Safety computing platform and method for driving based on train perception sensors

Abstract

The present invention provides a safe computing platform and method for train driving based on train perception sensors. The safe computing platform includes a perception processing unit and an overspeed protection processing unit. The perception processing unit includes a network card, a safety computing card, and a high-computing power computing card. There are two network cards, including a first network card and a second network card, which interconnect and communicate with the safety computing card and the high-computing power computing card. There are four safety computing cards, divided into two systems, each implementing a two-out-of-two architecture. The high-computing power computing card and the safety computing card interconnect and communicate through the network cards. The overspeed protection processing unit and the perception processing unit interconnect and communicate through two network cards for train speed measurement and overspeed protection. This technical solution can detect obstacles such as vehicles, personnel, and foreign objects on the track ahead of the train, identify traffic signs, and autonomously locate the train, measure speed, and prevent collisions, thereby improving the unmanned level of the urban rail transit system and achieving fully autonomous driving.

Description

Technical Field

[0001] Embodiments of the present invention generally relate to the technical field of unmanned train operation, and more specifically, to a safe computing platform and method for train operation based on train perception sensors. Background Art

[0002] Unmanned urban rail transit systems represent the most advanced technology in rail transit modernization. Train operation control in unmanned systems is a complex system engineering project involving the coordinated efforts of multiple disciplines, including vehicles, signaling, communications, platform screen doors, CCTV, integrated dispatching, power supply, and vehicle bases. This places high demands on the safety, reliability, and availability of every aspect of the system.

[0003] Currently, autonomous driving technology has been gradually upgraded from GOA3 to GOA4. This gradual progression in autonomous driving levels reflects the gradual elimination of the human factor, with train line operations gradually being taken over by technology and equipment. GoA4, also known as fully autonomous driving mode, abbreviated as UTO (Unattended Train Operation), offers greater operational flexibility and more efficient system resource scheduling, enabling flexible response to operational peaks and valleys, system emergencies, and other scheduling issues.

[0004] In unmanned operation scenarios, vehicles already have automatic wake-up, vehicle inspection, and driving scheduling functions. These vehicles can replace all routine driving operations previously performed by drivers, from morning departures to nighttime arrivals. Current technology focuses primarily on unmanned operations in routine operation scenarios, but human intervention is still often required in emergency situations such as encountering obstacles or ground equipment failures. The challenge is to enhance vehicle independence, enabling vehicles to make autonomous judgments and recognize operational scenarios like humans, enabling autonomous driving without external human intervention. This significantly reduces labor costs and training investment, improves line efficiency through automated systems, and enhances vehicle reusability and flexibility. The same number of vehicles can provide greater transport capacity, reducing operating costs. Summary of the Invention

[0005] According to an embodiment of the present invention, a safe computing platform and method based on train perception sensor driving are provided to improve target detection accuracy and system reliability, thereby enhancing the unmanned level of urban rail transit systems.

[0006] In a first aspect of the present invention, a secure computing platform for train operation based on train perception sensors is provided. The secure computing platform comprises:

[0007] Perception processing unit and overspeed protection processing unit, wherein,

[0008] The perception processing unit is used to receive and process information from the perception sensor, including:

[0009] Network cards, secure computing cards, and high-computing-power computing cards;

[0010] There are two network cards, including a first network card and a second network card that are redundant with each other, for receiving information from the sensing sensor and interconnecting and communicating with the secure computing card and the high computing power computing card;

[0011] There are four secure computing cards, divided into two series, each implementing a two-out-of-two architecture. The secure computing cards in the same series are interconnected and communicate with each other to process the information from the sensor, obtain the calculation and recognition results, and send them to the high-computing-power computing card;

[0012] There is one high-computing-power computing card, which communicates with the safety computing card through the network card, and is used to receive the calculation and recognition results of the safety computing card and generate driving instructions;

[0013] The overspeed protection processing unit and the perception processing unit are interconnected and communicated with each other through the two network cards, and are used to receive the driving instructions, train speed measurement and overspeed protection from the perception processing unit.

[0014] According to the above aspects and any possible implementation, a further implementation is provided, wherein the secure computing card is a series A secure computing card A1 or A2, which is used for traffic sign recognition.

[0015] The other is the B-series safety computing cards B1 and B2, which are used for obstacle detection;

[0016] The high-computing-power computing card is used to construct an electronic map of the track line and locate the train.

[0017] According to the above aspects and any possible implementation, an implementation is further provided, wherein the overspeed protection processing unit includes two ITP speed measuring units, a first ITP speed measuring unit and a second ITP speed measuring unit.

[0018] The first ITP speed measuring unit and the second ITP speed measuring unit are interconnected and communicated with the B-series safety computing cards B1 and B2 respectively, and send train speed information to the B-series safety computing cards B1 and B2.

[0019] The B-series safety calculation cards B1 and B2 respectively compare the train speed information of the first ITP speed measuring unit and the train speed information of the second ITP speed measuring unit. When the comparison results are the same, the safety calculation cards B1 and B2 calculate the distance of the obstacle relative to the train based on the train speed information.

[0020] According to the above aspects and any possible implementation, an implementation is further provided, wherein the first ITP speed measurement unit or the second ITP speed measurement unit is interconnected and communicated with the high computing power computing card,

[0021] The high computing power computing card obtains the train speed information transmitted by the first ITP speed measuring unit or the second ITP speed measuring unit, and obtains the compared train speed information transmitted by the B series safety computing card, and compares the two pieces of information.

[0022] According to the above aspects and any possible implementation, there is further provided an implementation, wherein the perception sensor includes a first perception sensor group and a second perception sensor group.

[0023] The first perception sensor group and the second perception sensor group form a redundant architecture. The first perception sensor group is connected to the first network card, and the second perception sensor group is connected to the second network card.

