WO2021174769A1

WO2021174769A1 - Method for processing train interface data of hot-standby vehicle-mounted device

Info

Publication number: WO2021174769A1
Application number: PCT/CN2020/109451
Authority: WO
Inventors: 于晓娜; 王建敏; 陈志强; 张友兵
Original assignee: 北京全路通信信号研究设计院集团有限公司
Priority date: 2020-03-06
Filing date: 2020-08-17
Publication date: 2021-09-10
Also published as: RS64526B1; EP3895958B1; CN111003024B; HUE063550T2; CN111003024A; EP3895958A1; EP3895958C0; EP3895958A4

Abstract

Provided is a method for processing train interface data of a hot-standby vehicle-mounted device. The method comprises: using a second main control unit to perform hot standby on a first main control unit, and simultaneously supplying power to the first main control unit and the second main control unit; and the first main control unit and the second main control unit receiving input signals sent by a train interface, and controlling the input signals to remain consistent. The problem of when a currently working first main control unit fails, needing to switch, when a train stops, from the first main control unit to a second main control unit because an existing vehicle-mounted device usually uses a cold-standby or warm-standby main control unit is solved.

Description

Method for processing train interface data of hot-standby vehicle-mounted equipment

Technical field

The present invention relates to the technical field of train control, in particular to a method for processing train interface data for hot standby on-board equipment.

Background technique

The train operation control system is a system to ensure the safe and fast operation of trains. The main function of the train operation control system is to complete the interval control and speed control of the train. The complete train operation control system consists of on-board equipment and ground equipment.

Existing in-vehicle equipment generally adopts the second main control unit for cold backup or warm backup for the first main control unit, which has the following problems:

When the working first main control unit fails, it is necessary to switch from the first main control unit to the second main control unit in the case of parking.

Summary of the invention

In order to overcome the shortcomings of the prior art, the present invention provides a method for processing train interface data of hot standby on-board equipment. When a main control unit fails, it is necessary to switch from the first main control unit to the second main control unit while parking.

The present invention is specifically implemented through the following technical solutions:

The method for processing train interface data of hot standby on-board equipment of the present invention specifically includes:

Using the second main control unit to hot backup the first main control unit, and supply power to the first main control unit and the second main control unit at the same time;

The first main control unit and the second main control unit receive the input signal sent by the train interface, and control the input signal to be consistent;

When the on-board equipment loses power, or when the first main control unit and the second main control unit all fail, the on-board equipment sends a safety command to the train interface;

When at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to send a safety command to the train interface according to the operating conditions.

Further, controlling the input signals to be consistent includes the following steps:

S1: The second main control unit receives the currently collected first input signal sent by the first main control unit;

S2: The second main control unit compares the first input signal with the currently collected second input signal. If the signal content of the first input signal and the second input signal are the same, the first main control unit The control unit uses the currently collected first input signal as input, and the second main control unit uses the currently collected second input signal as input; if the signal content of the first input signal and the second input signal are inconsistent, all The first main control unit discards the first input signal, the second main control unit discards the second input signal, and the first main control unit and the second main control unit maintain the previous consistent signal as input.

Further, when the signal content of the first input signal and the second input signal are inconsistent, if the signal content of the first input signal and the second input signal are inconsistent for more than a predetermined time, the second main control unit is determined Fault.

Further, controlling the input signal to be consistent is specifically:

The first main control unit receives the current input signal, and sends the input signal to the second main control unit;

The second main control unit receives the input signal as its own input signal.

Further, when at least one of the first main control unit and the second main control unit is in a normal operation state, the on-board equipment determines whether to send a safety command to the train interface according to the operation situation:

When the first main control unit fails or has no power, the second main control unit determines whether to send a safety command to the train interface as required;

or,

When the second main control unit fails or has no power, the first main control unit determines whether to send a safety command to the train interface as required;

or,

When the first main control unit and the second main control unit are all operating normally, the second main control unit continues to send safety commands to the circuit module in the vehicle equipment; the first main control unit determines whether to send to the circuit module as needed Security command; if the circuit module receives the security command of the second main control unit and the security command of the first main control unit, it sends a security command to the train interface; if the circuit module only receives the second The safety command of the main control unit does not send the safety command to the train interface.

Further, when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to send a safety command to the train interface according to the operating conditions:

Or, when the second main control unit fails or has no power, the first main control unit determines whether to send a safety command to the train interface as required;

Or, when the first main control unit and the second main control unit are all operating normally, the first main control unit or the second main control unit determines whether to send a safety command to the train interface according to the status of the local end and the opposite end.

Further, when the first main control unit and the second main control unit are all operating normally, the first main control unit or the second main control unit determines whether to send a safety command to the train interface according to the status of the local end and the opposite end Cancel the sending of safety commands to the train interface, including:

T1: Initially, both the local end and the opposite end are in an idle state;

T2: When the local end sends a safety command to the train interface, it is judged whether the sending status of the safety command has changed. If the sending status of the safety command changes, the first timer is started, the monitoring peer status is entered, and step T3 is executed; if it is safe If the sending status of the command has not changed, it is judged whether the security command information of the opposite end is received, and if the security command information of the opposite end is received, the confirmation packet of receiving the security command information is sent to the opposite end, and the second timer is started, and enter Monitor the status of the local end, and execute step T4. If the security command information from the opposite end is not received, continue to determine whether the sending status of the security command of the local end has changed;

T3: Judge whether the sending status of the changed safety command is sending a safety command to the train interface. If the sending status of the changed safety command is sending a safety command to the train interface, the local end sends the safety command to the train interface and periodically The opposite terminal sends a message to send a safety command to the train interface, and continues to step T3-1. If the changed safety command status is not to send a safety command to the train interface, the local terminal will not send a safety command to the train interface temporarily, and Periodically send messages not to send safety commands to the train interface to the opposite end, and continue to perform step T3-2;

