A rail transit control device and its usage method

Abstract

This invention discloses a rail transit control device and its usage method. The device includes: a first processing channel, used to generate its own allowed restart count security code based on its allowed restart count, and to generate a first drive signal after the allowed restart count security code passes verification; it is also used to generate first safety data; a second processing channel, used to generate its own allowed restart count security code based on its allowed restart count, and to generate a second drive signal after the allowed restart count security code passes verification; it is also used to generate second safety data; and a communication module connected to the first and second processing channels. The communication module operates after receiving the first and second drive signals, enabling the first processing channel to interact with external devices to exchange the first safety data and enabling the second processing channel to interact with external devices to exchange the second safety data. This invention uses security encoding for the allowed restart count to ensure the security of the allowed restart count.

Description

Technical Field

[0001] This invention relates to the field of rail transit technology, and in particular to a rail transit control device and its usage method. Background Technology

[0002] The functions of a rail transit control system include safety functions and non-safety functions. Safety functions refer to those with a safety integrity level of SIL4, such as speed measurement and positioning. Non-safety functions refer to those with a safety integrity level of SIL0, such as providing system maintenance data. When the rail transit control system detects a safety function failure, according to the fail-safe design principle, the system should be redirected to the safety side. This safety side should be controlled, and can generally be maintained by burning out non-recoverable fuses (e.g., automatic stopping, reducing operating speed).

[0003] During field operation, most faults in rail transit control systems are transient hardware failures caused by external environmental factors (such as electromagnetic interference and power supply anomalies) and software defects induced by unpredictable external inputs; these faults are often recoverable after a system restart. Therefore, from an availability perspective, the design of rail transit control systems generally filters detected faults. Currently, common practices include allowing a certain number of restarts when a fault is detected, or confirming a fault only after the same anomaly occurs several times (i.e., the equipment restarts several times). It can be seen that for rail transit control systems, the allowed number of restarts is a safety margin; however, existing systems do not implement safety measures regarding the allowed number of restarts during operation. Summary of the Invention

[0004] The purpose of this invention is to provide a rail transit control device and its usage method, which uses security coding to encode the number of times the device can be restarted, so as to ensure the security of the number of restarts.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solution:

[0006] A rail transit control device, comprising:

[0007] The first processing channel is used to generate its own allowed restart count security code based on its own allowed restart count, and to generate a first drive signal after its own allowed restart count security code is verified. It is also used to generate first security data.

[0008] The second processing channel is used to generate its own allowed restart count security code based on its own allowed restart count, and to generate a second drive signal after its own allowed restart count security code is verified. It is also used to generate second security data.

[0009] A communication module is connected to the first processing channel, the second processing channel, and an external device; and the communication module powers on after receiving the first drive signal and the second drive signal, enabling the first processing channel to interact with the external device to exchange the first security data and enabling the second processing channel to interact with the external device to exchange the second security data.

[0010] Optionally, the first processing channel includes:

[0011] The first programmable logic device is connected to the communication module and is used to generate its own allowed restart security code based on the allowed restart count of the first programmable logic device, and is also used to obtain the number of pulses of the first drive signal within a preset time period;

[0012] The first CPU, connected to the first programmable logic device and the communication module, is used to generate its own allowed restart count security code, generate the first security data, and verify the allowed restart count security code of the first programmable logic device and the pulse count of the first drive signal based on the allowed restart count of the first CPU itself. It is also used to generate a first dynamic system verification word based on the allowed restart count security code of the first CPU itself and the dynamic compensation value after the verification is passed, and send it to the first programmable logic device.

[0013] The first programmable logic device is also used to verify the first dynamic system verification word and, after the verification is passed, generate the first drive signal and send it to the communication module.

[0014] Optionally, the second processing channel includes:

[0015] The second programmable logic device is connected to the communication module and is used to generate its own allowed restart security code based on the allowed restart count of the second programmable logic device, and is also used to obtain the number of pulses of the second drive signal within the preset time period;

[0016] The second CPU, connected to the second programmable logic device and the communication module, is used to generate its own allowed restart count security code, generate the second security data, and verify the allowed restart count security code of the second programmable logic device and the pulse count of the second drive signal based on the allowed restart count of the second CPU itself. It is also used to generate a second dynamic system verification word based on the allowed restart count security code of the second CPU itself and the dynamic compensation value after the verification is passed, and send it to the second programmable logic device.

[0017] The second programmable logic device is also used to verify the second dynamic system verification word and, after the verification is passed, generate the second drive signal and send it to the communication module.

[0018] Optionally, the dynamic compensation value includes a specific compensation value, a first regular compensation value, and a second regular compensation value;

[0019] The first dynamic system verification word includes a first specific system verification word, a first regular system verification word, and a second regular system verification word; and the first CPU generates the first specific system verification word, the first regular system verification word, and the second regular system verification word based on its own allowed restart count security code and the specific compensation value;

[0020] The second dynamic system verification word includes a second specific system verification word, a third regular system verification word, and a fourth regular system verification word; and the second CPU generates the second specific system verification word based on its own allowed restart count security code and the specific compensation value, generates the third regular system verification word based on its own allowed restart count security code and the first regular compensation value, and generates the fourth regular system verification word based on its own allowed restart count security code and the second regular compensation value.

[0021] Optionally, the first programmable logic device is also connected to the second programmable logic device, and the first programmable logic device and the second programmable logic device exchange the allowed restart number security code of the first programmable logic device, the pulse number of the first drive signal, the first dynamic system verification word, the allowed restart number security code of the second programmable logic device, the pulse number of the second drive signal, and the second dynamic system verification word;

[0022] The first CPU is also connected to the second CPU, and the first CPU and the second CPU exchange the first dynamic system verification word, the allowed restart count security code of the first programmable logic device, the pulse count of the first drive signal, the second dynamic system verification word, the allowed restart count security code of the second programmable logic device, and the pulse count of the second drive signal.

[0023] Optionally, the conditions for passing the pulse count verification of the first drive signal include: the first programmable logic device does not send the first drive signal to the communication module, and the pulse count of the first drive signal is 0 within the preset time period; the first programmable logic device sends the first drive signal to the communication module, and the pulse count of the first drive signal is a preset value within the preset time period.

[0024] The conditions for passing the pulse count verification of the second drive signal include: the second programmable logic device does not send the second drive signal to the communication module, and the pulse count of the second drive signal is 0 within the preset time period; the second programmable logic device sends the second drive signal to the communication module, and the pulse count of the second drive signal within the preset time period is the preset value.

[0025] Optionally, the conditions for the security code verification of the allowed number of restarts of the first programmable logic device to pass include:

[0026] The security codes for the allowed number of restarts of the first programmable logic device are all valid values;

[0027] Upon receiving the first specific system verification word sent by the first CPU, the allowed number of restarts for the first programmable logic device is reduced by 1;

[0028] Upon receiving the first first conventional system verification word sent by the first CPU, the allowed restart count of the first programmable logic device is incremented by 1;

[0029] When receiving the alternating first conventional system verification word and second conventional system verification word sent by the first CPU, the number of allowed restarts of the first programmable logic device remains unchanged;

[0030] The conditions under which the security code verification for the allowed number of restarts of the second programmable logic device passes include:

[0031] The security codes for the allowed number of restarts of the second programmable logic device are all valid values;

[0032] Upon receiving the second specific system verification word sent by the second CPU, the allowed number of restarts for the second programmable logic device is reduced by 1;

[0033] Upon receiving the first third conventional system verification word sent by the second CPU, the allowed restart count of the second programmable logic device is incremented by 1;

[0034] When the second programmable logic device receives the alternating third and fourth conventional system verification words sent by the second CPU, the number of allowed restarts remains unchanged.

[0035] Optionally, the conditions for the first dynamic system to pass the verification of the verification word include:

[0036] The first dynamic system verification word received by the first programmable logic device for the first time is the first specific system verification word;

[0037] The first dynamic system verification word received by the first programmable logic device for the second time is the first conventional system verification word;

[0038] The first dynamic system verification word received by the first programmable logic device for the third time is the second conventional system verification word;

[0039] The first dynamic system check word received by the first programmable logic device after the third time alternates between the first conventional system check word and the second conventional system check word;

[0040] The conditions for the second dynamic system to pass the verification of the character include:

[0041] The second dynamic system verification word received by the second programmable logic device for the first time is the second specific system verification word;

[0042] The second dynamic system verification word received by the second programmable logic device for the second time is the third conventional system verification word;

[0043] The second dynamic system verification word received by the second programmable logic device for the third time is the fourth conventional system verification word;

[0044] The second dynamic system check word received by the second programmable logic device after the third time alternates between the third conventional system check word and the fourth conventional system check word.