[0024] According to the above aspects and any possible implementation, a further implementation is provided, wherein the perception processing unit further includes a backplane,

[0025] The first network card and the second network card are connected to the backplane respectively, and the secure computing card and the high computing power computing card are connected to the first network card and the second network card through the backplane.

[0026] Furthermore, the secure computing card is connected to another secure computing card of the same series via the backplane.

[0027] According to the aspects described above and any possible implementation method, a further implementation method is provided, wherein the perception processing unit also includes a panel, and the high-computing-power computing card is connected to the panel.

[0028] According to the aspects described above and any possible implementation method, an implementation method is further provided, in which the secure computing platform includes two identical perception processing units, and a two-by-two-to-two architecture is formed between the corresponding secure computing card and the high-computing-power computing card.

[0029] In a second aspect of the present invention, a safety computing method for train driving based on train perception sensors is provided, using the above-mentioned safety computing platform, comprising:

[0030] The first network card and the second network card of the perception processing unit receive information from the first perception sensor group and the second perception sensor group respectively, and send the information to the A series and B series security computing cards and the high computing power computing card;

[0031] A series safety computing cards A1 and A2 calculate and identify traffic signs and compare them to obtain traffic sign information.

[0032] The B-series safety computing cards B1 and B2 also receive and compare the train speed information from the first ITP speed measuring unit and the second ITP speed measuring unit respectively. When the comparison results are the same, they calculate and identify obstacles and compare them to obtain obstacle information.

[0033] The high-computing-power computing card receives the traffic sign information transmitted by the A-series safety computing card and the obstacle information transmitted by the B-series safety computing card through the first network card and / or the second network card. The high-computing-power computing card constructs an electronic map of the track line based on the traffic sign information and the obstacle information, obtains train positioning information, generates driving instructions, and sends the train positioning information, traffic sign information, and obstacle information to the overspeed protection processing unit through the first network card and / or the second network card.

[0034] According to the above aspects and any possible implementation, there is further provided an implementation, further comprising:

[0035] The high computing power computing card obtains the train speed information transmitted by the first ITP speed measuring unit or the second ITP speed measuring unit, and obtains the compared train speed information transmitted by the B series safety computing card, and compares the two pieces of information;

[0036] When the comparison result is the same, an electronic map of the track line is constructed based on the traffic sign information and obstacle information, the train positioning information is obtained, the traffic signs and whether there are obstacles are determined, and the train positioning information, traffic sign information and obstacle information are sent to the overspeed protection processing unit.

[0037] The perception processing unit, which includes a network card, a security computing card, and a high-computing power computing card, logically processes information acquired by the perception sensors. The security computing card processes the information from the perception sensors, and the high-computing power computing card further generates driving instructions based on the perception sensors. The overspeed protection processing unit implements overspeed protection, thus achieving autonomous driving.

[0038] The security computing platform of the present invention runs an environmental perception algorithm, builds an electronic map of the route, and judges the driving and approach paths. Through the integrated obstacle recognition technology of binocular vision and laser radar and other multi-source information fusion, the optimal environmental perception structure is designed to realize the detection of vehicles, people, foreign objects and other obstacles on the track ahead of the train, traffic sign recognition, train autonomous positioning, speed measurement and collision avoidance, and realize a two-out-of-two architecture to improve the target detection accuracy and system reliability, thereby improving the unmanned level of the urban rail transportation system, eliminating the potential accidents caused by human factors and other uncertain factors that affect the safety and reliability of urban rail vehicle operation, and realizing fully autonomous driving.

[0039] When the platform detects an obstacle, it can automatically initiate the vehicle's emergency braking, thereby significantly improving the train's operational safety and efficiency. In a fully automatic scenario, it can realize the function of autonomous driving based on perception sensing, and apply a secure computing platform to fully realize unmanned operation scenarios.

[0040] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0042] Figure 1 A connection diagram of a secure computing platform provided by an embodiment of the present invention is shown;

[0043] Figure 2 A schematic structural diagram of a secure computing platform provided by an embodiment of the present invention is shown;

[0044] Figure 3 A system block diagram of a secure computing platform host architecture provided by an embodiment of the present invention is shown;

[0045] Figure 4 A typical system composition diagram of a secure computing platform host in an actual scenario provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0046] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] In this document, the term "and / or" simply describes a relationship between related objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0048] The embodiments of the present invention provide a safe computing platform and method for driving based on train perception sensors, which realize the function of autonomous driving based on perception sensing in a fully automatic scenario, and apply the safe computing platform to fully realize the unmanned driving operation scenario.

[0049] Refer to the following Figures 1 to 4 The present invention provides a safety computing platform and method for train driving based on train perception sensors.

[0050] like Figure 1 As shown, it is a connection diagram of the secure computing platform provided by an embodiment of the present invention; Figure 2 As shown, it is a structural diagram of the safety computing platform provided by the embodiment of the present invention. The safety computing platform 100 of the embodiment of the present invention includes: a perception processing unit 110 and an overspeed protection processing unit 120. Among them, the perception processing unit 110 is used to receive and process information from each external perception sensor 200, and the overspeed protection processing unit 120 is used for train speed measurement and overspeed protection. The perception processing unit 110 obtains a perception processing result after computing the information received from the perception sensor 200, including train positioning information, traffic sign information, obstacle information and driving instructions, etc. The perception processing unit 110 outputs the perception processing result to the overspeed protection processing unit 120, and the overspeed protection processing unit 120 performs overspeed protection control of the train based on the perception processing result.

