WO2019080477A1 - 一种计算机联锁系统及其冗余切换方法 - Google Patents

一种计算机联锁系统及其冗余切换方法

Info

Publication number
WO2019080477A1
WO2019080477A1 PCT/CN2018/086255 CN2018086255W WO2019080477A1 WO 2019080477 A1 WO2019080477 A1 WO 2019080477A1 CN 2018086255 W CN2018086255 W CN 2018086255W WO 2019080477 A1 WO2019080477 A1 WO 2019080477A1
Authority
WO
WIPO (PCT)
Prior art keywords
interlocking
subsystem
slave
computer
structure according
Prior art date
Application number
PCT/CN2018/086255
Other languages
English (en)
French (fr)
Inventor
刘晓冬
刘贞
敖奇
张利峰
叶峰
陈代英
邹未栋
吕媛媛
Original Assignee
北京全路通信信号研究设计院集团有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京全路通信信号研究设计院集团有限公司 filed Critical 北京全路通信信号研究设计院集团有限公司
Priority to EP18869693.4A priority Critical patent/EP3690657B1/en
Priority to RS20230552A priority patent/RS64433B1/sr
Priority to HRP20230685TT priority patent/HRP20230685T1/hr
Priority to EA202091031A priority patent/EA202091031A1/ru
Publication of WO2019080477A1 publication Critical patent/WO2019080477A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1479—Generic software techniques for error detection or fault masking
    • G06F11/1487—Generic software techniques for error detection or fault masking using N-version programming
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
    • G06F11/202—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L19/00—Arrangements for interlocking between points and signals by means of a single interlocking device, e.g. central control
    • B61L19/06—Interlocking devices having electrical operation
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L27/00—Central railway traffic control systems; Trackside control; Communication systems specially adapted therefor
    • B61L27/30—Trackside multiple control systems, e.g. switch-over between different systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/1629—Error detection by comparing the output of redundant processing systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/1629—Error detection by comparing the output of redundant processing systems
    • G06F11/165—Error detection by comparing the output of redundant processing systems with continued operation after detection of the error
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
    • G06F11/202—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant
    • G06F11/2023—Failover techniques
    • G06F11/2028—Failover techniques eliminating a faulty processor or activating a spare
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/20—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
    • G06F11/202—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant
    • G06F11/2038—Error detection or correction of the data by redundancy in hardware using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements where processing functionality is redundant with a single idle spare processing component
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L19/00—Arrangements for interlocking between points and signals by means of a single interlocking device, e.g. central control
    • B61L19/06—Interlocking devices having electrical operation
    • B61L2019/065—Interlocking devices having electrical operation with electronic means

