KR20120136955A - Train contol system for obtain safty integrity - Google Patents

Abstract

PURPOSE: A train control system for securing safety integrity is provided to improve reliability and safety by minimizing a fault using a multi processor. CONSTITUTION: A multi processor includes first to third cores. A memory(120) is independently connected to the first to third cores. A control logic(130) is independently connected to the first to third cores. A voting control unit(400) restarts the core after resetting the core when errors occur in the core.

Description

Train control system for obtain safty integrity

The present invention relates to a train control system, and more particularly, to minimize the occurrence of errors by using multiple processors to secure stability and reliability of the control system, and to restart the failed processor to improve the utilization of the entire system. The present invention relates to a train control system for securing safety integrity.

Since the publication of the IEC 61508 standard covering the safety ratings of electronics, there has been a growing interest in the safety integrity level (SIL) in the rail system industry.

The safety integrity level suggests the failure rate versus the risk ratio for the performance required for the train control system. The safety integrity level is proposed from the lowest level 1 to the highest level 4. Level 4 (SIL 4) is required for systems where a large number of lives and property damage can occur due to an error between the train and the signal system.

In order to secure the stability of the train signal, it is required to secure the stability of each module constituting the train system and the control system for controlling each module, and to improve the communication reliability between the modules. The control system connected and controlled with each module may be defined as elements of a processor, a bus controller, a timer, a memory, and an input / output device, and in order to implement fault tolerance of each element, each element may be implemented in real time. It is necessary to prevent the error from being transmitted to other elements by diagnosing and correcting the error.

In the case of ATP / ATO (Auto Train Operation) mounted on a train to control the train, when the same device is placed in a pair in the train and one of them is in an ACTIVE state to ensure stability of the control system, The other is configured to maintain a standby state (STAND_BY). When an error occurs in the active control system, the standby control system is driven instead to minimize the error of the control system controlling the train. However, the active control system is not used until it is received and repaired in the garage, and there is no guarantee that an error does not occur in the standby control system.

On the other hand, hanba define the train, and train control system in IEC62278 RAMS to secure stability with respect to (an acronym meaning a combination of R eliability, vailability A, M and S aintainability afety) standard. The RAMS specification is represented by the first letter of the word, which represents a combination of system reliability, availability, maintainability, and stability, and, more than anything else, corresponds to the characteristics required for train systems. The RAMS specification is written by Park Young-soo, "A Study on the Verification Method of the Safety Integrity Level (SIL) of Railroad System" (Korean Rail Society 2007 Spring Conference Papers pp.9-13, 2007), and Korean Railways published in 2008. The Journal of Korean Journal of Vol. 11, No. 4, pp. 371? See 377.

The Safety Integrity Level (SIL) is used to assess the level at which the programmable control system's RAMS specification mitigates the occurrence of accident-related failures in IEC 62278 (EN 50126).

The safety integrity level (SIL) is expressed as a level from level 1 to level 4 as shown in Table 1 below, and each level is defined as a frequency of occurrence of a hazard or dangerous failure. Therefore, the target of SIL is to be a risk source or a risk side failure, and the SIL evaluation of safety side of the risk failure rate is established only by defining which accident causes the risk source or risk side failure. In general, the safety integrity level (SIL4) referred to in the train system is the frequency of occurrence of the hazards associated with the accident and is evaluated based on the frequency of occurrence of the hazard on the right side of Table 1. The failure rate criteria in terms of reliability in Table 1 are the incidences of failures for expected functions, and do not assess whether the effects of failures are related to an accident, but merely the probability that a given function will fail. However, the target of failure rate in terms of reliability can be expressed more as Mean Time Between Failure (MTBF) or Mean Kilometer Between Failure (MKBF) rather than Safety Integrity Level (SIL).

Therefore, the meaning of SIL for the train system defines accidents ("train collisions", "train derailments", "fire", "crosswalk accidents" which are serious accidents in the railroad safety law in Korea). And to prove that the frequency of incidents that could cause the listed incidents due to a failure of the control system is below the SIL4 range of 10 ^-8 / hour.

Accordingly, the present applicant is to configure a multi-complementary system using a multi-processor, and through this to propose a train control system for securing the safety integrity to implement the improved reliability and integrity of the train control system.