[0051] The perception sensor 200 includes a first perception sensor group 210 and a second perception sensor group 220. The first perception sensor group 210 and the second perception sensor group 220 form a redundant architecture, and each includes a laser radar and / or a camera and / or a millimeter-wave radar and / or an ultrasonic radar, etc. Among these sensors, the laser radar has the highest reliability and detection accuracy, and is therefore used as the main sensor for the obstacle detection solution; the camera can be used to determine the traffic signs in front of the train through image recognition, and the image in front of the train can be identified. Therefore, in this embodiment, the perception sensor 200 includes a laser radar and a camera, the first perception sensor group 210 includes a first laser radar and a first camera, and the second perception sensor group 220 includes a second laser radar and a second camera. In addition, in some embodiments, more than two laser radars can be provided. The perception sensor 200 is responsible for sensing the environment ahead of the train. LiDAR scans acquire three-dimensional point cloud information ahead of the train, while cameras capture two-dimensional plane information ahead of the train. This environmental perception information acquired by the perception sensor 200 is transmitted to the secure computing platform 100. After processing by the perception processing unit 110 of the secure computing platform 100, the current perception processing result is obtained. The secure computing platform 100 controls the vehicle's actuators to drive the train based on the current perception processing result. Furthermore, the perception sensor 200 is fixed at a fixed angle relative to the train. By detecting changes in the perception sensor's angular position, information about the train's posture can be obtained.

[0052] Thus, the addition of sensory sensors 200 provides the vehicle with multiple "eyes" for driving. The information acquired by these sensors also requires the "brain" of the secure computing platform 100 to perform logical processing. The train uses sensory sensors 200 to obtain track conditions, combines this information with the various sensory sensors 200, and performs calculations on the secure computing platform 100 to determine the current driving instructions. The secure computing platform 100 then controls the vehicle's actuators to execute these instructions, achieving fully autonomous driving.

[0053] like Figure 3 As shown, it is a block diagram of the host architecture system of a secure computing platform provided by an embodiment of the present invention; Figure 4 Figure 2 shows a typical system configuration diagram for a secure computing platform host in a practical scenario, according to an embodiment of the present invention. Based on secure computing platform 100, embodiments of the present invention also provide a secure computing platform system, comprising: secure computing platform 100 and range extender box 300. Secure computing platform 100 is responsible for data access and processing from various external sensors, as well as data exchange with the vehicle control center. Range extender box 300 is a power supply and network enhancement module required to adapt to different vehicle installation environments when the sensor 200 is installed too far from the secure computing platform host.

[0054] The hardware design of the secure computing platform 100 meets the requirements of EN-50129 SIL4. The architecture is a two-by-two hardware platform. The two computing channels of the two-by-two architecture use the same hardware design. The two systems of the two-by-two architecture also use the same hardware design. The perception processing unit 110 of any system in the two-by-two architecture is as follows: Figure 3 、 4 shown.

[0055] The host hardware of the perception processing unit 110 of the secure computing platform 100 includes a network card 111, a secure computing card 112, a high-computing power computing card 113, a backplane, and a front panel. The network cards 111 are two, a first network card and a second network card, which are redundant and are used to receive information from the perception sensors 200 and communicate with the secure computing card 112 and the high-computing power computing card 113. The secure computing card 112 and the high-computing power computing card 113 are used to process the information from the perception sensors 200. There are four safety computing cards 112, divided into two series. Series A safety computing cards A1 and A2 are used for traffic sign recognition, while series B safety computing cards B1 and B2 are used for obstacle detection. Both series A and B safety computing cards implement a two-out-of-two architecture. The safety computing cards 112 within the same series communicate and work collaboratively. Only when the calculation results of two safety computing cards 112 are identical is the system considered normal and the two safety computing cards 112 within the same series output their results. If the calculation results are different, the system is considered faulty, ensuring detection accuracy and platform security and reliability. There is one high-computing-power computing card 113, which communicates with the safety computing cards 112 via the network card 111. It is used to run big data algorithms, construct electronic maps of track routes, locate trains, and generate driving instructions based on sensor perception. This improves the unmanned operation of urban rail transit systems, eliminates potential accidents caused by human factors and other uncertainties that impact the safety and reliability of urban rail vehicle operations, and achieves fully autonomous operation. The secure computing card 112 and the high computing power computing card 113 are connected to the first network card and the second network card, and are connected to the blue network and the red network to form network redundancy.

[0056] The overspeed protection processing unit 120 of the secure computing platform 100 is interconnected and communicates with the perception processing unit 110 via the ITP interfaces respectively provided on the first network card and the second network card, and is used for train speed measurement and overspeed protection. The overspeed protection processing unit 120 can be provided based on an existing ITP (Intelligent Train Protection) system or an ATP (Automatic Train Protection) system. In this embodiment, the overspeed protection processing unit 120 is provided with two ITP speed measurement units 121, a first ITP speed measurement unit and a second ITP speed measurement unit. The first ITP speed measurement unit and the second ITP speed measurement unit are provided with a speed sensor and an acceleration sensor for obtaining train speed information and sending it to the perception processing unit 110. Other specific functional modules of the overspeed protection processing unit 120 can adopt the existing setting method and are not limited in this embodiment.

[0057] Specifically, the two network cards 111, the first network card and the second network card, form network redundancy to ensure data security and reliability. A single network card provides three 1000M / 100M adaptive Ethernet interfaces to the backplane, two of which are camera and lidar sensor interfaces, and the other one is used for host backplane interconnection. The backplane and the first network card and the second network card respectively provide five 1000M Ethernet interfaces, one for connecting to a high-computing power computing card and four for connecting to a security computing card. The MCU communicates with the two switching ICs via SPI to configure and manage the switching ICs. The MCU also extends an isolated RS485 to communicate with other boards in the perception processing unit 110 host.