Definitions

  • the present disclosure relates to the field of rail transit, and more particularly to a computer interlocking system applied to a rail transit station.
  • the interlocking architecture In the development of the existing rail transit interlocking platform, the interlocking architecture generally adopts 2 by 2 and 2 platforms. It consists of the same 2 and 2 structures of A and B. Each master sets two CPUs (central processors) with identical hardware and runs a common set of software internally. Under normal circumstances, the system is logically active, and the other system is logical standby. The two CPUs of each system adopt clock level synchronization, and automatically switch to the standby system when the main system fails.
  • clock-level synchronization it is directly subject to the CPU's main processing frequency, that is, the CPU clock frequency cannot be too fast, otherwise the data synchronization in the cycle will be affected due to the inability to complete the operation within the specified time.
  • clock-synchronized computers have lagged far behind existing general-purpose computers.
  • the dual CPU clock synchronization method has the disadvantage of not being able to implement two different sets of algorithms in two CPUs, and cannot eliminate the common mode failure of the software.
  • the present disclosure provides a computer interlocking system and a redundant switching method thereof, which adopts heterogeneous software/hardware, fixed difference programs to start running time to reduce the probability of occurrence of common mode faults, and eliminate common mode faults.
  • the development difficulty is reduced, the production efficiency is improved, and the requirements for debugging and maintenance are reduced.
  • a computer interlocking structure includes an interlocking subsystem, and the interlocking subsystem includes the same and interconnected interlocking I system and interlocking II system, wherein:
  • Both the interlocking I system and the interlocking II system include two CPUs that are identical in hardware and use task-level synchronization, and the two CPUs respectively execute executable files generated by different compilers compiling the same program code.
  • the two CPUs respectively execute executable files generated by the Visual C++ and Watcom C compilers compiling the same program code.
  • the IO subsystem, the control display and the maintenance subsystem are further included, and the interlocking subsystem receives the operation information of the human-machine dialogue layer from the control subsystem and the device state information collected by the IO subsystem, and performs a safety logic operation through the IO sub- The system actually controls the external device.
  • the IO subsystem includes the same IO I system and the IO II system, and the IO I system and the IO II system are respectively connected to the interlocking I system and the interlocking II system;
  • Both the IO I and IO II systems include two CPUs with the same hardware, which run two different sets of software.
  • the IO subsystem includes the same IO I system and the IO II system, and the IO I system and the IO II system are respectively connected to the interlocking I system and the interlocking II system;
  • Both the IO I and IO II systems include two hardware heterogeneous CPUs running two different sets of software.
  • the IO I system and the IO II system both include an input acquisition unit, and the input acquisition unit collects a static DC voltage through dynamic coding, and is separately collected by two independent CPU units in the input collection cage, and then sent to the interlock. The subsystems are compared by the collection results. It is consistently considered that the collected data is valid, otherwise the collected data is invalid, which constitutes two faults-safe collection.
  • both the IO I system and the IO II system also include an output unit, which adopts double-break control, dynamic and static two-way driving serial output, and the static and dynamic outputs are respectively controlled by two independent CPU units in the output cage, when When any one of the outputs is invalid, the total output is invalid, which constitutes a hardware-different two-fault-safe output.
  • the IO subsystem uses inherent fault-safety devices such as transformers and relays.
  • the drive and acquisition circuits are designed as safety circuits to ensure the reliability and safety of the drive.
  • the IO subsystem function execution unit directly controls the device as a station mechanical indoor gravity relay, and then indirectly controls the outdoor signal device through a combination of different relay circuits.
  • the present disclosure also provides a redundancy switching method based on the above computer interlocking structure, including a first system and a second system for performing master-slave redundancy switching, including the following steps:
  • the first system (second system) is started, enters a standby state, and determines to enter a logical primary mode or a logical standby mode according to a current working mode of the second system (first system), a dual-system communication state, and a dual-system clock synchronization state.
  • the first system and the second system output the same data after data comparison and mutual confirmation are consistent.
  • the slave system switches to the main system, and the original master system enters standby. If the slave system is synchronized with the current master system after standby and the system is faultless, the original master system switches to the slave system.
  • the slave enters the standby state in accordance with one of the following conditions: it is out of synchronization with the main system; the health of the slave system is worse than that of the main system; the master and slave systems are both faulty, and the fault degree is the same.
  • the main system or the slave system After the main system or the slave system enters the standby state, if communication with the other system is lost or the cycle starts to be interrupted, the system is switched to the main system; if a serious unresolved fault occurs, the operation is stopped.
  • the hardware/software heterogeneity of the interlocking structure reduces the probability of occurrence of common mode faults and improves system security
  • the IO subsystem directly connected to the field device is designed to be heterogeneous in software/hardware, which ensures the safety of the recovery result, while the upper interlocking subsystem will pay more attention to the work of safety logic operation and secure communication. A more reasonable distribution system is safely implemented to ensure reasonable and efficient use of system resources.
  • FIG. 1 is a structural diagram of a computer interlock system provided by the present disclosure
  • FIG. 2 is a software architecture diagram of a computer interlocking system provided by the present disclosure
  • FIG. 3 is a structural diagram of an interlocking subsystem provided by the present disclosure.
  • FIG. 4 is a schematic diagram of a master-slave switching state provided by the present disclosure.
  • the computer interlocking system provided by the present disclosure is a signal system for realizing station interlocking by using a computer as a main technical means.
  • the computer interlocking system constitutes an interlocking relationship between the stations and the sections of the relatively independent signal devices, such as the signal, track circuit and ballast, which are interlocked, and mutually restrictive, and performs centralized control to ensure driving. Safe control system.
  • the computer interlock system includes: a power subsystem, an interlock subsystem, an IO subsystem (input and output subsystem), a display and maintenance subsystem.
  • the power subsystem provides the required power supply for the equipment of all subsystems, so that the entire interlocking system works safely and reliably;
  • the interlocking subsystem is composed of the interlocking logic department, which is the core of the interlocking system, and receives the control. Display and maintain the operation information of the human-machine dialogue layer of the subsystem and the device status information of signals, switches, tracks, etc. of the IO subsystem.
  • the safety logic operation is performed to generate the corresponding control output, and the signal device is actually controlled by the IO subsystem;
  • the IO subsystem is composed of the acquisition and driving device of the field signal device, directly or through the relay interface circuit of the field device, The result of the lock operation is converted into a voltage (or current) that can act on the field signal device in a safe manner, and the state of the field signal device is collected in a safe manner;
  • the display and maintenance subsystem through the visualized human-machine interface, Provide operation and maintenance personnel to input control commands to the system and monitor driving operations and equipment working status information.
  • the computer interlocking system provided by the present disclosure adopts a two-by-two-two structure based on a fault-safe design technology.
  • the two-to-two comparison structure is widely used in the design, and heterogeneous software/hardware is adopted in the two-two combined fault-safety design.
  • the program with fixed difference starts running time to reduce the probability of common mode failure and improve the safety of the system. .