[0045] Optionally, the first CPU, the first programmable logic device, the second CPU, and the second programmable logic device are all equipped with registers.

[0046] Optionally, the register is a FLASH.

[0047] On the other hand, this embodiment also provides a method for using the rail transit control equipment as described above, including:

[0048] Power is supplied to the rail transit control equipment to enable the first and second processing channels to operate;

[0049] The first processing channel generates a first driving signal and first security data and sends them to the communication module, and the second processing channel generates a second driving signal and second security data and sends them to the communication module;

[0050] The communication module powers on and operates after receiving the first drive signal and the second drive signal; and

[0051] The first processing channel interacts with the external device to exchange the first security data through the communication module, and the second processing channel interacts with the external device to exchange the second security data through the communication module.

[0052] Optionally, the step of generating the first drive signal by the first processing channel includes:

[0053] The first programmable logic device generates its own allowed restart security code based on its allowed restart count and obtains the number of pulses of the first drive signal within a preset time period and sends it to the first CPU;

[0054] The first CPU verifies the allowed restart count security code of the first programmable logic device and the pulse count of the first drive signal. After the verification is passed, the first CPU generates a first dynamic system verification word based on its own allowed restart count security code and dynamic compensation value and sends it to the first programmable logic device.

[0055] The first programmable logic device verifies the first dynamic system verification word and generates the first drive signal after the verification is passed, and sends it to the communication module.

[0056] Optionally, the step of generating the second drive signal in the second processing channel includes:

[0057] The second programmable logic device generates its own allowed restart security code based on its allowed restart count and obtains the number of pulses of the second drive signal within a preset time period and sends it to the second CPU;

[0058] The second CPU verifies the allowed restart count security code of the second programmable logic device and the pulse count of the second drive signal. After the verification is passed, the second CPU generates a second dynamic system verification word based on its own allowed restart count security code and dynamic compensation value and sends it to the first programmable logic device.

[0059] The second programmable logic device verifies the second dynamic system verification word and generates the second drive signal after the verification is passed, and sends it to the communication module.

[0060] Optionally, the dynamic compensation value includes a specific compensation value, a first regular compensation value, and a second regular compensation value;

[0061] The first CPU generates the first dynamic system verification word based on its own allowed restart count security code and the specific compensation value, and sends it to the first programmable logic device.

[0062] The first programmable logic device verifies the first dynamic system verification word received for the first time and decrements its own allowed restart count by 1 after the verification is passed. The first programmable logic device also sends its new allowed restart count security code and the number of pulses of the first drive signal within the preset time period to the first CPU.

[0063] The first CPU verifies the new allowed restart count security code of the first programmable logic device and the number of pulses of the first drive signal within the preset time period. After the verification is passed, the first CPU generates the first dynamic system verification word based on its own allowed restart count security code and the first conventional compensation value and sends it to the first programmable logic device.

[0064] The first programmable logic device verifies the first dynamic system verification word received for the second time, and after the verification is successful, it increments its own allowed restart count by 1. The first programmable logic device also sends its new allowed restart count security code and the number of pulses of the first drive signal within the preset time period to the first CPU.

[0065] The first CPU verifies the new allowed restart count security code of the first programmable logic device and the number of pulses of the first drive signal within the preset time period. After the verification is passed, the first CPU generates the first dynamic system verification word based on its own allowed restart count security code and the second conventional compensation value and sends it to the first programmable logic device.

[0066] The first programmable logic device verifies the first dynamic system verification word received for the third time and keeps its allowed restart count unchanged after the verification is passed. The first programmable logic device also sends its own allowed restart count security code and the number of pulses of the first drive signal within the preset time period to the first CPU.

[0067] The first CPU verifies the allowable restart count security code of the first programmable logic device and the number of pulses of the first drive signal within the preset time period. After the verification is passed, the first CPU generates the first dynamic system verification word based on its own allowable restart count security code and the alternating first and second conventional compensation values ​​and sends it to the first programmable logic device.

[0068] The first programmable logic device verifies the first dynamic system verification word received after the third time, and generates the first drive signal and sends it to the first CPU after the verification is passed.

[0069] Optionally, the second CPU generates the second dynamic system verification word based on its own allowed restart count security code and the specific compensation value, and sends it to the second programmable logic device;

[0070] The second programmable logic device verifies the second dynamic system verification word received for the first time, and after the verification is passed, it decrements its own allowed restart count by 1. The second programmable logic device also sends its new allowed restart count security code and the number of pulses of the second drive signal within the preset time period to the second CPU.

[0071] The second CPU verifies the new allowed restart count security code of the second programmable logic device and the number of pulses of the second drive signal within the preset time period. After the verification is passed, the second CPU generates the second dynamic system verification word based on its own allowed restart count security code and the first conventional compensation value and sends it to the second programmable logic device.

[0072] The second programmable logic device verifies the second dynamic system verification word received for the second time, and after the verification is successful, it increments its own allowed restart count by 1. The second programmable logic device also sends its new allowed restart count security code and the number of pulses of the second drive signal within the preset time period to the second CPU.

[0073] The second CPU verifies the new allowed restart count security code of the second programmable logic device and the number of pulses of the second drive signal within the preset time period. After the verification is passed, the second CPU generates the second dynamic system verification word based on its own allowed restart count security code and the second conventional compensation value and sends it to the second programmable logic device.

[0074] The second programmable logic device verifies the second dynamic system verification word received for the third time and keeps its allowed restart count unchanged after the verification is passed. The second programmable logic device also sends its own allowed restart count security code and the number of pulses of the second drive signal within the preset time period to the second CPU.

[0075] The second CPU verifies the allowable restart count security code of the second programmable logic device and the number of pulses of the second drive signal within the preset time period. After the verification is passed, the second CPU generates the second dynamic system verification word based on its own allowable restart count security code and the alternating first and second conventional compensation values ​​and sends it to the second programmable logic device.

[0076] The second programmable logic device verifies the second dynamic system verification word received after the third time, and generates the second drive signal after the verification is passed and sends it to the second CPU.

[0077] Optionally, the conditions for the first dynamic system to pass the verification of the verification word include:

[0078] The first dynamic system verification word received by the first programmable logic device for the first time is the first specific system verification word;

[0079] The first dynamic system verification word received by the first programmable logic device for the second time is the first conventional system verification word;

[0080] The first dynamic system verification word received by the first programmable logic device for the third time is the second conventional system verification word;

[0081] The first dynamic system check word received by the first programmable logic device after the third time alternates between the first conventional system check word and the second conventional system check word;

[0082] The conditions for the second dynamic system to pass the verification of the character include:

[0083] The second dynamic system verification word received by the second programmable logic device for the first time is the second specific system verification word;

[0084] The second dynamic system verification word received by the second programmable logic device for the second time is the third conventional system verification word;

[0085] The second dynamic system verification word received by the second programmable logic device for the third time is the fourth conventional system verification word;

[0086] The second dynamic system check word received by the second programmable logic device after the third time alternates between the third conventional system check word and the fourth conventional system check word.

[0087] Optionally, the conditions for passing the pulse count verification of the first drive signal include: the first programmable logic device does not send the first drive signal to the communication module, and the pulse count of the first drive signal is 0 within the preset time period; the first programmable logic device sends the first drive signal to the communication module, and the pulse count of the first drive signal is a preset value within the preset time period.

[0088] The conditions for passing the pulse count verification of the second drive signal include: the second programmable logic device does not send the second drive signal to the communication module, and the pulse count of the second drive signal is 0 within the preset time period; the second programmable logic device sends the second drive signal to the communication module, and the pulse count of the second drive signal within the preset time period is the preset value.

[0089] Optionally, the conditions for the security code verification of the allowed number of restarts of the first programmable logic device to pass include:

[0090] The security codes for the allowed number of restarts of the first programmable logic device are all valid values;

[0091] Upon receiving the first specific system verification word sent by the first CPU, the allowed number of restarts for the first programmable logic device is reduced by 1;

[0092] Upon receiving the first first conventional system verification word sent by the first CPU, the allowed restart count of the first programmable logic device is incremented by 1;

[0093] When receiving the alternating first conventional system verification word and second conventional system verification word sent by the first CPU, the number of allowed restarts of the first programmable logic device remains unchanged;

[0094] The conditions under which the security code verification for the allowed number of restarts of the second programmable logic device passes include:

[0095] The security codes for the allowed number of restarts of the second programmable logic device are all valid values;

[0096] Upon receiving the second specific system verification word sent by the second CPU, the allowed number of restarts for the second programmable logic device is reduced by 1;

[0097] Upon receiving the first third conventional system verification word sent by the second CPU, the allowed restart count of the second programmable logic device is incremented by 1;

[0098] When the second programmable logic device receives the alternating third and fourth conventional system verification words sent by the second CPU, the number of allowed restarts remains unchanged.

