Self-restart apparatus and method for an in-vehicle safety computer

Abstract

This invention provides a self-restarting device and method for an in-vehicle safety computer. The device includes: an ATP module, an ATO module, a first relay module, a second relay module, and an execution module. The ATP module is connected to both the first relay module and the execution module. The ATO module is connected to both the first relay module and the second relay module. The execution module is connected to the second relay module. When the ATP module detects an abnormal state in the ATO module, it sends a first instruction to the execution module. Upon receiving the first instruction from the ATP module, the execution module sends a restart control signal to the second relay module. When the ATO module detects an abnormal state in the ATP module, it sends a restart control signal to the first relay module. The first relay module controls the ATP module to restart. The second relay module controls the ATO module to restart. This avoids the inconvenience caused by restarting the entire system when some devices malfunction.

Description

Technical Field

[0001] This invention relates to the field of rail transit technology, and in particular to a self-restarting device and method for an onboard safety computer. Background Technology

[0002] During the long-term operation of train equipment, some abnormalities may occur. In this case, it is necessary to restart the control to restore the abnormal equipment to normal status.

[0003] Currently, if any subsystem of the Automatic Train Protection (ATP) or Automatic Train Operation (ATO) subsystem malfunctions, the system sends a signal to a restart relay to restart the entire system. This method cannot guarantee the reliability of the restart circuit; if some equipment malfunctions, the entire system will stop operating within a short period, causing inconvenience. Summary of the Invention

[0004] In view of the problems existing in the prior art, the present invention provides a self-restarting device and method for an in-vehicle safety computer.

[0005] This invention provides a self-rebooting device for an in-vehicle safety computer, comprising:

[0006] The system includes an Automatic Train Protection (ATP) module, an Automatic Train Operation (ATO) module, a first relay module, a second relay module, and an execution module.

[0007] The ATP module is connected to both the first relay module and the execution module; the ATO module is connected to both the first relay module and the second relay module; the execution module is connected to the second relay module.

[0008] The ATP module is used to send a first instruction to the execution module when the ATO module is detected to be in an abnormal state.

[0009] The execution module is used to send a restart control signal to the second relay module after receiving the first instruction sent by the ATP module;

[0010] The ATO module is used to send a restart control signal to the first relay module when the ATP module is detected to be in an abnormal state.

[0011] The first relay module is used to control the restart of the ATP module; the second relay module is used to control the restart of the ATO module.

[0012] According to the present invention, a self-restarting device for an in-vehicle safety computer is provided, the device further comprising a third relay module;

[0013] The third relay module is disposed between the ATO module and the first relay module, and is connected to the execution module;

[0014] The ATP module is also used to send a second instruction to the execution module;

[0015] The execution module is also configured to send a restart prohibition control signal to the third relay module after receiving the second instruction sent by the ATP module;

[0016] The third relay module is used to prevent the ATP module from restarting.

[0017] According to the present invention, a self-restarting device for an in-vehicle safety computer is provided, wherein the ATP module includes two ATP units with parallel outputs.

[0018] According to the present invention, an ATO module for an in-vehicle safety computer includes two ATO units with parallel outputs.

[0019] According to the present invention, a self-restarting device for an in-vehicle safety computer is provided, wherein the first relay module includes two relays connected in parallel; and / or, the second relay module includes two relays connected in parallel.

[0020] The present invention also provides a self-rebooting method for an in-vehicle safety computer, applicable to any of the self-rebooting devices for an in-vehicle safety computer as described above, comprising:

[0021] If the ATP module is detected to be in an abnormal state, the ATO module sends a restart control signal to the first relay module;

[0022] Upon receiving the restart control signal sent by the ATO module, the first relay module controls the ATP module to restart.

[0023] According to the present invention, a self-rebooting method for an in-vehicle safety computer is provided, the method further comprising:

[0024] The ATP module sends a second instruction to the execution module;

[0025] After receiving the second instruction from the ATP module, the execution module sends a restart prohibition control signal to the third relay module;

[0026] Upon receiving the restart prohibition control signal sent by the execution module, the third relay module disconnects.

[0027] The present invention also provides a self-rebooting method for an in-vehicle safety computer, applicable to any of the self-rebooting devices for an in-vehicle safety computer as described above, comprising:

[0028] If the ATO module is detected to be in an abnormal state, the ATP module sends a first instruction to the execution module;

[0029] After receiving the first instruction from the ATP module, the execution module sends a restart control signal to the second relay module;

[0030] Upon receiving the restart control signal sent by the execution module, the second relay module controls the ATO module to restart.