T3-1: Judge whether the security command information of the opposite end is received, if the security command information of the opposite end is received, send a confirmation packet of receiving the security command information to the opposite end, and judge the security command information of the opposite end and the changed value of the local end Whether the sending status of the security command is consistent, if the security command information of the opposite end is consistent with the sending status of the changed security command of the local end, the first timer is turned off and the local end enters the idle state. If the security command information of the opposite end changes with the local end If the sending state of the subsequent security commands is inconsistent, the local end enters the fault state. If the security command information from the opposite end is not received, it is judged whether the timing time of the first timer has expired, and if the timing time of the first timer expires, it will be turned off. The first timer, the local end enters the idle state, if the time of the first timer does not expire, it is judged whether the confirmation packet of the security command information of the opposite end is received, and if the confirmation packet of the security command information of the opposite end is received, it stops Send the message of sending the safety command to the train interface to the opposite end to maintain the current state. If the confirmation packet of the safety command information of the opposite end is not received, it is judged whether the message of sending the safety command to the train interface to the opposite end exceeds the specified number of times. If the information of sending safety commands to the train interface to the opposite end exceeds the specified number of times, stop sending the information of sending safety commands to the train interface to the opposite end, and the local end enters a fault state. If the information of sending safety commands to the train interface is sent to the opposite end If it does not exceed the specified number of times, continue to send information to the opposite end to send safety commands to the train interface;

T3-2: Judge whether the security command information of the opposite end is received, if the security command information of the opposite end is received, then send a confirmation packet of receiving the security command information to the opposite end, and judge the security command information of the opposite end and the changed local end Whether the sending status of the security command is consistent, if the security command information of the opposite end is consistent with the sending status of the changed security command of the local end, the first timer is turned off and the local end enters the idle state. If the security command information of the opposite end changes with the local end If the sending state of the subsequent security commands is inconsistent, the local end enters the fault state. If the security command information from the opposite end is not received, it is judged whether the timing time of the first timer has expired, and if the timing time of the first timer expires, it will be turned off. The first timer, the local end enters the idle state, if the time of the first timer does not expire, it is judged whether the confirmation packet of the security command information of the opposite end is received, and if the confirmation packet of the security command information of the opposite end is received, it stops Send the message not to send the safety command to the train interface to the opposite end and maintain the current state. If the confirmation packet of the safety command information from the opposite end is not received, judge whether the message of not sending the safety command to the train interface to the opposite end exceeds the specified number of times If the message of not sending safety commands to the train interface is sent to the opposite end more than the specified number of times, stop sending the message of not sending safety commands to the train interface to the opposite end, and the local end enters a fault state. If the information of sending safety commands does not exceed the specified number of times, it will continue to send information not to send safety commands to the train interface to the opposite end;

T4: When the local end sends a safety command to the train interface, it judges whether the sending status of the safety command has changed. If the sending status of the safety command changes, it judges the sending status of the changed safety command and the received safety command information of the opposite end. Whether it is consistent or not, if the sending status of the changed security command is consistent with the received security command information of the opposite end, the local end keeps the sending status of the changed security command, and sends the changed security command information to the opposite end, closing the first The second timer enters the state of waiting for confirmation from the peer and continues to perform step T5. If the sending state of the changed security command is inconsistent with the received security command information of the peer, the second timer is turned off and the local end enters the fault state. If no, it is judged whether the second timer has timed out. If the second timer has timed out, the second timer will be turned off and enter the fault state. If the second timer has not timed out, it will continue to judge when the local end sends a safety command to the train interface. Whether the sending status of the safety command has changed;

T5: Periodically send the changed security command information to the opposite end to determine whether the confirmation information about the security command from the opposite end is received. If the confirmation information about the security command from the opposite end is received, the local end enters the idle state, if not received For the confirmation information of the security command on the opposite end, it is judged whether the number of times of sending the changed security command information to the opposite end exceeds the specified number of times. If the number of times of sending the changed security command information to the opposite end exceeds the specified number of times, the local end enters idle Status, if the number of times that the changed security command information is sent to the opposite end does not exceed the specified number of times, continue to send the changed security command information to the opposite end.

Further, the safety command includes a speed control command and a cutting traction command.

Further, the safety command includes a train interface control command;

When at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to send the train interface control command to the train interface according to the operating conditions, which specifically includes:

When the first main control unit fails or has no power, the first main control unit does not send the train interface control command to the train interface, and the second main control unit determines whether to send the train interface control command to the train interface as needed;

Or, when the second main control unit fails or has no power, the second main control unit does not send the train interface control command to the train interface, and the first main control unit determines whether to send the train interface control to the train interface as needed Order;

Or, the first main control unit and the second main control unit are all in a normal operating state, and the second main control unit cancels sending the train interface control command to the circuit module in the on-board equipment; the first main control unit determines whether to The circuit module sends the train interface control command; if the circuit module does not receive the train interface control command, it does not send the train interface control command to the train interface; if the circuit module receives the first master The train interface control command information of the control unit sends the train interface control command to the train interface.

Further, it also includes a brake test of on-board equipment, and the brake test includes the following steps:

D1: After the first main control unit receives the brake test request, it will execute the brake test. If the brake test fails, it will remind the driver that the brake test has failed, and re-execute the brake test until the brake test is successful. If successful, command the second main control unit to perform the brake test;

D2: After the second main control unit receives the command and sends a confirmation receipt command to the first main control unit, it starts to perform the brake test. If the brake test is successful, the brake test result is sent to the first main control unit , The first main control unit feeds back the brake test results of the local end and the second main control unit to the driver;

If the brake test fails, it is determined whether the number of braking times exceeds the specified number of times, if it exceeds, then execute step D3, if it does not exceed, then execute step D4;

D3: Repeat the brake test until the brake test is successful, and then send the brake test result to the first main control unit, and the first main control unit feeds back the brake test results of the local end and the second main control unit to the driver ；

D4: Inform the first main control unit that the test is over and the second main control unit enters a fault state. After the first main control unit receives the test end message of the second main control unit, it will feed back the brake test result of the first main control unit To the driver.