[0099] Compared with the prior art, the present invention has at least one of the following advantages:

[0100] This invention provides a rail transit control device. A first processing channel generates its own permissible restart count security code based on its own permissible restart count, and generates a first drive signal after the security code is verified. Similarly, a second processing channel generates its own permissible restart count security code based on its own permissible restart count, and generates a second drive signal after the security code is verified. A communication module powers on upon receiving the first and second drive signals, enabling the first processing channel to exchange first safety data with external devices through the communication module, and enabling the second processing channel to exchange second safety data with external devices through the communication module. This invention securely encodes the permissible restart count to ensure its security. Furthermore, this invention associates the security code for the permissible restart count obtained after security encoding with the drive signal used to control the power-on and power-off of the communication module, ensuring the reliability of the data output by the device.

[0101] This invention designs a security code for the number of allowed restarts of the CPU and programmable logic device in each processing channel. By performing a two-out-of-two comparison for the dual-channel CPU and a two-out-of-two comparison for the dual-channel programmable logic device, the security of the allowed number of restarts is ensured.

[0102] In this invention, each processing channel uses a different controller (CPU and programmable logic device) to independently manage the number of allowed restarts, eliminating the potential for common cause failures and improving the safety of the device; at the same time, through mutual detection between the CPU and the programmable logic device, functional failures of the CPU and the programmable logic device can be avoided.

[0103] In this invention, the CPU-managed allowed restart security code is calculated based on its own allowed restart count and the results of power-on self-test and periodic self-test, so as to detect whether the CPU hardware has failed; at the same time, the system verification word generated by the CPU is dynamically changing, so as to detect the solidification failure of the CPU or its FLASH memory.

[0104] This invention achieves functional self-testing of programmable logic devices by using specific dynamic system check words issued by the CPU and alternating conventional dynamic system check words.

[0105] In this invention, the communication module performs differential processing on the received first security data and second security data. If the first security data and the second security data are different, it indicates that the first CPU or the second CPU in the device has experienced a random failure. At this time, the communication module does not output security data to the outside world, thereby further ensuring the reliability of the data output by the device. Attached Figure Description

[0106] Figure 1This is a schematic diagram of the structure of a rail transit control device according to an embodiment of the present invention;

[0107] Figure 2 This is a flowchart illustrating a method of using a rail transit control device according to an embodiment of the present invention. Detailed Implementation

[0108] The following detailed description, in conjunction with the accompanying drawings and specific embodiments, provides a further detailed explanation of the rail transit control device and its usage method proposed in this invention. The advantages and features of this invention will become clearer from the following description. It should be noted that the drawings are in a very simplified form and use non-precise proportions, used only to facilitate and clearly illustrate the embodiments of this invention. Please refer to the drawings to make the objectives, features, and advantages of this invention more apparent and understandable. It should be understood that the structures, proportions, sizes, etc., depicted in the accompanying drawings are only for illustrative purposes to aid those skilled in the art and are not intended to limit the implementation conditions of this invention. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in proportions, or adjustments to the size, without affecting the effects and objectives achieved by this invention, should still fall within the scope of the technical content disclosed in this invention.

[0109] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0110] Combined with appendix Figure 1As shown, this embodiment provides a rail transit control device, including: a first processing channel, used to generate its own allowed restart count security code based on its own allowed restart count, and a first drive signal after its allowed restart count security code is verified, and also used to generate first safety data; a second processing channel, used to generate its own allowed restart count security code based on its own allowed restart count, and a second drive signal after its allowed restart count security code is verified, and also used to generate second safety data; a communication module, connected to the first processing channel, the second processing channel, and an external device; and the communication module powers on after receiving the first drive signal and the second drive signal, so that the first processing channel interacts with the external device through the communication module to exchange the first safety data, and the second processing channel interacts with the external device through the communication module to exchange the second safety data.

[0111] Specifically, in this embodiment, the rail transit control device is one device in the entire rail transit control system (e.g., an ATP device). The first processing channel and the second processing channel in the rail transit control device are two physically independent processing channels.

[0112] Please continue to refer to this. Figure 1 The first processing channel includes: a first programmable logic device (PLD), connected to the communication module, configured to generate its own allowed restart count security code based on the PLD's own allowed restart count, and also configured to acquire the pulse count of the first drive signal within a preset time period; a first CPU, connected to the PLD and the communication module, configured to generate its own allowed restart count security code based on the CPU's own allowed restart count, generate the first security data, and verify the PLD's allowed restart count security code and the pulse count of the first drive signal, and also configured to generate a first dynamic system verification word based on the CPU's own allowed restart count security code and dynamic compensation value after verification and send it to the PLD; the first PLD is also configured to verify the first dynamic system verification word and generate the first drive signal and send it to the communication module after verification.

[0113] The second processing channel includes: a second programmable logic device connected to the communication module, configured to generate its own allowed restart count security code based on the allowed restart count of the second programmable logic device, and also configured to acquire the pulse count of the second drive signal within the preset time period; a second CPU connected to the second programmable logic device and the communication module, configured to generate its own allowed restart count security code based on the allowed restart count of the second CPU, generate the second security data, and verify the allowed restart count security code of the second programmable logic device and the pulse count of the second drive signal, and also configured to generate a second dynamic system verification word based on the allowed restart count security code of the second CPU and the dynamic compensation value after the verification is passed, and send it to the second programmable logic device; the second programmable logic device is also configured to verify the second dynamic system verification word and generate the second drive signal after the verification is passed, and send it to the communication module.

[0114] Specifically, in this embodiment, the first CPU, the first programmable logic device, the second CPU, and the second programmable logic device are all equipped with registers for storing information. Preferably, the registers are FLASH memory. A direct connection interface for information exchange is provided between the first CPU and the first programmable logic device. Preferably, the first CPU accesses the registers of the first programmable logic device through an internal bus to achieve information exchange between the two. The information continuously exchanged between the two includes: the first dynamic system verification word and first health information composed of the allowed restart count security code of the first programmable logic device and the pulse count of the first drive signal. The specific process of information exchange is as follows: the first CPU periodically (e.g., every 50ms) provides the first dynamic system verification word it generates to the first programmable logic device, and the first programmable logic device periodically (e.g., every 50ms) provides the first health information it generates to the first CPU. More specifically, the first programmable logic device (PLD) manages its own allowed restart count security code, which is stored in the PLD's FLASH memory. Each restart count security code has a specific expected valid value that satisfies a certain Hamming code distance. Specifically, the valid security code value for 0 restarts is REBOOT_CODE0_PLD, the valid security code value for 1 restart is REBOOT_CODE1_PLD, and so on. Furthermore, during the handshake process between the first PLD and the first CPU, the allowed restart count of the first PLD is decremented by 1. When this operation results in the allowed restart count of the first PLD being 0, the corresponding valid security code value is REBOOT_CODE0_SPECIAL_PLD. The first CPU also manages its own allowed restart count security code, which is stored in the first CPU's FLASH memory. The allowed restart count security code of the first CPU is calculated based on its own self-test results (including power-on self-test results and periodic self-test results) and the allowed restart count. Each number of restarts has an expected legal value, which are different and meet a certain Hamming code distance. Among them, the legal value of the security code corresponding to 0 restarts is REBOOT_CODE0_CPU, the legal value of the security code corresponding to 1 restart is REBOOT_CODE1_CPU, and so on, but the present invention is not limited thereto.

[0115] Similarly, a direct connection interface for information exchange is also provided between the second CPU and the second programmable logic device. Preferably, the second CPU accesses the registers of the second programmable logic device through an internal bus to realize information exchange between the two. The information continuously exchanged between the two includes: the second dynamic system verification word and the second health information composed of the allowed restart count security code of the second programmable logic device and the pulse count of the second drive signal. The specific process of information exchange between the two is as follows: the second CPU periodically (e.g., every 50ms) provides the second dynamic system verification word generated by itself to the second programmable logic device, and the second programmable logic device periodically (e.g., every 50ms) provides the second health information generated by itself to the second CPU. More specifically, the second programmable logic device manages its own allowed restart count security code, which is stored in its own FLASH memory. Each restart count security code has an expected legal value, which are different and meet a certain Hamming code distance. Among them, the legal value of the security code corresponding to 0 restarts is REBOOT_CODE0_PLD, the legal value of the security code corresponding to 1 restart is REBOOT_CODE1_PLD, and so on. Furthermore, during the handshake process between the second programmable logic device and the second CPU, the allowed restart count of the second programmable logic device is decremented by 1. When this operation results in the allowed restart count of the second programmable logic device being 0, the corresponding valid security code value is REBOOT_CODE0_SPECIAL_PLD. The second CPU also manages its own allowed restart count security code, which is stored in its own FLASH memory. The allowed restart count security code of the second CPU is calculated based on its own self-test results (including power-on self-test results and periodic self-test results) and the allowed restart count. Each number of restarts has an expected valid value, which are different and satisfy a certain Hamming code distance. Among them, the valid security code value corresponding to 0 restarts is REBOOT_CODE0_CPU, the valid security code value corresponding to 1 restart is REBOOT_CODE1_CPU, and so on, but the present invention is not limited thereto.

