A rail transit traction and braking fusion control architecture and method

Abstract

The present invention relates to a rail transit traction and braking fusion control architecture and method. The fusion control architecture includes a low-safety system and a high-safety system integrated in the same fusion controller. The low-safety system adopts a software and hardware design that meets SIL2 requirements, and the high-safety system adopts a software and hardware design that meets SIL4 requirements. Traction control-related boards are provided in the low-safety system, and traction control-related data are transmitted using a CAN bus. Braking control-related boards are provided in the high-safety system, and brake control-related data are transmitted using a CANFD bus. The high and low safety systems communicate via an EtherCAT bus, thereby realizing the fusion of traction and braking control functions. The present invention realizes the fusion of traction and braking functions while meeting the respective safety level requirements of train traction and braking, thereby improving the real-time performance of data transmission between train traction and braking control, and thereby improving the response speed of train traction and braking.

Description

Technical Field

[0001] The present invention belongs to the field of rail transit technology, and in particular relates to a rail transit traction and braking fusion control architecture and method. Background Art

[0002] The central control system of a rail train connects various intelligent units distributed throughout the train, such as the traction control system and the brake control system, into a single train network via the train communication network. In existing rail trains, the traction control system and brake control system typically have independent controllers. The overall topology between the two systems is complex, and the signal links between them are lengthy. This results in significant delays in real-time data transmission, impacting the traction and brake response speed. Furthermore, existing traction control and brake control systems mostly implement internal data exchange via traditional buses such as RS485 / RS422 and PCI. These backplane bus platforms have poor portability and cannot meet the needs of large data transmission.

[0003] There are some designs in the existing technology for rail train control architectures that integrate traction and braking control functions. However, the existing traction and braking fusion control architectures usually adopt a functionally single design model and only consider the implementation of traction and braking control functions. With the development of rail transit technology, the safety requirements for rail transit vehicle design are becoming increasingly higher. The traction control and braking control of the train involve different SIL safety levels respectively. The transmission of traction control-related data usually needs to meet the SIL2 safety level requirements, while the transmission of braking control-related data needs to meet at least the SIL3 safety level requirements. The design of the existing traction and braking fusion control architecture cannot meet the integration of traction control and braking control with different functional safety levels. Summary of the Invention

[0004] The purpose of the present invention is to solve one of the above technical problems and provide a rail transit traction and braking fusion control architecture and method that integrates traction control function and braking control function while meeting the respective safety level requirements.

[0005] To achieve the above object, the technical solution adopted by the present invention is:

[0006] A rail transit traction and braking fusion control architecture, comprising: a low-safety system and a high-safety system integrated in the same fusion controller;

[0007] The low-safety system adopts hardware design and software design that meet SIL2 requirements, including the main processor module, traction calculation acquisition module and non-safety I / O module;

[0008] The high-safety system adopts hardware and software design that meets SIL4 requirements, including brake control module and safety I / O module;

[0009] The main processor module accesses the traction operation acquisition module and the brake control module through the EtherCAT bus to complete data interaction for bus management scheduling, traction logic control and brake control;

[0010] The main processor module accesses the resources of the non-safety I / O module through the CAN bus, receives the digital and analog signals that meet the SIL2 requirements collected by the non-safety I / O module, and outputs the digital and analog signals that meet the SIL2 requirements through the non-safety I / O module;

[0011] The brake control module accesses the resources of the safety I / O module through the CANFD bus, receives the digital signals and analog signals that meet the SIL4 requirements collected by the safety I / O module, and outputs the digital signals and analog signals that meet the SIL4 requirements through the safety I / O module.

[0012] In some embodiments of the present invention, the main processor module adopts hardware design and software design that meet SIL2 requirements, including a main processor board and a main processor control program;

[0013] The main processor board adopts a dual-CPU redundant design. The two CPUs of the main processor board communicate with each other in real time via Ethernet and serve as hot standby redundancy. Both CPUs run the main processor control program to perform bus management scheduling, traction logic control and braking control.

[0014] In some embodiments of the present invention, the main processor board adopts a dual EtherCAT master redundant architecture, which includes two EtherCAT masters and multiple EtherCAT slaves; the two CPUs of the main processor board respectively control the two EtherCAT masters, and the two EtherCAT masters and multiple EtherCAT slaves are connected using a ring topology.