Compared with the closest prior art, the technical solution of the present invention has the following beneficial effects:

The present invention provides a method for processing train interface data for hot standby on-board equipment, using a second main control unit to hot backup the first main control unit, and supply power to the first main control unit and the second main control unit at the same time, Control the input signals of the train interface of the first main control unit and the second main control unit to keep the same, to ensure that the first main control unit and the second main control unit are synchronized in operation, so that when the first main control unit fails, there is no need to stop the machine. Can automatically switch to the second main control unit.

Description of the drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative labor.

Fig. 1 is a schematic diagram of signal transmission between the hot standby on-board equipment and the train interface of the present invention;

FIG. 2 is a block diagram of the overall flow of the method for processing train interface data for hot backup on-board equipment according to the present invention;

Figure 3 is a flow chart of Scheme 1 for keeping the input signal consistent;

Figure 4 is a flow chart of Scheme 2 for keeping the input signal consistent;

Figure 5 is a block diagram of a part of the process for the situation 3 in the plan 2 adopted in the processing measures for the brake command;

Figure 6 is a block diagram of a part of the process for the situation 3 in the plan 2 adopted in the processing measures for the brake command;

Fig. 7 is a partial flow diagram for the situation 3 in the plan 2 adopted in the processing measures for the braking command;

Fig. 8 is a partial flow diagram for the situation 3 in the plan 2 adopted in the processing measures for the braking command;

FIG. 9 is a partial flow diagram for the situation 3 in the plan 2 adopted in the processing measures for the removal of the traction command;

FIG. 10 is a partial flow diagram for the situation 3 in the plan 2 adopted in the processing measures for the removal of the traction command;

FIG. 11 is a partial flow diagram for the situation 3 in the plan 2 adopted in the processing measures for the removal of the traction command;

FIG. 12 is a partial flow diagram for the situation 3 in the plan 2 adopted in the processing measures for the removal of the traction command;

Fig. 13 is a flowchart of a brake test of on-board equipment.

Detailed ways

The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

In the embodiment of the present invention, the first main control unit may be the main system main control unit or the standby system main control unit, and the second main control unit may be the main system main control unit or the standby system main control unit , That is, the first main control unit and the second main control unit are mutual backups, where, when the first main control unit is the main system main control unit, the second main control unit is the standby main control unit, and when the second main control unit When the unit is the main control unit of the main system, the first main control unit is the main control unit of the standby system.

As shown in Figure 1, the signal transmission schematic diagram between the hot standby on-board equipment and the train interface of this embodiment, the hot standby on-board equipment includes a first main control unit and a second main control unit, the first main control unit and the second main control unit The main control unit receives the input signal sent by the train interface; and the first main control unit and the second main control unit send output signals to the train interface.

As shown in FIG. 2, the method for processing train interface data of hot standby on-board equipment of this embodiment specifically includes: the second main control unit performs hot backup to the first main control unit, and the first main control unit and the second main control unit Two main control units supply power at the same time;

For the input signal sent by the train interface, the first main control unit and the second main control unit process the input signal sent by the train interface, and control the input signals of the train interface of the first main control unit and the second main control unit to be consistent;

Thereby, the first main control unit and the second main control unit are kept fully synchronized, so that when the first main control unit fails, it can automatically switch to the second main control unit without stopping;

The aforementioned input signals include, but are not limited to, the activation status of the bridge, the position of the direction handle, and the sleep signal;

The above-mentioned supplying power to the first main control unit and the second main control unit at the same time, specifically, the power supply module can be used to simultaneously supply power to the first main control unit and the second main control unit, or the same power supply module can be used to synchronize the first main control unit. Power supply for the unit and the second main control unit;

The above-mentioned keeping the input signals of the first main control unit and the second main control unit consistent can be implemented in the following two solutions:

Scheme 1, as shown in Figure 3:

S1: The first main control unit receives the current first input signal, and the second main control unit receives the current second input signal;

S2: The first main control unit sends the first input signal to the second main control unit;

S3: The second main control unit compares the signal content of the first input signal and the second input signal, and if the signal content is the same, it informs the first main control unit to use the currently collected first input signal as input, and the second main control unit The unit uses the currently collected second input signal as input; if the signal content is inconsistent, the first main control unit is notified to abandon the currently collected first input signal, and the second main control unit abandons the currently collected second input signal. The control unit and the second main control unit maintain the previous consistent signal as input.

It should be noted that the "consistent signal content" here refers to the same command. Taking signal activation as an example, the first main control unit and the second main control unit receive the activation signal sent by the train interface at the same time, or receive the train interface at the same time. The sent inactive signal means that the signal content is consistent.

As a preferred way, in Solution 1, in the case where the signal content of the first input signal and the second input signal are inconsistent, if the signal content of the first input signal and the second input signal are inconsistent for too long, exceeding the set duration, Then the second main control unit determines that the operation of the first main control unit and the second main control unit are not synchronized, and controls the second main control unit to enter the failure mode, and the first main control unit continues to operate.

Scheme 2, as shown in Figure 4:

The first main control unit receives the current input signal, and then sends the input signal to the second main control unit; the second main control unit receives the input signal sent by the first main control unit, and uses the received input signal as its own input signal .

Regarding the output signal sent to the train interface, when the second main control unit hot backups the first main control unit, the first main control unit and the second main control unit supply power at the same time, in order to ensure driving safety, different situations need to be addressed. Determine the measures to be taken for the transmission of the transmission signal.

The output signal includes safety commands. The safety commands include speed control commands. The speed control commands include but are not limited to brake commands. The brake commands include but are not limited to emergency brake commands and maximum service brake commands;

The following is to determine the processing measures of the speed control command for different situations, and take the brake command as an example for description:

Situation 1:

When the on-board equipment loses power, or when both the first main control unit and the second main control unit fail, the on-board equipment sends a braking command to the train interface;

Situation 2:

When at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to send a braking command to the train interface or cancel the braking command to the train interface according to the operating situation.

The "operation condition" here includes three situations where the first main control unit is faulty or has no power, the second main control unit is faulty or has no power, and the first main control unit and the second main control unit are both operating normally.