[0116] Specifically, in this embodiment, the dynamic compensation value includes a specific compensation value COMP_VALUE_0, a first regular compensation value COMP_VALUE_1, and a second regular compensation value COMP_VALUE_2. The first dynamic system verification word includes a first specific system verification word CHKWORD_SPECIAL_1, a first regular system verification word CHKWORD_1, and a second regular system verification word CHKWORD_2; and the first CPU generates the first specific system verification word CHKWORD_SPECIAL_1 based on its own allowed restart count security code and the specific compensation value COMP_VALUE_0, generates the first regular system verification word CHKWORD_1 based on its own allowed restart count security code and the first regular compensation value COMP_VALUE_1, and generates the second regular system verification word CHKWORD_2 based on its own allowed restart count security code and the second regular compensation value COMP_VALUE_2. The second dynamic system verification word includes a second specific system verification word CHKWORD_SPECIAL_2, a third regular system verification word CHKWORD_3, and a fourth regular system verification word CHKWORD_4; and the second CPU generates the second specific system verification word CHKWORD_SPECIAL_2 based on its own allowed restart count security code and the specific compensation value COMP_VALUE_0, generates the third regular system verification word CHKWORD_3 based on its own allowed restart count security code and the first regular compensation value COMP_VALUE_1, and generates the fourth regular system verification word CHKWORD_4 based on its own allowed restart count security code and the second regular compensation value COMP_VALUE_2. More specifically, when the allowed number of restarts security codes of the first CPU and the second CPU are the same, the calculated first specific system verification word CHKWORD_SPECIAL_1 and the second specific system verification word CHKWORD_SPECIAL_2 are the same, the first regular system verification word CHKWORD_1 and the third regular system verification word CHKWORD_3 are the same, and the second regular system verification word CHKWORD_2 and the fourth regular system verification word CHKWORD_4 are the same, but the present invention is not limited thereto.

[0117] Please continue to refer to this. Figure 1 The first programmable logic device is also connected to the second programmable logic device, and the first programmable logic device and the second programmable logic device interact with each other by the security code of the allowed number of restarts of the first programmable logic device, the pulse number of the first drive signal, the first dynamic system verification word, the security code of the allowed number of restarts of the second programmable logic device, the pulse number of the second drive signal, and the second dynamic system verification word.

[0118] The first CPU is also connected to the second CPU, and the first CPU and the second CPU exchange the first dynamic system verification word, the allowed restart count security code of the first programmable logic device, the pulse count of the first drive signal, the second dynamic system verification word, the allowed restart count security code of the second programmable logic device, and the pulse count of the second drive signal.

[0119] Specifically, in this embodiment, direct connection ports for exchanging information are provided between the first programmable logic device and the second programmable logic device, and between the first CPU and the second CPU, to facilitate information exchange, but the present invention is not limited thereto.

[0120] Specifically, in this embodiment, the first programmable logic device (PLD) and the second PLD jointly provide drive signals to supply power to the communication module. That is, the first PLD and the second PLD control the power-on and power-off of the communication module by providing corresponding first and second drive signals; the communication module operates when powered on and does not operate when powered off. More specifically, if at least one of the first PLD and the second PLD does not provide the corresponding drive signal (e.g., the first PLD provides the first drive signal or the second PLD provides the second drive signal), the communication module will power off and not operate. This prevents the rail transit control equipment from outputting safety data, ensuring that the data output is only performed when all components of the rail transit control equipment are functioning normally, thus guaranteeing the reliability of the output data. However, this invention is not limited to this.

[0121] Specifically, in this embodiment, when the first programmable logic device provides the first drive signal to the communication module, the first programmable logic device also performs real-time acquisition of the provided first drive signal to obtain a first retrieval signal and counts the number of pulses of the first retrieval signal within the preset time period to obtain the number of pulses of the first drive signal within the preset time period for self-testing. Similarly, when the second programmable logic device provides the second drive signal to the communication module, the second programmable logic device also performs real-time acquisition of the provided second drive signal to obtain a second retrieval signal and counts the number of pulses of the second retrieval signal within the preset time period to obtain the number of pulses of the second drive signal within the preset time period for self-testing, but the present invention is not limited thereto.

[0122] Furthermore, in this embodiment, the conditions for the pulse count verification of the first driving signal to pass include: the first programmable logic device does not send the first driving signal to the communication module, and the pulse count of the first driving signal within the preset time period is 0; the first programmable logic device sends the first driving signal to the communication module, and the pulse count of the first driving signal within the preset time period is a preset value PULSE_NUM_EXPECTED.

[0123] The conditions for passing the pulse count verification of the second drive signal include: the second programmable logic device does not send the second drive signal to the communication module, and the pulse count of the second drive signal is 0 within the preset time period; the second programmable logic device sends the second drive signal to the communication module, and the pulse count of the second drive signal within the preset time period is the preset value PULSE_NUM_EXPECTED.

[0124] The conditions under which the reset count security code verification of the first programmable logic device passes include: all reset count security codes of the first programmable logic device are valid values ​​but not equal to REBOOT_CODE0_PLD; when the first specific system verification word sent by the first CPU is received, the reset count of the first programmable logic device is decremented by 1; when the first first regular system verification word sent by the first CPU is received, the reset count of the first programmable logic device is incremented by 1; when the alternating first regular system verification word and second regular system verification word sent by the first CPU are received, the reset count of the first programmable logic device remains unchanged.

[0125] The conditions for the restart count security code verification of the second programmable logic device to pass include: the restart count security codes of the second programmable logic device are all valid values ​​but not equal to REBOOT_CODE0_PLD; when the second specific system verification word sent by the second CPU is received, the restart count of the second programmable logic device is decremented by 1; when the first third regular system verification word sent by the second CPU is received, the restart count of the second programmable logic device is incremented by 1; when the alternating third regular system verification word and the fourth regular system verification word sent by the second CPU are received, the restart count of the second programmable logic device remains unchanged.

[0126] The conditions for the first dynamic system verification word to pass the verification include: the first dynamic system verification word received by the first programmable logic device for the first time is the first specific system verification word; the first dynamic system verification word received by the first programmable logic device for the second time is the first regular system verification word; the first dynamic system verification word received by the first programmable logic device for the third time is the second regular system verification word; the first dynamic system verification word received by the first programmable logic device after the third time alternates between the first regular system verification word and the second regular system verification word. That is, if the first dynamic system verification word received by the first programmable logic device for the Nth time is the first regular system verification word, then the first dynamic system verification word received by the first programmable logic device for the N-1th and N+1th times is the second regular system verification word, where N≥4 and is a positive integer.

[0127] The conditions for the second dynamic system verification word to pass the verification include: the second dynamic system verification word received by the second programmable logic device for the first time is the second specific system verification word; the second dynamic system verification word received by the second programmable logic device for the second time is the third regular system verification word; the second dynamic system verification word received by the second programmable logic device for the third time is the fourth regular system verification word; the second dynamic system verification word received by the second programmable logic device after the third time alternates between the third regular system verification word and the fourth regular system verification word. That is, if the second dynamic system verification word received by the second programmable logic device for the Nth time is the third regular system verification word, then the second dynamic system verification word received by the second programmable logic device for the N-1th and N+1th times is the fourth regular system verification word, where N≥4 and is a positive integer.

[0128] Furthermore, in this embodiment, after the communication module is powered on, when the first CPU interacts with the external device through the communication module to exchange the first security data and the second CPU interacts with the external device through the communication module to exchange the second security data, the communication module will perform differential processing on the received first and second security data. If the first and second security data are the same, it indicates that the rail transit control equipment is normal. At this time, the communication module will send the first or second security data as the final security data to the external device. If the first and second security data are different, it indicates that the first CPU or the second CPU in the rail transit control equipment has experienced a random failure. At this time, the communication module will not output security data to ensure the reliability of the output data. More specifically, the first and second security data are related to the rail transit control equipment. For example, when the rail transit control equipment is ATP and the external device is RBC, the first and second security data are MA request data sent by ATP to RBC for obtaining mobility authorization, but the present invention is not limited thereto.

