Remote Upgrade Method for Train Onboard Software Based on Server Redundancy Backup Strategy

Abstract

The present invention discloses a method for remotely upgrading train onboard software based on a server redundancy backup strategy, which belongs to the field of train onboard software upgrades. The method includes upgrading each system of the train when the train enters a depot state. After the upgrade is successful, the main server and the backup server swap their identities. After the train operates normally for a preset period of time, the main server is allowed to communicate with the backup server, and the contents of the main server's software storage area are all transferred to the backup server. If the upgrade fails, each system is rewritten to the original software version, and the main server and the backup server communicate, and the contents of the main server's software storage area are all transferred to the backup server. The present invention solves the problem of a single onboard server being shut down or losing data due to software or hardware problems during the remote upgrade process of the train, thereby improving the operation and maintenance management capabilities of rail transit vehicles and the stability of remote upgrades.

Description

Technical Field

[0001] The present invention belongs to the field of train on-board software upgrade, and in particular relates to a train on-board software remote upgrade method based on a server redundancy backup strategy. Background Art

[0002] With the rapid development of rail transit vehicles and the continuous improvement of their intelligence, there are more and more on-board systems, and the demand for upgrades is also increasing. At present, the software upgrade of the on-board system is mainly completed by manual operation by operation and maintenance personnel on board the train. At present, research is being conducted on how to remotely upgrade the train system through remote communication technology. Since subway trains are public transportation, the remote upgrade of trains should comprehensively consider safety, convenience, reliability and other aspects. The present invention proposes a remote upgrade method for train on-board software based on a redundant backup strategy, which mainly proposes a safe redundant backup strategy for on-board servers, effectively dealing with the problem of downtime or data loss caused by software and hardware problems in the use of a single on-board server. Summary of the Invention

[0003] In response to the above-mentioned deficiencies in the prior art, the present invention provides a method for remotely upgrading train on-board software based on a server redundant backup strategy, which solves the problem of a single on-board server crashing or losing data due to software or hardware problems during the remote upgrade of the train, thereby improving the operation and maintenance management capabilities of rail transit vehicles and the stability of remote upgrades.

[0004] In order to achieve the above-mentioned purpose, the technical solution adopted by the present invention is: a method for remotely upgrading train onboard software based on a server redundancy backup strategy, comprising the following steps:

[0005] S1, the backup server determines whether the train has completed the pre-preparation. If so, it proceeds to step S2, otherwise, it loops through step S1;

[0006] S2. Confirm with the maintenance personnel whether the upgrade is allowed. If so, the backup server distributes the upgrade software package to each system, causing each system to start the upgrade and feedback the upgrade information to the backup server, and then proceeds to step S3. Otherwise, the upgrade process ends.

[0007] S3. Based on the upgrade information, determine whether all systems have been successfully upgraded. If so, the backup server records the upgrade success information, feeds back the upgrade success information to the ground center, and exchanges identities with the main server, and then proceeds to step S4. Otherwise, the backup server again issues upgrade instructions to each system that failed to upgrade, and then proceeds to step S5.

[0008] S4. After the train runs for a predetermined period of time, determine whether a software compatibility issue occurs. If so, proceed to step S6. Otherwise, complete the upgrade, enable the primary server to communicate with the backup server, and transfer all the contents of the primary server's software storage area to the backup server.

[0009] S5. Determine whether each system is being upgraded for the first time. If so, the backup server issues an upgrade instruction to each system that failed to upgrade, starts the upgrade, and feeds back the upgrade information to the backup server. The process then returns to step S3. Otherwise, the upgrade is stopped, the backup server records a log, and feeds back the upgrade failure information to the ground center. The process then proceeds to step S6.

[0010] S6. The backup server sends the upgrade failure information to the main server, and the main server distributes the original version of the software to each system, so that each system is flashed to the original software version, and the main server and the backup server communicate, and all the contents of the main server software storage area are transferred to the backup server.

[0011] The beneficial effects of the present invention are as follows: the strategy described in the present invention is composed of two completely identical servers, which can prevent a single server from crashing or losing data programs due to software and hardware problems during use, thereby affecting the operation of the entire vehicle; and the two servers can serve as each other's master and backup servers. Both the master server and the backup server can communicate with the ground center through wireless technology, have the same software and hardware configuration, and can communicate with each other at the same time, and communicate with all systems of the train through MVB or Ethernet. Based on the strategy described in the present invention, the latest version of the software sent from the ground and the current software version of the server are backed up, further improving the security of the system.