In case 2, the following two solutions are specifically adopted:

plan 1:

Option 1 includes the following three situations:

Condition 1: The first main control unit is faulty or has no power. The second main control unit determines whether to send a braking command to the train interface or cancel the braking command to the train interface as needed. For example, in the case of an overspeed train, the first The second main control unit sends a braking command to the train interface. When the train is not overspeeding, the second main control unit does not send a braking command to the train interface;

Condition 2: The second main control unit is faulty or has no power. The first main control unit determines whether to send a brake command to the train interface or cancel the brake command to the train interface as needed. The "as needed" scenario is the same as above;

Condition 3: Both the first main control unit and the second main control unit are operating normally, and the second main control unit continues to send braking commands to the circuit modules in the vehicle equipment;

The first main control unit determines whether to send a braking command to the above-mentioned circuit module or cancel the braking command to the circuit module according to needs. The "as needed" scenario is the same as the above example;

If the above circuit module receives the braking command of the second main control unit and the braking command of the first main control unit, it sends a braking command to the train interface;

If the above circuit module only receives the braking command from the second main control unit, it cancels sending the braking command to the train interface.

Scenario 2:

Option 2 includes the following three situations:

Condition 1: The first main control unit is faulty or has no power. The second main control unit determines whether to send a brake command to the train interface or cancel the brake command to the train interface as needed. The "as needed" scenario is the same as above;

Condition 3: The first main control unit and the second main control unit are all operating normally. The first main control unit or the second main control unit determines whether to send a brake command to the train interface or cancel the train interface according to the status of the local end and the opposite end Send a brake command, the specific processing process is as follows:

T1: As shown in Figure 5, initially, both the local end and the opposite end are in an idle state; "both the local end and the opposite end are in an idle state" means that the local end and the opposite end remain in the same state, that is, the local end and the opposite end are at the same time It is in the state of sending a brake command, or the local end and the opposite end are in the state of canceling sending the brake command at the same time;

T2: Determine whether the sending status of the brake command has changed when the local end sends a brake command to the train interface. If the sending status of the brake command changes, turn on the first timer, monitor the opposite end, and then execute the steps T3, if the sending status of the brake command has not changed, continue to judge whether the brake command information from the opposite end is received, and if the brake command information from the opposite end is received, then send the confirmation packet of the brake command information received to the opposite end , And turn on the second timer to monitor the local terminal, and then execute step T4. If the braking command information from the opposite terminal is not received, continue to determine whether the braking command is sent from the local terminal to the train interface when the braking command is sent changes happened;

T3: Determine whether the changed brake command sending status is to send a brake command to the train interface or cancel the sending brake command to the train interface. If the changed brake command sending status is to send a brake command to the train interface, then The local end sends a brake command to the train interface, and periodically sends a message to the opposite end to send a brake command to the train interface, continue to perform step T3-1, if the changed brake command sending status is to cancel the sending of the brake command to the train interface If the local end temporarily cancels the sending of the brake command to the train interface, and periodically sends the message to the opposite end to cancel the sending of the brake command to the train interface, continue to perform step T3-2;

T3-1: As shown in Figure 6, it is judged whether the brake command information from the opposite end is received. If the brake command information from the opposite end is received, a confirmation packet of the brake command information received is sent to the opposite end, and the opposite end is judged. Whether the brake command information is consistent with the sending status of the brake command after the local end is changed. If the brake command information of the opposite end is consistent with the sending status of the brake command after the local end is changed, the first timer is turned off and the local end enters In idle state, if the braking command information of the opposite end is inconsistent with the sending state of the changed braking command of the local end, the local end enters the fault state. If the braking command information of the opposite end is not received, the timing of the first timer is judged Whether the time has expired, if the time of the first timer expires, the first timer is turned off, and the local end enters the idle state. If the time of the first timer does not expire, it is judged whether the brake command information from the opposite end is received Acknowledgment packet. If it receives a confirmation packet of the brake command information from the opposite end, stop sending the brake command information to the train interface to the opposite end and maintain the current state. If the confirmation packet of the brake command information from the opposite end is not received, Then it is judged whether the information of sending brake commands to the train interface to the opposite end exceeds the specified number of times. If the information of sending brake commands to the train interface to the opposite end exceeds the specified number of times, stop sending the information to the opposite end to send brakes to the train interface Command information, the local end enters the fault state, if the information of sending brake commands to the train interface to the opposite end does not exceed the specified number of times, continue to send the information of sending brake commands to the train interface to the opposite end;

T3-2: As shown in Figure 7, it is judged whether the brake command information from the opposite end is received. If the brake command information from the opposite end is received, the confirmation packet of the brake command information received is sent to the opposite end, and the opposite end is judged. Whether the brake command information is consistent with the sending status of the brake command after the change of the local end, if the brake command information of the opposite end is consistent with the sending status of the brake command after the change of the local end, the first timer is turned off, and the local end enters idle Status. If the brake command information of the opposite end is inconsistent with the changed brake command sending status of the local end, the local end enters the fault state. If the brake command information of the opposite end is not received, the timing time of the first timer is judged Whether it is timed out, if the timing time of the first timer expires, the first timer is turned off, and the local end enters an idle state. If the timing time of the first timer does not expire, it is judged whether the confirmation of the brake command information from the opposite end is received If it receives the confirmation packet of the brake command information from the opposite end, stop sending the information to cancel the brake command sent to the train interface to the opposite end and maintain the current state. If the confirmation packet of the brake command information from the opposite end is not received, Then it is judged whether the information of canceling the sending of braking command to the train interface exceeds the specified number of times. If the information of canceling the sending of the brake command to the train interface exceeds the specified number of times, stop sending the information of canceling the sending of the brake command to the train interface. Sending the brake command information, the local end enters the fault state, if the message to cancel the brake command to the train interface is not sent to the opposite end for more than the specified number of times, continue to send the message to the opposite end to cancel the brake command to the train interface;