[0015] In some embodiments of the present invention, the main processor board adopts a multi-core CPU, and the multiple cores of the multi-core CPU are configured to run separate operating systems based on virtualization technology. The bus management scheduling, traction logic control and braking control of the main processor board run on different cores respectively.

[0016] In some embodiments of the present invention, the main processor board provides at least one MVB communication interface, at least one Ethernet communication interface supporting the TRDP protocol, and at least one CAN communication interface.

[0017] In some embodiments of the present invention, the traction operation acquisition module adopts hardware design and software design that meet SIL2 requirements, including a fast analog acquisition board, a pulse interface board, a traction operation control board and traction logic scheduling control software;

[0018] The traction operation control board is connected to the fast analog acquisition board and the pulse interface board;

[0019] The traction operation control board adopts a dual DSP chip redundant design. It controls the fast analog acquisition board to collect fast analog data by running the traction logic scheduling control software, and controls the pulse interface board to output pulses.

[0020] In some embodiments of the present invention, the brake control module adopts hardware design and software design that meet SIL4 requirements, including a brake control board and brake control software; the brake control board performs normal braking control, emergency braking control and anti-skid control of the train by running the brake control software.

[0021] In some embodiments of the present invention, the non-safety I / O module includes an analog input board, an analog output board, a digital input board, and a digital output board that meet SIL2 functional safety requirements;

[0022] Each board in the non-safety I / O module adopts a single CPU design. It collects single-channel digital and analog signals that meet SIL2 requirements by running non-safety I / O control software that meets SIL2 functional safety requirements, and outputs single-channel digital and analog signals that meet SIL2 requirements.

[0023] In some embodiments of the present invention, the safety I / O module includes an analog input board, an analog output board, a digital input board, and a digital output board that meet SIL4 functional safety requirements;

[0024] Each board in the safety I / O module adopts a dual-CPU design. By running the safety I / O control software that meets the SIL4 functional safety requirements, it collects two digital signals and analog signals that meet the SIL4 requirements, and outputs two digital signals and analog signals that meet the SIL4 requirements. The input board in the safety I / O module collects digital signals and analog signals that meet the SIL4 functional safety requirements, verifies and compares the collected data, and finally selects one trusted data to provide to the brake control module for use.

[0025] Some embodiments of the present invention further provide a rail transit traction and braking fusion control method, comprising the following steps:

[0026] Integrate the traction control and braking control of rail vehicles into the same fusion controller, and divide the fusion controller into a high-safety system and a low-safety system;

[0027] Configure the main processor module, traction operation acquisition module and non-safety I / O module that meet SIL2 requirements in the low-safety system;

[0028] Configure brake control modules and safety I / O modules that meet SIL4 requirements in high-safety systems;

[0029] The main processor module, traction operation and acquisition module, and brake control module are connected using the EtherCAT bus. The main processor module accesses the traction operation and acquisition module and the brake control module through the EtherCAT bus to complete data exchange for bus management scheduling, traction logic control, and brake control.

[0030] The main processor module and the non-safety I / O module are connected using the CAN bus. The main processor module accesses the resources of the non-safety I / O module through the CAN bus, receives the digital and analog signals meeting the SIL2 requirements collected by the non-safety I / O module, and outputs the digital and analog signals meeting the SIL2 requirements through the non-safety I / O module.

[0031] The brake control module and the safety I / O module are connected using the CANFD bus. The brake control module accesses the resources of the safety I / O module through the CANFD bus, receives the digital and analog signals that meet the SIL4 requirements collected by the safety I / O module, and outputs the digital and analog signals that meet the SIL4 requirements through the safety I / O module.

[0032] The beneficial effects of the present invention are:

[0033] 1. The present invention integrates the traction control and braking control of rail trains into a single controller. With the main processor board as the core, the traction operation and acquisition board and the braking control board are connected via the EtherCAT high-speed bus to achieve real-time data exchange. This reduces the complexity of the overall topology of the train's traction and braking control, shortens the data link for information exchange between the traction and braking controls, improves the real-time performance of data transmission, and thus enhances the response speed of the train's traction and braking.

[0034] 2. This invention uses the CAN bus to transmit SIL2-level traction control-related data and the CANFD bus to transmit SIL4-level brake control-related data, enabling the independent and coexistence of high-safety and low-safety systems within the same integrated controller. Communication between the high-safety and low-safety systems occurs via the EtherCAT bus, integrating traction and brake control functions while meeting their respective safety level requirements, thus meeting the increasingly stringent safety requirements of rail transit vehicle design.

