A safety monitoring method of a cloud-based rail transit signal safety computing platform

Abstract

The application provides a safety monitoring method of a cloud-based rail transit signal safety computing platform. The method comprises the following steps: constructing the cloud-based rail transit signal safety computing platform based on a private cloud, a fault safety voter and a target controller, deploying signal application software on a plurality of redundantly configured virtual machines in the private cloud, and executing rail transit signal application functions by using each signal application software; monitoring the rail transit signal application functions by using an application function monitor; and deploying a comprehensive monitor for the rail transit signal application functions and the application function monitor on another redundantly configured virtual machine on the private cloud. The application provides a specific application method of multi-level monitoring which can be used in the safety evaluation process of the cloud-based rail transit signal safety computing platform and can consolidate the safety guarantee mechanism of the safety computing platform.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of rail transit signal technology, and in particular to a safety monitoring method for a cloud-based rail transit signal safety computing platform. BACKGROUND

[0002] Currently, relevant manufacturers or institutions at home and abroad are researching how to deploy traditional rail transit signals to a cloud computing platform. For example, in March 2022, Siemens published an article entitled “Next Generation Signal System Based on Cloud Platform” in Issue 73 of the magazine “Urban Rail Transit”.

[0003] Currently, the cloud-based rail transit signal safety computing platform in the prior art, whether it is an external vote device type architecture or a full-stack software type architecture, cannot avoid the fact that cloud computing is based on Commercial Off-The-Shelf (COTS) hardware and software implementation. The COTS hardware used by cloud computing mainly includes X86 cloud computing IT COTS servers or self-controllable IT COTS servers, and the COTS software used by cloud computing mainly includes HostOS represented by Linux, Hypervisor represented by KVM, Guest OS represented by Windows / Linux / FreeBSD, and related hardware drivers.

[0004] In this way, whether the implementation of a rail transit signal system based on cloud computing is feasible is converted into the problem of whether the rail transit signal system can be implemented based on COTS hardware and software. As far as the current actual situation is concerned, when implementing a functional safety system, it is required to clearly explain a large number of things related to safety at each level. However, it is basically impossible for the above-mentioned general COTS OS, microcode inside the COTS processor, and related BIOS (UEFI) firmware, or even certain COTS driver software to clearly explain, unless supported by a manufacturer. Even open source software such as Linux / FreeBSD, and open source software sets such as OpenStack for cloud computing, it is very difficult to completely explain, not to mention modifying them to completely comply with the requirements for safety-related software.

[0005] Therefore, when implementing a functional safety system in the field of rail transit using COTS hardware and software products (including open source products), it is extremely likely that it will be difficult to pass the safety evaluation because it is not possible to clearly explain a large number of things related to safety at each level, which is also the view of many signal manufacturers and many safety evaluation agencies in China.

[0006] The practical solution to this problem is to return to the safety standards. The ISO 26262 standard for automotive electronics provides a reference technical route, that is: to achieve functional safety based on ASIL decomposition principle. ASIL refers to Automotive Safety Integrity Level. According to the definition of ISO 26262, ASIL decomposition is to redundantly allocate safety requirements to sufficiently independent elements (here referring to system components [software or hardware]; hardware components or software units) for the same safety goal, with the purpose of reducing the ASIL level of the redundant safety requirements allocated to the relevant elements.

[0007] The core content of ISO 26262 standard on ASIL decomposition can be summarized as follows:

[0008] 1) Decomposition object: each safety requirement, each system module, hardware module or software module.

[0009] 2) Implementation stage: functional safety concept stage, system design stage, hardware design stage, software design stage.

[0010] 3) Decomposition principle: independence.

[0011] 4) ASIL D decomposition method:

[0012] An ASIL D requirement shall be decomposed in one of the following ways:

[0013] 1) one ASIL C(D) requirement and one ASIL A(D) requirement; or

[0014] 2) one ASIL B(D) requirement and one ASIL B(D) requirement; or

[0015] 3) one ASIL D(D) requirement and one QM(D) requirement.

[0016] Figure 1 An ISO 26262 standard ASIL D decomposition diagram in the prior art. According to 3.117 of ISO 26262-1:2018(E), QM refers to quality management, which is defined as guiding and controlling the coordinated activities of an organization in terms of quality. Its Note 1 to entry states: QM is not an ASIL (3.6), but can be specified in the hazard analysis and risk assessment (3.76).