[0129] On the other hand, combined with the appendix Figure 2 As shown, this embodiment also provides a method for using the rail transit control device as described above, including: step S10, powering the rail transit control device to enable the first processing channel and the second processing channel to operate; step S20, the first processing channel generates a first drive signal and first safety data and sends them to the communication module, and the second processing channel generates a second drive signal and second safety data and sends them to the communication module; step S30, the communication module powers on after receiving the first drive signal and the second drive signal; and step S40, the first processing channel interacts with the external device through the communication module to exchange the first safety data, and the second processing channel interacts with the external device through the communication module to exchange the second safety data.

[0130] Specifically, in this embodiment, after the rail transit control equipment is powered on, the first programmable logic device and the first CPU of the first processing channel, and the second programmable logic device and the second CPU of the second processing channel begin to work. The step of the first processing channel generating the first drive signal includes: Step S211, the first programmable logic device generates its own allowed restart count security code based on its allowed restart count and obtains the number of pulses of the first drive signal within a preset time period, and sends it to the first CPU; Step S212, the first CPU verifies the allowed restart count security code of the first programmable logic device and the number of pulses of the first drive signal, and after successful verification, generates a first dynamic system verification word based on the first CPU's own allowed restart count security code and dynamic compensation value, and sends it to the first programmable logic device; Step S213, the first programmable logic device verifies the first dynamic system verification word, and after successful verification, generates the first drive signal and sends it to the communication module.

[0131] The steps for the second processing channel to generate the second driving signal include: Step S221, the second programmable logic device generates its own allowed restart count security code based on its own allowed restart count and obtains the number of pulses of the second driving signal within a preset time period and sends it to the second CPU; Step S222, the second CPU verifies the allowed restart count security code of the second programmable logic device and the number of pulses of the second driving signal, and after the verification is passed, generates a second dynamic system verification word based on the second CPU's own allowed restart count security code and dynamic compensation value and sends it to the first programmable logic device; Step S223, the second programmable logic device verifies the second dynamic system verification word and, after the verification is passed, generates the second driving signal and sends it to the communication module.

[0132] Please continue to refer to this. Figure 2The first CPU generates the first dynamic system verification word based on its own allowed restart count security code and the specific compensation value, and sends it to the first programmable logic device (PLD). The first PLD verifies the first dynamic system verification word received for the first time, and after passing the verification, decrements its allowed restart count by 1. The first PLD also sends its new allowed restart count security code and the number of pulses of the first drive signal within the preset time period to the first CPU. The first CPU verifies the new allowed restart count security code of the first PLD and the number of pulses of the first drive signal within the preset time period. After passing the verification, the first CPU generates the first dynamic system verification word based on its own allowed restart count security code and the first conventional compensation value, and sends it to the first PLD. The first PLD verifies the first dynamic system verification word received for the second time, and after passing the verification, increments its allowed restart count by 1. The first PLD also sends its new allowed restart count security code and the number of pulses of the first drive signal within the preset time period to the first CPU. The first CPU verifies the new allowed restart count security code of the first PLD and the number of pulses of the first drive signal within the preset time period to the first CPU. The system verifies the allowed restart count security code and the number of pulses of the first drive signal within the preset time period. After the verification passes, the first CPU generates the first dynamic system verification word based on its own allowed restart count security code and the second conventional compensation value, and sends it to the first programmable logic device. The first programmable logic device verifies the first dynamic system verification word received for the third time and maintains its own allowed restart count unchanged after the verification passes. The first programmable logic device sends its own unchanged allowed restart count security code and the number of pulses of the first drive signal within the preset time period to the first CPU. The first CPU verifies the unchanged allowed restart count security code of the first programmable logic device and the number of pulses of the first drive signal within the preset time period. After the verification passes, the first CPU generates the first dynamic system verification word alternately based on its own allowed restart count security code and the alternating first conventional compensation value and the second conventional compensation value, and sends it to the first programmable logic device. The first programmable logic device verifies the first dynamic system verification word received after the third time and generates the first drive signal after the verification passes, and sends it to the first CPU.

[0133] The second CPU generates the second dynamic system verification word based on its own allowed restart count security code and the specific compensation value, and sends it to the second programmable logic device (PLD). The second PLD verifies the second dynamic system verification word received for the first time, and after passing the verification, decrements its allowed restart count by 1. The second PLD also sends its new allowed restart count security code and the number of pulses of the second drive signal within the preset time period to the second CPU. The second CPU verifies the new allowed restart count security code of the second PLD and the number of pulses of the second drive signal within the preset time period. After passing the verification, the second CPU generates the second dynamic system verification word based on its own allowed restart count security code and the first conventional compensation value, and sends it to the second PLD. The second PLD verifies the second dynamic system verification word received for the second time, and after passing the verification, increments its allowed restart count by 1. The second PLD also sends its new allowed restart count security code and the number of pulses of the second drive signal within the preset time period to the second CPU. The second CPU verifies the new allowed restart count security code of the second PLD and the number of pulses of the second drive signal within the preset time period to the second CPU. The system verifies the allowed restart count security code and the number of pulses of the second drive signal within the preset time period. After successful verification, the second CPU generates the second dynamic system verification word based on its own allowed restart count security code and the second conventional compensation value, and sends it to the second programmable logic device. The second programmable logic device verifies the second dynamic system verification word received for the third time and maintains its own allowed restart count unchanged after successful verification. The second programmable logic device sends its own unchanged allowed restart count security code and the number of pulses of the second drive signal within the preset time period to the second CPU. The second CPU verifies the unchanged allowed restart count security code of the second programmable logic device and the number of pulses of the second drive signal within the preset time period. After successful verification, the second CPU generates the second dynamic system verification word alternately based on its own allowed restart count security code and the alternating first and second conventional compensation values, and sends it to the second programmable logic device. The second programmable logic device verifies the second dynamic system verification word received after the third time and generates the second drive signal after successful verification, and sends it to the second CPU.

[0134] Specifically, in this embodiment, when the first programmable logic device does not receive a qualified conventional system verification word (i.e., the alternating first conventional system verification word CHKWORD_1 and the second conventional system verification word CHKWORD_2) and / or the second programmable logic device does not receive a qualified conventional system verification word (i.e., the alternating third conventional system verification word CHKWORD_3 and the fourth conventional system verification word CHKWORD_4), neither the first programmable logic device nor the second programmable logic device provides the corresponding drive signal; at this time, the first programmable logic device reads and verifies its own allowed restart count security code, the... If one or more of the following four items fail verification: the number of pulses of the first drive signal within a preset time period, the allowed restart count security code of the second programmable logic device, and the number of pulses of the second drive signal within the preset time period, the first programmable logic device enters its safe state. At the same time, the second programmable logic device also reads and checks its own allowed restart count security code, the number of pulses of the first drive signal within the preset time period, the allowed restart count security code of the first programmable logic device, and the number of pulses of the second drive signal within the preset time period. If one or more of these four items fail verification, the second programmable logic device also enters its safe state. After the first programmable logic device and the second programmable logic device pass the above four verifications, when the first programmable logic device does not receive the first first specific system verification word (value CHKWORD_SPECIAL_1) and / or the second programmable logic device does not receive the first second specific system verification word (value CHKWORD_SPECIAL_2), the first programmable logic device periodically (e.g., every 50ms) provides the first health information to the first CPU, and the second programmable logic device periodically (e.g., every 50ms) provides the second health information to the second CPU.

[0135] The first CPU receives the first health information for the first time and performs a self-test (including power-on self-test and periodic self-test). If the first CPU's self-test is successful, it can obtain its own self-test result. The first CPU can then calculate the first specific system verification word based on its own self-test result, its allowed number of restarts, and the specific compensation value COMP_VALUE_0. At the same time, the second CPU receives the second health information for the first time and performs a self-test (including power-on self-test and periodic self-test). If the second CPU's self-test is successful, it can obtain its own self-test result. At this time, the second CPU can calculate the second specific system verification word based on its own self-test result, its allowed number of restarts, and the specific compensation value COMP_VALUE_0. Then, the first CPU and the second CPU exchange their respective specific system verification words and health information. The first CPU verifies six items: its own calculated first specific system verification word, the allowed restart count security code of the first programmable logic device, and the number of pulses of the first drive signal within the preset time period. The second CPU verifies the second specific system verification word, the allowed restart count security code of the second programmable logic device, and the number of pulses of the second drive signal within the preset time period. If one or more of these verifications fail, the first CPU enters its safe state. Simultaneously, the second CPU verifies the same six items: its own calculated second specific system verification word, the allowed restart count security code of the first programmable logic device, and the number of pulses of the first drive signal within the preset time period. If one or more of these verifications fail, the second CPU also enters its safe state. Furthermore, if the first CPU and the second CPU fail their self-tests, the corresponding CPU enters its safe state. After both the first CPU and the second CPU pass the above six checks, the first CPU sends the calculated first specific system check word to the first programmable logic device, and the second CPU sends the calculated second specific system check word to the second programmable logic device. The first programmable logic device checks the dynamic system check word it receives for the first time and the dynamic system check word it receives for the first time. If the values ​​of the dynamic system check words received for the first time are CHKWORD_SPECIAL_1 and CHKWORD_SPECIAL_2 respectively, the first programmable logic device decrements its allowed restart count by 1 and then provides its new health information to the first CPU; otherwise, the first programmable logic device enters its safe state.Similarly, the second programmable logic device verifies the dynamic system verification word it receives for the first time and the dynamic system verification word it receives for the first time. If the values ​​of the dynamic system verification words received for the first time are CHKWORD_SPECIAL_2 and CHKWORD_SPECIAL_1 respectively, the second programmable logic device decrements its allowed restart count by 1 and then provides its new health information to the second CPU. Otherwise, the second programmable logic device enters its safe state.