An object of the present invention is to provide a train control system for minimizing the occurrence of failure by using multiple processors, and to ensure the integrity of each processor to mutually monitor and complement other processors to improve reliability and stability.

The above object is, according to the present invention, a first system device including a first processor, a second system device including a second processor, and a third system device including a third processor, and the first system device to Receive a control output value of the third system apparatus, apply a majority vote selection to these control output values to determine an error for generating different control output values of the first system apparatus or the third system apparatus, and determine as an error This is accomplished by a voting control that resets the egg system device and then restarts to determine whether to switch to the active state.

The above object is, according to the present invention, a multi-processor having a first to third cores, a memory independently connected to the first to the third core, a control connected independently to the first to the third core Receives control outputs for logic and work instructions assigned to the first to third cores, and applies majority vote selection to the control outputs generated by the respective coders to apply the majority vote selection to the first to third cores. Is determined by a voting control unit which determines that an error has occurred for a core generating a different control output value, and restarts after resetting the core in which the error has occurred.

According to the present invention, when the train control is performed by a multi-system composed of multiple cores or a multi-system device including independent processors, mutual monitoring and complementation are performed, thereby improving reliability and stability of the train control system. Can be.

1 is a block diagram of a train control system for securing safety integrity according to an embodiment of the present invention.
2 is a conceptual diagram illustrating a software diagnostic method of a train control system according to the present invention.
3 is a reference diagram for an error correcting code scheme of a dual core.
Figure 4 shows a block diagram of a train control system according to another embodiment of the present invention.
FIG. 5 shows a reference drawing to a Markov model of a system arrangement, or a train control system of the present invention using multiple cores.

Hereinafter, the present invention will be described in detail with reference to the drawings.

1 is a block diagram of a train control system for securing safety integrity according to an embodiment of the present invention.

Referring to FIG. 1, a train control system (hereinafter, referred to as a “train control system”) for securing safety integrity according to the present embodiment may include a first system device 110 and a second system device 200. ), The third system device 300, and the voting control unit 400.

The first system device 100 may include a dual core (CORE) (eg, TI's TMS570) 111 for reducing a workload, and the dual core 110 may include a memory 120 and a control logic. 130, a memory interface 140, and error detection logic 150.

Although a dual core (processor, hereinafter omitted) is illustrated in the first system device 100, various types such as a single core, a triple core, or a quad core may be applied. However, it is not limited.

The memory 120 may include a nonvolatile flash memory and a volatile RAM, and the flash ROM and the RAM may have an ECC error correction function.

The error correction unit 130 performs an error diagnosis and correction on the memory 120 or the control logic, and the PBIST (Programmable Built Built-in) for diagnosing an error of the first system device 100. -In Self-Test, LBIST (Logic built-in self-test) for diagnosing the error of control logic in the first system device 100, memory CRC check unit (CRC), reset control unit (RESET), digital watch And a digital watch dog (DWD) timer (DWD) and a real time interrupt control unit (RTI).

The memory interface unit 140 provides an interface for connecting internal and external memories to the dual core 110. The memory interface unit 140 may include an asynchronous external memory interface (EMIF), and the asynchronous EMIF allows the dual core 110 to access an external memory.

The second system apparatus 200 and the third system apparatus 300 are composed of the same hardware as the first system apparatus 100 described above. Therefore, the descriptions of the components of the second system device 200 and the third system device 300 are to be the same as those of the first system device 100, and redundant description thereof will be omitted.

The first system device 100, the second system device 200, and the third system device 300 are connected to a voting control unit 400 and a control area network (CAN) bus implemented as a field-programmable gate array (FPGA). Can be connected. The voting controller 400 receives a control output value of the first system device 100 to the third system device 300 with respect to a control command generated for train control. The voting controller 400 determines a control output value that occupies a large number of the received control output values and a control output value that occupies a decimal number, and determines a system device in which an error occurs according to a majority vote. For example, when the control output values of the first system device 100 and the second system device 200 are the same and the control output values of the third system device 300 are different, an error has occurred in the third system device 300. You can judge.