  • the interlocking subsystem in the computer interlocking system provided by the present disclosure adopts two-two combined fault-safety design, and the master-slave dual-system (interlocking in the figure)
  • the I system and the interlocking II system have the same hardware, but the programs running in each series of dual CPUs are compiled by different compilers.
  • interlock subsystem logic system management software and the interlock application software are developed in C language, and different CPUs are used in each system.
  • CPU1 uses Visual C++ compiler (ie VC compiler)
  • CPU2 uses Watcom C compiler (WC compiler)
  • dual CPU uses different compilers to compile and link the same code respectively. , eventually generating different executables.
  • WC and VC as the most important C/C++ development tools in the 1990s, have achieved great success and widespread use in the market, and are the most mature C/C++ compilers that conform to the ANSI_C standard.
  • These two compilers are developed by two different companies, and the compiled executable files are different in data and code memory allocation and code execution efficiency. After the same software is compiled by WC and VC, the compiled file is analyzed, and the difference in address allocation between the code segment and the data segment is obvious, which can prevent common mode failure caused by memory.
  • the VC and WC compilers In addition to being able to protect memory and processor common mode failures, the VC and WC compilers generate executable programs that are different, preventing the risk of ROM decoding itself failing.
  • the same source code has a fixed difference start-up time when running on the same hardware, which reduces the development difficulty and reduces the development difficulty while reducing the common mode failure. Production efficiency has reduced the requirements for commissioning and maintenance.
  • the interlocking subsystem in the computer interlocking system provided by the present disclosure is always synchronized during system operation, and two CPU units (CPU1 and CPU2) in the interlocking I system (or interlocking II system) are respectively performed. Independent operation, synchronization and exchange of data through the dual-system synchronization board, when the voting structure is consistent, a valid external drive command is generated.
  • the IO subsystem in the computer interlocking system provided by the present disclosure also adopts a two-in-two combined fail-safe design, and implements hardware/software heterogeneity on the IO subsystem.
  • the IO subsystem directly connected to the field device is designed to include the same IO I system and IO II system, respectively connected to the interlocking I system and the interlocking II system, and the IO I system and the IO II system are designed as software/hardware. Heterogeneous, to ensure the safety of the recovery results, and the upper interlocking subsystem will pay more attention to the work of safety logic operation and secure communication, more reasonable distribution system security implementation, to ensure reasonable and efficient use of system resources.
  • the IO subsystem adopts both software and hardware heterogeneity.
  • the input acquisition unit adopts the dynamic acquisition mode, and the static DC voltage is collected by the dynamic coding method, and is collected by two independent CPU units in the input collection cage, and the interlocking subsystem compares the collection results, which is consistently considered.
  • the data is valid, otherwise the data is invalid, which constitutes two faults-safe collection;
  • the output unit adopts double-break control, dynamic and static two-way drive serial output, static and dynamic output are respectively separated by two independent CPUs in the output cage Unit control, when any one of the outputs is invalid, the total output is invalid, which constitutes a hardware-different two-fault-safe output.
  • the drive system of the railway system is a dual-channel, and some of the drive points that are not required for safety may have a single-channel situation, that is, a single drive or acquisition channel.
  • the present disclosure adopts a single channel function execution unit, adopts an inherent fault-safe device, and designs a fast error detection mechanism to detect when a fault occurs. The measures trigger the safety response, and realize the fault-safety system from the input to the output.
  • the inherent fault-safety device is a special component - a transformer and a relay, etc., after the component fails, it does not cause subsequent circuit error output, and thus leads to the safe side.
  • the computer interlocking system function execution unit provided by the present disclosure directly controls the device as a station mechanical indoor gravity relay, and then indirectly controls the outdoor signal device through a combination of different relay circuits;
  • the interlocking subsystem and the IO subsystem in the computer interlocking system provided by the present disclosure, according to which subsystem detects an error, perform corresponding fault processing according to the error level. If the interlocking subsystem detects its own fault, it performs downtime, downtime, etc. according to the error level; if the IO subsystem detects an error, the IO subsystem first uploads the fault information to the interlocking subsystem, and then downgrades according to the fault level. Wait for processing. After the interlock subsystem acquires the IO subsystem fault information, it performs fault identification and processing and leads to the safe side.
  • the subsystems in the computer interlocking system provided by the present disclosure are independent of each other, and the safety-related subsystems-interlocking subsystem and IO subsystem adopt fault-safety design, and can independently implement fault-safety functions to ensure high security of the system. And high availability.
  • the interlocking subsystem and the IO subsystem can work independently, ensuring high availability of the system.
  • the present disclosure further provides a redundancy switching method based on the above computer interlocking system.
  • This embodiment is described by taking an interlocking subsystem as an example, and the related art is easily extended to other interlocking structures.
  • the redundancy switching method provided by the present disclosure includes the following steps:
  • the interlocking I system (interlocking II system) is started, enters the standby state, and decides to enter the logical main mode according to the current working mode of the interlocking I I (interlocking I system), the dual-system communication state, and the dual-system clock synchronization state. Logical standby mode.
  • the input synchronization information is received and the mutual confirmation information is synchronized. If the interlocking I system or the interlocking system II is found to have a serious unavailability failure during the mutual confirmation process, the system in which the failure occurs is stopped, if the system is mainly Department, then the master and the slave are cut;
  • the interlocking I system and the interlocking I I system perform data comparison and mutual confirmation, and output the same data.
  • the primary or secondary system will enter a shutdown state in the event of a severely unavailable failure. If the main failure occurs in the serious unavailability failure, the slave system loses communication with the main system and automatically switches to the main system. In addition, if the health level is better than the main system and the fault level is lower than the main system, the slave system switches to the main system. At this time, the original main system enters standby. If it is synchronized with the current main system after standby and the system has no fault, the original main system switches to the slave system.
  • the slave enters the standby state in one of the following conditions: it is out of sync with the main system; the health of the slave system is worse than that of the main system; the master-slave system has faults, and the fault degree is the same.
  • the computer interlocking system and the master-slave switching method provided by the present disclosure support regional centralized interlock control, and can realize centralized control of multiple stations and optical transmission between adjacent stations by setting a set of interlocking hosts at the central station.
  • the distance (without network relay) can be up to 40km, and all internal devices are connected by optical cable, which ensures the high reliability of the internal information channel of the system. It also has the following features:
  • the self-diagnosis function is perfect, the fault alarm is positioned accurately; the graphic reproduction and printing functions are provided; and the remote diagnosis function is provided.
  • the structure is simple, reasonable, safe and reliable to meet international standards; the network interface with universal standards can realize secure or non-secure communication with external systems as needed, such as: secure communication with wireless blocking center; Offline data generation, system configuration software, and test fixtures.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mechanical Engineering (AREA)
  • Hardware Redundancy (AREA)
  • Safety Devices In Control Systems (AREA)
  • Multi Processors (AREA)