T4: As shown in Figure 8, it is judged whether the sending status of the brake command has changed when the local end sends a brake command to the train interface. If the sending status of the brake command has changed, judge the sending of the changed brake command Whether the status is consistent with the received brake command information of the opposite end, if the changed brake command sending status is consistent with the received brake command information of the opposite end, the local end will continue to maintain the changed brake command sending status , And send the changed brake command information to the opposite end, turn off the second timer, enter the waiting state for the opposite end to confirm, and continue to perform step T5, if the changed brake command sending status is the same as the received brake If the command information is inconsistent, the second timer will be turned off, and the local terminal will enter the fault state. If the sending state of the brake command does not change, it will be judged whether the second timer has timed out. If the second timer has timed out, the second timer will be turned off. , Enter the fault state, if the second timer does not time out, continue to determine whether the sending state of the brake command has changed when the local end sends the brake command to the train interface;

T5: Periodically send the changed brake command information to the opposite end to determine whether the opposite end’s confirmation information about the brake command has been received. If the opposite end has received confirmation information about the brake command, the local end will enter the idle state. If no confirmation information about the brake command is received from the opposite end, it is judged whether the number of times of sending the changed brake command information to the opposite end exceeds the specified number of times, if the number of times of sending the changed brake command information to the opposite end exceeds the specified number of times , The local end enters the idle state, and if the number of times that the changed brake command information is sent to the opposite end does not exceed the specified number of times, it continues to send the changed brake command information to the opposite end.

The above-mentioned safety commands also include the removal and traction commands. The following is an explanation of how to determine the removal and traction commands for different situations:

Situation 1:

If the on-board equipment loses power, or the first main control unit and the second main control unit are all faulty, the on-board equipment sends a command to cut off the traction to the train interface;

Situation 2:

When at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to send the traction removal command to the train interface or cancel the sending of the traction removal command to the train interface according to the operating conditions.

The "operation condition" here includes three situations where the first main control unit is faulty or has no power, the second main control unit is faulty or has no power, and both the first main control unit and the second main control unit are operating normally.

In case 2, the following two solutions are specifically adopted:

plan 1:

Plan 1 includes the following three situations:

Condition 1: The first main control unit is faulty or has no power, and the second main control unit determines whether to send a cut off traction command to the train interface or cancel the cut off traction command to the train interface as needed. For example, in the case of an overspeed train, 2. The main control unit sends a traction removal command to the train interface, and the second main control unit does not send the traction removal command to the train interface when the train is not overspeed;

Condition 2: The second main control unit is faulty or has no power. The first main control unit determines whether to send a cut off traction command to the train interface or cancel the cut off traction command to the train interface as needed. The "as needed" scenario is the same as above;

Condition 3: Both the first main control unit and the second main control unit are operating normally, and the second main control unit continues to send a removal command to the circuit module in the vehicle equipment;

The first main control unit determines whether to send the removal and pull command to the above circuit module or cancels the transmission of the removal and pull command to the above circuit module according to needs, the scenario example of "as needed" is the same as above;

If the circuit module receives the traction removal command of the second main control unit and the traction removal command of the first main control unit, it sends the traction removal command to the train interface;

If the above circuit module only receives the traction removal command from the second main control unit, it cancels sending the traction removal command to the train interface.

Scenario 2:

Option 2 includes the following three situations:

Condition 1: The first main control unit is faulty or has no power, and the second main control unit determines whether to send the traction removal command to the train interface or cancel the transmission of the traction removal command to the train interface as needed. The "as needed" scenario is the same as above;

Condition 2: The second main control unit is faulty or has no power. The first main control unit determines whether to send the traction removal command to the train interface or cancel the traction removal command to the train interface as needed. The "as needed" scenario is the same as above;

Condition 3: Both the first main control unit and the second main control unit are operating normally. The first main control unit or the second main control unit determines whether to send a traction command to the train interface or cancel the train interface according to the status of the local end and the opposite end Sending the removal and traction command, including the following processing procedures:

P1: As shown in Figure 9, initially, both the local end and the opposite end are in an idle state, and "both the local end and the opposite end are in an idle state" means that the local end and the opposite end remain in the same state, that is, the local end and the opposite end are at the same time It is in the state of sending the excision towing command, or the local end and the opposite end are in the state of canceling the sending of the excision towing command at the same time;

P2: Determine whether the sending status of the removing traction command has changed when the local end sends the removal traction command to the train interface. If the sending status of the removal traction command changes, the first timer is turned on, the peer end is monitored, and the steps are executed P3, if the sending status of the removal and towing command has not changed, judge whether the removal and towing command information from the opposite end is received. If the removal and towing command information from the opposite end is received, the second timer is turned on, the local end is monitored, and then the steps are performed P4: If the traction removal command information from the opposite end is not received, continue to determine whether the sending status of the traction removal command has changed when the local end sends the traction removal command to the train interface;

P3: Determine whether the changed status of the traction removal command is to send the removal traction command to the train interface or cancel the removal traction command to the train interface. If the status of the changed removal traction command is to send the removal traction command to the train interface, then The local end sends the traction removal command to the train interface, and periodically sends the message to the opposite end to send the removal traction command to the train interface, continue to perform step P3-1, if the changed sending status of the traction removal command is canceled to send the removal to the train interface Towing command, the local terminal temporarily cancels sending the traction removal command to the train interface, and periodically sends the message canceling the traction removal command to the train interface to the opposite terminal, and continues to perform step P3-2;

