EMA control system for vehicle-mounted platform

Abstract

The EMA control system comprises a double-CPU module, a double-CPU communication module, a data selector module, a fault-tolerant management module and an arbitration switching module, the double-CPU module controls output and input of data, the double-CPU module comprises a main CPU unit and a slave CPU unit, the double-CPU communication module adopts an RAM communication mode to achieve communication among different CPUs, and the data selector module is connected with the fault-tolerant management module. The arbitration switching module determines an output channel of the control system, and the fault-tolerant management module achieves monitoring and fault detection through CPU synchronous detection, RAM self-detection and double-CPU comparison arbitration. The arbitration switching module is arranged to compare the outputs of the two CPU units, the final output result is selected as the system output, the data selector module is controlled to output, and the accuracy of the system output is ensured; and the data selector module realizes undisturbed switching when the output needs to be switched.

Description

Technical Field

[0001] The present invention relates to the technical field of EMA control, and in particular to an EMA control system for a vehicle-mounted station. Background Art

[0002] The on-board radio is an important equipment to ensure driving safety. It enables train dispatchers, station attendants and train drivers to communicate with each other at any time, and can put train operation under the control of the dispatcher. This is very important for improving transportation efficiency and ensuring driving safety. In case of special circumstances, they can also be handled in time through the on-board radio. However, most of the existing on-board radio equipment adopts a single-core processor solution. When a local fault occurs, it is difficult for the system to complete the specified functions, which prolongs the fault handling time. In addition, when the on-board radio needs to handle multiple tasks, its performance is easily limited. It performs poorly in scenarios that require rapid response, affecting the overall work efficiency and response speed, and greatly reducing its reliability and stability.

[0003] The invention patent with the publication number CN117002562A discloses a vehicle-mounted station based on embedded software redundancy, which involves the field of vehicle-mounted equipment technology, including a railway special signal machine body and a control board with dual CPUs, and a shared set of peripheral circuits. The two CPUs are mutually verified by using the application layer software redundancy switching method, one is the main and the other is the backup, ensuring information synchronization while achieving fault detection, so that the disturbance-free switching function can be realized when a fault occurs. The patent adds embedded software redundancy to the dual CPU control and applies it to the vehicle-mounted station; the patent only realizes the redundancy of the dual CPUs and lacks the selection of different channel outputs.

[0004] Therefore, it is an urgent problem to provide an EMA control system that can perform fault detection and automatically select output channels. Summary of the invention

[0005] The purpose of the present invention is to provide an EMA control system for a vehicle-mounted station in order to overcome the defects of the above-mentioned prior art.

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] According to one aspect of the present invention, there is provided an EMA control system for a vehicle-mounted station, comprising a dual CPU module, a dual CPU communication module, a data selector module, a fault-tolerant management module and an arbitration switching module, wherein the dual CPU module controls the output and input of data, the dual CPU module comprises a master CPU unit and a slave CPU unit, the dual CPU communication module uses a RAM communication method to achieve communication between different CPUs, the arbitration switching module determines the output channel of the control system, and the fault-tolerant management module achieves monitoring and fault detection through CPU synchronization detection, RAM self-checking and dual CPU comparison arbitration;

[0008] Among them, the outputs of the main CPU unit and the slave CPU unit are transmitted to the arbitration switching module and the data selector module. According to the judgment result of the arbitration switching module, the data selector module is controlled to use the output of the main CPU unit or the slave CPU unit as the system output, and disturbance-free switching is achieved through the data selector module.

[0009] As a preferred technical solution, the arbitration switching module adopts CPLD.

[0010] As a preferred technical solution, the dual CPU comparison arbitration process includes the following steps:

[0011] S1. Compare input data;

[0012] S2. If the input data are relatively consistent, the input data is processed to obtain intermediate data, and the intermediate data is compared;

[0013] S3. If the intermediate data are relatively consistent, the intermediate data are processed to obtain output data;

[0014] S4. If the third-level comparison status bit is not 0, the output data is used as the system output.

[0015] As a preferred technical solution, if the input data is relatively inconsistent, the first-level comparison status bit is placed, and the last correct output value is used as the input data for data processing; if the intermediate data is relatively inconsistent, the second-level comparison status bit is placed, and the last correct output value is used as the intermediate data; if the output data is relatively inconsistent, the third-level comparison status bit is placed, and the last correct output value is used as the output data.