[0012] Furthermore, the step S1 includes the following steps:

[0013] S101, check whether the train has entered the depot state, if so, proceed to step S102, otherwise, loop step S101;

[0014] S102: The backup server receives the upgrade package from the ground center and uses the MD5 checksum to determine whether the upgrade package is consistent with the upgrade package from the ground center. If so, the upgrade package is stored in the temporary storage area of the backup server and the process proceeds to step S103. Otherwise, the backup server deletes the upgrade package and prompts the ground center to manually upload the package, ending the upgrade process.

[0015] S103. Determine whether the upgrade software package is the latest version. If so, update the latest software package on the backup server to the upgrade software package, so that the train onboard software completes the pre-preparation and enters step S2. Otherwise, feedback is fed back to the ground center that the software package is not the latest software, delete the upgrade software package in the temporary storage area of the backup server, and return to step S101.

[0016] The beneficial effects of the above further scheme are: using MD5 checksum value to confirm that the upgrade software package received by the backup server is consistent with the software package of the ground center, preventing the file from being tampered with and ensuring the security of the system; and adding the latest upgrade software package judgment mechanism to avoid invalid upgrades of the system.

[0017] Furthermore, step S102 includes the following steps:

[0018] S1021. The ground center encrypts the upgrade software package using the MD5 algorithm to obtain a first encrypted software package, and transmits the first encrypted software package to the backup server;

[0019] S1022: The backup server temporarily saves the first encrypted software package and feeds back the received data to the ground center;

[0020] S1023. After receiving the feedback, the ground center sends the upgrade software package to the backup server;

[0021] S1024. Encrypt the upgrade software package using the MD5 algorithm on the backup server to obtain a second encrypted software package.

[0022] S1025. Determine whether the first encryption software package and the second encryption software package are consistent. If so, determine that the upgrade software package of the backup server is consistent with the upgrade software package of the ground center, store the upgrade software package in the temporary storage area of the backup server, and enter step S103. Otherwise, determine that the upgrade software package of the backup server is inconsistent with the upgrade software package of the ground center, delete the first encryption software package, the second encryption software package and the upgrade software package by the backup server, and prompt the ground center to manually upload, ending the upgrade process.

[0023] The beneficial effect of the above further solution is: using the MD5 check value to determine whether the upgrade software package received by the backup server is consistent with the software package of the ground center, preventing the file from being tampered with and ensuring the security of the system.

[0024] Furthermore, the primary server and the backup server are located within the same security firewall.

[0025] The beneficial effect of the above further solution is that the main server and the backup server are located within the same security firewall, which reduces external risk interference when the two servers interact with each other.

[0026] Furthermore, the main server and the backup server are both located in the two lead vehicles.

[0027] The beneficial effects of the above further solution are: easier identification on the network train topology map, and more convenient maintenance for maintenance personnel.

[0028] Furthermore, the main server and the backup server are of the same model and structure, and both are redundantly backed up by each other.

[0029] The beneficial effects of the above further scheme are: the main server and the backup server use the same model and structure, ensuring that when the main server and the backup server exchange identities, normal communication between each system and the main server and the backup server can still be ensured, and can effectively deal with the problem of a single vehicle-mounted server crashing or losing data due to software and hardware problems during use.

[0030] Furthermore, the main server and the backup server both communicate with the ground center via wireless technology, and the main server and the backup server are connected to each other and communicate with various systems of the train via MVB or Ethernet.

[0031] The beneficial effects of the above further scheme are: the server and the ground center communicate through wireless technology, which facilitates long-distance data transmission; the server is connected to various systems of the train through wireless technology to ensure that communication will not be interrupted due to wear and tear of the wires, thereby improving the security of communication; at the same time, the main server and the backup server are connected through wireless technology, which facilitates data backup between the two.

[0032] Furthermore, the data storage of the primary server and the backup server both adopts stack storage.

[0033] The beneficial effect of the above further solution is that the stack storage method is first-in-last-out, and the software package at the front of the storage area is the latest software package, which makes it easier for the server to extract the latest upgraded software package. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 Flow chart of the method of the present invention.