Abstract

一种计算机联锁系统以及基于该联锁系统的冗余切换方法，所述计算机联锁系统包括联锁子系统，联锁子系统包含相同并互联的联锁I系和联锁II系，其中：联锁I系和联锁II系均包括两个硬件相同且采用任务级同步的CPU，该两个CPU分别运行由不同的编译器来编译相同程序代码产生的可执行文件。所述系统采用异构的软/硬件、固定差异的程序开始运行时间来减少共模故障发生概率，在降低共模故障的同时，降低开发难度，提高生产效率，起到了降低调试和维护的要求。

Description

一种计算机联锁系统及其冗余切换方法
本申请要求于2017年10月24日递交的中国专利申请第201711001027.2号的优先权，在此全文引用上述中国专利申请公开的内容以作为本申请的一部分。
技术领域
本公开涉及轨道交通领域，尤其涉及一种应用于轨道交通车站的计算机联锁系统。
背景技术
现有的轨道交通联锁平台开发中，联锁体系结构一般采用2乘2取2平台。由A,B两系相同的2取2结构组成，每系母版设置两个硬件完全相同的CPU(中央处理器)，内部运行一套共同的软件。正常情况下一系为逻辑主用，另外一系为逻辑备用，每一系的两个CPU采用时钟级同步，当主系发生故障时自动切换到备系。但是，由于采用时钟级同步，直接受制于CPU的主处理频率，即CPU时钟频率不能太快，否则将由于无法在规定时间内完成运算而影响周期内的数据同步。
目前，随着计算机性能的不断提升，时钟级同步的计算机已大大落后于现有的通用计算机。再者，双CPU时钟同步方式存在无法在两个CPU中实现两套不同算法的缺点，无法消除软件的共模故障。
因此当前很多研究提出采用软件和硬件同时异构的热冗余2乘2取2热备切换机制，比如CN201410459448.X，将两台硬件异构且采用任务级同步的CPU分别运行两套不同的软件，以消除软件的共模故障。但这种冗余方式开发难度大，调试和维护的要求比较高，大大降低了生产效率。
发明内容
有鉴于此，本公开提供一种计算机联锁系统及其冗余切换方法，采用异构的软/硬件、固定差异的程序开始运行时间来减少共模故障发生的概率，在消除共模故障的同时，降低了开发难度，提高了生产 效率，起到了降低调试和维护的要求。
为达到上述目的，本公开的技术方案如下：
一种计算机联锁结构，包括联锁子系统，联锁子系统包含相同并互联的联锁I系和联锁II系，其中：
联锁I系和联锁II系均包括两个硬件相同且采用任务级同步的CPU，该两个CPU分别运行由不同的编译器编译相同程序代码产生的可执行文件。
进一步的，两个CPU分别运行由Visual C++和Watcom C编译器编译相同程序代码产生的可执行文件。
进一步的，还包括IO子系统、控显和维护子系统，联锁子系统接收来自控显子系统人机对话层操作信息和IO子系统采集的设备状态信息，进行安全逻辑运算，通过IO子系统对外部设备进行实际控制。
进一步的，作为本公开的一种实施方式，IO子系统包含相同的IO I系和IO II系，IO I系和IO II系分别与联锁I系和联锁II系连接；
IO I系和IO II系均包括两个硬件相同的CPU，该两个CPU分别运行两套不同的软件。
进一步的，作为本公开的另一种实施方式，IO子系统包含相同的IO I系和IO II系，IO I系和IO II系分别与联锁I系和联锁II系连接；
IO I系和IO II系均包括两个硬件异构的CPU，该两个CPU分别运行两套不同的软件。
进一步的，IO I系和IO II系均包括输入采集单元，输入采集单元通过动态发码方式采集静态直流电压，由输入采集机笼内的两个独立CPU单元分别进行采集，然后发送至联锁子系统并由其对采集结果进行比较，比较一致认为采集数据有效，否则采集数据无效，构成二取二故障-安全采集。
进一步的，IO I系和IO II系均还包括输出单元，采用双断控制，动态和静态两路驱动串联输出，静态和动态输出分别由输出机笼内的两个独立的CPU单元控制，当任意一路输出无效时，总输出则为无效，构成硬件相异的二取二故障-安全输出。
IO子系统采用了变压器和继电器等固有故障-安全器件，驱动和采集电路均设计为安全电路，保证驱采的可靠性和安全性。
进一步的，IO子系统功能执行单元直接控制设备为车站机械室内重力继电器，再通过不同继电器电路的组合，间接的达到对室外信号设备的控制。
本公开还提供了一种基于以上计算机联锁结构的冗余切换方法，包括进行主从冗余切换的第一系统和第二系统，包含如下步骤：
第一系统(第二系统)启动，进入待机状态，依据第二系统(第一系统)当前工作模式、双系通信状态、双系时钟同步状态来决定进入逻辑主用模式或逻辑备用模式。
在每个周期接收到同步信息以及同步相互确认信息，如果在相互确认过程中发现第一系统或第二系统出现严重不可用故障，则发生故障的该系停机，若该系为主系，则主从倒切；
若主系健康程度差于从系，则两系进行主从倒切；
第一系统和第二系统进行数据比较和相互确认一致后输出相同数据。
进一步的，当从系健康程度高于主系，则从系切换至主系，原主系进入待机，如果待机后与当前主系同步且系统无故障，则原主系切换至从系。
进一步的，从系在符合以下条件之一进入待机状态：与主系不同步；从系健康程度比主系差；主从系均有故障，且故障程度相同。
进一步的，主系或从系进入待机状态后，若与他系失去通信或周期开始中断，则切换至主系；若发生严重不可用故障则停机。
进一步的，主系或从系进入停机状态重启后软件运行，则重新进入待机状态。
本公开的有益效果是：
(1)通过联锁结构软/硬件异构降低了共模故障发生的概率，提高系统安全性；
(2)在联锁子系统上采用硬件相同编译器异构的方案，使得相同的源代码在相同的硬件上运行时具有固定差异的开始运行时间，在降低共模故障的同时，降低了开发难度，提高了生产效率，起到了降低调试和维护的要求；
(3)将与现场设备直连的IO子系统设计为软/硬件异构，保障了驱采结果的安全性，而上层的联锁子系统将更关注于安全逻辑运算和安全通信的工作，更合理的分配系统安全实现，保证系统资源合理和高效的利用。
附图说明
通过以下参照附图对本公开实施例的描述，本公开的上述以及其它目的、特征和优点将更为清楚，在附图中：
图1为本公开提供的计算机联锁系统结构图；
图2为本公开提供的计算机联锁系统软件架构图；
图3为本公开提供的联锁子系统结构图；
图4为本公开提供的主从系切换状态图。
具体实施方式
以下基于实施例对本公开进行描述，但是本公开并不仅仅限于这些实施例。
本公开提供的一种计算机联锁系统，是以计算机作为主要技术手段实现车站联锁的信号系统。该计算机联锁系统将车站和区间内所有纳入联锁的信号机、轨道电路及道岔等相对独立的信号设备构成一种既相互联系又相互制约的联锁关系，并进行集中控制，是保证行车安全的控制系统。
如图1所示，本公开提供的计算机联锁系统包含：电源子系统、联锁子系统、IO子系统(输入输出子系统)、控显和维护子系统。其中，电源子系统为所有子系统的设备提供所需的电力供应，使整个联锁系统安全、可靠的工作；联锁子系统由联锁逻辑部组成，是联锁系统的核心，接收来自控显和维护子系统人机对话层的操作信息和IO子系统的信号、道岔、轨道等设备状态信息。根据以上信息进行安全逻辑运算，产生相应的控制输出，通过IO子系统对信号设备进行实际控制；IO子系统由现场信号设备的采集驱动设备组成，直接或通过现场设备的继电器接口电路，按联锁运算得出的结果以安全的方式转变成可使现场信号设备动作的电压(或电流)，并以安全的方式采集现场信号设备的状态；控显和维护子系统通过可视化的人机界面，提供操作及维修人员向系统输入控制命令并监测行车作业及设备工作状态信息。