The voting controller 400 may reset the system device in which the error occurs. In this case, the first system device 100, the second system device 200, and the third system device 300 are preferably driven by independent power sources.

After the voting control unit 400 performs a reset on the system device in which an error occurs, the voting control unit 400 refers to the device check signal output from the reset system device, or refers to the memory value of the memory of the reset system device to determine whether it normally boots and operates. If it is determined that the reset system device is normal, the determination may be made to the active state. This is the biggest difference from the conventional system structure. In the past, when an error occurs in the system device, the replacement system device is driven, and the failed system device is kept inactive. It can be used to increase system utilization.

The voting controller 400 may include an error controller 410, a compact PCI controller 420, a transceiver 430, and a self diagnosis unit 440.

The error control unit 410 refers to the control output values output from the first system device 100 to the third system device 300 connected by the CAN bus, and determines a system device in which an error occurs according to a majority vote, and the system in which the error occurs. After resetting the device, it is determined whether the system device is normal by referring to the device check signal output from the reset system device or by referring to the memory value of the memory of the reset system device. If it is determined that the reset system device is normal, it can be restarted and vice versa.

On the other hand, the voting control unit 400 itself may be multiplexed to limit the occurrence of errors in the voting control unit 400.

The voting control unit 400 may be implemented as an FPGA with two, three, or more numbers of the same voting logic. For example, the same voting logic is composed of four, and the integrity of the voting logic can be secured by resetting or deactivating the voting logic that submits a decimal result among the results of each voting logic.

Accordingly, the voting control unit 400 checks the errors of the result determination devices multiplexed into the first system device 100, the second system device 200, and the third system device 300, and diagnoses the error thereof. It is configured to. A typical train control system consists of an active device and a standby device, and if a failure occurs in the active device, the standby device performs the train control. These devices are SIL4 (Safety Integrity Level). 4), but the train control system according to the present invention is compared with the control result value of the three system devices (100, 200, 300) that are always available, as well as blocking the occurrence of the error, the occurrence of the error Since the voting control unit 400 itself for diagnosing and taking measures also performs error diagnosis, the safety of the train control system according to the existing SIL 4 standard may be exceeded. That is, the train control system according to the present invention can provide stability that exceeds the stability required by the SIL4 standard.

The compact PCI control unit 420 may allow the voting control unit 400 to be connected to the onboard computer of a train according to the compact PCI bus standard, or the voting control unit 400 may be an add-on according to the compact PCI standard. Allow the card to be connected. The transceiver 430 is a type in which the CAN-FT is embedded, and is provided for data transmission and reception with the first system device 100 to the third system device 300.

The self diagnosis unit 440 diagnoses an error of the voting control unit 400 implemented by FPGA logic.

The self-diagnosis unit 440 compares the output control value (or data) of the voting control unit 400, in which the error control unit 410, the compact PCI control unit 420, and the transceiver 430 have a triple structure in the same form. Diagnose whether the control unit 400 is an error. That is, the voting control unit 400 includes three sets of FPGA logic having the same structure, and the data output from each of the three sets of the error control unit 410, the compact PCI control unit 420, and the transceiver 430, and the control signal are the same. The self-diagnostic unit 400 compares the result, and determines or resets the failed FPGA logic according to the result.

2 is a conceptual diagram illustrating a software diagnostic method of a train control system according to the present invention.

Referring to FIG. 2, assuming that the dual core 110 is a TMS570 manufactured by TI, the same software is executed on the real time cores 111 and 112 embedded in the TMS570, and the two cores 111 and 112 simultaneously operate. The error can be detected by comparing the respective result values with each other. In case of using LSM method, hardware error such as operation core or memory can be detected. Although there is a disadvantage in that a software error cannot be detected, the software diagnostic method shown in FIG. 2 executes the same software on each core simultaneously, and proceeds to the next step if the result values of each core are the same.

3 illustrates a reference diagram for an error correcting code scheme of the dual core 110.

Referring to FIG. 3, when the dual core 110 is a TMS570 manufactured by TI, and a 32-bit control command or data is applied to the flash ROM 121 or the RAM 122, 4 bits of the control command or data are applied. Insert a sized Error Correction Code (ECC) to recover control commands or data. In this way, if an error occurs in one bit, the error can be repaired, or if an error occurs in two bits, a control command or data retransmission can be requested.

