High-availability safety platform and vehicle-mounted equipment
By using multiple differential processing units in the security platform to vote and form a new system, the reliability and availability of the two-match two-get two-structure structure in the event of failure is solved, and the precise positioning of the fault and the stable operation of the system is achieved.
Patent Information
- Application Number
- CN202411378092.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-30
- Publication Date
- 2024-12-10
AI Technical Summary
The existing two-by-two-two-to-two-to-two-structure cannot accurately locate the fault when the processing unit fails, resulting in a decrease in system reliability and availability, and it is difficult to recover after equipment is isolated.
Design a highly available security platform, vote through multiple differential processing units, accurately locate the fault channel, and form a new system or residual processing unit to form a security platform when a fault occurs, ensuring that the system continues to operate.
Accurate positioning and isolation of faults is achieved, the availability and reliability of the system is improved, the availability of traditional structures is reduced after unit failure is avoided, and the stability and scalability of the system is enhanced.
Smart Images
Figure CN119106001A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of rail transit safety technology, and in particular to a highly available safety platform and vehicle-mounted equipment. Background Art
[0002] Railway signal systems have extremely high requirements for reliability and safety. A commonly used system architecture is two-by-two-out-of-two. In the two-by-two-out-of-two structure, the system consists of two identical "two-out-of-two" devices (usually called the main system and the backup system). The two sets of equipment are independent of each other and form a hot standby redundant relationship. Under normal circumstances, the main system works and is responsible for external output, and the backup system is always on standby and keeps data synchronized with the main system. When the main system fails, the system automatically isolates the main system, stops its output, and immediately switches to the backup system. Each "two-out-of-two" device contains two processing units with exactly the same functions but independent logical calculations. According to the SIL4 safety requirements, the two processing units must be different. The two processing units process data simultaneously and compare their output results. Only when the output results of the two processing units are consistent will the system output the result, otherwise the system will determine the two processing units as a fault state and guide them to the safety side.
[0003] The two-by-two-take-two structure has the following disadvantages:
[0004] 1) When the comparison results of two processing units are inconsistent, it is impossible to determine which processing unit has failed, so the entire device can only be isolated, and it is also difficult to locate the fault in subsequent fault diagnosis;
[0005] 2) When one set of "two-out-of-two" equipment is isolated, only one set of "two-out-of-two" equipment is left working in the system, and its reliability and availability will be significantly reduced.
[0006] After searching, Chinese invention patent publication number CN111984585A discloses a secure computer platform compatible with 2x2-out-of-2 and 3x2-out-of-2, including a first board and a second board, wherein the first board is provided with three computing units, and the second board is provided with at least two computing units; when the secure computer switches to the 2x2-out-of-2 architecture, the two computing units in the first board and the two computing units in the second board process the input data; when the secure computer switches to the 3x2-out-of-2 architecture, the three computing units in the first board process the input data. Both architectures of the existing patent are composed of multiple computing units of the same board, and cross-board grouping is not realized, so there is a problem of low availability as long as a set of equipment is isolated.
[0007] How to achieve high availability of the security platform has become a technical problem that needs to be solved. Summary of the invention
[0008] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a highly available security platform and vehicle-mounted equipment.
[0009] The purpose of the present invention can be achieved by the following technical solutions:
[0010] According to one aspect of the present invention, there is provided a highly available security platform, comprising at least two sets of equipment, namely, series A and series B, each series comprising two different first processing units, or the security platform comprising a plurality of second processing units each of which is different from the other. When a processing unit fails, the processing unit is isolated, and a new series is formed by any two different first processing units, or the remaining different second processing units constitute the security platform.
[0011] Preferably, when a first processing unit fails, another first processing unit in the system where the first processing unit is located and a different first processing unit in another system form a new system.
[0012] Preferably, the method for determining a processing unit failure includes: comparing the calculation result of the processing unit to be determined with the calculation results of multiple processing units that are different from the processing unit; if there is no processing unit calculation result that is equal to the calculation result of the processing unit to be determined, then determining that the calculation result of the processing unit is wrong, and setting the status of the processing unit to "failure".
[0013] Preferably, the calculation result of the processing unit to be judged is compared with the calculation results of multiple processing units different from the processing unit. If at least one processing unit calculation result is equal to the calculation result of the processing unit to be judged, the calculation result of the processing unit to be judged is correct, and the status of the processing unit is set to "normal".