[0031] According to the present invention, a self-rebooting method for an in-vehicle safety computer is provided, the method further comprising:

[0032] Before the ATP module sends the first instruction to the execution module, it is determined whether the ATO module is allowed to restart itself.

[0033] According to a self-reboot method for an in-vehicle safety computer provided by the present invention, when the ATO module is detected to be in an abnormal state, the ATP module sends a first instruction to the execution module, specifically including:

[0034] If the ATO module is allowed to restart itself and an abnormal state is detected, the ATP module sends a first instruction to the execution module.

[0035] The self-restarting device and method for an in-vehicle safety computer provided by this invention connects an ATP module to a first relay module and an execution module, respectively. An ATO module is connected to both the first and second relay modules, and the execution module is connected to the second relay module. When the ATP module detects an abnormal state in the ATO module, it can send a first instruction to the execution module. Upon receiving the first instruction, the execution module sends a restart control signal to the second relay module, which then controls the ATO module to restart. Conversely, when the ATO module detects an abnormal state in the ATP module, it can send a restart control signal to the first relay module, which then controls the ATP module to restart. Therefore, when either the ATP or ATO module is in an abnormal state, the module in a normal state can restart the module in the abnormal state, avoiding the inconvenience of restarting the entire system due to partial device malfunctions. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0037] Figure 1 This is one of the structural schematic diagrams of the self-restarting device for an in-vehicle safety computer provided by the present invention;

[0038] Figure 2 This is a second schematic diagram of the self-restarting device for an in-vehicle safety computer provided by the present invention.

[0039] Figure 3 This is one of the flowcharts illustrating the self-reboot method for an in-vehicle safety computer provided by the present invention;

[0040] Figure 4 This is a second schematic flowchart of the self-restart method for an in-vehicle safety computer provided by the present invention;

[0041] Figure 5 A schematic flowchart of the self-restart control method for ATO and ATP provided by the present invention;

[0042] Figure 6 The present invention provides a partial circuit diagram of a restart relay and a restart relay. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0044] Figure 1 This is one of the structural schematic diagrams of the self-rebooting device for an in-vehicle safety computer provided by the present invention, such as... Figure 1 As shown, the device includes:

[0045] Train Automatic Protection (ATP) module 100, Train Automatic Train Operation (ATO) module 110, First Relay Module 120, Second Relay Module 130, and Execution Module 140;

[0046] The ATP module 100 is connected to the first relay module 120 and the execution module 140 respectively; the ATO module 110 is connected to the first relay module 120 and the second relay module 130 respectively; the execution module 140 is connected to the second relay module 130.

[0047] ATP module 100 is used to send a first instruction to execution module 140 when it detects that ATO module 110 is in an abnormal state;

[0048] The execution module 140 is used to send a restart control signal to the second relay module 130 after receiving the first instruction sent by the ATP module 100;

[0049] The ATO module 110 is used to send a restart control signal to the first relay module 120 when the ATP module 100 is detected to be in an abnormal state.

[0050] The first relay module 120 is used to control the restart of the ATP module 100; the second relay module 130 is used to control the restart of the ATO module 110.

[0051] Specifically, the self-restarting device for an in-vehicle safety computer provided by the present invention may include at least an ATP module, an ATO module, a first relay module, a second relay module, and an execution module.

[0052] The ATP module and ATO module are connected via a backplane bus and can communicate with each other, allowing one module to detect whether the other is in an abnormal state. For example, if the ATP module does not receive a signal from the ATO module for a period of time, the ATO module can be considered to be in an abnormal state; similarly, if the ATO module does not receive a signal from the ATP module for a period of time, the ATP module can be considered to be in an abnormal state.

[0053] In this embodiment of the invention, the ATP module and the ATO module need to be cross-controlled. That is, when the ATP module is in an abnormal state, the ATO module can be restarted, and when the ATO module is in an abnormal state, the ATP module can be restarted.

[0054] To enable the ATP module to restart when it is in an abnormal state, the ATO module can be configured to connect the ATO module, the first relay module, and the ATP module in sequence.

[0055] If the ATP module is detected to be in an abnormal state, the ATO module can send a restart control signal to the first relay module. The relay in the first relay module is a normally closed relay, which can open and close again after receiving the restart control signal sent by the ATO module, thereby controlling the restart of the ATP module.