Figure 4 shows a block diagram of a train control system according to another embodiment of the present invention.

The illustrated train control system may have a form in which a plurality of cores are built in one multiprocessor or a form in which individual processors are aggregated in one system device.

The system cores 510 to 540 capable of independently driving the memory and the software are driven in connection with the individual memory and control logic. The system cores 510 to 540 independently drive the software (SW1 to SW4) and execute the result values of the software (SW1 to SW4). It may be provided to the voting control unit 400.

If the voting control unit 400 determines that an error occurs in the software execution result of the core 1 510 and is different from that of the core 2 520 and the core 3 530, the core 1 510 is a register and a register. You can discard all the values in memory and do a reset (killing the thread and creating a new one). In this case, the core 4 540 may be driven in place of the core 1 510, and the core 4 540 may receive the data for the operation and the instruction from the core 2 520 or the core 3 530 to start the operation. The core 1 510 finishes the reset in the meantime and determines for itself whether the hardware is stuck.

FIG. 5 shows a reference drawing to a Markov model of a system arrangement, or a train control system of the present invention using multiple cores.

M1: All control devices operate normally

M2: Three controllers work normally

M3: Two controllers work normally

M4: Three or all control units fail

을 가지고 있고. 자가 복구 시스템의 고장율을

로 가정한다.Figure 10 shows the Markov model of the proposed quad-core device. 4 Cores have the same failure rate

Have it. Failure rate of self-healing system

.

라 놓으면 그림의 상태도에서

은 아래의 수학식 1과 같다.The modes in which the control system can operate are M1, M2 and M3. When modeled as Markov Process, it is as follows. First, state probability vector

In the state diagram of the picture

Is the same as Equation 1 below.

100: first system device 200: second system device
300: third system device 400: voting control

Claims (11)

A first system device including a first processor, a second system device including a second processor, and a third system device including a third processor; And
Receive control output values of the first system apparatus or the third system apparatus and apply a majority vote selection to these control output values to generate an error for generating different control output values of the first system apparatus or the third system apparatus. And a voting control unit for determining whether to switch the active state after resetting the system device determined to be an error and restarting the system device. The method of claim 1,
The voting control unit,
After resetting a system device determined to be an error among the first to third system devices, if the memory output value of the system device determined to be an error is determined to be normal, the system device determined to be an error is changed to an active state. Train control system for securing safety integrity, characterized in that. The method of claim 1,
The first system device to the third system device,
The same hardware and software are installed,
The same program is executed with respect to the same control, and a result is transmitted to the voting control unit, and the voting control unit refers to the result value of the first system device to the third system device with reference to the first value. A train control system for ensuring safety integrity, characterized in that for determining the integrity of the system device to the third system device. The method of claim 1,
The third system device,
Train control system for securing safety integrity, characterized in that at least one or more. The method of claim 1,
And the first system device, the second system device, the third system device, and the voting control unit are connected to a CAN bus. The method of claim 1,
The voting control unit,
Train control system for securing safety integrity, characterized in that implemented as a field programmable gate array (FPGA). The method of claim 1,
The first to third system apparatus,
Train control system for securing safety integrity, characterized in that driven by an independent power source. A multiprocessor having a first core to a third core;
A memory connected independently to the first to third cores;
A control logic connected independently to the first to third cores; And
Receives a control output value for a work command assigned to the first core to the third core, and applies a majority vote selection to the control output values generated by the respective cores so as to be different from the first core to the third core. And a voting control unit configured to determine that an error has occurred in the core generating the control output value and to restart the core in which the error has occurred, and to restart the core. 9. The method of claim 8,
The first core, to the third core,
Train control system for securing safety integrity, characterized in that the independent hardware control system connected to the same hardware. 9. The method of claim 8,
The first core to the third core,
Run the same software,
The same program is executed for the same control command, and the result is transmitted to the voting control unit;
The voting control unit performs an error determination on a core that calculates different result values by referring to result values of the first core to the third core. 9. The method of claim 8,
The third core,
Train control system for securing safety integrity, characterized in that at least one or more.

Images