[0035] Figure 2 This is a diagram of the server framework based on redundant backup in the present invention. DETAILED DESCRIPTION

[0036] The specific embodiments of the present invention are described below to facilitate understanding of the present invention by those skilled in the art. However, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the appended claims, these changes are obvious, and all inventions and creations utilizing the concepts of the present invention are protected.

[0037] like Figure 1 As shown, in one embodiment of the present invention, the present invention provides a method for remotely upgrading train onboard software based on a server redundancy backup strategy, comprising the following steps:

[0038] S1. The backup server determines whether the train has completed pre-preparation. If so, the process proceeds to step S2. Otherwise, the process loops through step S1. Step S1 includes the following steps:

[0039] S101, check whether the train has entered the depot state, if so, proceed to step S102, otherwise, loop step S101;

[0040] S102: The backup server receives the upgrade software package from the ground center and determines whether the upgrade software package is consistent with the upgrade software package of the ground center through the MD5 checksum. If so, the upgrade software package is stored in the temporary storage area of the backup server and the process proceeds to step S103. Otherwise, the backup server deletes the upgrade software package and prompts the ground center to manually upload the software package, thereby ending the upgrade process. Step S102 includes the following steps:

[0041] S1021. The ground center encrypts the upgrade software package using the MD5 algorithm to obtain a first encrypted software package, and transmits the first encrypted software package to the backup server;

[0042] S1022: The backup server temporarily saves the first encrypted software package and feeds back the received data to the ground center;

[0043] S1023. After receiving the feedback, the ground center sends the upgrade software package to the backup server;

[0044] S1024. Encrypt the upgrade software package using the MD5 algorithm on the backup server to obtain a second encrypted software package.

[0045] S1025. Determine whether the first encryption software package and the second encryption software package are consistent. If so, determine that the upgrade software package of the backup server is consistent with the upgrade software package of the ground center, and store the upgrade software package in the temporary storage area of the backup server, and enter step S103. Otherwise, determine that the upgrade software package of the backup server is inconsistent with the upgrade software package of the ground center, and delete the first encryption software package, the second encryption software package and the upgrade software package by the backup server, and prompt the ground center to manually upload, ending the upgrade process.

[0046] S103. Determine whether the upgrade software package is the latest version. If so, update the latest software package on the backup server to the upgrade software package, so that the train onboard software completes the pre-preparation and enters step S2. Otherwise, feedback is fed back to the ground center that the software package is not the latest software, delete the upgrade software package in the temporary storage area of the backup server, and return to step S101.

[0047] S2. Confirm with the maintenance personnel whether the upgrade is allowed. If so, the backup server distributes the upgrade software package to each system. Each system starts the upgrade and feeds back the upgrade information to the backup server, and then proceeds to step S3. Otherwise, the upgrade process ends.

[0048] S3. Based on the upgrade information, determine whether all systems have been successfully upgraded. If so, the backup server records the upgrade success information, feeds back the upgrade success information to the ground center, and exchanges identities with the main server, and then proceeds to step S4. Otherwise, the backup server again issues upgrade instructions to each system that failed to upgrade, and then proceeds to step S5.

[0049] S4. After the train runs for a predetermined period of time, determine whether a software compatibility issue occurs. If so, proceed to step S6. Otherwise, complete the upgrade, enable the primary server to communicate with the backup server, and transfer all the contents of the primary server's software storage area to the backup server.

[0050] S5. Determine whether each system is being upgraded for the first time. If so, the backup server issues an upgrade instruction to each system that failed to upgrade, starts the upgrade, and feeds back the upgrade information to the backup server. The process then returns to step S3. Otherwise, the upgrade is stopped, the backup server records a log, and feeds back the upgrade failure information to the ground center. The process then proceeds to step S6.

[0051] S6. The backup server sends the upgrade failure information to the main server, and the main server distributes the original version of the software to each system, so that each system is flashed to the original software version, and the main server and the backup server communicate, and all the contents of the main server software storage area are transferred to the backup server.

[0052] The primary server and the backup server are located within the same security firewall.

[0053] The main server and the backup server are both located in the two head vehicles.

[0054] The main server and the backup server are of the same model and structure, and they are mutually redundant.

[0055] The main server and backup server both communicate with the ground center via wireless technology, and can communicate with each other and with various train systems via MVB or Ethernet.

[0056] The data storage of the main server and the backup server both adopts stack storage.

[0057] In this embodiment, the main server and the backup server are connected to each system of the train respectively, such as Figure 2 As shown, the systems include train network system, door system, air conditioning system, PIS system, safety monitoring system and traction system.