[0056] To enable the ATO module to restart when it is in an abnormal state, the ATP module can be configured to connect the ATP module, execution module, second relay module, and ATO module in sequence.

[0057] If the ATO module is detected to be in an abnormal state, the ATP module can send a first instruction to the execution module. The first instruction is used to instruct the execution module to perform a restart operation of the ATO module. Therefore, after receiving the first instruction sent by the ATP module, the execution module can send a restart control signal to the second relay module. The relay in the second relay module is a normally closed relay, which can open and close again after receiving the restart control signal sent by the execution module, thereby controlling the restart of the ATO module.

[0058] The execution module can be a Flexible I / O tester (FIO) module, which can receive instructions from the ATP module and perform subsequent operations according to the ATP module.

[0059] The self-restarting device for an in-vehicle safety computer provided by this invention connects an ATP module to a first relay module and an execution module, respectively. An ATO module is connected to both the first and second relay modules, and the execution module is connected to the second relay module. When the ATP module detects an abnormal state in the ATO module, it can send a first command to the execution module. Upon receiving the first command, the execution module sends a restart control signal to the second relay module, which then controls the ATO module to restart. Conversely, when the ATO module detects an abnormal state in the ATP module, it can send a restart control signal to the first relay module, which then controls the ATP module to restart. Therefore, when either the ATP or ATO module is in an abnormal state, the module in a normal state can restart the module in the abnormal state, avoiding the inconvenience of restarting the entire system due to partial device malfunctions.

[0060] Figure 2 This is a second schematic diagram of the structure of the self-restarting device for an in-vehicle safety computer provided by the present invention, as shown below. Figure 2 As shown, according to the present invention, a self-restarting device for an in-vehicle safety computer may further include a third relay module 150.

[0061] The third relay module 150 is disposed between the ATO module 110 and the first relay module 120, and is connected to the execution module 140;

[0062] ATP module 100 is also used to send a second instruction to execution module 140;

[0063] The execution module 140 is also used to send a restart prohibition control signal to the third relay module 150 after receiving the second instruction sent by the ATP module 100;

[0064] The third relay module 150 is used to prevent the ATP module 100 from restarting.

[0065] Specifically, a third relay module can be added to the device and placed between the first relay and the ATO module, and the execution module can be connected to the third relay module.

[0066] When the ATP module is in normal output mode, the ATP module can send a second instruction to the execution module. The second instruction is used to instruct the execution module to perform an operation to prevent the ATP module from restarting. Therefore, after receiving the second instruction sent by the ATP module, the execution module can send a restart prevention control signal to the third relay module. The relay in the third relay module is a normally closed relay, which can remain open after receiving the restart prevention control signal sent by the execution module, so that the ATO module cannot send a restart control signal to the first relay module.

[0067] Understandably, when the ATP module is in an abnormal state, it cannot send a second instruction to the execution module. The execution module will not send a restart prohibition control signal to the third relay module. The relays in the third relay module are normally closed relays, which remain closed in the absence of a restart prohibition control signal from the execution module. Thus, the ATO module can send a restart control signal to the first relay module.

[0068] Therefore, by adding a third relay module to the device and placing it between the first relay module and the ATO module, and connecting the execution module to the third relay module, the restart control signal sent by the ATO module can be rendered invalid when the ATP module is in normal output mode. This prevents the first relay module, which controls the restart of the ATO module, from malfunctioning and causing the ATP module to stop working.

[0069] According to the present invention, a self-restarting device for an in-vehicle safety computer is provided, wherein the ATP module includes two ATP units with parallel outputs.

[0070] Specifically, the ATP module in this embodiment of the invention can be composed of two ATP units with parallel outputs. Even if one ATP unit malfunctions or has no output, the other ATP unit can still work normally and output, thereby ensuring the reliability of the ATP module in restarting the ATO module.

[0071] According to the present invention, an ATO module for an in-vehicle safety computer includes two ATO units with parallel outputs.

[0072] Specifically, the ATO module in this embodiment of the invention can be composed of two ATO units with parallel outputs. Even if one ATO unit malfunctions or has no output, the other ATO unit can still work normally and output, thereby ensuring the reliability of the ATO module in restarting the ATP module.

[0073] According to the present invention, a self-restarting device for an in-vehicle safety computer includes a first relay module comprising two relays connected in parallel; and / or, a second relay module comprising two relays connected in parallel.