本公开提供的计算机联锁系统中采用故障-安全设计技术为基础设计的二乘二取二结构。设计中广泛采用二取二比较结构，并且在二取二组合故障-安全设计中采用异构的软/硬件，固定差异的程序开始运行时间来减少共模故障发生的概率，提高系统的安全性。
如图1所示，作为本公开的其中一种具体实施例，本公开提供的计算机联锁系统中的联锁子系统采用二取二组合故障-安全设计，主从双系(图中联锁I系、联锁II系)硬件一致，但是每系双CPU运行的程序分别通过不同的编译器来编译产生。
进一步的，联锁子系统逻辑部系统管理软件和联锁应用软件采用C语言开发，每系内双CPU采用不同的编译器。如图2、3所示，其中，CPU1采用Visual C++编译器(即VC编译器)，CPU2采用Watcom C编译器(即WC编译器)，双CPU采用不同编译器分别对相同代码进行编译和链接，最终生成不同的可执行文件。
WC和VC在20世纪90年代作为最主要在C/C++开发工具，在市场获得巨大成功和广泛使用，是符合ANSI_C标准的最为成熟的C/C++编译器。这2个编译器由2个不同公司进行开发，其编译生成的可执行文件在数据与代码内存的分配和代码执行效率均不同。同一软件经过WC和VC编译后，通过对编译后的文件进行分析，发现其代码段和数据段的地址分配差异较明显，可防止内存引起的共模故障。
除地址分配存在差异外，两个CPU对代码中同一个控制语句的执行时间存在一定的差异，经测试，由WC编译后的程序执行速度比VC编译后的程序执行速度快5ms，双CPU对同一功能的执行存在固定的时差，可防止处理器引起的共模故障。
除能够防护内存和处理器共模故障外，由于VC和WC编译器生成的可执行程序不尽相同，能够防止ROM解码本身失效的风险。
通过采用WC和VC两种异构的编译器，可以有效的防止编译器、内存、ROM和处理器等引起的共因失效风险，提高了系统的安全性。
通过在联锁子系统上采用编译器异构的方案，使得相同的源代码在相同的硬件上运行时具有固定差异的开始运行时间，在降低共模故障的同时，降低了开发难度，提高了生产效率，起到了降低调试和维护的要求。
如图3所示，本公开提供的计算机联锁系统中联锁子系统在系统运行时始终保持同步，联锁I系(或联锁II系)中两个CPU单元(CPU1和CPU2)分别进行独立的运算，通过双系同步板同步并交换数据，当表决结构一致时，产生有效的对外驱动命令。
作为本公开的其中一种具体实施例，本公开提供的计算机联锁系统中的IO子系统同样采用二取二组合故障-安全设计，在IO子系统上实现了软/硬件异构。将与现场设备直连的IO子系统设计为包含相 同的IO I系和IO II系，分别与联锁I系和联锁II系连接，并将IO I系和IO II系设计为软/硬件异构，保障了驱采结果的安全性，而上层的联锁子系统将更关注于安全逻辑运算和安全通信的工作，更合理的分配系统安全实现，保证系统资源合理和高效的利用。
进一步的，IO子系统上采用了软、硬件同时异构。其中，输入采集单元采用动态采集方式，通过动态发码方式采集静态直流电压，由输入采集机笼内的两个独立CPU单元分别进行采集，由联锁子系统对采集结果进行比较，比较一致认为采集数据有效，否则采集数据无效，构成二取二故障-安全采集；输出单元采用双断控制，动态和静态两路驱动串联输出，静态和动态输出分别由输出机笼内的两个独立的CPU单元控制，当任意一路输出无效时，总输出则为无效，构成硬件相异的二取二故障-安全输出。
一般来说，铁路系统的驱采都是双通道，部分对安全性要求不高的驱采点，可能会存在单通道的情况，即单独的一路驱动或采集通道。为提高单一通道的安全性，作为本公开的其中一种具体实施例，本公开对采用单一通道的功能执行单元，采用固有故障-安全器件，设计快速的错误检测机制，检测到故障发生时采取措施触发安全反应，实现自输入到输出全过程二取二结构的故障-安全系统。
进一步的，所述固有故障-安全器件为特殊元器件-变压器和继电器等，该元器件在发生失效后，不会导致后续的电路错误输出，从而导向安全侧。
作为本公开的其中一种具体实施例，本公开提供的计算机联锁系统功能执行单元直接控制设备为车站机械室内重力继电器，再通过不同继电器电路的组合，间接的达到对室外信号设备的控制；
本公开提供的计算机联锁系统中联锁子系统和IO子系统，无论是哪个子系统检测到错误，都会根据错误级别进行相应的故障处理。如果联锁子系统检测到自身故障，根据错误级别进行宕机、降待机等处理；如果IO子系统检测到错误，IO子系统先上传故障信息给联锁子系统，再根据故障等级进行宕机等处理。联锁子系统获取IO子系统故障信息后，进行故障识别和处理，导向安全侧。
本公开提供的计算机联锁系统中各子系统相互独立，安全相关的子系统-联锁子系统和IO子系统均采用故障-安全设计，可以独立实现故障-安全功能，保证系统的高安全性和高可用性。此外，联锁子系统和IO子系统单系均可独立工作，保证了系统的高可用性。
基于以上计算机联锁系统，本公开还提供一种基于上述计算机联锁系统的冗余切换方法，本实施例以联锁子系统为例进行说明，相关技术容易扩展至其他联锁结构。
本公开提供的冗余切换方法包括如下步骤：
联锁I系(联锁II系)启动，进入待机状态，依据联锁I I系(联锁I系)当前工作模式、双系通信状态、双系时钟同步状态来决定进入逻辑主用模式或逻辑备用模式。
在每个周期接收到输入同步信息以及同步相互确认信息，如果在相互确认过程中发现联锁I系或联锁II系出现严重不可用故障，则发生故障的该系停机，若该系为主系，则主从倒切；
若主系健康程度差于从系，则两系进行主从倒切；
联锁I系和联锁I I系进行数据比较和相互确认一致后输出相同数据。
如图4所示，主系或从系在发生严重不可用故障时会进入停机状态。若发生严重不可用故障的是主系，从系与主系失去通信，自动切换到主系，另外从系如果健康程度比主系好，故障级别低于主系，则从系切换至主系，此时原主系进入待机，如果待机后与当前主系同步且系统无故障，则原主系切换至从系。
从系在符合以下条件之一进入待机状态：与主系不同步；从系健康程度比主系差；主从系均有故障，且故障程度相同。
另外，主系或从系进入待机状态后，若与他系失去通信或周期开始中断，则切换至主系；若发生严重不可用故障则停机。
若主系或从系进入停机状态重启软件运行，则重新进入待机状态。
综上，本公开提供的计算机联锁系统及主从切换方法，支持区域集中联锁控制，通过在中心站设一套联锁主机，能实现多个车站的集中控制，相邻站间光纤传输距离(无网络中继)最远可达40km，内部各设备间全部采用光缆连接，保证了系统内部信息通道的高可靠性。另外还具有如下特点：
自诊断功能完善，故障报警定位准确；具有图形再现和打印功能；提供远程诊断功能。结构简单、合理、安全性和可靠性达到国际标准；具备通用标准的网络接口，可根据需要实现与外部系统的安全或非安全通信，如：与无线闭塞中心的安全通信等；具有完善的配套离线数据生成、系统配置软件和测试工装。
以上所述仅为本公开的优选实施例，并不用于限制本公开，另外，本公开可以有各种改动和变化。凡在本公开的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本公开的保护范围之内。

