Computer interlocking system and primary and standby system redundancy switching method thereof

Abstract

The present application belongs to the field of rail transit technology, and particularly relates to a computer interlocking system and a primary and backup system redundancy switching method thereof, wherein the switching method comprises the following steps: judging the health degree of the primary and backup system according to the communication state of the obtained interlocking logic department double system and the internal equipment of the interlocking system and the external safety data network equipment; and performing primary and backup switching according to the health degree of the primary and backup system. The primary and backup system redundancy switching method and system of the present application embodiment do not need additional hardware equipment, thereby saving cost. Meanwhile, the flexibility of double system switching is improved, the reliability of the interlocking system is ensured, and the availability and safety of the computer interlocking system in engineering are improved.

Description

Technical Field

[0001] This invention belongs to the field of rail transit technology, and specifically relates to a computer interlocking system and its primary / backup redundancy switching method. Background Technology

[0002] Computerized interlocking systems include 3x2 and 2x2x2 structures. Currently, the 2x2x2 structure is widely used in the railway sector.

[0003] The computer-based interlocking system mainly consists of four parts: the control and display subsystem, the maintenance subsystem, the input / output subsystem (I / O subsystem), and the interlocking logic unit. The interlocking logic unit comprises two interconnected interlocking systems, Interlocking System I and Interlocking System II, which use the same CPU and operate synchronously. Both systems receive command information from the control and display subsystem, display information from signals, switches, and sections in the I / O subsystem, and relevant information from the safety data network via a network. Devices connected to the safety data network include the train control center, neighboring station interlocking systems, and the radio block center. When a system in the interlocking system experiences a serious unavailability fault, that system shuts down. If that system is the primary system, a primary / backup switch is performed.

[0004] The ability of the interlocking logic department to switch between two systems in the event of a failure in one system is crucial for the safety and availability of a computer-based interlocking system. Existing computer-based interlocking systems primarily employ two methods for dual-system redundancy switching: An external primary / backup switching system is installed, comprising a power module, a dual-system switching board, a primary / backup conversion module, a communication module, a switching module, an indicator module, and a watchdog module. This system acquires switching commands by monitoring the status of external switching buttons and sends these commands to the interlocking logic department, which then executes the dual-system redundancy switching function.

[0005] The existing dual-system redundancy switching method of the computer interlocking system requires an additional set of hardware equipment outside the computer interlocking system, increasing costs. Secondly, the system needs to communicate with the interlocking logic department, increasing the pressure on interlocking data processing. Communication instability issues lead to inflexible master-slave switching, reducing the availability of the computer interlocking system. Therefore, improving availability while ensuring the safety and reliability of the computer interlocking system has become a top priority. Summary of the Invention

[0006] To address the above problems, this invention provides a computer interlocking system and its primary / backup redundancy switching method, employing the following technical solution:

[0007] A method for redundancy switching of a primary and backup system in a computer interlocking system includes the following steps: determining the health status of the primary and backup systems based on the communication status of the interlocking logic unit with internal devices and external safety data network devices of the interlocking system; and performing primary-backup switching based on the health status of the primary and backup systems.

[0008] Furthermore, the internal equipment of the interlocking system includes control and display equipment and I / O equipment.

[0009] Furthermore, the external safety data network equipment includes train control center equipment, neighboring station interlocking equipment, and wireless block center equipment.

[0010] Furthermore, based on the communication status between the interlocking logic department and the internal equipment and external safety data network equipment of the interlocking system, the health status of the primary and backup systems is determined as follows:

[0011] Based on the communication status of the interlocking logic unit with the control and display equipment, IO equipment and external security data network equipment, set the control and display system cut-off flag, IO system cut-off flag and security data network cut-off flag;

[0012] When this system is the master system and has one or more of the following flags: control and display switching flag, IO switching flag, and secure data network switching flag, if other systems are synchronized with the master system and have no switching flags, it is determined that the health level of other systems is higher than that of this system.

[0013] When the main system is the system and there is a disconnection indicator, if it is determined that other systems also have disconnection indicators, then it is determined that both systems are faulty, and that the health status of other systems is the same as that of the main system.

[0014] Furthermore, based on the health status of the primary and backup systems, the primary / backup switchover process includes the following steps:

[0015] If the health status of another system is higher than that of this system, a master-slave system switchover operation will be performed. The original master system will be downgraded to standby mode, and the original standby system will be promoted to master system. If the system is synchronized with the current master system after standby and there are no system faults, the original master system will be switched to slave system.