[0074] Specifically, in this embodiment of the invention, the first relay module may include two relays connected in parallel; or, the second relay module may include two relays connected in parallel; or, the first relay module includes two relays connected in parallel, and the second relay module also includes two relays connected in parallel.

[0075] For the first relay module, two relays are used for parallel control. Even if one of the relays malfunctions and cannot be engaged, it will not affect the normal operation of the ATP module in the device. For the second relay module, two relays are used for parallel control. Even if one of the relays malfunctions and cannot be engaged, it will not affect the normal operation of the ATO module in the device.

[0076] The self-rebooting method for an in-vehicle safety computer provided by the present invention is described below. The self-rebooting method for an in-vehicle safety computer provided by the present invention can be applied to the self-rebooting device for an in-vehicle safety computer provided by the present invention.

[0077] Figure 3 This is one of the flowcharts illustrating a self-rebooting method for an in-vehicle safety computer provided by the present invention. This method is applied to any of the self-rebooting devices for an in-vehicle safety computer described above, such as... Figure 3 As shown, the method includes the following steps:

[0078] Step 300: If the ATP module is detected to be in an abnormal state, the ATO module sends a restart control signal to the first relay module.

[0079] Step 301: After receiving the restart control signal sent by the ATO module, the first relay module controls the ATP module to restart.

[0080] Specifically, this method can be applied to the self-restarting device for an in-vehicle safety computer provided by the present invention, which may include at least an ATP module, an ATO module, a first relay module, a second relay module, and an execution module.

[0081] The ATP module and ATO module are connected via a backplane bus and can communicate with each other, allowing one module to detect whether the other is in an abnormal state. For example, if the ATP module does not receive a signal from the ATO module for a period of time, the ATO module can be considered to be in an abnormal state; similarly, if the ATO module does not receive a signal from the ATP module for a period of time, the ATP module can be considered to be in an abnormal state.

[0082] In this embodiment of the invention, it is necessary to enable the ATP module to be restarted through the ATO module when the ATP module is in an abnormal state. Therefore, the ATO module, the first relay module and the ATP module can be connected in sequence.

[0083] If the ATP module is detected to be in an abnormal state, the ATO module can send a restart control signal to the first relay module. The relay in the first relay module is a normally closed relay, which can open and close again after receiving the restart control signal sent by the ATO module, thereby controlling the restart of the ATP module.

[0084] The self-restart method for an in-vehicle safety computer provided by the present invention involves the ATO module sending a restart control signal to the first relay module when the ATP module is detected to be in an abnormal state. After receiving the restart control signal sent by the ATO module, the first relay module controls the restart of the ATP module. Thus, when the ATP module is in an abnormal state, the ATP module can be restarted by the ATO module in a normal state, avoiding the inconvenience caused by restarting the entire system when some devices malfunction.

[0085] A self-rebooting method for an in-vehicle safety computer according to the present invention further includes:

[0086] The ATP module sends a second instruction to the execution module;

[0087] After receiving the second instruction from the ATP module, the execution module sends a restart prohibition control signal to the third relay module;

[0088] Upon receiving the restart prohibition control signal sent by the execution module, the third relay module disconnects.

[0089] Specifically, in the case where the self-restart device for an in-vehicle safety computer provided by the present invention further includes a third relay module, the third relay module is disposed between the first relay and the ATO module, and the execution module is connected to the third relay module.

[0090] When the ATP module is in normal output mode, the ATP module can send a second instruction to the execution module. The second instruction is used to instruct the execution module to perform an operation to prevent the ATP module from restarting. Therefore, after receiving the second instruction sent by the ATP module, the execution module can send a restart prevention control signal to the third relay module. The relay in the third relay module is a normally closed relay, which can remain open after receiving the restart prevention control signal sent by the execution module, so that the ATO module cannot send a restart control signal to the first relay module.

[0091] Understandably, when the ATP module is in an abnormal state, it cannot send a second instruction to the execution module. The execution module will not send a restart prohibition control signal to the third relay module. The relays in the third relay module are normally closed relays, which remain closed in the absence of a restart prohibition control signal from the execution module. Thus, the ATO module can send a restart control signal to the first relay module.

[0092] Therefore, by sending a second instruction to the execution module through the ATP module, the execution module sends a restart prohibition control signal to the third relay module after receiving the second instruction from the ATP module. The relay in the third relay module disconnects after receiving the restart prohibition control signal from the execution module, which makes the restart control signal sent by the ATO module invalid when the ATP module is in normal output, thus avoiding the first relay module controlling the restart of the ATO module from malfunctioning and causing the ATP module to stop working.