[0058] In this embodiment, a method for remotely upgrading train on-board software based on a server redundancy backup strategy is used to solve the problem of train remote upgrades, in which the on-board server crashes or the software and hardware are damaged and the normal on-board software remote upgrade cannot be completed. It is mainly composed of an on-board server A and a server B. The two servers redundantly backup each other. At a time, only one server is the main server and the other is the backup server. The two servers are within the same security firewall and are physically located in the two head cars. The slave server receives data from the ground center, verifies and decrypts it, and then upgrades the on-board subsystem when the train enters the depot and stops. After the upgrade is successful, the main server and the backup server swap their identities. The two servers are allowed to interconnect only after the train has been operating normally for more than a period of time (the time can be set independently), and the latest program in the main server is written into the slave server. The present invention can effectively deal with the problem of a single on-board server crashing or losing data due to software and hardware problems during use, thereby improving the operation and maintenance management capabilities of rail transit vehicles and the stability of remote upgrades.

[0059] like Figure 2 As shown, in this embodiment, the ground center sends the upgrade software package to the train's onboard server. The onboard server is divided into two independent servers A and B that communicate with each other. Taking server A as the main server always used by the train as an example, the onboard server receives and sends data based on the redundant backup strategy:

[0060] 1. Server A is the primary server, and Server B is the backup server. Data on Servers A and B is stored in a stacked fashion, i.e., first-in, last-out. The software package at the front of the storage area is the latest. The software package to be upgraded, transmitted from the ground center, passes through a secure firewall and is received by Server B.

[0061] 2. Server B performs an MD5 checksum on the software package. If the consistency check passes, the software package is stored in a temporary storage area and compared with the current software package version on Server B. If the software package version in the temporary storage area is newer than the current software package version, the process continues to Step 3. Otherwise, the ground center is notified that the software package is not the latest version and the software package in the temporary storage area is deleted. (Supplementary Note: MD5 checksum file consistency check: Before transmitting the software package, the ground center first encrypts the software package to be transmitted using the MD5 algorithm and transmits the encrypted content to Server B. Server B temporarily stores the result and transmits the data received to the ground center. The ground center then sends the software package to Server B, which performs an MD5 encryption on the software package. If the two results match, the software packages are confirmed to be consistent. This is a method for determining software package consistency and preventing file tampering.)

[0062] 3. Server B communicates with the human-machine interface (HMI) to inform the maintenance personnel that the latest version of the software package is available and confirms with the maintenance personnel whether to allow the upgrade. If the maintenance personnel clicks "Yes", Server B will distribute the upgrade software package according to different subsystems. Each subsystem will start upgrading after receiving the upgrade software package; otherwise, the upgrade process ends.

[0063] 4. If all systems have completed the upgrade to the latest software package, they will report the upgrade success to Server B, which will then report it back to the ground center, and proceed to Step 5. If the upgrade of all or some subsystems is unsuccessful, Server B will send the upgrade command to all or some subsystems again to perform the software upgrade. If the upgrade is still unsuccessful, the upgrade will be stopped, a log will be recorded, and the failure of the upgrade will be sent back to the ground center via Server B, and proceed to Step 6. (If the upgrade of any system fails, the upgrade is considered unsuccessful.)

[0064] 5. After the software upgrade is successful, the upgrade success information is recorded on server B and sent back to the ground center. At the same time, server B is set as the main server and server A is set as the backup server. If it operates normally for one month (the time can be set independently) and no new software compatibility issues occur, the software upgrade is considered successful. After the train is parked in the depot on the same day, server A communicates with server B and copies the contents of the software storage area of server B (including whether the upgrade is successful) into the software storage area of server A. Until the next remote software upgrade, server B always acts as the main server and server A acts as the backup server, and this upgrade is completed;

[0065] 6. If the software upgrade fails, Server B will send an upgrade failure message to Server A. Server A will still be the primary server. The original software version of each subsystem will be distributed through Server A, and each subsystem will be flashed back to the original software version. Server A will communicate with Server B and copy the contents of Server A's software storage area to Server B's software storage area until the next remote software upgrade. Server A will always act as the primary server and Server B will act as the backup server. The upgrade is completed.