[0014] Preferably, the first processing unit is different from at least one first processing unit in a different system.
[0015] Preferably, if the calculation results of the two first processing units of the A system are the same, and the calculation results of the two first processing units of the B system are the same, but the calculation results of the first processing units of the A system and the B system are different, it is considered that the A system and the B system are not synchronized.
[0016] More preferably, when system A is out of sync with system B, if system A is the primary system and system B is the backup system, the backup system is taken offline and data is synchronized with the primary system, and the backup system is put into operation after synchronization with the primary system is achieved.
[0017] Preferably, the security platform is scalable.
[0018] More preferably, the security platform includes a device of series C, the series C includes two different first processing units, and the first processing unit of the series C is different from at least one first processing unit in each of the different series.
[0019] More preferably, the security platform further comprises a device of series D, the series D comprises two different first processing units, and the first processing unit of the series D is different from at least one first processing unit in each of the different series.
[0020] More preferably, when a first processing unit fails, the first processing unit is isolated, and a new system is formed by another first processing unit in the system where the first processing unit is located and a different first processing unit in another system.
[0021] Preferably, the second processing unit is expandable, wherein the expanded second processing unit is different from the other second processing units.
[0022] Preferably, the security platform is based on a two-out-of-three architecture, comprising three second processing units that are different in pairs.
[0023] Preferably, the security platform is based on a three-out-of-four architecture, comprising four second processing units that are different in pairs.
[0024] More preferably, when a certain second processing unit fails, the remaining different second processing units constitute a safety platform.
[0025] Preferably, the security platform includes at least three second processing units.
[0026] According to a second aspect of the present invention, there is provided a vehicle-mounted device, comprising the highly available security platform.
[0027] Compared with the prior art, the present invention has the following beneficial effects:
[0028] 1. The present invention performs voting through multiple different channels. When a processing unit fails, the fault channel is accurately located to the processing unit, the processing unit is isolated, and another processing unit in the system where the processing unit is located and a different processing unit in another system form a new system, or the remaining second processing units form a safety platform. Compared with the traditional two-by-two-take-two system, the present invention solves the problem that only one set of "two-take-two" equipment is left working when a processing unit fails, and improves the availability and reliability of the safety platform.
[0029] 2. Compared with the prior art, the present invention uses any two different channels to form a new system to continue the service, or the remaining second processing units form a security platform, thereby improving the availability and stability of the system.
[0030] 3. The system and processing unit of the present invention are expandable and are not limited to the traditional two-by-two-out-of-two architecture and three-out-of-two architecture, and have strong scalability. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] Figure 1This is a schematic diagram of the structure of a security platform according to Embodiment 1 of the present invention;
[0032] Figure 2 A schematic diagram of the fault isolation results of the high-availability two-by-two-out-of-two method and the traditional two-by-two-out-of-two method according to Embodiment 1 of the present invention;
[0033] Figure 3 This is a schematic diagram of the security platform structure of Example 2 of the present invention. DETAILED DESCRIPTION
[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0035] Example 1
[0036] This embodiment relates to a highly available security platform, such as Figure 1 The platform includes two sets of equipment, called A series and B series. The two processing units of A series are called A1 and A2, and the two processing units of B series are called B1 and B2. The calculation results of processing units A1, A2, B1 and B2 are called DATA_A1, DATA_A2, DATA_B1 and DATA_B2 respectively.
[0037] According to the SIL4 safety requirements, two processing units in the same system are different, and a processing unit in system A is different from at least one processing unit in system B, that is, processing units A1 and A2 are different, processing units B1 and B2 are different; processing units A1 and B2 are different, and processing units A2 and B1 are different.
[0038] In order to determine whether the calculation result (such as DATA_A1) of a processing unit (such as A1) is correct, the calculation results (such as DATA_A2 and DATA_B2) of multiple processing units (such as A2 and B2) different from the processing unit are used for comparison. If the calculation result of at least one of the latter (such as A2 and B2) is equal to the calculation result of the processing unit to be judged, the calculation result of this processing unit (such as A1) is considered to be correct, and the status of this processing unit is set to "normal"; otherwise, the calculation result of this processing unit is considered to be wrong, and the status of this processing unit (such as A1) is set to "fault", and the system should isolate it.
[0039] The rules for determining the status of each processing unit are shown in Table 1. For example, in item 2, the status of A1 and B2 must be determined.