Claims (13)

  1. 一种计算机联锁结构，其中：包括联锁子系统，所述联锁子系统包含相同并互联的联锁I系和联锁II系，其中：
    所述联锁I系和联锁II系均包括两个硬件相同且采用任务级同步的CPU，该两个CPU分别运行由不同的编译器编译相同程序代码产生的可执行文件。
  2. 根据权利要求1所述的计算机联锁结构，其中：所述两个CPU分别运行由Visual C++和Watcom C编译器编译相同程序代码产生的可执行文件。
  3. 根据权利要求1或2所述的计算机联锁结构，其中：还包括IO子系统、控显和维护子系统，所述联锁子系统接收来自控显子系统人机对话层操作信息和IO子系统采集的设备状态信息，进行安全逻辑运算，通过IO子系统对设备进行实际控制。
  4. 根据权利要求1-3任一所述的计算机联锁结构，其中：所述IO子系统包含相同的IO I系和IO II系，所述IO I系和IO II系分别与所述联锁I系和联锁II系连接；
    所述IO I系和IO II系均包括两个硬件相同的CPU，该两个CPU分别运行两套不同的软件。
  5. 根据权利要求1-3任一所述的计算机联锁结构，其中：所述IO子系统包含相同的IO I系和IO II系，所述IO I系和IO II系分别与所述联锁I系和联锁II系连接；
    所述IO I系和IO II系均包括两个硬件异构的CPU，该两个CPU分别运行两套不同的软件。
  6. 根据权利要求1-5任一所述的计算机联锁结构，其中：所述IO I系和IO II系均包括输入采集单元，所述输入采集单元通过动态发码方式采集静态直流电压，由输入采集机笼内的两个独立CPU单元分别进行采集，然后发送至联锁子系统并由其对采集结果进行比较，比较一致认为采集数据有效，否则采集数据无效，构成二取二故障-安全采集。
  7. 根据权利要求1-6任一所述的计算机联锁结构，其中：所述IO I系和IO II系均还包括输出单元，采用双断控制，动态和静态两路驱动串联输出，静态和动态输出分别由输出机笼内的两个独立的CPU单元控制，当任意一路输出无效时，总输出则为无效，构成硬件 相异的二取二故障-安全输出。
  8. 根据权利要求1-3任一所述的计算机联锁结构，其中：所述IO子系统功能执行单元直接控制设备为车站机械室内重力继电器，通过不同继电器电路的组合，对室外信号设备进行控制。
  9. 一种基于以上权利要求1-8任一项所述计算机联锁结构的冗余切换方法，包括进行主从冗余切换的第一系统和第二系统，其中，包含如下步骤：
    第一系统(第二系统)启动，进入待机状态，依据第二系统(第一系统)当前工作模式、双系通信状态、双系时钟同步状态决定进入逻辑主用模式或逻辑备用模式；
    在每个周期接收到同步信息以及同步相互确认信息，如果在相互确认过程中发现第一系统或第二系统出现严重不可用故障，则发生故障的该系停机，若该系为主系，则主从倒切；
    若主系健康程度差于从系，则两系进行主从倒切；
    第一系统和第二系统进行数据比较和相互确认一致后输出相同数据。
  10. 根据权利要求9所述的计算机联锁结构冗余切换方法，其中：当所述从系健康程度高于主系，则从系切换至主系，原主系进入待机，如果待机后与当前主系同步且系统无故障，则原主系切换至从系。
  11. 根据权利要求9或10所述的计算机联锁结构冗余切换方法，其中：所述从系在符合以下条件之一进入待机状态：与主系不同步；从系健康程度比主系差；主从系均有故障，且故障程度相同。
  12. 根据权利要求10或11所述的计算机联锁结构冗余切换方法，其中：所述主系或从系进入待机状态后，若与他系失去通信或周期开始中断，则切换至主系；若发生严重不可用故障则停机。
  13. 根据权利要求9-12任一所述的计算机联锁结构冗余切换方法，其中：所述主系或从系进入停机状态重启后软件运行，则重新进入待机状态。
PCT/CN2018/086255 2017-10-24 2018-05-10 一种计算机联锁系统及其冗余切换方法 WO2019080477A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP18869693.4A EP3690657B1 (en) 2017-10-24 2018-05-10 Computer-based interlocking system and redundancy switching method thereof
RS20230552A RS64433B1 (sr) 2017-10-24 2018-05-10 Računarski signalno-sigurnosni sistem i njegov postupak za zamenu redundanse
HRP20230685TT HRP20230685T1 (hr) 2017-10-24 2018-05-10 Računalni signalno-sigurnosni sustav i metoda redundancije sklopa
EA202091031A EA202091031A1 (ru) 2017-10-24 2018-05-10 Компьютеризированная система централизации и способ ее резервного переключения

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201711001027.2A CN107992382B (zh) 2017-10-24 2017-10-24 一种计算机联锁系统及其冗余切换方法
CN201711001027.2 2017-10-24

Publications (1)

Publication Number Publication Date
WO2019080477A1 true WO2019080477A1 (zh) 2019-05-02

Family

ID=62029953

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/086255 WO2019080477A1 (zh) 2017-10-24 2018-05-10 一种计算机联锁系统及其冗余切换方法

Country Status (7)

Country Link
EP (1) EP3690657B1 (zh)
CN (1) CN107992382B (zh)
EA (1) EA202091031A1 (zh)
HR (1) HRP20230685T1 (zh)
HU (1) HUE063100T2 (zh)
RS (1) RS64433B1 (zh)
WO (1) WO2019080477A1 (zh)

Cited By (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110871775A (zh) * 2019-11-12 2020-03-10 西安航空制动科技有限公司 一种飞机刹车主备通道闭锁控制系统及其控制方法
CN111400111A (zh) * 2020-03-12 2020-07-10 北京交大思诺科技股份有限公司 一种具有备机失步状态的安全计算机平台
CN112130448A (zh) * 2020-09-25 2020-12-25 北京交大思诺科技股份有限公司 一种双机主备切换的方法
CN112596991A (zh) * 2020-12-27 2021-04-02 卡斯柯信号有限公司 一种基于机器健康状态的热备倒切方法
CN112783036A (zh) * 2020-12-30 2021-05-11 交控科技股份有限公司 列车自动控制系统
CN113806067A (zh) * 2021-07-28 2021-12-17 卡斯柯信号有限公司 基于车车通信的安全数据校验方法、装置、设备及介质
CN114003429A (zh) * 2021-12-30 2022-02-01 中国铁道科学研究院集团有限公司通信信号研究所 基于2oo2×2的安全苛求系统的双系状态控制方法和系统
CN114237990A (zh) * 2021-11-18 2022-03-25 通号万全信号设备有限公司 一种基于fpga芯片的二乘冗余切换方法及装置
CN114280918A (zh) * 2021-12-29 2022-04-05 交控科技股份有限公司 多方向联锁倒切系统和轨道控制系统
CN114407975A (zh) * 2021-12-21 2022-04-29 合肥工大高科信息科技股份有限公司 一种全电子联锁系统执行单元的热备方法及热备联锁系统
CN114516355A (zh) * 2022-02-23 2022-05-20 浙江众合科技股份有限公司 一种基于铁路全线车站智能管控系统
CN114675918A (zh) * 2022-03-22 2022-06-28 重庆市珞宾信息技术有限公司 一种装维终端子系统应用运行方法
CN114735048A (zh) * 2022-03-17 2022-07-12 浙江众合科技股份有限公司 一种基于powerlink总线架构的全电子联锁系统
CN115933469A (zh) * 2022-12-02 2023-04-07 中铁工程设计咨询集团有限公司 一种基于工业以太网的轨道交通车载控制方法和系统
CN116684260A (zh) * 2023-07-31 2023-09-01 卡斯柯信号(北京)有限公司 一种用于全电子联锁系统的新型应急盘及其控制方法