[0093] Figure 4 This is a second flowchart illustrating the self-reboot method for an in-vehicle safety computer provided by the present invention. This method is applied to any of the self-reboot devices for in-vehicle safety computers described above, such as... Figure 4 As shown, the method includes the following steps:

[0094] Step 400: If the ATO module is detected to be in an abnormal state, the ATP module sends the first instruction to the execution module.

[0095] Step 401: After receiving the first instruction sent by the ATP module, the execution module sends a restart control signal to the second relay module.

[0096] Step 402: After receiving the restart control signal sent by the execution module, the second relay module controls the ATO module to restart.

[0097] Specifically, this method can be applied to the self-restarting device for an in-vehicle safety computer provided by the present invention, which may include at least an ATP module, an ATO module, a first relay module, a second relay module, and an execution module.

[0098] The ATP module and ATO module are connected via a backplane bus and can communicate with each other, allowing one module to detect whether the other is in an abnormal state. For example, if the ATP module does not receive a signal from the ATO module for a period of time, the ATO module can be considered to be in an abnormal state; similarly, if the ATO module does not receive a signal from the ATP module for a period of time, the ATP module can be considered to be in an abnormal state.

[0099] In this embodiment of the invention, it is necessary to enable the ATO module to be restarted through the ATP module when the ATO module is in an abnormal state. Therefore, the ATP module, execution module, second relay module and ATO module can be connected in sequence.

[0100] If the ATO module is detected to be in an abnormal state, the ATP module can send a first instruction to the execution module. The first instruction is used to instruct the execution module to perform a restart operation of the ATO module. Therefore, after receiving the first instruction sent by the ATP module, the execution module can send a restart control signal to the second relay module. The relay in the second relay module is a normally closed relay, which can open and close again after receiving the restart control signal sent by the execution module, thereby controlling the restart of the ATO module.

[0101] The execution module can be an FIO module, which can receive instructions from the ATP module and perform subsequent operations according to the ATP module.

[0102] The self-restart method for an in-vehicle safety computer provided by this invention involves the ATP module sending a first instruction to the execution module when the ATO module is detected to be in an abnormal state. After receiving the first instruction from the ATP module, the execution module sends a restart control signal to the second relay module. After receiving the restart control signal from the execution module, the second relay module controls the restart of the ATO module. Thus, when the ATO module is in an abnormal state, it can be restarted by the ATP module in a normal state, avoiding the inconvenience caused by restarting the entire system when some devices malfunction.

[0103] A self-rebooting method for an in-vehicle safety computer according to the present invention further includes:

[0104] Before the ATP module sends the first instruction to the execution module, it determines whether the ATO module is allowed to restart itself.

[0105] Specifically, conditions for allowing or disallowing the ATO module to restart itself can be preset. When the ATO module is detected to be in an abnormal state, before the ATP module sends the first instruction to the execution module, it can determine whether to allow the ATO module to restart itself based on the conditions for allowing or disallowing the ATO module to restart itself.

[0106] Furthermore, upon detecting an abnormal state in the ATO module, the ATP module sends a first instruction to the execution module, specifically including:

[0107] If the ATO module is allowed to restart itself and an abnormal state is detected in the ATO module, the ATP module sends a first instruction to the execution module, thereby restarting the ATO module. For example, the condition that the ATO module is not allowed to restart itself could be that the train is approaching a station. If the train is not currently approaching a station, and the ATP module detects a fault in the ATO module, it determines that the ATO module is allowed to restart itself and sends a first instruction to the execution module.

[0108] If the ATO module is determined to be disallowed from self-restarting, the ATP module may not send the first instruction to the execution module, thus preventing the ATO module from restarting. For example, a condition that disallows the ATO module from self-restarting could be that the train is approaching a station. In this case, if the ATP module detects a fault in the ATO module during the train's approach to the station, it will not send the first instruction to the execution module.

[0109] The conditions for ATO module self-restart are set according to the actual situation, and a judgment is made before restarting ATO module through ATP module. If ATO module self-restart is allowed and ATO module is detected to be in an abnormal state, ATP module sends the first instruction to execution module, which can more reasonably control ATO module self-restart.

[0110] The following examples, through specific application scenarios, further illustrate the self-restarting device and self-restarting method for vehicle-mounted safety computers provided by the present invention.