[0136] After the first CPU receives the new health information of the first programmable logic device for the second time, it calculates the first normal system verification word based on its own self-test result, its allowed restart count, and the first normal compensation value COMP_VALUE_1. After the second CPU receives the health information of the second programmable logic device for the second time, it calculates the third normal system verification word based on its own self-test result, its allowed restart count, and the first normal compensation value COMP_VALUE_1. Then, the first CPU and the second CPU exchange their respective normal system verification words and health information. The first CPU compares its calculated first normal system verification word, the allowed restart count security code of the first programmable logic device, and the number of pulses of the first drive signal within the preset time period. The first CPU verifies six items: the third conventional system verification word calculated by the second CPU, the allowed restart count security code of the second programmable logic device, and the number of pulses of the second drive signal within the preset time period. If one or more of these verifications fail, the first CPU enters its safe state. Simultaneously, the second CPU verifies the same six items: its own calculated third conventional system verification word, the allowed restart count security code of the first programmable logic device, the number of pulses of the first drive signal within the preset time period, the first conventional system verification word calculated by the first CPU, the allowed restart count security code of the second programmable logic device, and the number of pulses of the second drive signal within the preset time period. If one or more of these verifications fail, the second CPU also enters its safe state. After both the first CPU and the second CPU pass the verifications for the above six items, the first CPU sends its calculated first conventional dynamic system verification word to the first programmable logic device, and the second CPU sends its calculated third conventional dynamic system verification word to the second programmable logic device. The first programmable logic device (PLD) verifies the dynamic system check word it receives for the second time, and the second programmable logic device (PLD) verifies the dynamic system check word it receives for the second time. If the values ​​of the second received dynamic system check words are CHKWORD_1 and CHKWORD_3 respectively, the first PLD decrements its allowed restart count by 1 and then provides its new health information to the first CPU; otherwise, the first PLD enters its safe state. Similarly, the second PLD verifies the dynamic system check word it receives for the second time, and the first PLD verifies the dynamic system check word it receives for the second time. If the values ​​of the second received dynamic system check words are CHKWORD_3 and CHKWORD_1 respectively, the second PLD increments its allowed restart count by 1 and then provides its new health information to the second CPU; otherwise, the second PLD enters its safe state.

[0137] After the first CPU receives the health information of the first programmable logic device for the third time, it calculates the second routine system verification word based on its own self-test result, its allowed restart count, and the second routine compensation value COMP_VALUE_2. After the second CPU receives the health information of the second programmable logic device for the third time, it calculates the fourth routine system verification word based on its own self-test result, its allowed restart count, and the second routine compensation value COMP_VALUE_2. Then, the first CPU and the second CPU exchange their respective routine system verification words and health information. The first CPU compares its calculated second routine system verification word, the allowed restart count security code of the first programmable logic device, and the number of pulses of the first drive signal within the preset time period. The first CPU verifies six items: the fourth conventional system verification word calculated by the second CPU, the allowed restart count security code of the second programmable logic device, and the number of pulses of the second drive signal within the preset time period. If one or more of these verifications fail, the first CPU enters its safe state. Simultaneously, the second CPU verifies the same six items: its own calculated fourth conventional system verification word, the allowed restart count security code of the first programmable logic device, the number of pulses of the first drive signal within the preset time period, the second conventional system verification word calculated by the first CPU, the allowed restart count security code of the second programmable logic device, and the number of pulses of the second drive signal within the preset time period. If one or more of these verifications fail, the second CPU also enters its safe state. After both the first CPU and the second CPU pass the verifications for the above six items, the first CPU sends its calculated second conventional dynamic system verification word to the second programmable logic device, and the second CPU sends its calculated fourth conventional dynamic system verification word to the second programmable logic device. The first programmable logic device verifies the dynamic system check word it receives for the third time with the third dynamic system check word received by the second programmable logic device. If the values ​​of the third dynamic system check words received by the two devices are CHKWORD_2 and CHKWORD_4 respectively, the first programmable logic device provides its fixed health information to the first CPU; otherwise, the first programmable logic device enters its safe state. Similarly, the second programmable logic device verifies the dynamic system check word it receives for the third time with the first programmable logic device. If the values ​​of the third dynamic system check words received by the two devices are CHKWORD_4 and CHKWORD_2 respectively, the second programmable logic device provides its fixed health information to the second CPU; otherwise, the second programmable logic device enters its safe state.

[0138] After the first CPU receives the health information of the first programmable logic device for the fourth time, it calculates the first normal system verification word based on its own self-test result, its allowed restart count, and the first normal compensation value COMP_VALUE_1. After the second CPU receives the health information of the second programmable logic device for the fourth time, it calculates the third normal system verification word based on its own self-test result, its allowed restart count, and the first normal compensation value COMP_VALUE_1. Then, the first CPU and the second CPU exchange their respective normal system verification words and health information. The first CPU compares its calculated first normal system verification word, the allowed restart count security code of the first programmable logic device, and the number of pulses of the first drive signal within the preset time period. The first CPU verifies six items: the third conventional system verification word calculated by the second CPU, the allowed restart count security code of the second programmable logic device, and the number of pulses of the second drive signal within the preset time period. If one or more of these verifications fail, the first CPU enters its safe state. Simultaneously, the second CPU verifies the same six items: its own calculated third conventional system verification word, the allowed restart count security code of the first programmable logic device, the number of pulses of the first drive signal within the preset time period, the first conventional system verification word calculated by the first CPU, the allowed restart count security code of the second programmable logic device, and the number of pulses of the second drive signal within the preset time period. If one or more of these verifications fail, the second CPU also enters its safe state. After both the first CPU and the second CPU pass the verifications for the above six items, the first CPU sends its calculated first conventional dynamic system verification word to the second programmable logic device, and the second CPU sends its calculated third conventional dynamic system verification word to the second programmable logic device. The first programmable logic device verifies its fourth received dynamic system check word and the fourth received dynamic system check word of the second programmable logic device. If the values ​​of the fourth received dynamic system check words are CHKWORD_1 and CHKWORD_3 respectively, the first programmable logic device provides its own health information to the first CPU; otherwise, the first programmable logic device enters its safe state. Similarly, the second programmable logic device verifies its fourth received dynamic system check word and the fourth received dynamic system check word of the first programmable logic device. If the values ​​of the fourth received dynamic system check words are CHKWORD_3 and CHKWORD_1 respectively, the second programmable logic device provides its own health information to the second CPU; otherwise, the second programmable logic device enters its safe state.

[0139] The process of the first CPU and the second CPU receiving the corresponding health information for the third time and the second CPU receiving the corresponding health information for the fourth time is repeated alternately. If the dynamic system verification word received by the first programmable logic device alternates between CHKWORD_1 and CHKWORD_2, and the dynamic system verification word received by the second programmable logic device alternates between CHKWORD_3 and CHKWORD_4, then the first programmable logic device sends the first drive signal to the communication module and periodically (e.g., every 50ms) provides its own health information to the second CPU. The second programmable logic device sends the second drive signal to the communication module and periodically (e.g., every 50ms) provides its own health information to the second CPU. Otherwise, the corresponding programmable logic device enters its safe state.

[0140] In addition, in this embodiment, the safe state of the programmable logic device is as follows: (1) it no longer provides the health information and dynamic system verification word of this processing channel to the CPU of this processing channel and the programmable logic device of another processing channel; (2) it no longer provides the corresponding drive signal to the communication module; (3) when its own allowed restart digit is an illegal value, it sets its own allowed restart digit to REBOOT_CODE0_PLD, and when its own allowed restart count is greater than 0, it decrements its own allowed restart count by 1 (except for the decrement operation when a specific system verification word is received, the programmable logic device performs a decrement operation at most once during each operation), and when its own allowed restart count is 0, it keeps its own allowed restart digit set to REBOOT_CODE0_PLD.