[0017] In addition, NOTE 2 in ISO 26262-9:2018(E) 5.4.7 states: If the decomposition ASILx(x) + QM(x) is chosen, then QM(x) implies that the quality management system is sufficient to develop components that implement the safety requirements assigned to the intended function.

[0018] The principle of reactive fail-safety is given in EN 50129-2018, Appendix B (normative) Management of faults for safety-related functions:

[0019] (1) The technology allows safety-related functions to be performed by a single item, but its safe operation must be ensured by rapid detection and negation of any dangerous faults (for example, by coding, multiple calculation and comparison, or by continuous testing). Although only one item has the actual safety-related function, the checking / testing / detecting function can be considered as a second item, which should be independent of other items to avoid the occurrence of common cause failures;

[0020] (2) The integrity of the checking / testing / detecting function (second item) should be ensured throughout the entire life cycle of the system, so as to lead to a safe state in the case of loss of integrity.

[0021] In Table E.4 Architecture of system, subsystem or equipment of EN 50129-2018, Appendix E (normative) Techniques and measures for the avoidance of systematic faults and the control of random and systematic faults, it is also explicitly stated that a single electronic structure based on reactive fail-safety can meet the architecture requirements of SIL 4. SUMMARY

[0022] Embodiments of the present application provide a safety monitoring method for a cloud-based rail transit signal safety computing platform to effectively ensure the safety of the rail transit signal safety computing platform.

[0023] In order to achieve the above-mentioned purpose, the technical scheme adopted by the present application is as follows.

[0024] A safety monitoring method of a cloud-based rail transit signal safety computing platform, comprising:

[0025] A cloud-based rail transit signal safety computing platform is built based on a private cloud, a fault safety voter and a target controller, signal application software is deployed on a plurality of redundantly configured virtual machines in the private cloud, and a rail transit signal application function is executed by each signal application software:

[0026] An application function monitor in the form of executable software is deployed in parallel in the virtual machine corresponding to the rail transit signal application function; or an application function monitor supported by another private cloud virtual machine is started on the same hardware + virtual machine manager; the application function monitor monitors the rail transit signal application function;

[0027] A comprehensive monitor for the rail transit signal application function and the application function monitor is deployed on another redundantly configured virtual machine on the private cloud.

[0028] The safety monitor of the rail transit signal application function, the application function monitor and the comprehensive monitor is composed of a fault safety voter;

[0029] The target controller is connected directly with various rail transit signal ground field safety equipment or train safety function modules, and the target controller constitutes the base and fulcrum of the functional safety of the rail transit signal control system.

[0030] Preferably, the fault safety voter and the target controller are implemented based on hardware that has passed SIL3 or SIL4 safety certification and software that has passed SIL3 or SIL4 safety certification according to the safety standards of EN50126-2017, EN50128-2010, EN50129-2018 and EN50159-2010, and the fault safety voter and the target controller adopt the same safety redundant architecture, which is selected as 2 out of 2, 3 out of 2 or 2 times 2 out of 2 architecture.

[0031] Preferably, the virtual machines in the private cloud are redundantly configured as 2 out of 2, i.e. two virtual machines are set to support signal application software respectively; the virtual machines in the private cloud are redundantly configured as 3 out of 2, i.e. three virtual machines are set to support signal application software respectively; and the virtual machines in the private cloud are redundantly configured as 2 times 2 out of 2, i.e. four virtual machines are set to support signal application software respectively.

[0032] Preferably, the application function monitor performs heartbeat, challenge-response and fault injection operations.

[0033] The comprehensive monitor performs virtual machine monitoring, self-checking, heartbeat, challenge-response and fault injection operations;

[0034] The safety monitor includes an independent safety channel, and performs self-checking, heartbeat, challenge-response and fault injection operations;

[0035] The ground target controller controls field safety-critical equipment including switches and signal machines, and the train-mounted target controller controls train safety function modules including acceleration and braking, which meet the fault-oriented safety design principle, and the target controller supports safety comparison, self-checking and fault injection safety assurance operations.