[0016] If the health status of another system is the same as that of this system, the current primary / backup system status will be maintained and no primary / backup system switching operation will be performed, while the backup system will be reduced to standby status.

[0017] Furthermore, based on the communication status between the interlocking logic unit and the control and display equipment, the control and display switching flag is set as follows:

[0018] When the interlocking logic unit has two systems, if the communication interruption between this system and control display machine A and control display machine B exceeds the interruption tolerance time of the main system while other systems communicate normally with the control display equipment, then the control display system switching flag is set; when the interlocking logic unit has two systems, if the communication interruption between this system and the two control display machines exceeds the interruption tolerance time of the backup system, then the control display system switching flag is set.

[0019] Furthermore, based on the obtained communication status between the interlocking logic unit and the IO device, the IO switching flag is set as follows:

[0020] When the interlocking logic unit is the master system, if the communication interruption between the master system and the IO device exceeds the master system's interruption tolerance time while the other system communicates normally with the IO device, then the IO disconnection flag is set. When the interlocking logic unit is not the master system, if the communication interruption between the master system and the IO device exceeds the backup system's interruption tolerance time, then the IO disconnection flag is set.

[0021] Furthermore, based on the communication status of the acquired external secure data network devices, the secure data network disconnection flag is set as follows:

[0022] When the interlocking logic unit has two systems, if the system is the primary system and the communication interruption time between the system and the external security data network equipment exceeds the primary system's interruption tolerance time, while the other system communicates normally with the external security data network equipment, then a security data network disconnection flag is set. When the interlocking logic unit has two systems, if the system is not the primary system and the communication interruption time between the system and the external security data network equipment exceeds the backup system's interruption tolerance time, then a security data network disconnection flag is set.

[0023] Furthermore, the interruption tolerance time of the primary system in the interlocking logic unit should be 3 cycles longer than that of the backup system.

[0024] The present invention also provides a computer interlocking system, including an interlocking logic unit dual system and internal equipment of the interlocking system; wherein, the interlocking logic unit dual system is used to determine the health status of the primary and backup systems based on its own communication status with the internal equipment of the interlocking system and the external security data network equipment;

[0025] The interlocking logic unit is also used to perform primary / backup switching based on the health status of the primary and backup systems.

[0026] Furthermore, the internal equipment of the interlocking system includes control and display equipment and I / O equipment.

[0027] Furthermore, the interlocking logic unit dual system is used to determine the health status of the primary and backup systems based on the communication status between the interlocking logic unit dual system and the internal equipment of the interlocking system and the external safety data network equipment, as follows:

[0028] Based on the communication status of the interlocking logic unit with the control and display equipment, IO equipment and external security data network equipment, set the control and display system cut-off flag, IO system cut-off flag and security data network cut-off flag;

[0029] When this system is the master system and has one or more of the following flags: control and display switching flag, IO switching flag, and secure data network switching flag, if other systems are synchronized with the master system and have no switching flags, it is determined that the health level of other systems is higher than that of this system.

[0030] When the main system is the system and there is a disconnection indicator, if it is determined that other systems also have disconnection indicators, then it is determined that both systems are faulty, and that the health status of other systems is the same as that of the main system.

[0031] Furthermore, the interlocking logic unit is used to perform primary / standby switching based on the health status of the primary and standby systems, as follows:

[0032] If the health status of another system is higher than that of this system, a master-slave system switchover operation will be performed. The original master system will be downgraded to standby mode, and the original standby system will be promoted to master system. If the system is synchronized with the current master system after standby and there are no system faults, the original master system will be switched to slave system.

[0033] If the health status of another system is the same as that of this system, the current primary / backup system status will be maintained and no primary / backup system switching operation will be performed, while the backup system will be reduced to standby status.

[0034] The beneficial effects of this invention are as follows: The primary / backup redundancy switching method and system of this invention do not require additional hardware equipment, thus saving costs. At the same time, it improves the flexibility of dual-system switching, ensures the reliability of the interlocking system, and enhances the availability and safety of the computer interlocking system in engineering projects.

[0035] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures pointed out in the description and the drawings. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 A schematic diagram of a computer interlocking system according to an embodiment of the present invention is shown;

[0038] Figure 2 A schematic diagram showing the connection between the interlocking logic unit dual system and the train control center equipment according to an embodiment of the present invention is shown;

[0039] Figure 3 A flowchart illustrating a primary / backup redundancy switching method for a computer interlocking system according to an embodiment of the present invention is shown.