[0058] Thus, the first network card is connected to the first perception sensor group 210, and the second network card is connected to the second perception sensor group 220. The first and second laser radars communicate with the perception processing unit 110 via 100M / 1000M Ethernet, and the first and second cameras communicate with the perception processing unit 110 via GigE. The first and second perception sensor groups 210, 220 are connected and communicate with the first and second network cards, transmitting information from the perception sensor laser radars and cameras to the security computing card 112 and high-computing power computing card 113 of the perception processing unit 200, forming a redundant architecture to ensure the accuracy and reliability of perception information collection.

[0059] A host computer includes four security computing cards: A1 and A2 for the A-series security computing cards, and B1 and B2 for the B-series security computing cards. One security computing card 112 provides three independent Gigabit Ethernet interfaces, two of which are connected to the first and second network cards, respectively, via the backplane. These interfaces communicate with the high-computing-power computing card 113 and the sensor 200 via Gigabit Ethernet. The remaining Ethernet interface is interconnected on the backplane with another security computing card 112 from the same series, enabling Gigabit Ethernet communication between the two security computing cards 112. Furthermore, an isolated CAN interface is reserved and connected to the backplane CAN bus, connecting to another security computing card and the high-computing-power computing card. This serves as a backup, enabling the CAN interface to transmit information in the event of an Ethernet transmission failure.

[0060] The safety computing cards A1, A2, B1 and B2 receive the laser radar and camera perception information collected by the first perception sensor group 210 and the second perception sensor group 220 from the first network card and the second network card. The two safety computing cards A1 and A2, and B1 and B2 in the same system proofread the received information according to the preset protocol. When the proofread result of the received information is normal, the next step of calculation processing is performed.

[0061] The A-series Safety Computing Card is used to identify traffic signs, specifically traffic lights in this embodiment. Information from the perception sensor 200 can be processed using existing camera image recognition technology, LiDAR ranging technology, dual LiDAR, and binocular vision fusion technology to identify information such as the distance and status of the traffic light ahead of the vehicle. For example, the A-series Safety Computing Card processes camera information to identify the traffic light ahead of the vehicle. The information processing method for the perception sensor 200 is not specifically limited herein.

[0062] The B-series Safety Computing Card is used to identify obstacles and detect vehicles, people, and foreign objects on the track. Information from the perception sensor 200 can be processed using existing camera image recognition technology, LiDAR ranging technology, or dual LiDAR and binocular vision fusion technology to identify information such as the distance and size of obstacles ahead of the vehicle. For example, the B-series Safety Computing Card processes LiDAR information to identify obstacles. The information processing method for the perception sensor 200 is not specifically limited herein.

[0063] In addition, the two ITP speed measuring units 121 of the overspeed protection processing unit 120, the first ITP speed measuring unit and the second ITP speed measuring unit, are respectively connected to the B-series safety computing cards B1 and B2 via the field bus RS485 to achieve interconnected communication, and send train speed information to the B-series safety computing cards B1 and B2 respectively. The B-series safety computing cards B1 and B2 compare the train speed information of the first ITP speed measuring unit with the train speed information of the second ITP speed measuring unit. When the comparison results are the same, the safety computing cards B1 and B2 calculate and identify obstacles based on the train speed information, lidar information and / or camera information. Therefore, on the one hand, the accuracy of obstacle detection is ensured. On the other hand, before calculating and identifying the obstacle, the train speed information of the first ITP speed measuring unit and the train speed information of the second ITP speed measuring unit are compared, thereby supervising the train speed information collected by the first and second ITP speed measuring units and ensuring data security and reliability.

[0064] For obstacle identification, based on the principle of laser radar ranging, the time it takes for the laser radar to transmit and receive the returned laser beam varies at different train speeds. Therefore, safety computing cards B1 and B2 need to obtain train speed information. Based on the train speed information, the three-dimensional point cloud information of the laser radar, the time it takes for the laser radar to receive the laser beam returned from the obstacle, and the two-dimensional plane information of the camera, the distance of the obstacle relative to the train at the current real-time train speed is calculated.

[0065] Thus, the A-series safety computing cards A1 and A2 obtain traffic sign information based on the information from the perception sensor 200; the B-series safety computing cards B1 and B2 obtain obstacle information based on the information from the perception sensor 200 and the train speed information from the ITP speed measurement unit 121. The two systems implement different functions respectively.

[0066] Furthermore, the security computing cards 112 within the same system communicate with each other, sending calculation results and comparing data to implement a two-out-of-two operation. Specifically, security computing card A1 in system A sends its calculation results to security computing card A2, which in turn sends its calculation results to security computing card A1. This means that A1 and A2 mutually receive the traffic sign information results calculated by the other party. The calculation results are sent via the first network card and / or the second network card, and a two-out-of-two logical comparison operation is performed. Only when the traffic sign information is identical do security computing cards A1 and A2 output the calculation results. Security computing card B1 in system B sends its calculation results to security computing card B2, which in turn sends its calculation results to security computing card B1. This means that B1 and B2 mutually receive the obstacle information results calculated by the other party. The calculation results are sent via the first network card and / or the second network card, and a two-out-of-two logical comparison operation is performed. Only when the calculation results are identical do security computing cards B1 and B2 output the calculation results, ensuring data security and integrity.

[0067] Any secure computing card 112 in the same series can safely shut down the intranet Gigabit network communication of the two-out-of-two dual-machine through the secure shutdown circuit. That is, when any secure computing card 112 detects that the two-out-of-two results are different or the system fails, all intranet Ethernet outputs of the two secure computing cards 112 can be safely shut down.

[0068] The high-computing power computing card 113, also known as the high-computing power board, has an AGX Xavier module as its core processing unit, with power-on control and temperature management handled by a single-chip microcontroller. The AGX Xavier provides three Gigabit Ethernet ports via one RGMII port and two PCIe ports. Two of these ports are connected to two network boards 111 via the backplane, providing access to the blue and red networks. The high-computing power computing card 113 and the secure computing card 112 communicate with each other via the network board 111, with the remaining port outputted to the front panel.

