Yes in S1006), the data exchange register shown in FIG. 3 is checked (S1007). If the data exchange register is also sound (branch to Yes in S1008), the fail-safe operation unit determines that all are sound and ends the initial check.

  If the CPU is unhealthy (branch to No in S1001), one or more of the RAM / counter / DSP / bus verification circuit is unhealthy (branch to No in S1006), or the data exchange register is unhealthy (S1008) Branch to No), it is determined that the fail-safe operation unit is out of order, an abnormality notification (S9000) is performed, and the initial check is stopped.

  Next, the soundness check of the data exchange register will be described in more detail. First, the CPU recognizes whether it is the A system or the B system by using the connection side confirmation register. Next, the A system / B system CPU writes different check data in the A system / B system to the A and B surfaces of the data exchange register. Further, the A system / B system CPU designates and accesses the A / B side of the data exchange register, and then alternately reads the data exchange registers of both systems to confirm that the data of each system can be exchanged and acquired. .

  The special value used for the check here confirms that there is no fixed failure in the data exchange area by exchanging check data in which all bits of the data exchange area are changed by 0/1. With this processing, the soundness of the data exchange register can be confirmed. Further, by allowing the data exchange of the pulse count value only after this processing is completed, it becomes possible to prevent speed recognition errors due to erroneous data exchange.

More specifically (S01) Each of the CPUs 207a and 207b recognizes its own system on the A side 212a and the B side 212b of the connection side confirmation register. (2071a, 2071b)
(S02) When the connection side confirmation register is the A system 212a, that is, when it is recognized that it is the A system CPU 207a, the data of (0x5A5A5A5A) is written to the A side 210a of the data exchange register. (2072a)
(S03) When the connection side confirmation register is the B system 212b, that is, when it recognizes that it is the B system CPU 207b, the data of (0xA5A5A5A5) is written to the B surface 210b of the data exchange register. (2072b)
(S04) Each CPU 207a, 207b designates the A side 210a of the data exchange register and reads the stored data. Here, the result read from the A side 210a of the data exchange register is (0x5A5A5A5A). (2073a, 2073b)
(S05) Each of the CPUs 207a and 207b designates the B side 210b of the data exchange register and reads the stored data. Here, the result read from the B surface 210b of the data exchange register is (0xA5A5A5A5). (2074a, 2074b)
(S06) The CPU 207a confirms that the value (0x5A5A5A5A) designated and read out from the A-side 210a of the data exchange register matches the A-system check data (0x5A5A5A5A) recognized in advance. (2075a)
(S07) The CPU 207b confirms that the value (0xA5A5A5A5) read by designating the B surface 210a of the data exchange register matches the B system check data (0xA5A5A5A5) recognized in advance. (2075b)
(S08) The CPU 207a confirms that the value (0xA5A5A5A5) read by designating the B surface 210b of the data exchange register matches the inversion of the A system check data (0x5A5A5A5A) recognized in advance. (2076a)
(S09) The CPU 207b confirms that the value (0x5A5A5A5A) read by designating the A side 210a of the data exchange register matches the inversion of the B system check data (0xA5A5A5A5) recognized in advance. (2076b)
In the above processing, since all the bits of the data exchange register 210 are changed to 0 and 1 and checked, a failure can be detected reliably.

Next, the soundness check of the pulse count data in taking in the speed pulse signal will be described with reference to FIG.
(S11) The A-system / B-system CPUs 207a and 207b obtain the pulse count values TCLKA_A and TCLKA_B from their own system timer_A 205a and timer_B 205b, respectively. (2171a, 2171b)
(S12) The CPU 207a writes the pulse count value captured in its own system to the A side (210a) of the data exchange register 210 and the CPU 207b to the B side (210b) of the data exchange register 210. (2172a, 2172b)
(S13) The CPU 207a and the CPU 207b designate and read the A side (210a) of the data exchange register 210, thereby acquiring the pulse count value TCLKA_A of the A-system timer 205a. (2173a, 2173b)
(S14) The CPU 207a and the CPU 207b designate and read the B side (210b) of the data exchange register 210, thereby acquiring the pulse count value TCLKA_B of the B-system timer 210b. (2174a, 2174b)
(S15) The CPUs 207a and 207b confirm that the difference between the pulse count value TCLKA_A of the A-system timer 205a read in (S13) and (S14) and the pulse count value TCLKA_B of the B-system timer 205b is within a threshold ( Pulse difference monitoring process). (2175a, 2175b)
(S16) If there is no abnormality in the pulse difference monitoring process in (S15), the CPUs 207a and 207b use the pulse count value TCLKA_A captured by the A-system timer 205a for the calculation of the train speed, and perform the train control process.
If the pulse count difference in (S15) is larger than the threshold value, it is considered that the input stage circuit or timer is abnormal, and the train is decelerated or stopped by the failure detection signal and the brake output. Therefore, safe operation is possible as a train system.