[0036] Preferably, the fault safety voter includes a communication gateway function unit, a program sequence monitoring function unit, a voting function unit and a private cloud computing platform virtual machine failure degradation control function unit.

[0037] The communication gateway function unit is configured to connect the target controller through a signal safety network or a train communication network, connect the private cloud hardware through a safety computer internal network, receive information sent by the OC, forward the information to signal application logic operation software deployed on the private cloud computing platform virtual machine, and receive logic monitoring / time monitoring results, intermediate calculation results and output framing data sent back by the signal application software supported on the private cloud virtual machine.

[0038] The program sequence monitoring function unit is configured to implement challenge-response and heartbeat functions of the safety monitor by using logic monitoring and time monitoring functions according to EN50129-2018 to reinforce program sequence monitoring functions of the safety monitor.

[0039] The voting function unit is configured to vote on the logic monitoring / time monitoring results, intermediate calculation results and output framing data.

[0040] The private cloud computing platform virtual machine failure degradation control function unit is configured to communicate with a cloud management platform, and control reset, migration or deletion functions of the cloud management platform.

[0041] Preferably, the implementation architecture of the cloud-based rail transit signal safety computing platform includes:

[0042] The signal application software and the fault safety voter are one-to-one configured or one fault safety voter controls multiple sets of signal application software, and one fault safety voter is connected with all target controllers in a corresponding control area through a signal safety network or a train communication network, and a private cloud computing supporting running of the signal application software corresponding to the control area is connected with the fault safety voter through a safety computer internal network based on a COTS general network.

[0043] The signal application software of the multiple-redundancy setting is arranged on a cloud.

[0044] The technical solution provided by the embodiment of the application can be seen as follows: the application provides a specific method for applying a multi-level monitoring to a cloud-based rail transit signal safety computing platform, so that a safety computing platform safety guarantee mechanism that can be practically used in safety evaluation is realized.

[0045] Additional aspects and advantages of the application will be described in the following description, which will become apparent from the description, or will be learned by practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings needed to be used in the embodiment description will be briefly introduced as follows: obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0047] Figure 1 An ISO 26262 standard ASIL D decomposition schematic diagram in the prior art;

[0048] Figure 2 An architecture scheme A schematic diagram of a cloud-based rail transit signal safety computing platform provided by the embodiment of the application;

[0049] Figure 3 An architecture scheme A-B schematic diagram of a cloud-based rail transit signal safety computing platform provided by the embodiment of the application;

[0050] Figure 4 A scheme A schematic diagram of a cloud-based rail transit signal safety computing platform provided by the embodiment of the application, in which a multiple-redundancy (for example, 2 times) configuration is provided;

[0051] Figure 5 A scheme B schematic diagram of a cloud-based rail transit signal safety computing platform provided by the embodiment of the application, in which a multiple-redundancy (for example, 2 times) configuration is provided;

[0052] Figure 6 An implementation scheme 2A schematic diagram of a cloud-based rail transit signal safety computing platform provided by the embodiment of the application;

[0053] Figure 7 An implementation scheme 2B schematic diagram of a cloud-based rail transit signal safety computing platform provided by the embodiment of the application;

[0054] Figure 8A schematic diagram of a scheme two A of a multiple redundancy (for example, 2 times) configuration of a cloud-based rail transit signal safety computing platform provided for an embodiment of the present application;

[0055] Figure 9 A schematic diagram of a scheme two B of a multiple redundancy (for example, 2 times) configuration of a cloud-based rail transit signal safety computing platform provided for an embodiment of the present application. DETAILED DESCRIPTION

[0056] Embodiments of the present application are described in detail below with reference to several specific embodiments, as shown in the drawings, wherein the same or similar numerals represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are only used to explain the present application, and cannot be interpreted as a limitation on the present application.

[0057] Those skilled in the art can understand that, unless specifically stated, the singular forms "a", "an" and "the" used herein also include the plural forms. It should be further understood that the use of the phrase "comprising" in the specification of the present application means that the features, integers, steps, operations, elements and / or components exist, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we say that an element is "connected" or "coupled" to another element, it can be directly connected or coupled to the other element, or there can be intermediate elements. In addition, "connected" or "coupled" used herein can include wireless connection or coupling. The phrase "and / or" used herein includes any one of the associated listed items and all combinations thereof.