[0141] CPU security state: (1) No longer provides the dynamic system check word and health information of this processing channel to the programmable logic device of this channel and the CPU of another channel; (2) No longer provides the corresponding security data to the communication module; (3) When its own allowed restart digit is an illegal value, it sets its own allowed restart digit to REBOOT_CODE0_CPU; when its own allowed restart count is greater than 0, it decrements its own allowed restart count by 1 (the CPU performs a decrement operation at most once during each run); when its own allowed restart count is 0, it keeps its own allowed restart digit set to REBOOT_CODE0_CPU.

[0142] In summary, this embodiment provides a rail transit control device where a first processing channel generates its own permissible restart security code based on its permissible restart count, and generates a first drive signal after its permissible restart security code is verified. Similarly, a second processing channel generates its own permissible restart security code based on its own permissible restart count, and generates a second drive signal after its permissible restart security code is verified. The communication module powers on upon receiving the first and second drive signals, enabling the first processing channel to exchange first safety data with external devices through the communication module, and enabling the second processing channel to exchange second safety data with external devices through the communication module. This embodiment securely encodes the permissible restart count to ensure its security. Furthermore, the invention associates the securely encoded permissible restart security code with the drive signal used to control the power-on and power-off of the communication module, ensuring the reliability of the data output by the device. Each processing channel uses a different control device (CPU and programmable logic device) to independently manage the permissible restart count, eliminating the potential for common-cause failure and improving device safety. Simultaneously, mutual detection between the CPU and the programmable logic device prevents functional failures of both the CPU and the programmable logic device. The CPU's allowed restart count security code is calculated based on the results of its power-on self-test and periodic self-tests to detect whether the CPU hardware has failed. Simultaneously, the system verification word generated by the CPU is dynamically changing to detect permanent failures in the CPU or its FLASH memory. Furthermore, in this embodiment, a functional self-test of the programmable logic device is achieved through a specific dynamic system verification word issued by the CPU and alternating conventional dynamic system verification words. A security code is designed for the allowed restart count of the CPU and programmable logic device, ensuring the security of the allowed restart count through a two-out-of-two comparison between the dual-channel CPU and the dual-channel programmable logic device.

[0143] Although the present invention has been described in detail through the preferred embodiments above, it should be understood that the above description should not be considered as a limitation of the present invention. Various modifications and substitutions to the present invention will be apparent to those skilled in the art after reading the above description. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A rail transit control device, characterized in that, include: The first processing channel is used to generate its own allowed restart count security code based on its own allowed restart count, and to generate a first drive signal after its own allowed restart count security code is verified. It is also used to generate first security data. The second processing channel is used to generate its own allowed restart count security code based on its own allowed restart count, and to generate a second drive signal after its own allowed restart count security code is verified. It is also used to generate second security data. A communication module is connected to the first processing channel, the second processing channel, and an external device; and the communication module powers on after receiving the first driving signal and the second driving signal, enabling the first processing channel to interact with the external device to exchange the first security data and enabling the second processing channel to interact with the external device to exchange the second security data. The first processing channel includes: The first programmable logic device is connected to the communication module and is used to generate its own allowed restart security code based on the allowed restart count of the first programmable logic device, and is also used to obtain the number of pulses of the first drive signal within a preset time period; The first CPU, connected to the first programmable logic device and the communication module, is used to generate its own allowed restart count security code, generate the first security data, and verify the allowed restart count security code of the first programmable logic device and the pulse count of the first drive signal based on the allowed restart count of the first CPU itself. It is also used to generate a first dynamic system verification word based on the allowed restart count security code of the first CPU itself and the dynamic compensation value after the verification is passed, and send it to the first programmable logic device. The first programmable logic device is also used to verify the first dynamic system verification word and generate the first drive signal after the verification is passed and send it to the communication module; The second processing channel includes: The second programmable logic device is connected to the communication module and is used to generate its own allowed restart security code based on the allowed restart count of the second programmable logic device, and is also used to obtain the number of pulses of the second drive signal within the preset time period; The second CPU, connected to the second programmable logic device and the communication module, is used to generate its own allowed restart count security code, generate the second security data, and verify the allowed restart count security code of the second programmable logic device and the pulse count of the second drive signal based on the allowed restart count of the second CPU itself. It is also used to generate a second dynamic system verification word based on the allowed restart count security code of the second CPU itself and the dynamic compensation value after the verification is passed, and send it to the second programmable logic device. The second programmable logic device is also used to verify the second dynamic system verification word and, after the verification is passed, generate the second drive signal and send it to the communication module.

2. The rail transit control equipment as described in claim 1, characterized in that, The dynamic compensation value includes a specific compensation value, a first regular compensation value, and a second regular compensation value; The first dynamic system verification word includes a first specific system verification word, a first regular system verification word, and a second regular system verification word; and the first CPU generates the first specific system verification word, the first regular system verification word, and the second regular system verification word based on its own allowed restart count security code and the specific compensation value; The second dynamic system verification word includes a second specific system verification word, a third regular system verification word, and a fourth regular system verification word; and the second CPU generates the second specific system verification word based on its own allowed restart count security code and the specific compensation value, generates the third regular system verification word based on its own allowed restart count security code and the first regular compensation value, and generates the fourth regular system verification word based on its own allowed restart count security code and the second regular compensation value.

3. The rail transit control equipment as described in claim 2, characterized in that, The first programmable logic device is also connected to the second programmable logic device, and the first programmable logic device and the second programmable logic device exchange the allowed restart number security code of the first programmable logic device, the pulse number of the first drive signal, the first dynamic system verification word, the allowed restart number security code of the second programmable logic device, the pulse number of the second drive signal, and the second dynamic system verification word; The first CPU is also connected to the second CPU, and the first CPU and the second CPU exchange the first dynamic system verification word, the allowed restart count security code of the first programmable logic device, the pulse count of the first drive signal, the second dynamic system verification word, the allowed restart count security code of the second programmable logic device, and the pulse count of the second drive signal.

4. The rail transit control equipment as described in claim 3, characterized in that, The conditions under which the pulse count verification of the first drive signal passes include: the first programmable logic device does not send the first drive signal to the communication module, and the pulse count of the first drive signal is 0 within the preset time period; or the first programmable logic device sends the first drive signal to the communication module, and the pulse count of the first drive signal is a preset value within the preset time period. The conditions for passing the pulse count verification of the second drive signal include: the second programmable logic device does not send the second drive signal to the communication module, and the pulse count of the second drive signal is 0 within the preset time period; the second programmable logic device sends the second drive signal to the communication module, and the pulse count of the second drive signal within the preset time period is the preset value.

5. The rail transit control equipment as described in claim 3, characterized in that, The conditions under which the security code verification of the allowed number of restarts of the first programmable logic device passes include: The security codes for the allowed number of restarts of the first programmable logic device are all valid values; Upon receiving the first specific system verification word sent by the first CPU, the allowed number of restarts for the first programmable logic device is reduced by 1; Upon receiving the first first conventional system verification word sent by the first CPU, the allowed restart count of the first programmable logic device is incremented by 1; When receiving the alternating first conventional system verification word and second conventional system verification word sent by the first CPU, the number of allowed restarts of the first programmable logic device remains unchanged; The conditions under which the security code verification for the allowed number of restarts of the second programmable logic device passes include: The security codes for the allowed number of restarts of the second programmable logic device are all valid values; Upon receiving the second specific system verification word sent by the second CPU, the allowed number of restarts for the second programmable logic device is reduced by 1; Upon receiving the first third conventional system verification word sent by the second CPU, the allowed restart count of the second programmable logic device is incremented by 1; When the second programmable logic device receives the alternating third and fourth conventional system verification words sent by the second CPU, the number of allowed restarts remains unchanged.

6. The rail transit control equipment as described in claim 3, characterized in that, The conditions under which the verification of the first dynamic system passes include: The first dynamic system verification word received by the first programmable logic device for the first time is the first specific system verification word; The first dynamic system verification word received by the first programmable logic device for the second time is the first conventional system verification word; The first dynamic system verification word received by the first programmable logic device for the third time is the second conventional system verification word; The first dynamic system check word received by the first programmable logic device after the third time alternates between the first conventional system check word and the second conventional system check word; The conditions for the second dynamic system to pass the verification of the character include: The second dynamic system verification word received by the second programmable logic device for the first time is the second specific system verification word; The second dynamic system verification word received by the second programmable logic device for the second time is the third conventional system verification word; The second dynamic system verification word received by the second programmable logic device for the third time is the fourth conventional system verification word; The second dynamic system check word received by the second programmable logic device after the third time alternates between the third conventional system check word and the fourth conventional system check word.