[0040] Figure 4 A schematic diagram of the process for setting the control display cutting system mark according to an embodiment of the present invention is shown;

[0041] Figure 5 A flowchart illustrating the setting of the IO switching flag according to an embodiment of the present invention is shown;

[0042] Figure 6 A flowchart illustrating the process of setting a secure data network disconnection flag according to an embodiment of the present invention is shown;

[0043] Figure 7 A schematic diagram of dual-system redundancy switching according to an embodiment of the present invention is shown. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] It should be noted that the terms "first," "second," etc., used in this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein.

[0046] This invention provides a computer interlocking system and a method for switching between primary and backup systems, which effectively ensures the safety and availability of the computer interlocking system while guaranteeing the implementation of all interlocking functions.

[0047] like Figure 1 As shown, a computer interlocking system includes an interlocking logic unit, internal equipment of the interlocking system, and a maintenance subsystem. The internal equipment of the interlocking system includes control and display equipment and I / O equipment.

[0048] The computer interlocking system of this invention adopts a two-out-of-two redundancy structure design. All components involved in safety information processing and transmission in the computer interlocking system adopt a dual-system structure design according to the "fail-safe" principle. Any single point of failure will not affect the normal use of the system, so as to meet the high reliability and high safety requirements of railway station signal control equipment.

[0049] In a computer interlocking system, the interlocking logic unit is the core component responsible for interlocking operations. It consists of two systems: Interlocking System I and Interlocking System II. Each system is configured with two CPUs to implement a two-out-of-two function. The two systems operate in parallel in a master-slave manner and exchange information through a high-speed channel to achieve synchronization and switching between the two systems.

[0050] The interlocking logic unit is used to determine the health status of the primary and backup systems based on its own communication status with internal equipment and external safety data network equipment; the interlocking logic unit is also used to perform primary / backup switching based on the health status of the primary and backup systems.

[0051] The external safety data network equipment includes train control center equipment, neighboring station interlocking equipment, and wireless block center equipment.

[0052] The control and display equipment is used for human-machine interaction, including Control Display A, Control Display B, and operating and display devices for station duty officers to handle train operation. For example, the operating device is a mouse, and the display device is a graphic monitor. The control and display equipment receives commands from the human-machine interface or from the CTC (Centralized Traffic Control) and transmits them to the interlocking logic department. The control and display equipment sends information to the CTC, TDCS (Train Operation Dispatching Command System), and STP (Shunting Train Protection) via the RS422 interface.

[0053] IO devices include the IOI series and the IOII series. IO devices are used to collect information input and output interlocking calculation results, collect the status of switch quantities such as relays, and drive related relays to pick up / drop.

[0054] The maintenance unit (also known as the interlocking monitoring unit) subsystem includes an electrical maintenance unit, keyboard, monitor, printer, and mouse. The maintenance unit subsystem is used for system maintenance, fault diagnosis, and other functions. The electrical maintenance unit can also transmit interlocking information to the remote monitoring system via an RS422 interface.

[0055] The interlocking logic unit is connected to the control and display subsystem via Ethernet, and the I / O devices are connected to the interlocking logic unit via Ethernet. The connection between the interlocking logic unit and the maintenance machine subsystem is also described, but the communication status between the interlocking logic unit and the maintenance machine does not affect the dual-system redundancy switching; therefore, this embodiment of the invention will not elaborate on this connection.

[0056] The control and display equipment and maintenance machine subsystem receive data from the interlocking dual system via Ethernet network cards (ETH). The control and display equipment transmits the operator's operation information data from the control console to the interlocking dual system (i.e., the control and display network) through the control and display network A and B switches. The interlocking dual system, control and display dual machines, and maintenance machine network cables are all directly connected to the maintenance network switch, enabling communication and information exchange between the various subsystems (i.e., the maintenance network). The IOI and IOII systems of the IO devices are connected to the interlocking logic department's dual system via Ethernet switches to achieve information transmission between the interlocking logic department and the input / output units (i.e., the control network). The interlocking I system and interlocking II system communicate via inter-system Ethernet.

[0057] The computer interlocking system communicates with external safety data network equipment via RJ45 Ethernet interfaces, and the communication networks are all configured with redundancy. Specifically, the train control center, adjacent station interlocking equipment, and the computer interlocking system use the RSSP-I railway signal safety communication protocol, while the radio block center and the computer interlocking system use the RSSP-II railway signal safety communication protocol.