[0058] Those skilled in the art can understand that, unless otherwise defined, all terms (including technical terms and scientific terms) used herein have the same meaning as that generally understood by those skilled in the art to which the present application belongs. It should also be understood that terms such as those defined in a general dictionary should be understood to have meanings consistent with those in the context of the prior art, and should not be interpreted with idealized or overly formal meanings unless defined as such.

[0059] For the sake of understanding the embodiments of the present application, further explanation and description will be made below with reference to the drawings in conjunction with several specific embodiments, and each embodiment does not constitute a limitation on the embodiments of the present application.

[0060] The safety monitoring method of a cloud-based rail transit signal safety computing platform provided by the embodiments of the present application comprises:

[0061] Aiming at the cloud-based rail transit signal safety computing platform realized by the architecture of private clouds + fail-safe voter + object controller (OC); the signal application software supported by the multiple redundant virtual machines respectively deployed on different hardware + hypervisor in the private cloud, and the fail-safe voter constitute the EN

[0062] 50129-2018 standard gives the combined fail-safe structure. Specifically: 2-to-2 structure needs 2 virtual machines respectively supporting signal application software, 3-to-2 structure needs 3 virtual machines respectively supporting signal application software; 2-by-2-to-2 structure needs 4 virtual machines respectively supporting signal application software. Based on the basic principle of ASIL decomposition of ISO 26262 standard, according to the reactive fail-safety principle given by EN 50129-2018 standard, and considering each "signal application software supported by private cloud virtual machine" as a rail transit signal application function (i.e. certified App-SW, referred to as level 0, L0), the following multi-level monitoring scheme is obtained:

[0063] 1: In the virtual machine corresponding to the rail transit signal application function (level 0), the application function monitor (level 1, L1) is supported by deploying executable software in parallel; or another private cloud virtual machine is started on the same hardware + hypervisor to support the application function monitor (level 1); the application function monitor (level 1) is used to monitor the rail transit signal application function (level 0);

[0064] 2: Deploy a comprehensive monitor (level 2, L2) for the rail transit signal application function (level 0) and the application function monitor (level 1) on another redundant virtual machine on the private cloud;

[0065] 3: The fail-safe voter (Fail-Safe Voter) is responsible for the safety monitor (level 3, L3) function of the level 0, level 1, and level 2;

[0066] 4: Utilize the characteristics of OC directly connected (input and output) with various rail transit signal ground field safety critical devices such as turnouts, signals, and train safety critical function modules such as acceleration and braking, let OC constitute the base and fulcrum of the functional safety of the specific rail transit signal control system, and play the role of safety monitoring and guaranteeing the last barrier (level 4, L4).

[0067] 5: Fail-Safe Voter and OC are both based on EN50126-2017, EN50128-2010, EN50129-2018, EN50159-2010, etc. safety standards, implemented based on SIL3 or SIL4 safety certified hardware (such as safety MCU with Lockstep architecture), SIL3 or SIL4 safety certified software (such as SIL3 certified Hypervisor and RTOS, SIL4 certified application software), Fail-Safe Voter and OC can use the same safety redundant architecture, the safety redundant architecture is preferably 2 out of 2, 3 out of 2, 2 by 2 out of 2, etc. architecture, Fail-Safe Voter generally does not contain other input and output units required by OC in addition to external communication unit.

[0068] 6: Take sufficient measures to ensure that the level 1 is independent of the level 0, the level 2 is independent of the level 1 and the level 0, the level 3 is independent of the level 2, the level 1 and the level 0, the level 4 is independent of the level 3, the level 2, the level 1 and the level 0.

[0069] Specific multi-level monitoring implementation methods include:

[0070] The monitoring method (level 1) for the application function (level 0) includes heartbeat, challenge-response, fault injection, etc.

[0071] The monitoring method (level 2) for the application function (level 0) and the application function monitor (level 1) includes hypervisor monitor, self-test, heartbeat, challenge-response, fault injection, etc.

[0072] The safety monitoring method (level 3) for the level 0, level 1, level 2 includes independent safety channel, self-test, heartbeat, challenge-response, fault injection, etc.