[0035] 3. The main processor board and traction calculation and acquisition board provided by the present invention all adopt a hot standby redundant design, and the EtherCAT bus adopts a dual-master redundant design, which can realize fault diagnosis and redundant switching of redundant circuits, thereby improving the reliability of the integrated control architecture and the safety of train traction and braking control;

[0036] 4. The non-safety I / O module and safety I / O module in the fusion controller provided by the present invention are independently designed and have their own external interfaces. The input board and output board in the module can be flexibly configured according to the actual needs of the train, and can adapt to the traction and braking requirements of rail trains of different models, and have high versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0038] Figure 1 This is a schematic diagram of the structure of the rail transit traction and braking fusion control architecture provided by the present invention;

[0039] Figure 2 This is a software architecture diagram of the rail transit traction and braking fusion control architecture provided by the present invention;

[0040] Figure 3 This is a flow chart of the rail transit traction and braking fusion control method provided by the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of this application more clearly understood, the present application is described and illustrated below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely used to explain this application and are not intended to limit this application. Based on the embodiments provided in this application, all other embodiments obtained by those of ordinary skill in the art without making any creative efforts are within the scope of protection of this application.

[0042] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0043] In the absence of conflict, the embodiments of the present invention and the features thereof may be combined with each other.

[0044] The technical solution of the present invention is described in detail below in conjunction with specific embodiments and the accompanying drawings.

[0045] As attached Figure 1-2 As shown, in an illustrative embodiment of a rail transit traction and braking fusion control architecture of the present invention, the fusion control architecture includes a low-safety system and a high-safety system integrated in the same fusion controller, and both the low-safety system and the high-safety system include a hardware design part and a software design part.

[0046] Among them, the low-safety system adopts hardware design and software design that can meet the highest SIL2 requirements. The low-safety system is compatible with the transmission of data with SIL2, SIL1 and SIL0 safety levels, including the main processor module, traction operation acquisition module and non-safety I / O module.

[0047] The high-safety system adopts hardware design and software design that meet SIL4 requirements. The high-safety system is compatible with the transmission of data of SIL3 and SIL4 safety levels, including the brake control module and safety I / O module.

[0048] The main processor module accesses the traction calculation and acquisition module and the brake control module via the EtherCAT bus, completing data exchange for bus management and scheduling, traction logic control, brake control, and fault process data recording. EtherCAT offers the advantages of high speed, low latency, precise synchronization, flexible topology, and high reliability. Within the same controller, the main processor module connects the traction calculation and acquisition module and the brake control module via the same EtherCAT bus, which helps improve the real-time data transmission between the traction and brake control modules, thereby increasing the responsiveness of the train's traction and braking.

[0049] The data collected by the non-safety I / O module is SIL2-level data with lower real-time requirements. Therefore, the main processor module accesses the resources of the non-safety I / O module through the CAN bus, receives the digital signals and analog signals that meet the SIL2 requirements collected by the non-safety I / O module, and outputs the digital signals and analog signals that meet the SIL2 requirements through the non-safety I / O module.

[0050] The data collected by the safety I / O module is SIL4-level data with a large amount of data. Therefore, the brake control module accesses the resources of the safety I / O module through the CANFD bus, receives the digital signals and analog signals that meet the SIL4 requirements collected by the safety I / O module, and outputs the digital signals and analog signals that meet the SIL4 requirements through the safety I / O module.

[0051] The traction-brake fusion control architecture provided by the present invention integrates the train traction and braking control functions and saves hardware resources such as MVB communication modules, fault storage, and human-machine interfaces, avoiding waste of hardware resources, reducing the complexity of the traction-brake control system in the train, and improving the reliability and maintainability of the system.

[0052] In some embodiments of the present invention, the main processor module adopts hardware design and software design that meet SIL2 requirements, including a main processor board and a main processor control program running on the main processor board.

[0053] The main processor board utilizes a dual-CPU redundant design, with two CPUs, CPU1 and CPU2, respectively. Its hardware architecture conforms to the 1OO1D (1 out of 1 with Diagnostic) model. This architecture incorporates self-diagnostic capabilities, enabling fault diagnosis and redundancy switching for each redundant circuit, enhancing the reliability of the main processor board. The two CPUs communicate with each other in real time via Ethernet, providing hot standby redundancy. Both CPUs run the main processor control program, which performs bus management and scheduling, traction logic control, braking control, and fault process data logging. Virtualization technology enables internal communication between the traction logic control and braking control.