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107992382B (zh) * 2017-10-24 2020-12-29 北京全路通信信号研究设计院集团有限公司 一种计算机联锁系统及其冗余切换方法
CN110936982B (zh) * 2018-09-21 2023-01-06 比亚迪股份有限公司 列车全自动驾驶控制方法、装置和无人驾驶列车信号系统
CN109442214B (zh) * 2018-10-24 2021-04-09 浙江浙能天然气运行有限公司 一种天然气场站输气方法
CN109739568B (zh) * 2018-12-19 2021-12-21 卡斯柯信号有限公司 一种基于2乘2取2架构的安全平台启动方法
CN109649446B (zh) * 2018-12-21 2024-05-31 中国铁道科学研究院集团有限公司通信信号研究所 一种多重冗余网络化的计算机联锁人机交互系统
CN109976208A (zh) * 2018-12-28 2019-07-05 上海亨钧科技股份有限公司 一种联锁i/o系统及控制方法
CN109849969A (zh) * 2019-01-11 2019-06-07 宝鸡文理学院 一种计算机联锁系统
CN110293999B (zh) * 2019-04-30 2021-06-04 北京交大思诺科技股份有限公司 一种安全型lkj制动控制方式
CN111007713A (zh) * 2019-07-10 2020-04-14 沈阳中科一唯电子技术有限公司 一种符合功能安全的异构冗余整车控制器
CN111186463A (zh) * 2020-01-16 2020-05-22 浙江众合科技股份有限公司 一种板级冗余的全电子计算机联锁系统
FR3113747B1 (fr) * 2020-09-02 2023-03-03 Thales Sa Système électronique pour la mise en œuvre d’une fonction critique et procédé associé
CN112238947B (zh) * 2020-10-26 2023-10-13 航宇救生装备有限公司 一种弹射模式切换控制的电子式指令弹射系统
CN112564484B (zh) * 2020-11-05 2022-04-12 北京全路通信信号研究设计院集团有限公司 一种基于物联网技术的高安全远程应急开关装置及数据处理方法
CN112650047A (zh) * 2020-12-04 2021-04-13 北京交大微联科技有限公司 继电器倒机控制电路、控制方法及计算机联锁系统
CN114407971B (zh) * 2021-12-16 2023-09-08 卡斯柯信号有限公司 一种基于首尾冗余的列车控制级别调整方法、设备及介质
CN114553376B (zh) * 2022-01-06 2024-04-30 北京全路通信信号研究设计院集团有限公司 用于计算机联锁系统的二乘二取二平台通信方法及系统
CN114337944B (zh) * 2022-03-16 2023-04-14 中国人民解放军海军工程大学 一种系统级主备冗余通用控制方法
CN114954576B (zh) * 2022-05-23 2023-10-13 北京交大微联科技有限公司 联锁系统中与无线闭塞中心通信时通信机的实现结构
CN115140129B (zh) * 2022-09-05 2022-12-09 卡斯柯信号(北京)有限公司 一种列车占用回执信息的调整方法及装置
CN116767305B (zh) * 2023-08-21 2023-11-17 北京全路通信信号研究设计院集团有限公司 一种全电子编码和信号传递装置及方法
CN118426291B (zh) * 2024-06-28 2024-10-11 比亚迪股份有限公司 系统控制方法、存储介质、程序产品及电子设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101876928A (zh) * 2009-11-13 2010-11-03 北京全路通信信号研究设计院 一种二乘二取二系统的同步方法和设备
CN104268037A (zh) * 2014-09-10 2015-01-07 上海自仪泰雷兹交通自动化系统有限公司 热冗余联锁子系统及其主备切换方法
CN106095626A (zh) * 2016-06-21 2016-11-09 浙江众合科技股份有限公司 改进型二取二架构
CN107992382A (zh) * 2017-10-24 2018-05-04 北京全路通信信号研究设计院集团有限公司 一种计算机联锁系统及其冗余切换方法

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5261092A (en) * 1990-09-26 1993-11-09 Honeywell Inc. Synchronizing slave processors through eavesdrop by one on periodic sync-verify messages directed to another followed by comparison of individual status
CZ282967B6 (cs) 1995-11-08 1997-11-12 Ažd Praha S. R. O. Zabezpečovací zařízení
CZ2003601A3 (en) 2003-02-28 2004-06-16 AŽD Praha s.r.o. Electronic alarm device
CZ2007224A3 (cs) 2007-03-26 2009-02-11 Ažd Praha S. R. O. Elektronický systém železnicního zabezpecovacího zarízení
CN101580073B (zh) * 2008-05-12 2012-01-25 卡斯柯信号有限公司 计算机联锁系统码位级冗余方法
CN101833490B (zh) * 2010-03-31 2012-05-30 卡斯柯信号有限公司 基于软硬件相异性的二取二安全平台的信息处理方法
CN201909961U (zh) * 2010-05-18 2011-07-27 北京捷世伟业电子科技有限公司 一种冗余控制系统
CN102381342B (zh) * 2011-08-31 2014-08-13 北京和利时系统工程有限公司 一种计算机联锁系统及其控制城市轨道交通信号的方法
CN102945221A (zh) * 2012-10-18 2013-02-27 上海亨钧科技有限公司 一种全电子安全计算机联锁系统
CN103176870B (zh) * 2013-03-21 2014-12-03 中国铁道科学研究院 一种多模式信息交互的冗余安全计算机平台

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101876928A (zh) * 2009-11-13 2010-11-03 北京全路通信信号研究设计院 一种二乘二取二系统的同步方法和设备
CN104268037A (zh) * 2014-09-10 2015-01-07 上海自仪泰雷兹交通自动化系统有限公司 热冗余联锁子系统及其主备切换方法
CN106095626A (zh) * 2016-06-21 2016-11-09 浙江众合科技股份有限公司 改进型二取二架构
CN107992382A (zh) * 2017-10-24 2018-05-04 北京全路通信信号研究设计院集团有限公司 一种计算机联锁系统及其冗余切换方法