[0069] The high-computing power computing card 113 is extended with multiple panel interfaces, including an RS422 interface for the panel indicator panel interface, an RS232 interface for the panel GPS interface, and a CAN interface for the panel millimeter-wave radar interface. This enables communication between external devices connected through the panel extension and the high-computing power computing card 113. Furthermore, the high-computing power computing card 113 can connect and communicate with GNSS (GPS) and / or millimeter-wave radar and / or inertial navigation sensors to assist or monitor high-precision positioning and speed measurement of trains.

[0070] Safety computing card 112 transmits the traffic sign and obstacle information obtained through the two-by-two calculation to high-computing computing card 113 via the first network card and / or the second network card. High-computing computing card 113 receives the safety computing card 112's calculation and recognition results of the information from the perception sensor 200. Furthermore, the B-series safety computing card transmits the compared train speed information to high-computing computing card 113.

[0071] In addition, the high computing power computing card 113 is connected to one of the two ITP speed measuring units, the first ITP speed measuring unit or the second ITP speed measuring unit, through the field bus RS485 to obtain the train speed information transmitted by the first ITP speed measuring unit or the second ITP speed measuring unit.

[0072] In some embodiments, the high-computing-power computing card 113 pre-generates an electronic map of the track line based on the three-dimensional point cloud data of the lidar of the perception sensor, the camera image information and / or the recognition results calculated by the security computing card 112, the train speed information and the GNSS and / or millimeter-wave radar and / or inertial navigation sensor information, runs the entire track line through multiple learning cycles in advance, and stores the electronic map of the line in the high-computing-power computing card 113.

[0073] During train operation, the high-computing power computing card 113 acquires train speed information transmitted by the first or second ITP speed measuring unit, and obtains train speed information transmitted by the B-series safety computing card after comparison. The card then compares the two pieces of information and performs a two-out-of-two logic operation. If the comparison results of the two train speed information are identical, the high-computing power computing card 113 proceeds to the next step of calculation, ensuring data security and reliability.

[0074] The high-computing-power computing card 113 calculates the current route electronic map based on the traffic sign information and obstacle information, and calculates the real-time high-precision positioning information of the train in combination with the positioning of the GNSS / inertial navigation sensor; retrieves the corresponding pre-stored route electronic map based on the high-precision positioning information, compares the current route electronic map with the pre-stored route electronic map, and determines whether there are obstacles; the high-computing-power computing card 113 calculates and determines the traffic signs; combines the obstacles, traffic signs, and train speed information obtained after the judgment, determines the driving and approach paths, and calculates and generates driving instructions related to obstacles and traffic signs based on the perception sensors.

[0075] During operation, the high-computing power computing card 113 runs environmental perception algorithms to construct an electronic map of the route. Based on this real-time electronic map, high-precision real-time train positioning information is obtained. By integrating obstacle recognition technology that integrates binocular vision and multi-source information such as lidar, an optimal environmental perception structure is designed to improve target detection accuracy and platform reliability, thereby enhancing the safety and reliability of autonomous train operation.

[0076] Furthermore, the high computing power calculation card 113 transmits the obstacle information, traffic sign information, train positioning information, and driving instructions to the overspeed protection processing unit 120 through the first network card and the second network card.

[0077] like Figure 3 、 4 As shown, the ITP interface is an Ethernet interface, and the high computing power computing card 113 communicates with the overspeed protection processing unit 120 via Ethernet through the first network card and the second network card.

[0078] In addition, AGX Xavier extends an isolated CAN interface through the isolation interface chip to the backplane CAN bus, which is used as a backup. When Ethernet transmission fails, the CAN interface is enabled to communicate with the secure computing card to transmit information.

[0079] In addition, the USB interface and HDMI interface are extended and output to the panel after protection. The board integrates 2-way M.2 hard disk expansion and 2-way 4G slots or 5G slots. The high-computing power computing card 113 assists in positioning after the vehicle is downgraded through wireless communications such as 4G, 5G, and WIFI.

[0080] The sensor processing unit 110 host also includes a power supply card to power the various internal boards and external sensors. Each sensor processing unit 110 includes two power supply cards for power redundancy. A single power supply card has a DC110V input on the front panel and dual DC12V / 150W outputs. Power is then output to the backplane and front panel through ideal diodes to power other plug-in cards and sensors. Ideal diodes have the advantages of ultra-low voltage drop and low heat generation, and they prevent current backflow. The output power of the two power supply cards is combined through the ideal diodes to provide redundant power for the entire system.

[0081] The backplane interconnects the various slots. The two Ethernet interfaces of each safety computing card 112 are connected to the two network cards 111, and the two Ethernet interfaces of the high-computing-power computing card 113 are connected to the two network cards 111. This allows Ethernet communication between the safety computing card 112, the high-computing-power computing card 113, and the two network cards 111. The backplane also directly interconnects the Ethernet communication interfaces of two safety computing cards 112 in the same system. The backplane connects the CAN interfaces of the safety computing card 112 and the high-computing-power computing card 113 to the same bus. Furthermore, each slot on the backplane is equipped with an ID pin, allowing the card to determine which slot it is currently in when it is inserted into the backplane.

[0082] In addition, in some implementations, the ITP speed measurement unit may also be replaced by a millimeter wave.