[0054] The main processor board provides a CAN communication interface facing the inside of the fusion controller so as to connect to the non-safety I / O board through the CAN bus and access the resources of the non-safety I / O board.

[0055] Further, as attached Figure 2 As shown in the figure, the main processor board adopts a dual EtherCAT master redundant architecture, which includes two EtherCAT masters and multiple EtherCAT slaves. The two CPUs of the main processor board respectively control the two EtherCAT masters, and the multiple EtherCAT slaves are controlled by the CPUs of other boards connected to the main processor board in the fusion controller. The two EtherCAT masters and multiple EtherCAT slaves are connected in a ring topology.

[0056] When the device is powered on, CPU1 of the main processor board is in active state to control the EtherCAT bus, and CPU2 is in hot standby. When CPU1 fails, it can automatically switch to CPU2 to control the EtherCAT bus and realize the master station communication function. The ring topology structure of the link can ensure that if a failure occurs somewhere in the link, the EtherCAT master station can still maintain data transmission with each slave station, greatly enhancing the stability and maintainability of the system.

[0057] Furthermore, the main processor board utilizes a multi-core CPU. Each core of the multi-core CPU is configured to run a separate operating system based on virtualization technology. Bus management and scheduling, traction logic control, braking control, and fault process data logging for the main processor board run on separate cores. Software also implements physical and temporal isolation between the different operating systems to ensure their security. High-speed data exchange between cores is achieved through shared memory between the operating systems, further improving the safety of both traction and braking control, as well as the speed of information exchange between them.

[0058] The multi-core CPU of the main processor board can also be deployed with different security levels based on virtualization technology, allowing secure and non-secure applications to run in parallel on their respective cores. The cores at each security level can run unmodified guest operating systems.

[0059] In some embodiments of the present invention, the main processor board provides at least one MVB communication interface, at least one Ethernet communication interface supporting TRDP agreement and at least one CAN communication interface, to meet the requirement of train MVB and Ethernet networking. In the present embodiment, the main processor board provides two MVB communication interfaces, two Ethernet communication interfaces supporting TRDP agreement and two CAN communication interfaces, to meet the demand of vehicle-to-vehicle equipment communication, reduce train wiring.

[0060] In some embodiments of the present invention, the traction operation acquisition module adopts hardware design and software design that meet SIL2 requirements, including a fast analog acquisition board, a pulse interface board and a traction operation control board interconnected by connectors, as well as traction logic scheduling control software running on the fast analog acquisition board.

[0061] The traction operation control board uses a dual-core C28x architecture DSP chip and a single-board dual-DSP chip redundant design to implement data interaction with the backplane EtherCAT bus, analog data acquisition, speed acquisition, rapid fault protection, pulse output, chopping control, and algorithmic operations. The DSP chip communicates with the fast analog acquisition board via the SPI bus, controls the fast analog acquisition board to collect fast analog data by running the traction logic scheduling control software, and controls the pulse interface board to output pulses. Compared to the FPGA+DSP architecture design in the prior art, the architectural design of the traction operation control board in this invention reduces the data transmission risks brought about by the FPGA as a data transfer station, enables rapid control of the inverter, and thus improves the traction response speed of the train.

[0062] In some embodiments of the present invention, the brake control module adopts hardware design and software design that meet SIL4 requirements, including a brake control board and brake control software; the brake control board provides train common brake management, parking and holding brake control, emergency brake control, rapid brake control and anti-skid control through the running brake control software.

[0063] In some embodiments of the present invention, the non-safety I / O module includes an analog input board, an analog output board, a digital input board, and a digital output board that meet SIL2 functional safety requirements. The non-safety I / O module has its own external interface. The number of input boards and output boards in the module can be flexibly configured according to the actual needs of the train, and includes at least one input board and one output board.

[0064] The input and output boards in the non-safety I / O module are both designed with a single CPU. By running non-safety I / O control software that meets SIL2 functional safety requirements, they collect single-channel digital and analog signals that meet SIL2 requirements, and output single-channel digital and analog signals that meet SIL2 requirements.

[0065] In some embodiments of the present invention, the safety I / O module includes an analog input board, an analog output board, a digital input board, and a digital output board that meet SIL4 functional safety requirements; the safety I / O module has its own external interface, and the number of input boards and output boards in the module can be flexibly configured according to the actual needs of the train, including at least one input board and one output board.