P3-1: As shown in Figure 10, it is judged whether the removal and pulling command information of the opposite end is received. If the removal and pulling command information of the opposite end is received, the confirmation packet of receiving the removal and pulling command information is sent to the opposite end, and the opposite end is judged. Whether the cutting and pulling command information is consistent with the sending status of the changed cutting and pulling command at the local end. If the sending status of the cutting and pulling command at the opposite end is the same as the sending status of the changing cutting and pulling command at the local end, the first timer is closed and the local end enters In idle state, if the sending state of the removal and pulling command of the opposite end is inconsistent with the sending state of the removal and pulling command after the change of the local end, the local end enters the fault state. If the removal and pulling command information of the opposite end is not received, the timing of the first timer is judged Whether the time has expired, if the time of the first timer expires, the first timer is turned off, and the local end enters the idle state. If the time of the first timer does not expire, it is judged whether the removal of the traction command information from the opposite end is received Acknowledgment packet, if it receives the confirmation packet of the removal of the traction command information from the opposite end, stop sending the information of sending the removal of the traction command to the train interface to the opposite end, and maintain the current state. If the confirmation packet of the removal of the traction command information from the opposite end is not received, Then it is judged whether the information sent to the opposite end to send the removal of traction command to the train interface exceeds the specified number of times. If the information sent to the opposite end to send the removal of the traction command to the train interface exceeds the specified number of times, stop sending the information to the opposite end to send the removal of traction to the train interface Command information, the local end enters a fault state, and if the number of messages sent to the opposite end of the traction removal command to the train interface does not exceed the specified number of times, it will continue to send the message to the opposite end to send the traction removal command to the train interface;

P3-2: As shown in Figure 11, it is judged whether the removal and pulling command information from the opposite end is received. If the removal and pulling command information from the opposite end is received, the confirmation packet of the removal and pulling command information is sent to the opposite end, and the opposite end is judged. Whether the removal of the towing command information is consistent with the sending status of the changed removal of the towing command at the local end, if the sending status of the removal of the towing command of the opposite end is consistent with the sending status of the changed removal of the towing command at the local end, the first timer is turned off and the local end enters idle Status. If the sending status of the removal command from the opposite end is inconsistent with the sending status of the local removal command after the change, the local end enters the fault state. If the removal command information from the opposite end is not received, the timing of the first timer is judged Whether it is timed out, if the time of the first timer expires, the first timer is turned off, and the local end enters the idle state. If the time of the first timer does not expire, it is judged whether the confirmation of the removal and traction command information from the opposite end is received Packet, if it receives the confirmation packet of the removal of the traction command information from the opposite end, stop sending the information to cancel the sending of the removal of the traction command to the train interface, and maintain the current state. If the confirmation packet of the removal of the traction command information from the opposite end is not received, Then it is judged whether the information of cancelling the traction command sent to the train interface exceeds the specified number of times. If the information of cancelling the traction command sent to the train interface exceeds the specified number of times, stop sending the information of canceling the traction command to the opposite end to the train interface Sending the information of cutting off the traction command, the local end enters the fault state, if the message of canceling the sending of the cutting off traction command to the train interface does not exceed the specified number of times, it will continue to send the message of canceling the sending of the cutting off traction command to the train interface to the opposite end;

P4: As shown in Figure 12, it is judged whether the sending state of the cutting off traction command has changed when the local end sends the cutting off traction command to the train interface. If the sending state of the cutting off traction command has changed, then judging the sending state of the changed traction command Whether it is consistent with the received information of the removal and towing command of the opposite end, if the sending status of the changed removal and towing command is consistent with the received removal and towing command information of the opposite end, the local end will continue to maintain the sending status of the changed removal and towing command. And send the changed ablation towing command information to the opposite end, turn off the second timer, enter the waiting state for confirmation from the opposite end, and continue to perform step P5, if the changed sending state of the ablated towing command is the same as the received opposite end’s ablation and towing command If the information is inconsistent, the second timer is turned off, and the local end enters a fault state. If the sending state of the cut-off traction command does not change, it is judged whether the second timer has timed out, and if the second timer times out, the second timer is turned off. In the fault state, if the second timer does not time out, continue to determine whether the sending state of the traction removal command has changed when the local end sends the traction removal command to the train interface;

P5: Periodically send the changed removal and towing command information to the opposite end to determine whether the confirmation information about the removal and towing command is received from the opposite end. If the confirmation information about the removal and towing command is received from the opposite end, the local end enters the idle state, if If the confirmation information about the removal and pulling command is not received from the opposite end, it is judged whether the number of times of sending the changed removal and pulling command information to the opposite end exceeds the specified number of times. If the number of times of sending the changed removal and pulling command information to the opposite end exceeds the specified number of times , The local end enters the idle state, and if the number of times that the changed removal and traction command information is sent to the opposite end does not exceed the specified number of times, it continues to send the changed removal and traction command information to the opposite end.

The aforementioned safety commands also include train interface control commands. Train interface control commands include but are not limited to service brake level 4, service brake level 1, over-phase command, over-phase selection;

The following is to determine the handling measures of the train interface control commands for different situations, and take the over-phase command as an example for explanation:

Situation 1:

If the on-board equipment loses power, or both the first main control unit and the second main control unit are faulty, cancel the sending of the over-phase command to the train interface;

Situation 2:

When at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to send a phase-separation command to the train interface according to the operating condition;

The above situation 2 specifically includes the handling of the following three situations:

Scenario 1: When the first main control unit fails or has no power, the first main control unit continues to cancel sending the excessive phase separation command to the train interface, and the second main control unit determines whether to send the excessive phase separation command to the train interface as needed, for example, in For railway sections that need to execute the over-phase command, the second main control unit sends the over-phase command to the train interface, and in the railway section that does not need to execute the over-phase command, the second main control unit does not send the over-phase command to the train interface;

Scenario 2: When the second main control unit fails or has no power, the second main control unit continuously cancels sending the excessive phase division command to the train interface, and the first main control unit determines whether to send the excessive phase division command to the train interface as needed, "as needed" The scene examples are the same as above;

Scenario 3: The first main control unit and the second main control unit are all in a normal operating state, and the second main control unit continuously cancels sending the excessive phase division command to the circuit module in the vehicle equipment;

The first main control unit determines whether to send the over-phase division command to the above-mentioned circuit module or cancels the transmission of the over-phase division command to the above-mentioned circuit module according to needs, the scenario example of "as needed" is the same as above;

If the above circuit module does not receive the over-phase division command, it cancels sending the over-phase division command to the train interface;

If the circuit module receives the over-phase division command from the first main control unit, it sends the over-phase division command to the train interface.