[0083] In this embodiment, the perception processing unit 110 implements logical processing of information acquired by the perception sensors through an architecture comprising two network cards 111, four security computing cards 112, and one high-computing power computing card 113. The two network cards 111 receive information from the perception sensors 200, and interconnect communication between the security computing cards 112, the high-computing power computing cards 113, and the overspeed protection processing unit 120. The security computing card 112 is responsible for secure data processing, utilizing a hardware two-out-of-two security architecture to perform two-out-of-two operations on information from the external perception sensors 200. System A is used for traffic sign recognition, and system B is used for obstacle detection. The high-computing power computing card 113 is responsible for achieving high-precision positioning, constructing and generating electronic route maps, running big data algorithms to generate high-precision train positioning information, and obtaining driving instructions based on the perception sensors. The high-computing power computing card 113 outputs the processing results to the overspeed protection processing unit 120 via the network card 111, which then generates the final overspeed protection driving instructions. The safety computing platform 100 controls the vehicle's actuators to achieve autonomous driving according to the driving instructions of the high-computing-power computing card 113 and / or the overspeed protection processing unit 120.

[0084] The secure computing platform 100 is a two-by-two hardware platform. The two systems comprise two identical perception processing units 110 and overspeed protection processing units 120, with corresponding secure computing cards 112 and high-computing power computing cards 113 forming a two-by-two-out-of-two architecture. This active-standby architecture and two-out-of-two logic operations enhance the platform's security and reliability.

[0085] In the secure computing platform system of this embodiment, the range extender box 300 serves as a peripheral device for the secure computing platform 100 and is not required when the distance is short. The perception sensors 200 are typically installed in the driver's cab of the vehicle. To prevent power and signal degradation caused by the sensor 200 being too far from the secure computing platform host, the range extender box 300 is installed between the first and second sensor groups 210, 220, and the perception processing unit 110. The range extender box 300 has an adapter interface that provides power and network access for the perception sensors 200, such as the lidar and camera.

[0086] The data exchange communication of the vehicle control center is realized through the overspeed protection processing unit 120 or the vehicle equipped network.

[0087] In addition, the platform software of the safe computing platform 100 architecture adopts the two-by-two platform software. The two computing channels of the two-by-two adopt the same software, and the two systems of the two-by-two also adopt the same software. All the above software development and design meet the EN-50128 SIL4 level requirements.

[0088] To improve availability, the two-by-two data exchange between the computing cards of the two-by-two system and the data transmission between the two systems of the two-by-two system adopt a secure communication protocol that complies with EN-50159 requirements.

[0089] The platform software supports secure communication encryption protocols and non-secure communication open lines between the host backplane and the internal network boards, which are transmitted through the internal network Gigabit Ethernet and use the UDP protocol at the bottom layer; the platform software supports secure communication and non-secure communication between the host and external devices (forwarded through the communication controller), and the communication between the host board and the communication controller is transmitted through the internal network Gigabit Ethernet and uses the UDP protocol at the bottom layer; the platform software implements voting on the status of the main and standby systems through redundant communication, and does not have a third-party arbitration module.

[0090] The platform software implements system self-tests suitable for the QNX operating system and multi-core CPUs, including at least CPU self-tests, memory self-tests, and supervision of software execution timing and order. Furthermore, the platform software takes into account compatibility with different hardware and operating systems, and can be migrated to new hardware platforms or operating systems with only minor software modifications. Furthermore, the platform software takes into account compatibility with different product applications, and can be compatible with different product applications with minimal modification to the platform software. Remote upgrades of the platform software and data can be achieved through third-party software (sftp server).

[0091] Given that the perception processing unit 110 requires a huge amount of data for image analysis and obstacle recognition, the response processing requires high real-time performance, the demand for the computing power of the secure computing platform 100 is enhanced, the amount of communication data carried is increased, and at the same time, the requirements of the SIL4 level must be met, the functions developed using bare metal SIL4 cannot meet the design requirements of the perception platform.

[0092] This implementation utilizes a microkernel-based embedded security operating system for platform software design. This allows security and non-security functions to run in separate processes within the same compute card's CPU and memory, ensuring full isolation and mutual non-interference. Thanks to the microkernel-based security operating system, BSPs for security functions can be developed using two approaches: security analysis and black-box testing of commercial COTS BSPs; and verification of self-developed or modified BSPs through white-box and black-box testing, in accordance with SIL4-level software development requirements.

[0093] Multi-core CPU self-test technology can create a self-test thread for each CPU core to ensure that self-test covers all cores; it locks the security platform task on a specific CPU core and only performs self-test on that CPU core.

[0094] Adaptive partition scheduling algorithm is used to ensure the response time of the process and maximize the CPU utilization.

[0095] Adopt the control flow supervision method, execute code blocks sequentially, improve the CFCSS algorithm, and achieve 100% detection of control flow jump errors; cooperate with timed interrupts to monitor code timing.

[0096] Analyze the process memory space of the QNX operating system, as shown in the following table:

[0097]

[0098]

[0099] Develop corresponding memory self-test measures for different memory segments.

[0100] Based on the secure computing platform and system described above, an embodiment of the present invention further provides a secure computing method, including:

[0101] The first network card and the second network card of the perception processing unit 110 respectively receive information from the first perception sensor group 210 and the second perception sensor group 220 and send the information to the A series and B series security computing cards and the high computing power computing card 113 of the security computing card 112 .

[0102] The security computing cards and the high computing power computing cards of the A series and the B series calibrate the information of the first sensing sensor group and the second sensing sensor group according to a preset protocol;

[0103] When the verification result is normal, the A series safety computing cards A1 and A2 calculate and identify the traffic sign and compare them to obtain the traffic sign information;

[0104] The B-series safety computing cards B1 and B2 also receive and compare the train speed information from the first ITP speed measuring unit and the second ITP speed measuring unit respectively. When the comparison results are the same, they calculate and identify obstacles and compare them to obtain obstacle information.