[0111] Figure 5 This is a flowchart illustrating the self-restart control method for ATO and ATP provided by the present invention, as shown below. Figure 5 As shown, the control principle of this method includes:

[0112] 1. ATO module controls ATP module restart: The ATP module restart is controlled by the ATO module. The ATO module provides the restart control signal, which is output by two ATO mainboards in parallel. Relay restart control is used, and a restart disable circuit is included.

[0113] Figure 6 The present invention provides a partial circuit diagram of a resetting relay and a restart relay, as shown below. Figure 6 As shown, when the ATP module is working normally, it can output a restart prohibition control signal to the restart prohibition relay. The restart prohibition relay is a normally closed contact. After receiving the restart prohibition control signal, the contact opens. At this time, the restart relay cannot receive the restart control signal, thus prohibiting the ATP module from restarting itself.

[0114] When the ATP module malfunctions, it cannot output a restart prohibition control signal to the restart prohibition relay. The contacts of the restart prohibition relay remain closed. At this time, the restart relay can receive the restart control signal, which allows the ATP module to restart itself. The ATO module can control the ATP module to restart.

[0115] 2. ATP module controls ATO module restart: The ATO module restart is controlled by the ATP module. The ATP module provides the restart control signal. The ATP module includes two ATP units, and either ATP unit can control the ATO module to restart.

[0116] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0117] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0118] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A self-restarting device for an in-vehicle safety computer, characterized in that, include: The system includes an Automatic Train Protection (ATP) module, an Automatic Train Operation (ATO) module, a first relay module, a second relay module, and an execution module. The ATP module is connected to both the first relay module and the execution module; the ATO module is connected to both the first relay module and the second relay module; the execution module is connected to the second relay module. The ATP module is used to send a first instruction to the execution module when the ATO module is detected to be in an abnormal state. The execution module is used to send a restart control signal to the second relay module after receiving the first instruction sent by the ATP module; The ATO module is used to send a restart control signal to the first relay module when the ATP module is detected to be in an abnormal state. The first relay module is used to control the restart of the ATP module; the second relay module is used to control the restart of the ATO module.

2. The self-restarting device for an in-vehicle safety computer according to claim 1, characterized in that, The device also includes a third relay module; The third relay module is disposed between the ATO module and the first relay module, and is connected to the execution module; The ATP module is also used to send a second instruction to the execution module; The execution module is also configured to send a restart prohibition control signal to the third relay module after receiving the second instruction sent by the ATP module; The third relay module is used to prevent the ATP module from restarting.

3. The self-restarting device for an in-vehicle safety computer according to claim 1, characterized in that, The ATP module includes two ATP units with parallel outputs.

4. The self-restarting device for an in-vehicle safety computer according to claim 1, characterized in that, The ATO module includes two ATO units with parallel outputs.

5. The self-restarting device for an in-vehicle safety computer according to claim 1, characterized in that, The first relay module includes two relays connected in parallel; and / or, the second relay module includes two relays connected in parallel.

6. A self-rebooting method for an in-vehicle safety computer, characterized in that, The self-rebooting device for an in-vehicle safety computer as described in any one of claims 1 to 5 comprises: If the ATP module is detected to be in an abnormal state, the ATO module sends a restart control signal to the first relay module; Upon receiving the restart control signal sent by the ATO module, the first relay module controls the ATP module to restart.

7. The self-rebooting method for an in-vehicle safety computer according to claim 6, characterized in that, The method further includes: The ATP module sends a second instruction to the execution module; After receiving the second instruction from the ATP module, the execution module sends a restart prohibition control signal to the third relay module; Upon receiving the restart prohibition control signal sent by the execution module, the third relay module disconnects.

8. A self-rebooting method for an in-vehicle safety computer, characterized in that, The self-rebooting device for an in-vehicle safety computer as described in any one of claims 1 to 5 comprises: If the ATO module is detected to be in an abnormal state, the ATP module sends a first instruction to the execution module; wherein, before the ATP module sends the first instruction to the execution module, it is determined whether the ATO module is allowed to self-restart; if the ATO module is allowed to self-restart and the ATO module is detected to be in an abnormal state, the ATP module sends the first instruction to the execution module. After receiving the first instruction from the ATP module, the execution module sends a restart control signal to the second relay module; Upon receiving the restart control signal sent by the execution module, the second relay module controls the ATO module to restart.

Images