[0058] Each port of the train control center, adjacent station interlocking, and wireless block center establishes a secure communication connection with the corresponding ports of the two systems of the computer interlocking system.

[0059] like Figure 2 As shown, for example, taking the train control center equipment as an example, the A network port of Interlocking System I is connected to the A network port of Train Control Center System I and the A network port of Train Control Center System II; the B network port of Interlocking System I is connected to the B network port of Train Control Center System I and the B network port of Train Control Center System II; the A network port of Interlocking System II is connected to the A network port of Train Control Center System I and the A network port of Train Control Center System II; and the B network port of Interlocking System II is connected to the B network port of Train Control Center System I and the B network port of Train Control Center System II.

[0060] Based on the aforementioned computer interlocking system, this embodiment of the invention also provides a method for primary / backup redundancy switching in a computer interlocking system, such as... Figure 3 As shown, a method for primary and backup redundancy switching in a computer interlocking system includes the following steps: determining the health status of the primary and backup systems based on the communication status of the interlocking logic unit with internal devices and external security data network devices; and performing primary and backup switching based on the health status of the primary and backup systems.

[0061] Specifically, the health status of the primary and backup systems is determined based on the communication status between the interlocking logic department's dual systems and internal equipment and external safety data network equipment within the interlocking system, as follows:

[0062] S11. Based on the communication status of the interlocking logic unit with the control and display equipment, IO equipment and external security data network equipment, set the control and display system switching flag, IO system switching flag and security data network switching flag.

[0063] like Figure 4 As shown, for example, based on the communication status between the interlocking logic unit and the control and display device, the control and display switching flag is set as follows:

[0064] S111. During the periodic operation of the interlocking logic unit, after receiving valid data from the control display device A and control display device B each cycle, the system writes the normal communication flag between the interlocking logic unit and control display device A and control display device B into the synchronization data area of ​​its own system, so that the other system can obtain the communication status between its own system and control display device A and control display device B. The communication flag between the interlocking logic unit and control display device A and control display device B occupies 2 bytes.

[0065] S112. If the data received by the interlocking logic unit from the control display device A and B in each cycle is invalid, then the communication interruption flag with the control display device A and B is written into the synchronization data area of ​​this system, so that the other system can obtain the communication status between this system and the control display device A and B. When the interlocking logic unit is the master system, if the communication interruption between this system and the control display device A and B exceeds the master system interruption tolerance time and the other system communicates normally with the control display device, then the control display system switching flag is set. When the interlocking logic unit is not the master system, if the communication interruption between this system and the control display devices exceeds the backup system interruption tolerance time, then the control display system switching flag is set.

[0066] like Figure 5 As shown, for example, based on the obtained communication status between the interlocking logic unit and the IO device, the IO switching flag is set as follows:

[0067] S113. During the periodic operation, after receiving valid data from the IO device each cycle, the interlocking logic unit writes the normal communication flag with the IO device into the synchronization data area of ​​its own system, so that the other system can obtain the communication status between its own system and the IO device. The communication flag between the interlocking logic unit's two systems and the IO device occupies 1 byte.

[0068] S114. If the data received from the IO device by the two systems in the interlocking logic unit is invalid each cycle, the communication interruption flag with the IO device is written into the synchronization data area of ​​this system, so that the other system can obtain the communication status between this system and the IO device. When the two systems in the interlocking logic unit are the master system, if the communication interruption between this system and the IO device exceeds the master system's interruption tolerance time and the other system communicates normally with the IO device, the IO system switching flag is set. When the two systems in the interlocking logic unit are not the master system, if the communication interruption between this system and the IO device exceeds the backup system's interruption tolerance time, the IO system switching flag is set.

[0069] like Figure 6 As shown, for example, based on the communication status of the acquired external secure data network device, the secure data network disconnection flag is set as follows:

[0070] S115. During the periodic operation, after receiving valid data from the external security data network device each cycle, the interlocking logic department writes the normal communication flag with the external security data network device into the synchronization data area of ​​its own system, so that the other system can obtain the communication status between its own system and the external security data network device. The interlocking logic department's dual-network communication flag with the external security data network device occupies 2 bytes.