[0073] The OC is the last link (level 4) of the safety monitoring and protection of the specific rail transit signal control system function: the ground OC controls the on-site safety key equipment such as turnouts and signal machines, and the on-board OC controls the train safety key function modules such as acceleration and braking, which should all meet the respective fail-safe design principles. In addition, the OC also supports safety protection methods such as safety voting, self-test, fault injection, etc.

[0074] Therefore, the Fail-Safe Voter has the following functions:

[0075] Communication gateway function unit: the Fail-Safe Voter is connected to the OC through the signal safety network or the train communication network (external network), and is connected to the private cloud hardware through the safety computer internal network, thereby playing the role of a communication gateway. Specifically, it receives all the information sent by the OC and caches it, waiting for the right opportunity to forward it to the signal application logic operation software deployed on the virtual machine of the private cloud computing platform. It receives the logic monitoring / time monitoring results, (intermediate) calculation results and output framing data sent back by the signal application software supported by the virtual machine of the private cloud.

[0076] Program sequence monitoring function unit: according to EN50129-2018, the challenge-response and heartbeat functions in the safety monitoring method (level 3) should be supplemented with program sequence monitoring functions. Specifically, the challenge-response and heartbeat functions are realized by using the logic monitoring function and the time monitoring function.

[0077] Voting function unit: voting on the logic monitoring / time monitoring results, (intermediate) calculation results and output framing data; the safety redundant architecture composed of multiple redundant virtual machines on the private cloud supporting signal application software + Fail-Safe Voter voting function, at least meets the 2 out of 2 structure to achieve the SIL 4 safety redundant architecture requirement.

[0078] Degradation control function unit after private cloud computing platform virtual machine failure: communication with the cloud management platform to control its reset or migration or deletion functions; the safety monitoring method (level 3) should be supplemented with degradation control after the private cloud computing platform virtual machine fails. After the private cloud computing platform virtual machine fails, the monitoring method (level 2) detects and realizes degradation control through the safety monitoring method (level 3).

[0079] Specific implementation architecture of the cloud-based rail transit signal safety computing platform 1

[0080] Solution 1 is a one-to-one configuration of signaling application software (authentication App-SW) and fail-safe voters. That is, for every set of signaling application software (authentication App-SW) deployed on the cloud, a fail-safe voter (fail-safe voter) is configured outside the cloud. For every N sets of existing signaling application software on the cloud, there are N corresponding fail-safe voters.

[0081] Solution 1 is further divided into two implementation methods based on the application function monitor (level 1): Figure 2 The scheme shown is A, Figure 3 The following is the solution B. In Solution A, the application function monitor (level 1) is supported by deploying executable software in parallel within the virtual machine corresponding to the signal application function (level 0); in Solution B, another private cloud virtual machine is created on the same hardware (Harware) + virtual machine manager (Hypervisor) to support the application function monitor (level 1).

[0082] Figure 2 、 3 Heterogeneous implementation of 2-out-of-2 has been considered, with heterogeneity guaranteed by at least X86 and ARM hardware. A two-cloud solution offers a significant advantage over a single cloud in resolving common cause failures in logical operations.

[0083] exist Figure 2 、 3 In this system, a fail-safe voter is connected to all target controllers (OCs) within its corresponding control area via a signal safety network or train communication network (external network). The private cloud computing platform that supports the signal application software for that control area is connected to the fail-safe voter via a secure computer intranet based on a common COTS network.

[0084] If the reliability and availability of the authentication App-SW operation are taken into consideration, it is necessary to set up a signal application software (authentication App-SW) with multiple redundancy (for example, 2 times). Based on the actual configuration of cloud computing and to reduce complexity, the signal application software (authentication App-SW) with multiple redundancy is all deployed on one cloud.

[0085] At this time, the two implementation methods of application function monitor (level 1) are further divided into: Figure 4 The scheme 1A of the multiple redundancy (for example, 2 times) configuration shown in FIG. Figure 5 The scheme 1B of the multiple redundancy (eg, 2 times) configuration is shown.

[0086] The scheme of one-to-one configuration of fail-safe voter and signal application software, especially in the condition of multi-cloud, firstly, the network throughput requirement of fail-safe voter is relatively low, which can be realized based on existing SIL4 equipment. Secondly, the division of configuration and control area of traditional signal function is closer, and the influence between different control areas is smaller.