[0105] Specifically, the safety computing cards A1 and A2 identify traffic lights based on camera information image recognition or based on the fusion of camera information image recognition and lidar information. After obtaining the calculation results, they obtain the calculation results of another safety computing card 112 of the same system. The safety computing cards A1 and A2 compare and confirm each other's calculation results. When the calculation results of the safety computing cards A1 and A2 are the same, the calculation results are judged to be normal, and the traffic sign information is obtained.

[0106] Safety computing cards B1 and B2 identify obstacles ahead of the vehicle based on lidar information or based on camera information image recognition and lidar information fusion. After obtaining the calculation results, they obtain the calculation results of another safety computing card 112 of the same system. Safety computing cards B1 and B2 compare and confirm each other's calculation results. When the calculation results of safety computing cards B1 and B2 are the same, the calculation results are judged to be normal and obstacle information is obtained.

[0107] The high computing power computing card 113 receives the traffic sign information transmitted by the A series safety computing card and the obstacle information transmitted by the B series safety computing card through the first network card and / or the second network card, constructs an electronic map of the track line based on the traffic sign information and the obstacle information, obtains the train positioning information, and sends the train positioning information, traffic sign information and obstacle information to the overspeed protection processing unit 120 through the first network card and / or the second network card.

[0108] Specifically, the high-computing-power computing card 113 obtains the train speed information transmitted by the first ITP speed measuring unit or the second ITP speed measuring unit, and obtains the train speed information transmitted by the B-series safety computing card after comparison and confirmation, and compares the two pieces of information; when the comparison result is the same, the high-computing-power computing card 113 calculates the current line electronic map based on the traffic sign information and the obstacle information, and calculates the real-time high-precision positioning information of the train based on the positioning of the GNSS / inertial navigation sensor; according to the high-precision positioning information, the corresponding pre-stored line electronic map is retrieved, and the current line electronic map is compared with the pre-stored line electronic map to determine whether there are obstacles; the high-computing-power computing card 113 calculates and determines the traffic signs; based on the obstacles, traffic signs, and train speed information obtained after the judgment, the driving and route paths are judged, and driving instructions related to obstacles and traffic signs based on the perception sensors are calculated and generated.

[0109] By integrating binocular vision with multi-source information fusion such as lidar and obstacle recognition technology, the optimal environmental perception structure is designed to improve target detection accuracy and platform reliability, thereby enhancing the safety and reliability of autonomous train operation.

[0110] Before calculating the train positioning information and driving instructions, the high-computing-power computing card 113 first compares the train speed information of the first ITP speed measuring unit or the second ITP speed measuring unit with the compared train speed information transmitted by the B-series safety computing card. When the comparison results of the two train speed information are the same, the high-computing-power computing card 113 performs the next step of calculation and processing, ensuring the security and reliability of the data.

[0111] The high-computing-power computing card 113 outputs the calculation results to the overspeed protection processing unit 120 through the network card 111 , and the overspeed protection processing unit 120 generates the final overspeed protection driving instruction.

[0112] The high-computing-power computing card 113 and the overspeed protection processing unit 120 can respectively calculate and generate driving instructions and overspeed protection driving instructions related to obstacles and traffic signs based on perception sensors according to actual needs, or under different working conditions, such as when the overspeed protection processing unit 120 fails or the train is degraded, the driving instructions can be calculated as needed to perform driving control.

[0113] When an obstacle is detected on the track ahead of the train, the high-computing-power computing card 113 outputs obstacle information, warning information, and / or driving instructions to the overspeed protection processing unit 120 in advance. The overspeed protection processing unit 120 controls the speed of the train based on the above information, or immediately implements emergency braking and other controls. When a traffic sign on the track ahead of the train is detected and identified, the high-computing-power computing card 113 outputs traffic sign information to the overspeed protection processing unit 120 in advance. The overspeed protection processing unit 120 controls the speed of the train based on the above information, or immediately implements emergency braking and other controls, thereby achieving autonomous driving, improving the unmanned level of the urban rail transit system, and eliminating the potential safety and reliability of urban rail vehicle operation caused by human factors and other uncertain factors.

[0114] Therefore, the flow and processing of information from sensor 200 is based on the secure computing platform and method described above, enabling autonomous driving. Autonomous driving requires the following: high-precision positioning, generating an electronic route map, and implementing track detection; obstacle detection through track detection; monitoring and comparing high-precision positioning with vehicle speed, position, and posture; and image recognition to identify and identify traffic signs ahead.

[0115] In this embodiment, the safety computing platform 100 includes a perception processing unit 110 and an overspeed protection processing unit 120, which can detect the clearance distance of the train and can detect obstacles such as vehicles, personnel, foreign objects, etc. on the track in front of the train. The maximum detection distance exceeds 300 meters. After detecting an obstacle, the safety computing platform 100 can automatically start the emergency braking of the vehicle, thereby significantly improving the operational safety and efficiency of the train. It has three core functions: autonomous positioning, speed measurement, and collision avoidance, ensuring that data can be collected safely and correctly, and after logical operations and analysis, the control commands can be correctly output. At the same time, according to the fault safety principle, a safety guarantee function can be made when a fault that affects the safety of the product occurs. The data processing of the perception sensor 200 and the application calculation of the perception algorithm reach the SIL4 level, ensuring that the perception safety computing platform system reaches the overall goal of SIL4.

[0116] The secure computing platform 100 makes full use of the certified functions and modules of the secure operating system QNX, encapsulating the secure operating system into a secure application subset that meets the requirements of EN-50128. It provides application software development with the ability to use operating environment perception algorithms, build electronic route maps, and make driving and route path judgments. Through obstacle recognition technology that integrates multi-source information fusion such as binocular vision and lidar, it designs the optimal environmental perception structure, improves target detection accuracy and system reliability, and provides the perception sensor 200 with a reliable secure computing system that meets the IEC62267 standard.