Claims

1. A train vehicle software remote upgrade method based on server redundancy backup strategy, characterized in that: The following steps are involved: S1, the backup server determines whether the train has completed the pre-preparation. If so, it proceeds to step S2, otherwise, it loops through step S1; S2. Confirm with the maintenance personnel whether the upgrade is allowed. If so, the backup server distributes the upgrade software package to each system, causing each system to start the upgrade and feedback the upgrade information to the backup server, and then proceeds to step S3. Otherwise, the upgrade process ends; S3. Based on the upgrade information, determine whether all systems have been successfully upgraded. If so, the backup server records the upgrade success information, feeds back the upgrade success information to the ground center, and exchanges identities with the main server, and then proceeds to step S4. Otherwise, the backup server again issues upgrade instructions to each system that failed to upgrade, and then proceeds to step S5. S4. After the train runs for a predetermined period of time, determine whether a software compatibility issue occurs. If so, proceed to step S6. Otherwise, complete the upgrade, enable the primary server to communicate with the backup server, and transfer all the contents of the primary server's software storage area to the backup server. S5. Determine whether each system is being upgraded for the first time. If so, the backup server issues an upgrade instruction to each system that failed to upgrade, starts the upgrade, and feeds back the upgrade information to the backup server. The process then returns to step S3. Otherwise, the upgrade is stopped, the backup server records a log, and feeds back the upgrade failure information to the ground center. The process then proceeds to step S6. S6. The backup server sends the upgrade failure information to the main server, and the main server distributes the original version of the software to each system, so that each system is flashed to the original software version, and the main server and the backup server communicate, and all the contents of the main server software storage area are transferred to the backup server.

2. The train onboard software remote upgrade method based on server redundancy backup strategy according to claim 1 is characterized in that: The step S1 comprises the following steps: S101, check whether the train has entered the depot state, if so, proceed to step S102, otherwise, loop step S101; S102: The backup server receives the upgrade package from the ground center and uses the MD5 checksum to determine whether the upgrade package is consistent with the upgrade package from the ground center. If so, the upgrade package is stored in the temporary storage area of the backup server and the process proceeds to step S103. Otherwise, the backup server deletes the upgrade package and prompts the ground center to manually upload the package, ending the upgrade process. S103. Determine whether the upgrade software package is the latest version. If so, update the latest software package on the backup server to the upgrade software package, so that the train onboard software completes the pre-preparation and enters step S2. Otherwise, feedback is fed back to the ground center that the software package is not the latest software, delete the upgrade software package in the temporary storage area of the backup server, and return to step S101.

3. The train onboard software remote upgrade method based on server redundancy backup strategy according to claim 2 is characterized in that: The step S102 includes the following steps: S1021. The ground center encrypts the upgrade software package using the MD5 algorithm to obtain a first encrypted software package, and transmits the first encrypted software package to the backup server; S1022: The backup server temporarily saves the first encrypted software package and feeds back the received data to the ground center; S1023. After receiving the feedback, the ground center sends the upgrade software package to the backup server; S1024. Encrypt the upgrade software package using the MD5 algorithm on the backup server to obtain a second encrypted software package. S1025. Determine whether the first encryption software package and the second encryption software package are consistent. If so, determine that the upgrade software package of the backup server is consistent with the upgrade software package of the ground center, store the upgrade software package in the temporary storage area of the backup server, and enter step S103. Otherwise, determine that the upgrade software package of the backup server is inconsistent with the upgrade software package of the ground center, delete the first encryption software package, the second encryption software package and the upgrade software package by the backup server, and prompt the ground center to manually upload, ending the upgrade process.

4. The train onboard software remote upgrade method based on server redundancy backup strategy according to claim 1 is characterized in that: The primary server and the backup server are located within the same security firewall.

5. The train onboard software remote upgrade method based on server redundancy backup strategy according to claim 4 is characterized in that: The main server and the backup server are both located in the two head vehicles.

6. The train onboard software remote upgrade method based on server redundancy backup strategy according to claim 5 is characterized in that: The main server and backup server are of the same model and structure, and they are mutually redundant.

7. The train onboard software remote upgrade method based on server redundancy backup strategy according to claim 6 is characterized in that: The main server and the backup server both communicate with the ground center via wireless technology, and the main server and the backup server are connected to each other and communicate with each system of the train via MVB or Ethernet.

8. The train onboard software remote upgrade method based on server redundancy backup strategy according to claim 7 is characterized in that: The data storage of the main server and the backup server both adopts stack storage.

Images