[0016] As a preferred technical solution, if the third-level comparison status bit is 0, the last correct output value is used as the system output and the second-level comparison status bit and the first-level comparison status bit are not 0, an interrupt is generated and the system performs self-diagnosis; if the second-level comparison status bit is 0, the last correct output value is used as input data for data processing; if the second-level comparison status bit is not 0 and the first-level comparison status bit is 0, the last correct output value is used as input data for input data comparison.

[0017] As a preferred technical solution, the RAM self-check process includes the following steps:

[0018] S5, write 0 to RAM;

[0019] S6. If the RAM read result is 0, write DBX to the odd address;

[0020] S7, if the inverse code of the odd address is correct, write DBX to the even address;

[0021] S8. If the even address inverse is correct, restore the unit content;

[0022] S9. If it is the last unit, the RAM test passes and the RAM is normal; if it is not the last unit, write 0 to the RAM.

[0023] As a preferred technical solution, if the RAM reading result is not 0 or the odd address inverse is incorrect or the even address inverse is incorrect, the RAM is faulty.

[0024] As a preferred technical solution, the main CPU unit includes a main CPU, the slave CPU unit includes a slave CPU, and the CPU synchronization detection process includes the following steps: the main CPU and the slave CPU enter the synchronization detection program, suspend the task and delay; if each time a response message from the slave CPU is received and the response message is incorrect or no response message from the slave CPU is received and the waiting time is reached, the number of i increases once, and if each time a response message is sent to the main CPU once, the number of j increases once; the initial values ​​of the number i and the number j are 0.

[0025] As a preferred technical solution, if the response information is correct, dual CPU synchronization detection is performed; if the number i reaches the first preset value, the synchronization fault is located in the slave CPU, and the slave CPU is isolated at the same time; if the number j reaches the first preset value and there is an instruction to isolate the slave CPU, the slave CPU terminates operation and waits for system reorganization; if the number j reaches the first preset value and there is no instruction to isolate the slave CPU and the waiting time is reached, the synchronization fault is located in the main CPU, and the main CPU is isolated to reorganize the system.

[0026] As a preferred technical solution, if the main CPU test information is not received and the waiting time is reached, it is determined whether there is an instruction to isolate the slave CPU; if there is an instruction to isolate the slave CPU, the slave CPU terminates operation and waits for system reorganization; if there is no instruction to isolate the slave CPU and the waiting time is reached, the synchronous fault is located in the main CPU, and the main CPU is isolated and the system is reorganized.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] 1. The present invention sets an arbitration switching module and a data selector module. The arbitration switching module compares the outputs of the two CPU units, determines whether the outputs are consistent, selects the final output result as the system output, and controls the data selector module to output, thereby ensuring the accuracy of the system output; the data selector module receives the outputs of the master CPU unit and the slave CPU unit at the same time, and realizes disturbance-free switching when the output needs to be switched.

[0029] 2. In the dual CPU comparison arbitration of the present invention, multi-level comparison status bits are set to ensure the accuracy of the system output; according to the status of the comparison status bits, the fault location is judged and a response is made automatically; at the same time, the system can perform self-diagnosis.

[0030] 3. During the RAM self-check process, the present invention detects the state of the RAM by writing 0 to the RAM, writing DBX to the odd address and the even address, and judging whether the result of reading the RAM is 0 or whether the inverse code is correct, thereby avoiding poor communication between CPUs due to RAM failure.

[0031] 4. The present invention uses dual CPU synchronous detection. Every time a response message is received from the slave CPU and the response message is incorrect or no response message is received from the slave CPU and the waiting time is reached, the number of i increases once. If a response message is sent to the main CPU once, the number of j increases once. When the number i or the number j reaches a first preset value, the faulty CPU is judged and located to facilitate subsequent system reorganization. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a schematic diagram of the redundant structure of the dual CPU modules of the present invention;

[0033] Figure 2 It is a schematic diagram of the dual CPU module redundant structure flow of the present invention;

[0034] Figure 3 It is a schematic diagram of the connection of the dual CPU module redundant structure of the present invention;

[0035] Figure 4 It is a schematic diagram of the working of the dual CPU module redundant structure of the present invention;

[0036] Figure 5 It is a schematic diagram of the system output of the present invention;

[0037] Figure 6 It is a dual CPU comparison arbitration flow chart of the present invention;

[0038] Figure 7 It is the RAM self-built flow chart of the present invention;