[0066] Because the safety I / O module collects and outputs data at a high safety level, each input and output board in the module utilizes a dual-CPU design. These boards, running safety I / O control software that meets SIL4 functional safety requirements, collect two digital and analog signals that meet SIL4 requirements, and output two digital and analog signals that meet SIL4 requirements. After collecting digital and analog signals that meet SIL4 functional safety requirements, the input boards in the safety I / O module verify and compare the collected data, ultimately selecting a trusted data source and providing it to the brake control module, further ensuring the security of brake-related data transmission.

[0067] The fusion controller provided by the present invention adopts a high-strength reinforced chassis, and the mechanical dimensions of each board in the fusion controller are 100mm*160mm.

[0068] The fusion controller further includes a power module, which is composed of a power board. Its main function is to electrically connect with the various boards in the fusion controller, provide power to each board, power the various sensors in the train traction and braking fusion control system, and power the train's inverter drive board.

[0069] The software architecture corresponding to the traction brake fusion control architecture provided by the present invention is shown in the attached Figure 2 As shown in the figure, the software related to traction and braking control is modularly designed according to their respective functions. The software of each functional module is relatively independent. At the same time, there are strict signal interface definitions between modules. Data exchange is carried out through EtherCAT, CAN and CANFD buses to ensure that the data transmitted between the software is real-time and effective.

[0070] As attached Figure 3 As shown, some embodiments of the present invention further provide a rail transit traction and braking fusion control method, which includes the following steps.

[0071] Integrate the traction control and braking control of rail vehicles into the same fusion controller, and divide the fusion controller into a high-safety system and a low-safety system;

[0072] Configure the main processor module, traction operation acquisition module and non-safety I / O module that meet SIL2 requirements in the low-safety system;

[0073] Configure brake control modules and safety I / O modules that meet SIL4 requirements in high-safety systems;

[0074] The main processor module, traction operation and acquisition module, and brake control module are connected using the EtherCAT bus. The main processor module accesses the traction operation and acquisition module and the brake control module through the EtherCAT bus to complete data exchange for bus management scheduling, traction logic control, and brake control.

[0075] The main processor module and non-safety I / O module are connected using the CAN bus. The main processor module accesses the resources of the non-safety I / O module through the CAN bus, receives digital signals and analog signals that meet SIL2 requirements collected by the non-safety I / O module, and outputs digital signals and analog signals that meet SIL2 requirements through the non-safety I / O module.

[0076] The brake control module and the safety I / O module are connected using the CANFD bus. The brake control module accesses the resources of the safety I / O module through the CANFD bus, receives the digital and analog signals that meet the SIL4 requirements collected by the safety I / O module, and outputs the digital and analog signals that meet the SIL4 requirements through the safety I / O module.

[0077] Finally, it should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0078] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the same. Although the present invention has been described in detail with reference to preferred embodiments, persons skilled in the art should understand that the specific implementation methods of the present invention may still be modified or some technical features may be replaced by equivalents without departing from the spirit of the technical solutions of the present invention, and all of these should fall within the scope of the technical solutions claimed for protection by the present invention.

Claims

1. A rail transit traction and braking fusion control architecture, characterized in that: include: Low-security and high-security systems integrated into the same fusion controller; The low-safety system adopts hardware design and software design that meets SIL2 requirements, including a main processor module, a traction calculation acquisition module and a non-safety I / O module; The high-safety system adopts hardware design and software design that meets SIL4 requirements, including brake control module and safety I / O module; The main processor module accesses the traction operation acquisition module and the brake control module through the EtherCAT bus to complete data interaction to perform bus management scheduling, traction logic control and brake control; The main processor module accesses the resources of the non-safety I / O module through the CAN bus, receives the digital signals and analog signals meeting the SIL2 requirements collected by the non-safety I / O module, and outputs the digital signals and analog signals meeting the SIL2 requirements through the non-safety I / O module; The brake control module accesses the resources of the safety I / O module through the CANFD bus, receives digital signals and analog signals that meet SIL4 requirements collected by the safety I / O module, and outputs digital signals and analog signals that meet SIL4 requirements through the safety I / O module.

2. The rail transit traction and braking fusion control architecture according to claim 1 is characterized in that: The main processor module adopts hardware design and software design that meet SIL2 requirements, including a main processor board and a main processor control program; The main processor board adopts a dual CPU redundant design. The two CPUs of the main processor board communicate with each other in real time via Ethernet and serve as hot standby redundancy. Both CPUs run the main processor control program to perform bus management scheduling, traction logic control and braking control.