[0117] The application of the safe computing platform 100 based on the perception sensor 200 driving, the system technology and the safe computing method can provide the best solution for the construction and reconstruction of new lines in the urban rail transit industry, improve the reusability and flexibility of vehicles, reduce operating costs, and provide important theoretical significance and practical application value for promoting the development of unmanned driving technology for urban rail vehicles in my country.

[0118] In this specification, the terms "connect," "install," and "fix" should be understood broadly. For example, "connect" can refer to a fixed connection, a detachable connection, or an integral connection; it can refer to a direct connection or an indirect connection through an intermediary. Those skilled in the art will understand the specific meanings of these terms in this application based on the specific circumstances.

[0119] It should be noted that for the aforementioned method embodiments, for simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0120] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not limited herein.

[0121] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A safe computing platform based on train perception sensors, characterized in that: include: Perception processing unit and overspeed protection processing unit, wherein, The perception processing unit is used to receive and process information from the perception sensor, including: Network cards, secure computing cards, and high-computing-power computing cards; There are two network cards, including a first network card and a second network card that are redundant with each other, for receiving information from the sensing sensor and interconnecting and communicating with the secure computing card and the high computing power computing card; There are four secure computing cards, divided into two series, each implementing a two-out-of-two architecture. The secure computing cards in the same series are interconnected and communicate with each other to process the information from the sensor, obtain the calculation and recognition results, and send them to the high-computing-power computing card; There is one high-computing-power computing card, which communicates with the safety computing card through the network card, and is used to receive the calculation and recognition results of the safety computing card and generate driving instructions; The overspeed protection processing unit and the perception processing unit are interconnected and communicated through the two network cards, and are used to receive the driving instructions and train speed measurement and overspeed protection from the perception processing unit; wherein, The safety computing card series A is the safety computing card series A1 and A2, which are used for traffic sign recognition. The other is the B-series safety computing cards B1 and B2, which are used for obstacle detection; The overspeed protection processing unit includes two ITP speed measuring units, a first ITP speed measuring unit and a second ITP speed measuring unit. The first ITP speed measuring unit is interconnected and communicated with the B-series safety computing card B1, and the second ITP speed measuring unit is interconnected and communicated with the B-series safety computing card B2, and sends train speed information to the B-series safety computing cards B1 and B2. The B-series safety calculation cards B1 and B2 respectively compare the train speed information of the first ITP speed measuring unit and the train speed information of the second ITP speed measuring unit. When the comparison results are the same, the safety calculation cards B1 and B2 calculate the distance of the obstacle relative to the train based on the train speed information.

2. The secure computing platform according to claim 1, wherein: The high-computing-power computing card is used to construct an electronic map of the track line and locate the train.

3. The secure computing platform according to claim 2, wherein: The first ITP speed measuring unit or the second ITP speed measuring unit is interconnected and communicates with the high computing power computing card. The high computing power computing card obtains the train speed information transmitted by the first ITP speed measuring unit or the second ITP speed measuring unit, and obtains the compared train speed information transmitted by the B series safety computing card, and compares the two pieces of information.

4. The secure computing platform according to claim 1, wherein: The sensing sensors include a first sensing sensor group and a second sensing sensor group. The first perception sensor group and the second perception sensor group form a redundant architecture. The first perception sensor group is connected to the first network card, and the second perception sensor group is connected to the second network card.

5. The secure computing platform according to claim 1, wherein: The perception processing unit also includes a backplane, The first network card and the second network card are connected to the backplane respectively, and the secure computing card and the high computing power computing card are connected to the first network card and the second network card through the backplane. Furthermore, the secure computing card is connected to another secure computing card of the same series via the backplane.

6. The secure computing platform according to claim 5, characterized in that: The perception processing unit also includes a panel, and the high-computing-power computing card is connected to the panel.

7. The secure computing platform according to claim 1, wherein: The secure computing platform includes two identical perception processing units, and a two-by-two-take-two architecture is formed between the corresponding secure computing card and the high-computing-power computing card.

8. A safety calculation method for train driving based on train perception sensors, using the safety calculation platform according to any one of claims 1 to 7, characterized in that: include: The first network card and the second network card of the perception processing unit receive information from the first perception sensor group and the second perception sensor group respectively, and send the information to the A series and B series security computing cards and the high computing power computing card; A series safety computing cards A1 and A2 calculate and identify traffic signs and compare them to obtain traffic sign information. The B-series safety computing card B1 receives the train speed information from the first ITP speed measuring unit, and the B-series safety computing card B2 receives the train speed information from the second ITP speed measuring unit. The B-series safety computing cards B1 and B2 also compare the train speed information from the first ITP speed measuring unit and the second ITP speed measuring unit. When the comparison results are the same, the cards identify obstacles and perform a comparison to obtain obstacle information. The high-computing-power computing card receives the traffic sign information transmitted by the A-series safety computing card and the obstacle information transmitted by the B-series safety computing card through the first network card and / or the second network card. The high-computing-power computing card constructs an electronic map of the track line based on the traffic sign information and the obstacle information, obtains the train positioning information, generates driving instructions, and sends the train positioning information, traffic sign information and obstacle information to the overspeed protection processing unit through the first network card and / or the second network card.

9. The secure computing method according to claim 8, wherein: Also includes: The high computing power computing card obtains the train speed information transmitted by the first ITP speed measuring unit or the second ITP speed measuring unit, and obtains the compared train speed information transmitted by the B series safety computing card, and compares the two pieces of information; When the comparison result is the same, an electronic map of the track line is constructed based on the traffic sign information and obstacle information, the train positioning information is obtained, the traffic signs and whether there are obstacles are determined, and the train positioning information, traffic sign information and obstacle information are sent to the overspeed protection processing unit.

Images