[0087] The second specific implementation architecture scheme of cloud-based rail transit signal safety computing platform

[0088] The second scheme is a fail-safe voter controlling multiple sets of signal application software (authentication App-SW), that is, a fail-safe voter is configured outside the cloud, and multiple sets of existing signal application software are configured on the cloud, that is, one-to-many.

[0089] The second scheme is further divided into scheme two A as shown in Figure 6 and scheme two B as shown in Figure 7 . In scheme two A, the signal application function (level 0) is supported by the application function monitor (level 1) in the form of executable software through parallel deployment in the virtual machine. In scheme two B, a private cloud virtual machine is started to support the application function monitor (level 1) on the same hardware (Harware) + hypervisor.

[0090] Figure 6 、 7 The heterogeneous implementation of 2-of-2 has been considered in , which is guaranteed by at least X86 and ARM hardware. The 2-heterogeneous cloud scheme has a strong advantage in solving the common cause failure of logical operation compared to the one-cloud scheme.

[0091] In Figure 6 、 7 , a fail-safe voter is connected to all target controllers OC in the control area through a signal safety network or train communication network (external network). The private cloud computing supporting the running of the signal application software corresponding to the control area is connected to the fail-safe voter through the internal network of the security computer based on the COTS general network.

[0092] If considering the reliability and availability of the authentication App-SW operation, a multiple-redundancy (for example, 2 times) set signal application software (authentication App-SW) is arranged, from the actual configuration of cloud computing and the reduction of complexity, the multiple-redundancy set signal application software (authentication App-SW) is arranged on one cloud.

[0093] At this time, according to the two implementation modes of the application function monitor (level 1), it is further subdivided into scheme two A of multiple-redundancy (for example, 2 times) configuration as shown in Figure 8 Figure 9 Scheme two B of multiple-redundancy (for example, 2 times) configuration as shown in.

[0094] The scheme of one-to-many configuration of the Fail-Safe Voter and the signal application software requires a higher network throughput capability of the Fail-Safe Voter, and can also be realized based on the existing SIL4 device. Secondly, compared with the traditional signal logic configuration, the one-to-many configuration has a larger mutual influence on the control areas.

[0095] The scheme of one-to-many configuration of the Fail-Safe Voter and the signal application software is further evolved, and can be changed to only set one Fail-Safe Voter, but control all signal application software (authentication App-SW), that is, one-to-all. The scheme of one-to-all configuration of the Fail-Safe Voter and the signal application software has the highest requirement on the network throughput capability of the Fail-Safe Voter; compared with the traditional signal logic configuration, the one-to-all configuration has the largest mutual influence on the control areas.

[0096] In summary, the embodiment of the application uses the decomposition principle of the automotive safety level (Automotive Safety Integrity Level, ASIL) of the ISO 26262 standard in the automotive electronics field to realize the functional safety idea, and proposes a multi-level monitoring principle and specific implementation method and architecture scheme that can be used in the safety guarantee mechanism of the cloud-based rail transit signal safety computing platform. The principle and specific implementation method and architecture scheme can be used in the safety evaluation process of the cloud-based rail transit signal safety computing platform, thereby solving the problem of missing safety evidence faced by using COTS software and hardware products (including open source products) in the cloud-based rail transit signal safety computing platform.

[0097] Those skilled in the art can understand that the drawings are only schematic diagrams of an embodiment, and the modules or processes in the drawings are not necessarily necessary for implementing the application.

[0098] ​Those skilled in the art can clearly understand the present application by the description of the above embodiments. Based on such an understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product can be stored in a storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a plurality of instructions to cause a computer device (which can be a personal computer, a server, or a network device, and the like) to execute the methods described in the various embodiments or some parts of the embodiments.

[0099] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments mainly describes the difference from other embodiments. In particular, for the device or system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the related parts can be referred to the part of the method embodiments. The above-described device and system embodiments are merely illustrative, and the units described as separate components can be or can not be physically separated, and the components displayed as units can be or can not be physical units, that is, they can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiments according to the actual needs. Those skilled in the art can understand and implement it without creative labor.