  In this embodiment, the description has been made using the address 1 of the data exchange register 210. However, since the data exchange register 210 includes a plurality of registers having a plurality of bits (a plurality of bytes), it is possible to check by sequentially changing the registers.

  FIG. 6 is a flowchart of an abnormality detection method during train operation. In this figure, the health of the data exchange register 210, which is an important functional unit in the fail-safe calculation unit 14, is performed in addition to the pulse count value check during operation (S11 to S16 described above) in addition to the initial check. is there. First, time information is acquired from the timers 205a to 205b (S2000), and when the information reaches the check time (branch to Yes in S2001), the data exchange register is checked (S2100, S01 to S09 described above) to be sound. Whether or not (S2101).

  If it is sound (branch to Yes in S2101), the pulse count value check (S2002) is performed to check the soundness. If it is healthy (branch to Yes in S2003), the bus verification circuit 208 is checked (S2005). If it is healthy (branch to Yes in S2005), the same processing is repeated again. If any of S2101, S2003, and S2005 is unhealthy (branch to No), it is determined that there is a failure, and an abnormality notification S9000 (failure detection signal and brake output to train) is executed.

  The main check is from S2000 to S2005, and S2100 and S2101 are subordinate checks. Therefore, for example, the main check confirms the soundness finely once every 10 msec, and the sub-check confirms the soundness once every 100 sec. By checking the entire fall-safe device in detail by such a method, the soundness can be further improved. In the above description of the embodiment, a train is used as an example of a moving body, but it goes without saying that the present invention can be applied to a moving body other than a train, such as an automobile.

  It can be applied to a fail-safe device that performs train control in railways. It can also be applied to computers other than railways that require high reliability and safety and other mobile objects.

11 ATC transmission unit 12 Train 13 ATC reception unit 14 Fail-safe operation unit 15 Speed check unit 16 Speed generator 17 Wheel 18 Track circuit 19 Power receiver 111 ATC signal 130a DSP_A
130b DSP_B
141 Speed limit information 142 Failure detection signal 151 Brake output 152 Speed check circuit 161 Speed pulse signal 191 ATC signal 204a Bus_A
204b Bus_B
205a Timer_A
205b Timer_B
206a RAM_A
206b RAM_B
207a CPU_A
207b CPU_B
208 Bus verification circuit 2081 Error signal 210 Data exchange register 210a Data exchange register_A surface 210b Data exchange register_B surface 212a Connection side confirmation register_A surface 212b Connection side confirmation register_B surface

Claims (3)

In fail-safe equipment with output verification method in multiplex system,
A receiver that captures external data of the pulse count ;
A data exchange section for each system to exchange data;
An operation unit for writing data to the data exchange unit in each system or reading data is provided,
Each system stores the data to be written by the own system and the data to be written by other systems, in which the data exchange area of the data is inverted over all bits,
Compare the data written by the own system to the data exchange unit and the result read by the own system from the data exchange unit to confirm the first soundness,
Compare the data written by the other system to the data exchange unit and the result of inverting the data exchange area of the data read from the data exchange unit by the own system over all bits, and confirm the second soundness,
If the integrity of the data exchange unit the confirmation of the first health check and the second health run for each system was confirmed,
External data taken by the own system from the receiving unit is data to be written to the data exchange unit,
External data taken by the other system itself from the receiving unit as data to be written to the data exchange unit,
When the local system reads the data written to the data exchange unit and the other system reads the data written to the data exchange unit, and the difference between the two data comparison is within a preset threshold, the multiplexing system A fail-safe device characterized in that soundness is maintained . 2. The fail-safe device according to claim 1, wherein when a soundness of the data exchange unit or the multiplexing system cannot be confirmed, an abnormality detection signal or a control signal is output to the outside of the fail-safe device. Safe device. The fail-safe device according to claim 1 , wherein the external data captured by the receiving unit is speed information of a moving body .

Images