[0040] 1) Determine A1. Because A2 is different from A1 and B2 is different from A1, DATA_A2 and DATA_B2 are compared with DATA_A1 respectively. Because DATA_A2 = DATA_A1, A1 is determined to be normal.
[0041] 2) Determine B2. Because A1 and B2 are different and B1 and B2 are different, DATA_A1, DATA_B1 and DATA_B2 are compared. Because DATA_A1≠DATA_B2 and DATA_B1≠DATA_B2, B2 is determined to be faulty.
[0042]
[0043]
[0044] For the situations of item 4 and item 13 in Table 1 (the calculation results of the two processing units of the main system are the same, and the calculation results of the two processing units of the backup system are the same, but the calculation results of the processing units of the main system and the backup system are different), it is considered that the backup system is not synchronized with the main system. The usual practice is to take the backup system offline and synchronize data with the main system. When the backup system is synchronized with the main system, the backup system is put into operation.
[0045] Next, the high-availability two-by-two-out-of-two architecture solution of Embodiment 1 of the present invention is compared with the traditional two-by-two-out-of-two solution. Figure 2 As shown:
[0046] 1) When the calculation results of the four processing units are the same, the four processing units are in operation in both schemes.
[0047] 2) When DATA_A1=DATA_A2=DATA_B1≠DATA_B2, the traditional two-by-two-take-two scheme will determine that system B is faulty, isolate system B, and only keep system A running; according to the judgment rules in Table 1, this technical scheme determines that B2 is faulty, only isolates B2, and processing units A1, A2 and B1 continue to run.
[0048] 3) When DATA_A1≠DATA_A2=DATA_B1, the traditional two-by-two solution will determine that system A is faulty, and the system will stop providing services. According to the judgment rules in Table 1, this technical solution determines that A1 is faulty. Since A2 and B1 are still different, the system can still continue to provide services by forming a new two-by-two system composed of A2 and B1.
[0049] This embodiment accurately locates the fault channel to the processing unit, rather than the traditional two-by-two-take-two solution that locates the fault to the system, so the availability of the security platform is higher.
[0050] Example 2
[0051] This embodiment relates to a highly available security platform. When the system needs to meet higher availability indicators, it supports adding system devices (i.e., the system is scalable), such as Figure 3 ,exist Figure 1 On the basis of the above, C series and / or D series are added, each series includes two different processing units, namely A1, A2, B1, B2, C1, C2, D1, D2, and a certain processing unit is different from at least one processing unit in each series.
[0052] The method of determining the calculation result of a certain processing unit in Example 1 is still used to determine the status of any processing unit in the system. When a processing unit of a system fails, any other two different channels form a new system (including another processing unit of a system can form a new system of two out of two with processing units different from other systems) to continue to provide services. Therefore, it has good scalability and stability.
[0053] Example 3
[0054] The present embodiment relates to a highly available security platform, which can be expanded to a two-out-of-three architecture, including processing units A1, A2 and A3, where the three processing units are different from each other.
[0055] In order to determine whether the calculation result (such as DATA_A1) of a processing unit (such as A1) is correct, the calculation results (such as DATA_A2 and DATA_A3) of multiple processing units (such as A2 and A3) different from the processing unit are used for comparison. If the calculation result of at least one of the latter (such as A2 and A3) is equal to the calculation result of the processing unit to be determined, the calculation result of the processing unit (such as A1) is considered to be correct, and the status of the processing unit is set to "normal"; otherwise, the calculation result of the processing unit is considered to be wrong, and the status of the processing unit (such as A1) is set to "fault", and the system should isolate it.
[0056] When a processing unit fails, other different processing units form a safety platform to continue to provide reliability services, so it has good scalability and stability.
[0057] Similarly, the processing units of the security platform can be expanded to three out of four and other architectures, such as including processing units A1, A2, A3 and A4, where the four processing units are different from each other. The method for determining the calculation result of a processing unit is similar to the two out of three architecture of this embodiment.
[0058] When a processing unit fails, any three other different processing units form a safety platform to continue to provide reliability services. Therefore, it has good scalability and stability.