When the existing on-board equipment is started, the brake loop needs to be tested to ensure that the brake command is accurately sent during operation. Therefore, the second main control unit hot backups the first main control unit, the first main control unit and the In the case that the second main control unit supplies power at the same time, the method of providing the brake test of the on-board equipment includes the following steps, as shown in Figure 13:

D1: The first main control unit receives the brake test request in real time. After receiving the brake test request, the first main control unit starts to perform the brake test. If the brake test fails, it reminds the driver that the brake test failed and executes it again Brake test until the brake test is successful, if the brake test is successful, command the second main control unit to perform the brake test;

D2: The second main control unit receives the command to execute the brake test sent by the first main control unit, and after sending the confirmation command to the first main control unit, it starts to perform the brake test. If the brake test is successful, it will brake The test result is sent to the first main control unit, and the first main control unit feeds back the brake test results of the local end and the second main control unit to the driver;

If the brake test fails, it is judged whether the number of brake tests exceeds the specified number, if not, then step D3 is executed, if it exceeds, step D4 is executed;

Using the above method, when the vehicle-mounted equipment is started, the braking loops of the first main control unit and the second main control unit are tested, so as to ensure that the brake command is accurately sent during the operation of the vehicle-mounted equipment.

The above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art can still modify or equivalently replace the specific embodiments of the present invention. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention shall fall within the protection scope of the claims of the present invention pending approval.

Claims

A method for processing train interface data of hot standby on-board equipment, which is characterized in that:

Using the second main control unit to hot backup the first main control unit, and supply power to the first main control unit and the second main control unit at the same time;

The first main control unit and the second main control unit receive the input signal sent by the train interface, and control the input signal to be consistent;

When the on-board equipment loses power, or when the first main control unit and the second main control unit all fail, the on-board equipment sends a safety command to the train interface;

When at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to send a safety command to the train interface according to the operating conditions.
The method for processing train interface data of hot standby on-board equipment according to claim 1, wherein controlling the input signals to be consistent includes the following steps:

S1: The second main control unit receives the currently collected first input signal sent by the first main control unit;

S2: The second main control unit compares the first input signal with the currently collected second input signal. If the signal content of the first input signal and the second input signal are the same, the first main control unit The control unit uses the currently collected first input signal as input, and the second main control unit uses the currently collected second input signal as input; if the signal content of the first input signal and the second input signal are inconsistent, all The first main control unit discards the first input signal, the second main control unit discards the second input signal, and the first main control unit and the second main control unit maintain the previous consistent signal as input.
The method for processing train interface data of hot standby on-board equipment according to claim 2, wherein when the signal content of the first input signal and the second input signal are inconsistent, if the first input signal If the time that is inconsistent with the signal content of the second input signal exceeds the specified time, it is determined that the second main control unit is faulty.
The method for processing train interface data of hot standby on-board equipment according to claim 1, wherein controlling the input signals to be consistent is specifically:

The first main control unit receives the current input signal, and sends the input signal to the second main control unit;

The second main control unit receives the input signal as its own input signal.
The method for processing train interface data of hot backup on-board equipment according to claim 1, wherein when at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment Determine whether to send a safety command to the train interface according to the operating conditions:

When the first main control unit fails or has no power, the second main control unit determines whether to send a safety command to the train interface as required;

Or, when the second main control unit fails or has no power, the first main control unit determines whether to send a safety command to the train interface as required;

Or, when the first main control unit and the second main control unit are all operating normally, the second main control unit continues to send safety commands to the circuit module in the on-board equipment; the first main control unit determines whether to send to the circuit as required The module sends a safety command; if the circuit module receives the safety command of the second main control unit and the safety command of the first main control unit, it sends a safety command to the train interface; if the circuit module only receives the safety command The safety command of the second main control unit does not send the safety command to the train interface.
The method for processing train interface data of hot backup on-board equipment according to claim 1, wherein when at least one of the first main control unit and the second main control unit is in a normal operation state, the on-board equipment operates according to The situation determines whether to send a safety command to the train interface:

When the first main control unit fails or has no power, the second main control unit determines whether to send a safety command to the train interface as required;

Or, when the second main control unit fails or has no power, the first main control unit determines whether to send a safety command to the train interface as required;

Or, when the first main control unit and the second main control unit are all operating normally, the first main control unit or the second main control unit determines whether to send a safety command to the train interface according to the status of the local end and the opposite end.
The method for processing train interface data of hot standby on-board equipment according to claim 6, wherein when the first main control unit and the second main control unit are all operating normally, the first main control unit Or the second main control unit determines whether to send a safety command to the train interface or cancel the safety command to the train interface according to the status of the local end and the opposite end, which specifically includes:

T1: Initially, both the local end and the opposite end are in an idle state;

T2: When the local end sends a safety command to the train interface, it is judged whether the sending status of the safety command has changed. If the sending status of the safety command changes, the first timer is started, the monitoring peer status is entered, and step T3 is executed; if it is safe If the sending status of the command has not changed, it is judged whether the security command information of the opposite end is received, and if the security command information of the opposite end is received, the confirmation packet of receiving the security command information is sent to the opposite end, and the second timer is started, and enter Monitor the status of the local end, and execute step T4. If the security command information from the opposite end is not received, continue to determine whether the sending status of the security command of the local end has changed;

T3: Judge whether the sending status of the changed safety command is sending a safety command to the train interface. If the sending status of the changed safety command is sending a safety command to the train interface, the local end sends the safety command to the train interface and periodically The opposite terminal sends a message to send a safety command to the train interface, and continues to step T3-1. If the changed safety command status is not to send a safety command to the train interface, the local terminal will not send a safety command to the train interface temporarily, and Periodically send messages not to send safety commands to the train interface to the opposite end, and continue to perform step T3-2;