[0071] S116. If the data received by the two systems of the interlocking logic unit from the external security data network device is invalid each cycle, a communication interruption flag with the external security data network device will be written into the synchronization data area of ​​this system, so that the other system can obtain the communication status between this system and the external security data network device. When the two systems of the interlocking logic unit are the master system, if the interruption time of both the communication between this system and the external security data network device exceeds the interruption tolerance time of the master system, and the other system communicates normally with the external security data network device, then a security data network disconnection flag will be set. When the two systems of the interlocking logic unit are not the master system, if the interruption time of both the communication between this system and the external security data network device exceeds the interruption tolerance time of the backup system, then a security data network disconnection flag will be set.

[0072] In this embodiment of the invention, the primary interruption tolerance time of the interlocking logic unit should be 3 cycles longer than the backup interruption tolerance time.

[0073] S12. When this system is the master system and has one or more of the following: control and display system switching flag, IO system switching flag, and security data network system switching flag, if other systems are synchronized with the master system and have no switching flag, it is determined that the health level of other systems is higher than that of this system; among them, having no switching flag indicates that other systems are communicating normally with control and display devices, IO devices, and external security data network devices.

[0074] S13. When this system is the main system and has a cut-off indicator, if it is determined that other systems also have a cut-off indicator, then it is determined that both systems have a fault, and that the health level of other systems is the same as that of this system.

[0075] It should be noted that the fault refers to the interruption of communication between the interlocking logic unit and the control and display equipment, IO devices, or external security data network.

[0076] like Figure 7 As shown, the primary / standby switchover process, based on the health status of the primary and standby systems, includes the following steps:

[0077] S21. If the health level of another system is higher than that of this system, then the master-slave system switching operation is performed. The original master system is reduced to standby state, and the original standby system is promoted to master system. If the system is synchronized with the current master system after standby and there are no system faults, then the original master system is switched to slave system.

[0078] S22. If the health level of another system is the same as that of this system, then the current primary / backup system status is maintained and no primary / backup system switching operation is performed, and the backup system is reduced to standby status.

[0079] The primary / backup redundancy switching method of this invention requires no external hardware, saving costs. It also improves the flexibility and reliability of dual-system switching, with the interlocking logic unit performing the redundancy switching through calculations, meeting the SIL4 level requirements of computer interlocking. This ensures the reliability of the interlocking system and improves the availability and safety of the computer interlocking system in engineering projects.

[0080] Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for redundancy switching between primary and backup systems in a computer interlocking system, characterized in that, Includes the following steps: Based on the communication status between the interlocking logic unit and the internal devices of the interlocking system and the external safety data network devices, the health status of the primary and backup systems is determined; based on the health status of the primary and backup systems, a primary / backup switchover is performed; the internal devices of the interlocking system include control and display devices and I / O devices; Based on the communication status between the interlocking logic unit's dual systems and internal equipment of the interlocking system, as well as external safety data network equipment, the health status of the primary and backup systems is determined as follows: Based on the acquired communication status between the interlocking logic unit's dual systems and control / display equipment, IO equipment, and external safety data network equipment, control / display system switching flags, IO system switching flags, and safety data network system switching flags are set. When this system is the primary system and has one or more of the control / display system switching flags, IO system switching flags, and safety data network system switching flags, if other systems are synchronized with the primary system and have no system switching flags, it is determined that the health status of other systems is higher than that of this system. When this system is the primary system and has a system switching flag, if it is determined that other systems also have system switching flags, it is determined that both systems have faults, and the health status of other systems is the same as that of this system. Based on the communication status between the interlocking logic unit's dual systems and the control and display equipment, the control and display system switching flag is set as follows: When the interlocking logic unit's dual systems are the master system in this system, if the communication interruption between this system and control and display machine A and control and display machine B exceeds the master system's interruption tolerance time while other systems communicate normally with the control and display equipment, then the control and display system switching flag is set; when the interlocking logic unit's dual systems are not the master system in this system, if the communication interruption between this system and the control and display dual machines exceeds the backup system's interruption tolerance time, then the control and display system switching flag is set. Based on the communication status between the interlocking logic unit's dual system and the IO device, the IO disconnection flag is set as follows: When the interlocking logic unit's dual system is the master system, if the communication interruption between this system and the IO device exceeds the master system's interruption tolerance time while other systems communicate normally with the IO device, then the IO disconnection flag is set; when the interlocking logic unit's dual system is not the master system, if the communication interruption between this system and the IO device exceeds the backup system's interruption tolerance time, then the IO disconnection flag is set. Based on the communication status of the external security data network equipment, the security data network disconnection flag is set as follows: When the interlocking logic unit has two systems, if the communication interruption time between this system and the external security data network equipment exceeds the interruption tolerance time of the primary system, and the other system communicates normally with the external security data network equipment, then the security data network disconnection flag is set; when the interlocking logic unit has two systems, if the communication interruption time between this system and the external security data network equipment exceeds the interruption tolerance time of the backup system, then the security data network disconnection flag is set.