7. The rail transit control equipment as described in claim 1, characterized in that, The first CPU, the first programmable logic device, the second CPU, and the second programmable logic device all have registers.

8. The rail transit control equipment as described in claim 7, characterized in that, The register is a FLASH.

9. A method of using the rail transit control equipment as described in any one of claims 1 to 8, characterized in that, include: Power is supplied to the rail transit control equipment to enable the first and second processing channels to operate; The first processing channel generates a first driving signal and first security data and sends them to the communication module, and the second processing channel generates a second driving signal and second security data and sends them to the communication module; The communication module powers on and operates after receiving the first drive signal and the second drive signal. as well as The first processing channel interacts with the external device to exchange the first security data through the communication module, and the second processing channel interacts with the external device to exchange the second security data through the communication module. The steps for the first processing channel to generate the first driving signal include: The first programmable logic device generates its own allowed restart security code based on its allowed restart count and obtains the number of pulses of the first drive signal within a preset time period and sends it to the first CPU; The first CPU verifies the allowed restart count security code of the first programmable logic device and the pulse count of the first drive signal. After the verification is passed, the first CPU generates a first dynamic system verification word based on its own allowed restart count security code and dynamic compensation value and sends it to the first programmable logic device. The first programmable logic device verifies the first dynamic system verification word and generates the first drive signal after the verification is passed, and sends it to the communication module; The step of generating the second drive signal in the second processing channel includes: The second programmable logic device generates its own allowed restart security code based on its allowed restart count and obtains the number of pulses of the second drive signal within a preset time period and sends it to the second CPU; The second CPU verifies the allowed restart count security code of the second programmable logic device and the pulse count of the second drive signal. After the verification is passed, the second CPU generates a second dynamic system verification word based on its own allowed restart count security code and dynamic compensation value and sends it to the first programmable logic device. The second programmable logic device verifies the second dynamic system verification word and generates the second drive signal after the verification is passed, and sends it to the communication module.

10. The method of using the rail transit control equipment as described in claim 9, characterized in that, The dynamic compensation value includes a specific compensation value, a first regular compensation value, and a second regular compensation value; The first CPU generates the first dynamic system verification word based on its own allowed restart count security code and the specific compensation value, and sends it to the first programmable logic device. The first programmable logic device verifies the first dynamic system verification word received for the first time and decrements its own allowed restart count by 1 after the verification is passed. The first programmable logic device also sends its new allowed restart count security code and the number of pulses of the first drive signal within the preset time period to the first CPU. The first CPU verifies the new allowed restart count security code of the first programmable logic device and the number of pulses of the first drive signal within the preset time period. After the verification is passed, the first CPU generates the first dynamic system verification word based on its own allowed restart count security code and the first conventional compensation value and sends it to the first programmable logic device. The first programmable logic device verifies the first dynamic system verification word received for the second time, and after the verification is successful, it increments its own allowed restart count by 1. The first programmable logic device also sends its new allowed restart count security code and the number of pulses of the first drive signal within the preset time period to the first CPU. The first CPU verifies the new allowed restart count security code of the first programmable logic device and the number of pulses of the first drive signal within the preset time period. After the verification is passed, the first CPU generates the first dynamic system verification word based on its own allowed restart count security code and the second conventional compensation value and sends it to the first programmable logic device. The first programmable logic device verifies the first dynamic system verification word received for the third time and keeps its allowed restart count unchanged after the verification is passed. The first programmable logic device also sends its own allowed restart count security code and the number of pulses of the first drive signal within the preset time period to the first CPU. The first CPU verifies the allowable restart count security code of the first programmable logic device and the number of pulses of the first drive signal within the preset time period. After the verification is passed, the first CPU generates the first dynamic system verification word based on its own allowable restart count security code and the alternating first and second conventional compensation values ​​and sends it to the first programmable logic device. The first programmable logic device verifies the first dynamic system verification word received after the third time, and generates the first drive signal and sends it to the first CPU after the verification is passed.

11. The method of using the rail transit control equipment as described in claim 10, characterized in that, The second CPU generates the second dynamic system verification word based on its own allowed restart count security code and the specific compensation value, and sends it to the second programmable logic device; The second programmable logic device verifies the second dynamic system verification word received for the first time, and after the verification is passed, it decrements its own allowed restart count by 1. The second programmable logic device also sends its new allowed restart count security code and the number of pulses of the second drive signal within the preset time period to the second CPU. The second CPU verifies the new allowed restart count security code of the second programmable logic device and the number of pulses of the second drive signal within the preset time period. After the verification is passed, the second CPU generates the second dynamic system verification word based on its own allowed restart count security code and the first conventional compensation value and sends it to the second programmable logic device. The second programmable logic device verifies the second dynamic system verification word received for the second time, and after the verification is successful, it increments its own allowed restart count by 1. The second programmable logic device also sends its new allowed restart count security code and the number of pulses of the second drive signal within the preset time period to the second CPU. The second CPU verifies the new allowed restart count security code of the second programmable logic device and the number of pulses of the second drive signal within the preset time period. After the verification is passed, the second CPU generates the second dynamic system verification word based on its own allowed restart count security code and the second conventional compensation value and sends it to the second programmable logic device. The second programmable logic device verifies the second dynamic system verification word received for the third time and keeps its allowed restart count unchanged after the verification is passed. The second programmable logic device also sends its own allowed restart count security code and the number of pulses of the second drive signal within the preset time period to the second CPU. The second CPU verifies the allowable restart count security code of the second programmable logic device and the number of pulses of the second drive signal within the preset time period. After the verification is passed, the second CPU generates the second dynamic system verification word based on its own allowable restart count security code and the alternating first and second conventional compensation values ​​and sends it to the second programmable logic device. The second programmable logic device verifies the second dynamic system verification word received after the third time, and generates the second drive signal after the verification is passed and sends it to the second CPU.

12. The method of using the rail transit control equipment as described in claim 11, characterized in that, The conditions under which the verification of the first dynamic system passes include: The first dynamic system verification word received by the first programmable logic device for the first time is the first specific system verification word; The first dynamic system verification word received by the first programmable logic device for the second time is the first conventional system verification word; The first dynamic system verification word received by the first programmable logic device for the third time is the second conventional system verification word; The first dynamic system check word received by the first programmable logic device after the third time alternates between the first conventional system check word and the second conventional system check word; The conditions for the second dynamic system to pass the verification of the character include: The second dynamic system verification word received by the second programmable logic device for the first time is the second specific system verification word; The second dynamic system verification word received by the second programmable logic device for the second time is the third conventional system verification word; The second dynamic system verification word received by the second programmable logic device for the third time is the fourth conventional system verification word; The second dynamic system check word received by the second programmable logic device after the third time alternates between the third conventional system check word and the fourth conventional system check word.

13. The method of using the rail transit control equipment as described in claim 11, characterized in that, The conditions under which the pulse count verification of the first drive signal passes include: the first programmable logic device does not send the first drive signal to the communication module, and the pulse count of the first drive signal is 0 within the preset time period; or the first programmable logic device sends the first drive signal to the communication module, and the pulse count of the first drive signal is a preset value within the preset time period. The conditions for passing the pulse count verification of the second drive signal include: the second programmable logic device does not send the second drive signal to the communication module, and the pulse count of the second drive signal is 0 within the preset time period; the second programmable logic device sends the second drive signal to the communication module, and the pulse count of the second drive signal within the preset time period is the preset value.

14. The method of using the rail transit control equipment as described in claim 12, characterized in that, The conditions under which the security code verification of the allowed number of restarts of the first programmable logic device passes include: The security codes for the allowed number of restarts of the first programmable logic device are all valid values; Upon receiving the first specific system verification word sent by the first CPU, the allowed number of restarts for the first programmable logic device is reduced by 1; Upon receiving the first first conventional system verification word sent by the first CPU, the allowed restart count of the first programmable logic device is incremented by 1; When receiving the alternating first conventional system verification word and second conventional system verification word sent by the first CPU, the number of allowed restarts of the first programmable logic device remains unchanged; The conditions under which the security code verification for the allowed number of restarts of the second programmable logic device passes include: The security codes for the allowed number of restarts of the second programmable logic device are all valid values; Upon receiving the second specific system verification word sent by the second CPU, the allowed number of restarts for the second programmable logic device is reduced by 1; Upon receiving the first third conventional system verification word sent by the second CPU, the allowed restart count of the second programmable logic device is incremented by 1; When the second programmable logic device receives the alternating third and fourth conventional system verification words sent by the second CPU, the number of allowed restarts remains unchanged.

Images