Cited By (25)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110871775A (zh) * 2019-11-12 2020-03-10 西安航空制动科技有限公司 一种飞机刹车主备通道闭锁控制系统及其控制方法
CN110871775B (zh) * 2019-11-12 2023-06-30 西安航空制动科技有限公司 一种飞机刹车主备通道闭锁控制系统及其控制方法
CN111400111A (zh) * 2020-03-12 2020-07-10 北京交大思诺科技股份有限公司 一种具有备机失步状态的安全计算机平台
CN111400111B (zh) * 2020-03-12 2024-02-27 北京交大思诺科技股份有限公司 一种具有备机失步状态的安全计算机平台
CN112130448A (zh) * 2020-09-25 2020-12-25 北京交大思诺科技股份有限公司 一种双机主备切换的方法
CN112596991A (zh) * 2020-12-27 2021-04-02 卡斯柯信号有限公司 一种基于机器健康状态的热备倒切方法
CN112596991B (zh) * 2020-12-27 2023-09-08 卡斯柯信号有限公司 一种基于机器健康状态的热备倒切方法
CN112783036A (zh) * 2020-12-30 2021-05-11 交控科技股份有限公司 列车自动控制系统
CN113806067A (zh) * 2021-07-28 2021-12-17 卡斯柯信号有限公司 基于车车通信的安全数据校验方法、装置、设备及介质
CN113806067B (zh) * 2021-07-28 2024-03-29 卡斯柯信号有限公司 基于车车通信的安全数据校验方法、装置、设备及介质
CN114237990A (zh) * 2021-11-18 2022-03-25 通号万全信号设备有限公司 一种基于fpga芯片的二乘冗余切换方法及装置
CN114237990B (zh) * 2021-11-18 2024-04-26 通号万全信号设备有限公司 一种基于fpga芯片的二乘冗余切换方法及装置
CN114407975A (zh) * 2021-12-21 2022-04-29 合肥工大高科信息科技股份有限公司 一种全电子联锁系统执行单元的热备方法及热备联锁系统
CN114407975B (zh) * 2021-12-21 2024-04-19 合肥工大高科信息科技股份有限公司 一种全电子联锁系统执行单元的热备方法及热备联锁系统
CN114280918A (zh) * 2021-12-29 2022-04-05 交控科技股份有限公司 多方向联锁倒切系统和轨道控制系统
CN114003429B (zh) * 2021-12-30 2022-03-29 中国铁道科学研究院集团有限公司通信信号研究所 基于2oo2×2的安全苛求系统的双系状态控制方法和系统
CN114003429A (zh) * 2021-12-30 2022-02-01 中国铁道科学研究院集团有限公司通信信号研究所 基于2oo2×2的安全苛求系统的双系状态控制方法和系统
CN114516355A (zh) * 2022-02-23 2022-05-20 浙江众合科技股份有限公司 一种基于铁路全线车站智能管控系统
CN114516355B (zh) * 2022-02-23 2024-03-12 浙江众合科技股份有限公司 一种基于铁路全线车站智能管控系统
CN114735048A (zh) * 2022-03-17 2022-07-12 浙江众合科技股份有限公司 一种基于powerlink总线架构的全电子联锁系统
CN114735048B (zh) * 2022-03-17 2024-06-04 浙江众合科技股份有限公司 一种基于powerlink总线架构的全电子联锁系统
CN114675918A (zh) * 2022-03-22 2022-06-28 重庆市珞宾信息技术有限公司 一种装维终端子系统应用运行方法
CN115933469A (zh) * 2022-12-02 2023-04-07 中铁工程设计咨询集团有限公司 一种基于工业以太网的轨道交通车载控制方法和系统
CN116684260B (zh) * 2023-07-31 2023-11-28 卡斯柯信号(北京)有限公司 一种用于全电子联锁系统的新型应急盘及其控制方法
CN116684260A (zh) * 2023-07-31 2023-09-01 卡斯柯信号(北京)有限公司 一种用于全电子联锁系统的新型应急盘及其控制方法

Also Published As

Publication number Publication date
HRP20230685T1 (hr) 2023-11-10
EP3690657A1 (en) 2020-08-05
EP3690657B1 (en) 2023-06-21
EP3690657C0 (en) 2023-06-21
CN107992382B (zh) 2020-12-29
EP3690657A4 (en) 2021-03-10
RS64433B1 (sr) 2023-09-29
CN107992382A (zh) 2018-05-04
EA202091031A1 (ru) 2020-09-30
HUE063100T2 (hu) 2023-12-28

Similar Documents

Publication Publication Date Title
WO2019080477A1 (zh) 一种计算机联锁系统及其冗余切换方法
CN110361979B (zh) 一种铁路信号领域的安全计算机平台
CN107634855A (zh) 一种嵌入式系统的双机热备方法
CN110376876B (zh) 一种双系同步的安全计算机平台
CN109946956B (zh) 一种设备主备系同步和热备方法
CN201909961U (zh) 一种冗余控制系统
CN107135102B (zh) 一种列车uic网关冗余切换装置及其控制方法
CN106648997A (zh) 一种基于非实时操作系统的主从双机切换方法
CN105974879A (zh) 数字仪控系统中的冗余控制设备、系统及控制方法
CN105187248A (zh) 一种冗余切换系统
WO2009137988A1 (zh) 计算机联锁系统码位级冗余方法
CN104794028A (zh) 一种容灾处理方法、装置、主用数据中心和备用数据中心
CN102103532A (zh) 列控车载设备的安全冗余计算机系统
CN113157499B (zh) 一种基于云计算的安全计算机平台
CN101267392B (zh) 一种上行链路状态切换时通知下游设备的实现方法
CN110758489A (zh) 一种列车自动防护系统
CN114439345A (zh) 一种基于安全计算机的站台门控制装置及系统
CN101916068A (zh) 基于2取2结构的计算机控制系统及其实现方法
CN202142052U (zh) 列控车载设备的安全冗余计算机系统
CN113665631A (zh) 一种联锁主机设备远程重启方法及装置
JP2009086938A (ja) 高安全制御装置
EA043509B1 (ru) Компьютеризированная система централизации и способ ее резервного переключения
CN204695092U (zh) 一种硼加热系统的pcs系统
CN203444463U (zh) 一种安全双机切换控制器
CN103738366A (zh) 计算机系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18869693

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018869693

Country of ref document: EP

Effective date: 20200429