[0100] The above describes only the preferred embodiments of the present application, but the protection scope of the present application is not limited to this. Any skilled person in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A security monitoring method for a cloud-based rail transit signal safety computing platform, characterized in that: include: A cloud-based rail transit signal safety computing platform is built based on the architecture of a private cloud, a fail-safe voter, and a target controller. Signal application software is deployed on multiple redundant virtual machines in the private cloud, and each signal application software is used to perform rail transit signal application functions: Deploy an application function monitor in the form of executable software in parallel within a virtual machine corresponding to the rail transit signal application function; or establish an application function monitor supported by another private cloud virtual machine on the same hardware and virtual machine manager; the application function monitor monitors the rail transit signal application function; Deploying a comprehensive monitor for the rail transit signal application function and the application function monitor on another redundantly configured virtual machine on the private cloud; A fail-safe voting device is used to constitute a safety monitor for the rail transit signal application function, the application function monitor and the integrated monitor; By utilizing the feature of direct connection between the target controller OC and various rail transit signal ground-site safety equipment or train safety function modules, the target controller becomes the base and fulcrum of the functional safety of the rail transit signal control system.

2. The method according to claim 1, characterized in that The fail-safe voter and the target controller are implemented in accordance with the EN50126-2017, EN50128-2010, EN50129-2018, and EN50159-2010 safety standards, based on hardware that has passed SIL3 or SIL4 safety certification and software that has passed SIL3 or SIL4 safety certification. The fail-safe voter and the target controller adopt the same safety redundancy architecture, which is selected as 2 out of 2, 3 out of 2, and 2 times 2 out of 2 architecture.

3. The method according to claim 2, characterized in that The virtual machines in the private cloud adopt a 2-out-of-2 redundant configuration, that is, 2 virtual machines are set up to support the signal application software respectively; the virtual machines in the private cloud adopt a 3-out-of-2 redundant configuration, that is, 3 virtual machines are set up to support the signal application software respectively; the virtual machines in the private cloud adopt a 2x2-out-of-2 redundant configuration, that is, 4 virtual machines are set up to support the signal application software respectively.

4. The method according to claim 1, wherein: The application function monitor performs: heartbeat, challenge-response and fault injection operations; The comprehensive monitor performs virtual machine monitoring, self-checking, heartbeating, challenge-response, and fault injection operations; The security monitor includes an independent security channel to perform self-test, heartbeat, challenge-response and fault injection operations; The ground target controller controls on-site key safety equipment including switches and signals. The on-board target controller controls train safety function modules including acceleration and braking in accordance with the fault-oriented safety design principle. The target controller supports safety comparison, self-test and fault injection safety assurance operations.

5. The method according to claim 1, wherein The fail-safe voting device includes: a communication gateway functional unit, a program sequence monitoring functional unit, a voting functional unit and a private cloud computing platform virtual machine failure degradation control functional unit; The communication gateway functional unit is used to connect to the target controller through the signal safety network or the train communication network, connect to the private cloud hardware through the secure computer intranet, receive information sent by the OC, and forward the information to the signal application logic operation software deployed on the private cloud computing platform virtual machine; receive the logic monitoring / time monitoring results, intermediate calculation results and output framing data sent back by the signal application software supported by the private cloud virtual machine; The program sequence monitoring functional unit is used to enhance the program sequence monitoring function of the safety monitor in accordance with EN50129-2018, and implement the challenge-response and heartbeat functions of the safety monitor by using the logic monitoring function and the time monitoring function; The voting function unit is used to vote on the logic monitoring / time monitoring results, intermediate calculation results and output framing data; The private cloud computing platform virtual machine failure degradation control function unit is used to communicate with the cloud management platform to control the reset, migration or deletion function of the cloud management platform.

6. The method according to any one of claims 1 to 5, characterized in that The implementation architecture of the cloud-based rail transit signal safety computing platform includes: Signal application software and fail-safe voting devices are configured one-to-one, or one fail-safe voting device controls multiple signal application software devices. A fail-safe voting device is connected to all target controllers within its corresponding control area via a signal safety network or train communication network. The private cloud computing system supporting the signal application software in that control area is connected to the fail-safe voting device via a secure computer intranet based on a COTS general-purpose network. Set up multiple redundant signal application software, and all the multiple redundant signal application software are deployed on one cloud.

Images