3. The rail transit traction and braking fusion control architecture according to claim 2 is characterized in that: The main processor board adopts a dual EtherCAT master station redundant architecture, which includes two EtherCAT master stations and multiple EtherCAT slave stations; the two CPUs of the main processor board respectively control the two EtherCAT master stations, and the two EtherCAT master stations and multiple EtherCAT slave stations are connected using a ring topology.

4. The rail transit traction and braking fusion control architecture according to claim 2 or 3, characterized in that: The main processor board adopts a multi-core CPU, and the multiple cores of the multi-core CPU are configured to run separate operating systems based on virtualization technology. The bus management scheduling, traction logic control and braking control of the main processor board run on different cores respectively.

5. The rail transit traction and braking fusion control architecture according to claim 2 or 3, characterized in that: The main processor board provides at least one MVB communication interface, at least one Ethernet communication interface supporting the TRDP protocol, and at least one CAN communication interface.

6. The rail transit traction and braking fusion control architecture according to claim 1 is characterized in that: The traction operation acquisition module adopts hardware design and software design that meet SIL2 requirements, including fast analog acquisition board, pulse interface board, traction operation control board and traction logic scheduling control software; The traction operation control board is in communication with the fast analog quantity acquisition board and the pulse interface board; The traction operation control board adopts a dual DSP chip redundant design, and controls the fast analog acquisition board to collect fast analog data and controls the pulse interface board to output pulses by running the traction logic scheduling control software.

7. The rail transit traction and braking fusion control architecture according to claim 1 is characterized in that: The brake control module adopts hardware design and software design that meet SIL4 requirements, including a brake control board and brake control software; the brake control board performs normal braking control, emergency braking control and anti-skid control of the train by running the brake control software.

8. The rail transit traction and braking fusion control architecture according to claim 1, characterized in that: The non-safety I / O modules include analog input boards, analog output boards, digital input boards, and digital output boards that meet SIL2 functional safety requirements; Each board in the non-safety I / O module adopts a single CPU design, and collects a single-channel digital signal and analog signal that meets the SIL2 requirements by running non-safety I / O control software that meets the SIL2 functional safety requirements, and outputs a single-channel digital signal and analog signal that meets the SIL2 requirements.

9. The rail transit traction and braking fusion control architecture according to claim 1 or 8, characterized in that: The safety I / O module includes an analog input board, an analog output board, a digital input board, and a digital output board that meet SIL4 functional safety requirements; Each board in the safety I / O module adopts a dual CPU design, and collects two digital signals and analog signals that meet SIL4 requirements by running safety I / O control software that meets SIL4 functional safety requirements, and outputs two digital signals and analog signals that meet SIL4 requirements; the input board in the safety I / O module collects digital signals and analog signals that meet SIL4 functional safety requirements, verifies and compares the collected data, and finally selects one channel of trusted data to provide to the brake control module for use.

10. A rail transit traction and braking fusion control method, adopting the rail transit traction and braking fusion control architecture according to any one of claims 1 to 9, characterized in that: The following steps are involved: Integrating traction control and braking control of a rail vehicle into a single fusion controller, and dividing the fusion controller into a high-safety system and a low-safety system; Configure a main processor module, a traction operation acquisition module, and a non-safety I / O module that meet SIL2 requirements in the low-safety system; Configuring a brake control module and a safety I / O module that meet SIL4 requirements in the high-safety system; The main processor module, traction operation and acquisition module, and brake control module are connected using the EtherCAT bus. The main processor module accesses the traction operation and acquisition module and the brake control module through the EtherCAT bus to complete data exchange for bus management scheduling, traction logic control, and brake control. The main processor module and the non-safety I / O module are connected using the CAN bus. The main processor module accesses the resources of the non-safety I / O module through the CAN bus, receives the digital and analog signals meeting the SIL2 requirements collected by the non-safety I / O module, and outputs the digital and analog signals meeting the SIL2 requirements through the non-safety I / O module. The brake control module and the safety I / O module are connected using the CANFD bus. The brake control module accesses the resources of the safety I / O module through the CANFD bus, receives the digital and analog signals that meet the SIL4 requirements collected by the safety I / O module, and outputs the digital and analog signals that meet the SIL4 requirements through the safety I / O module.

Images