T3-1: Judge whether the security command information of the opposite end is received, if the security command information of the opposite end is received, send a confirmation packet of receiving the security command information to the opposite end, and judge the security command information of the opposite end and the changed value of the local end Whether the sending status of the security command is consistent, if the security command information of the opposite end is consistent with the sending status of the changed security command of the local end, the first timer is turned off and the local end enters the idle state. If the security command information of the opposite end changes with the local end If the sending state of the subsequent security commands is inconsistent, the local end enters the fault state. If the security command information from the opposite end is not received, it is judged whether the timing time of the first timer has expired, and if the timing time of the first timer expires, it will be turned off. The first timer, the local end enters the idle state, if the time of the first timer does not expire, it is judged whether the confirmation packet of the security command information of the opposite end is received, and if the confirmation packet of the security command information of the opposite end is received, it stops Send the message of sending the safety command to the train interface to the opposite end to maintain the current state. If the confirmation packet of the safety command information of the opposite end is not received, it is judged whether the message of sending the safety command to the train interface to the opposite end exceeds the specified number of times. If the information of sending safety commands to the train interface to the opposite end exceeds the specified number of times, stop sending the information of sending safety commands to the train interface to the opposite end, and the local end enters a fault state. If the information of sending safety commands to the train interface is sent to the opposite end If it does not exceed the specified number of times, continue to send information to the opposite end to send safety commands to the train interface;

T3-2: Judge whether the security command information of the opposite end is received, if the security command information of the opposite end is received, then send a confirmation packet of receiving the security command information to the opposite end, and judge the security command information of the opposite end and the changed local end Whether the sending status of the security command is consistent, if the security command information of the opposite end is consistent with the sending status of the changed security command of the local end, the first timer is turned off and the local end enters the idle state. If the security command information of the opposite end changes with the local end If the sending state of the subsequent security commands is inconsistent, the local end will enter the fault state. If the security command information from the opposite end is not received, it will be judged whether the timing time of the first timer has expired, and if the timing time of the first timer has expired, it will be turned off. The first timer, the local end enters the idle state, if the time of the first timer does not expire, it is judged whether the confirmation packet of the security command information of the opposite end is received, and if the confirmation packet of the security command information of the opposite end is received, it stops Send the message not to send the safety command to the train interface to the opposite end, and maintain the current state. If the confirmation packet of the safety command information from the opposite terminal is not received, judge whether the message of not sending the safety command to the train interface to the opposite end exceeds the specified number of times , If the message of not sending safety commands to the train interface is sent to the opposite end for more than the specified number of times, the message of not sending safety commands to the train interface to the opposite terminal will be stopped, and the local terminal will enter a fault state. If the information of sending safety commands does not exceed the specified number of times, it will continue to send information not to send safety commands to the train interface to the opposite end;

T4: When the local end sends a safety command to the train interface, it judges whether the sending status of the safety command has changed. If the sending status of the safety command changes, it judges the sending status of the changed safety command and the received safety command information of the opposite end. Whether it is consistent or not, if the sending status of the changed security command is consistent with the received security command information of the opposite end, the local end keeps the sending status of the changed security command, and sends the changed security command information to the opposite end, closing the first The second timer enters the state of waiting for confirmation from the peer and continues to perform step T5. If the sending state of the changed security command is inconsistent with the received security command information of the peer, the second timer is turned off and the local end enters the fault state. If no, it is judged whether the second timer has timed out. If the second timer has timed out, the second timer will be turned off and enter the fault state. If the second timer has not timed out, it will continue to judge when the local end sends a safety command to the train interface. Whether the sending status of the safety command has changed;

T5: Periodically send the changed security command information to the opposite end to determine whether the confirmation information about the security command from the opposite end is received. If the confirmation information about the security command from the opposite end is received, the local end enters the idle state, if not received For the confirmation information of the security command on the opposite end, it is judged whether the number of times of sending the changed security command information to the opposite end exceeds the specified number of times. If the number of times of sending the changed security command information to the opposite end exceeds the specified number of times, the local end enters idle Status, if the number of times that the changed security command information is sent to the opposite end does not exceed the specified number of times, continue to send the changed security command information to the opposite end.
The method for processing train interface data of hot standby on-board equipment according to claim 7, wherein the safety command includes a speed control command and a cut-off traction command.
The method for processing train interface data for hot backup on-board equipment according to claim 1, characterized in that,

The safety command includes a train interface control command;

When at least one of the first main control unit and the second main control unit is in a normal operating state, the on-board equipment determines whether to send the train interface control command to the train interface according to the operating conditions, which specifically includes:

When the first main control unit fails or has no power, the first main control unit does not send the train interface control command to the train interface, and the second main control unit determines whether to send the train interface control command to the train interface as needed;

Or, when the second main control unit fails or has no power, the second main control unit does not send the train interface control command to the train interface, and the first main control unit determines whether to send the train interface control to the train interface as needed Order;

Or, the first main control unit and the second main control unit are all in a normal operating state, and the second main control unit cancels sending the train interface control command to the circuit module in the on-board equipment; the first main control unit determines whether to The circuit module sends the train interface control command; if the circuit module does not receive the train interface control command, it does not send the train interface control command to the train interface; if the circuit module receives the first master The train interface control command information of the control unit sends the train interface control command to the train interface.
The method for processing train interface data of hot standby on-board equipment according to claim 1, characterized in that it further comprises a brake test of the on-board equipment, and the brake test comprises the following steps:

D1: After the first main control unit receives the brake test request, it will execute the brake test. If the brake test fails, it will remind the driver that the brake test has failed, and re-execute the brake test until the brake test is successful. If successful, command the second main control unit to perform the brake test;

D2: After the second main control unit receives the command and sends a confirmation receipt command to the first main control unit, it starts to perform the brake test. If the brake test is successful, the brake test result is sent to the first main control unit , The first main control unit feeds back the brake test results of the local end and the second main control unit to the driver;

If the brake test fails, it is determined whether the number of braking times exceeds the specified number of times, if it exceeds, then execute step D3, if it does not exceed, then execute step D4;

D3: Repeat the brake test until the brake test is successful, and then send the brake test result to the first main control unit, and the first main control unit feeds back the brake test results of the local end and the second main control unit to the driver ；

D4: Inform the first main control unit that the test is over and the second main control unit enters a fault state. After the first main control unit receives the test end message of the second main control unit, it will feed back the brake test result of the first main control unit To the driver.