[0039] Figure 8 It is a main CPU unit synchronous detection flow chart of the present invention;

[0040] Fig. 9 This is a flow chart of synchronous detection from a CPU unit of the present invention. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0042] The on-board radio is an important equipment to ensure driving safety. It enables train dispatchers, station attendants and train drivers to communicate with each other at any time, and can put train operation under the control of the dispatcher. This is very important for improving transportation efficiency and ensuring driving safety. In case of special circumstances, they can also be handled in time through the on-board radio. However, most of the existing on-board radio equipment adopts a single-core processor solution. When a local fault occurs, it is difficult for the system to complete the specified functions, which prolongs the fault handling time. In addition, when the on-board radio needs to handle multiple tasks, its performance is easily limited. It performs poorly in scenarios that require rapid response, affecting the overall work efficiency and response speed, and greatly reducing its reliability and stability.

[0043] EMA: Electro-Mechanical Actuator. EMA does not use any hydraulic system inside, and has many advantages such as simple and compact structure, high efficiency, small size and light weight, and easy maintenance. EMA generates mechanical motion, such as linear displacement or angular displacement, through the rotation of the motor. EMA usually has high control accuracy and can achieve fast response and precise position control. By combining sensors and feedback systems, EMA can maintain high-precision position, speed and force control. Compared with hydraulic actuators, EMA reduces oil usage and pipeline maintenance problems, and has the advantages of simple structure and easy maintenance. This makes it more suitable for scenarios requiring high reliability and low maintenance.

[0044] BIT: Built-In Test. This is an automated testing mechanism embedded in a device or system to detect performance or fault conditions while the device is running. Its main function is to ensure the health of the system and take appropriate measures quickly when a fault is found to improve reliability and maintenance efficiency.

[0045] The present invention mainly studies the hardware fault-tolerant technology and software fault-tolerant technology of the vehicle-mounted station. After analyzing various redundancy methods, the dual-machine hot backup method is selected in combination with the system characteristics. According to the determined overall plan based on dual-machine hot backup, the hardware of the redundant EMA control system is designed. Each functional module is specifically studied and designed, and the communication between the dual CPUs is realized by using a dual-port RAM, and the arbitration switching function of the system is realized by using a CPLD. Then, in combination with the designed hardware system, the software design of the redundant EMA control system is carried out. The software design is carried out in a hierarchical and modular manner, and the algorithms of dual-machine communication, dual-machine synchronization, synchronous fault diagnosis, comparative arbitration, and self-check of each functional module are studied. At the same time, in order to improve the reliability of the software itself, the software is also designed to be fault-tolerant.

[0046] Therefore, an EMA control system for a vehicle-mounted station is provided. The present invention sets an arbitration switching module and a data selector module. The arbitration switching module compares the outputs of the two CPU units, determines whether the outputs are consistent, selects the final output result as the system output, and controls the data selector module to output, thereby ensuring the accuracy of the system output; the data selector module simultaneously receives the outputs of the main CPU unit and the slave CPU unit, and realizes disturbance-free switching when the output needs to be switched. In the dual-CPU comparison arbitration of the present invention, a multi-level comparison status bit is set to ensure the accuracy of the system output; according to the state of the comparison status bit, the fault location is judged and a response is made automatically; at the same time, the system can perform self-diagnosis. In the process of RAM self-check, the present invention detects the state of RAM by writing 0 to RAM, writing DBX to odd addresses and even addresses, and judging whether the result of reading RAM is 0 or whether the inverse code is correct, thereby avoiding poor communication between CPUs due to RAM failure. The present invention uses dual CPU synchronous detection. Every time a response message from a slave CPU is received and the response message is incorrect or no response message from the slave CPU is received and the waiting time is reached, the number of i increases once. If a response message is sent to the main CPU once, the number of j increases once. When the number i or the number j reaches a first preset value, the faulty CPU is judged and located, which is convenient for subsequent system reorganization.