2. The method for primary / backup redundancy switching in a computer interlocking system according to claim 1, characterized in that, External safety data network equipment includes train control center equipment, neighboring station interlocking equipment, and wireless block center equipment.

3. The method for primary / backup redundancy switching in a computer interlocking system according to claim 1 or 2, characterized in that, Based on the health status of the primary and backup systems, the primary / backup switchover includes the following steps: If the health status of another system is higher than that of this system, a master-slave system switchover operation will be performed. The original master system will be downgraded to standby mode, and the original standby system will be promoted to master system. If the system is synchronized with the current master system after standby and there are no system faults, the original master system will be switched to slave system. If the health status of another system is the same as that of this system, the current primary / backup system status will be maintained and no primary / backup system switching operation will be performed, while the backup system will be reduced to standby status.

4. The method for primary / backup redundancy switching in a computer interlocking system according to claim 1, characterized in that, The interruption tolerance time of the primary system in the interlocking logic unit should be 3 cycles longer than that of the backup system.

5. A computer interlocking system, characterized in that, This includes the interlocking logic section and internal equipment of the interlocking system; Among them, the interlocking logic unit is used to determine the health status of the main and backup systems based on its own communication status with internal equipment of the interlocking system and external safety data network equipment; The interlocking logic unit is also used to perform primary / backup switching based on the health status of the primary and backup systems; the internal equipment of the interlocking system includes control and display devices and I / O devices; Based on the communication status between the interlocking logic unit's dual systems and internal equipment of the interlocking system, as well as external safety data network equipment, the health status of the primary and backup systems is determined as follows: Based on the acquired communication status between the interlocking logic unit's dual systems and control / display equipment, IO equipment, and external safety data network equipment, control / display system switching flags, IO system switching flags, and safety data network system switching flags are set. When this system is the primary system and has one or more of the control / display system switching flags, IO system switching flags, and safety data network system switching flags, if other systems are synchronized with the primary system and have no system switching flags, it is determined that the health status of other systems is higher than that of this system. When this system is the primary system and has a system switching flag, if it is determined that other systems also have system switching flags, it is determined that both systems have faults, and the health status of other systems is the same as that of this system. Based on the communication status between the interlocking logic unit's dual systems and the control and display equipment, the control and display system switching flag is set as follows: When the interlocking logic unit's dual systems are the master system in this system, if the communication interruption between this system and control and display machine A and control and display machine B exceeds the master system's interruption tolerance time while other systems communicate normally with the control and display equipment, then the control and display system switching flag is set; when the interlocking logic unit's dual systems are not the master system in this system, if the communication interruption between this system and the control and display dual machines exceeds the backup system's interruption tolerance time, then the control and display system switching flag is set. Based on the communication status between the interlocking logic unit's dual system and the IO device, the IO disconnection flag is set as follows: When the interlocking logic unit's dual system is the master system, if the communication interruption between this system and the IO device exceeds the master system's interruption tolerance time while other systems communicate normally with the IO device, then the IO disconnection flag is set; when the interlocking logic unit's dual system is not the master system, if the communication interruption between this system and the IO device exceeds the backup system's interruption tolerance time, then the IO disconnection flag is set. Based on the communication status of the external security data network equipment, the security data network disconnection flag is set as follows: When the interlocking logic unit has two systems, if the communication interruption time between this system and the external security data network equipment exceeds the interruption tolerance time of the primary system, and the other system communicates normally with the external security data network equipment, then the security data network disconnection flag is set; when the interlocking logic unit has two systems, if the communication interruption time between this system and the external security data network equipment exceeds the interruption tolerance time of the backup system, then the security data network disconnection flag is set.

6. The computer interlocking system according to claim 5, characterized in that, The interlocking logic unit is used to perform primary / standby switching based on the health status of the primary and standby systems, as follows: If the health status of another system is higher than that of this system, a master-slave system switchover operation will be performed. The original master system will be downgraded to standby mode, and the original standby system will be promoted to master system. If the system is synchronized with the current master system after standby and there are no system faults, the original master system will be switched to slave system. If the health status of another system is the same as that of this system, the current primary / backup system status will be maintained and no primary / backup system switching operation will be performed, while the backup system will be reduced to standby status.

Images