[0059] Example 4
[0060] This embodiment relates to an in-vehicle device, which includes a highly available security platform, which includes two sets of equipment, respectively referred to as system A and system B. The two processing units of system A are respectively referred to as A1 and A2, and the two processing units of system B are respectively referred to as B1 and B2. The calculation results of processing units A1, A2, B1 and B2 are respectively referred to as DATA_A1, DATA_A2, DATA_B1 and DATA_B2.
[0061] Compare the calculation results (such as DATA_A2 and DATA_B2) of multiple processing units (such as A2 and B2) different from a certain processing unit (such as A1) with it. If the calculation result of at least one of the latter (such as A2 and B2) is equal to the calculation result of the processing unit to be judged, the calculation result of this processing unit (such as A1) is considered to be correct, and the status of this processing unit is set to "normal"; otherwise, the calculation result of this processing unit is considered to be wrong, and the status of this processing unit (such as A1) is set to "fault", and the system should isolate it.
[0062] When a processing unit fails, another processing unit in the system where the processing unit is located and a different processing unit form a two-for-two system to continue providing services.
[0063] The vehicle-mounted device includes an available platform that supports device expansion and is not limited to two-by-two, three-by-two, and four-by-three architectures, and has wide applicability and scalability.
[0064] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.
Claims
1. A highly available security platform comprising at least two sets of equipment, Series A and Series B, each set comprising two distinct first processing units, or the security platform comprising a plurality of pairwise distinct second processing units, characterized in that: When a processing unit fails, the processing unit is isolated and a new system is formed by any two different first processing units, or a safety platform is formed by the remaining different second processing units.
2. A highly available security platform according to claim 1, characterized in that: When a first processing unit fails, another first processing unit in the system where the first processing unit is located and a different first processing unit in another system form a new system.
3. A highly available security platform according to claim 1, characterized in that: The method for determining a processing unit failure includes comparing a calculation result of a processing unit to be determined with calculation results of multiple processing units that are different from the processing unit; if no calculation result of a processing unit is equal to the calculation result of the processing unit to be determined, determining that the calculation result of the processing unit is incorrect and setting the status of the processing unit to "failure".
4. A highly available security platform according to claim 1, characterized in that: The calculation result of the processing unit to be judged is compared with the calculation results of multiple processing units different from the processing unit. If the calculation result of at least one processing unit is equal to the calculation result of the processing unit to be judged, the calculation result of the processing unit to be judged is correct, and the status of the processing unit is set to "normal".
5. A highly available security platform according to claim 1, characterized in that: The first processing unit is different from at least one first processing unit in a different system.
6. A highly available security platform according to claim 1, characterized in that: If the calculation results of the two first processing units of system A are the same, and the calculation results of the two first processing units of system B are the same, but the calculation results of the first processing units of system A and system B are different, then system A and system B are considered to be out of synchronization.
7. A highly available security platform according to claim 5, characterized in that: When system A and system B are out of sync, if system A is the primary system and system B is the backup system, take the backup system offline and synchronize its data with the primary system. When the backup system is synchronized with the primary system, put the backup system into operation.
8. The highly available security platform according to claim 1, characterized in that: The security platform is scalable.
9. A highly available security platform according to claim 8, characterized in that: The security platform includes a device of series C, wherein series C includes two different first processing units, and the first processing unit of series C is different from at least one first processing unit in each of the different series.
10. A highly available security platform according to claim 9, characterized in that: The security platform further includes a device of the D series, the D series includes two different first processing units, and the first processing unit of the D series is different from at least one first processing unit in each of the different series.
11. A highly available security platform according to claim 9 or 10, characterized in that: When a first processing unit fails, the first processing unit is isolated, and a new system is formed by another first processing unit in the system where the first processing unit is located and a different first processing unit in another system.
12. The highly available security platform according to claim 1, characterized in that: The second processing unit is expandable, wherein the expanded second processing unit is different from other second processing units.
13. The highly available security platform according to claim 1, characterized in that: The security platform is based on a two-out-of-three architecture and includes three second processing units that are mutually exclusive.
14. The highly available security platform according to claim 1, characterized in that: The security platform is based on a three-out-of-four architecture and includes four second processing units that are different in pairs.
15. A highly available security platform according to claim 13 or 14, characterized in that: When a certain second processing unit fails, the remaining different second processing units form a safety platform.
16. The highly available security platform according to claim 1, characterized in that: The security platform includes at least three second processing units.
17. A vehicle-mounted device, characterized in that: The invention comprises the highly available security platform as described in any one of claims 1 to 16.