[0047] Example 1

[0048] An EMA control system for a vehicle-mounted station, comprising a dual CPU module, a dual CPU communication module, a data selector module, a fault-tolerant management module and an arbitration switching module, wherein the dual CPU module controls the output and input of data, the dual CPU module comprises a master CPU unit and a slave CPU unit, the dual CPU communication module uses a RAM communication method to achieve communication between different CPUs, the arbitration switching module determines the output channel of the control system, and the fault-tolerant management module achieves monitoring and fault detection through CPU synchronization detection, RAM self-checking and dual CPU comparison arbitration;

[0049] Among them, the outputs of the main CPU unit and the slave CPU unit are transmitted to the arbitration switching module and the data selector module. According to the judgment result of the arbitration switching module, the data selector module is controlled to use the output of the main CPU unit or the slave CPU unit as the system output, and disturbance-free switching is achieved through the data selector module.

[0050] The arbitration switching module adopts CPLD. CPLD is a digital integrated circuit with logic functions that users can construct according to their own needs.

[0051] In this embodiment, if Figure 1-Figure 4 As shown, the vehicle-mounted station includes a railway dedicated signal machine body, a control board with two CPUs, and a set of shared peripheral circuits. On the principle of not increasing a lot of costs, the peripheral circuits are shared, and only a set of parallel core processing units is added. The two CPUs check each other by using the method of redundant switching of application layer software, one is the main and the other is the backup. The data selector module includes a two-choice data selector,

[0052] The dual-CPU communication module uses dual-port RAM communication to synchronize information. The dual-port RAM has two sets of completely independent data buses, address buses, and control buses, which can realize memory sharing. When the CPU module with control power fails, the other CPU unit can quickly take over the output control of the system and ensure that the outputs of the system after switching are consistent with those before switching. At the same time, the CPU's EMC external storage control function reuses the pins to complete the communication between the two CPUs and the dual-port RAM.

[0053] The arbitration switching module design uses a CPLD device to implement the arbitration switching module of the system. It arbitrates the output of the system according to the pre-set arbitration switching logic, and switches the output of the master and slave units according to the arbitration results to prevent the output of the faulty channel and ensure that the system output is correct and reliable. At the same time, in order to perform redundancy switching in the shortest time after a fault occurs. Figure 5As shown in the figure, this design directly connects the outputs of both channels to a two-choice data selector, and then selects one of the data in the data selector to output according to the result of the arbitration logic judgment module, thereby realizing disturbance-free switching. The CPU and CPLD are directly connected and driven by general I / O pins. The system uses the CAN bus for communication, receives the instructions of the computer and transmits relevant data such as EMA position information and fault information to the computer. Based on the consideration of improving reliability, each CPU module in the system has two CAN interfaces that can be connected to the CAN bus to ensure reliable communication of the system. When the system starts, the CPLD device will be initialized according to the pre-set logic, and the CPU and CPLD will be interconnected through general I / O pins. During the initialization stage, the system will detect the channel status and prepare for the control of master-slave switching. The system has two channels (the main channel and the backup channel correspond to the main CPU unit and the slave CPU unit respectively), and their outputs are connected to the two-choice data selector. The CPLD module constantly monitors the status of the main and backup channels, such as whether there are faults and whether they are working properly. If both channels are normal, the system defaults to using the main channel for data output. If there is a problem with the main channel, the CPLD will switch to the backup channel through arbitration logic to ensure the correctness and reliability of the system output. Under normal conditions, the CPLD will give priority to the data output of the main channel. Under fault conditions (failure of the main channel), the CPLD automatically switches to the data output of the backup channel based on the arbitration result. The design of the arbitration logic ensures that after detecting an abnormality in the main channel, redundant switching is performed in the shortest time to avoid output errors. In order to ensure that data switching does not interfere with the system, the CPLD controls the data selector through arbitration logic, making the switching process smooth and seamless without affecting the normal operation of the system.

[0054] The fault-tolerant processing module is the key to the entire redundant system and directly determines the performance of the entire system. The dual-CPU communication module is mainly used to realize information sharing and dual-machine synchronization between the master and slave CPU units, and assist in realizing the redundant function, so the module must be executed efficiently. Synchronization design is a key link in the entire redundant software design. This design realizes dual-machine synchronization through dual-CPU communication. After each synchronization starts, the two machines start working independently. When the host with control runs to the detection point, the data of the master CPU unit at this time is stored in the dual-port RAM and a trigger signal is issued. After the slave CPU unit receives the trigger signal sent by the master CPU unit, the master CPU unit data is taken out from the dual-port RAM and compared. After the comparison is completed, the comparison result is stored in the dual-port RAM and the master CPU unit is triggered. The master CPU unit reads the comparison result to achieve synchronization and fault-tolerant processing.

[0055] Fault tolerance uses instruction redundancy to add several single-byte NOP instructions after double-byte instructions and multi-byte instructions to ensure that the following instructions will not be easily disassembled. It is also possible to check the key and important data during program operation to see if it is within the preset range. If it is within the specified range, it will continue to run, otherwise it will take corresponding error handling measures.

[0056] The control system also includes a calculation processing module, a communication module and a system management module. The calculation processing module is responsible for performing calculations and giving corresponding control signals after being triggered by external events and receiving data input, so it is necessary to ensure that the module responds in a timely manner. The system management module manages various programs, which mainly include startup and initialization programs, dual-machine communication programs, interrupt processing programs, I / O management programs, and dual-machine synchronization programs. The communication module realizes the communication function between the system and EMA.

[0057] The process of dual CPU comparison arbitration comprises the following steps:

[0058] S1. Compare input data;

[0059] S2. If the input data are relatively consistent, the input data is processed to obtain intermediate data, and the intermediate data is compared;

[0060] S3. If the intermediate data are relatively consistent, the intermediate data are processed to obtain output data;

[0061] S4. If the third-level comparison status bit is not 0, the output data is used as the system output.

[0062] If the input data is inconsistent, the first-level comparison status bit is set, and the last correct output value is used as the input data for data processing; if the intermediate data is inconsistent, the second-level comparison status bit is set, and the last correct output value is used as the intermediate data; if the output data is inconsistent, the third-level comparison status bit is set, and the last correct output value is used as the output data.

[0063] If the third-level comparison status bit is 0, the last correct output value is used as the system output and if the second-level comparison status bit and the first-level comparison status bit are not 0, an interrupt is generated and the system performs self-diagnosis; if the second-level comparison status bit is 0, the last correct output value is used as input data for data processing; if the second-level comparison status bit is not 0 and the first-level comparison status bit is 0, the last correct output value is used as input data for input data comparison.

[0064] In this embodiment, the dual CPUs use an inaccurate comparison detection method when performing comparison arbitration. The system implements dual CPU comparison arbitration through a dual-port RAM. Each time a dual CPU comparison is performed, the slave CPU writes the data required for the comparison into a dedicated address in the dual-port RAM. The master CPU reads these data for comparison and updates the dual CPU comparison result flag set in the dual-port RAM according to the result. The temporary data written by the slave CPU is cleared by the master CPU after the comparison is completed, thereby avoiding affecting the result of the next dual CPU comparison arbitration. Figure 6 shown.

[0065] The RAM self-test process includes the following steps:

[0066] S5, write 0 to RAM;

[0067] S6. If the RAM read result is 0, write DBX to the odd address;

[0068] S7, if the inverse code of the odd address is correct, write DBX to the even address;

[0069] S8. If the even address inverse is correct, restore the unit content;

[0070] S9. If it is the last unit, the RAM test passes and the RAM is normal; if it is not the last unit, write 0 to the RAM.

[0071] If the RAM read result is not 0, the odd address inverse is incorrect, or the even address inverse is incorrect, the RAM is faulty.

[0072] In this embodiment, in the EMA control system, the CPU module is the core of the entire redundant system, and the dual-port RAM module is the basis for dual CPU communication, so the self-test of these two modules is considered. The system uses the functional test method to perform CPU self-test. All functions of the CPU are implemented by executing instructions, so it is only necessary to detect whether the CPU can correctly execute all its instructions to determine whether the CPU is working properly. Figure 7 As shown, the MARCH-G algorithm is used to complete the RAM test using software. The RAM self-test program is stored in the ROM. When the RAM test is required, the program pointer points to its first address and the RAM self-test begins. If a fault is found during the test, the relevant fault information is displayed and the corresponding status flag is updated; if no fault is found after the self-test program is executed, it means that the RAM is normal and the test passes. The corresponding status flag is also updated and the program pointer returns to the user program area.

[0073] The main CPU unit includes a main CPU, the slave CPU unit includes a slave CPU, and the CPU synchronization detection process includes the following steps: the main CPU and the slave CPU enter a synchronization detection program, suspend the task and delay; if each time a response message from the slave CPU is received and the response message is incorrect or no response message from the slave CPU is received and the waiting time is reached, the number of i increases once, and if each time a response message is sent to the main CPU once, the number of j increases once; the initial values ​​of the number i and the number j are 0.

[0074] If the response information is correct, the dual CPU synchronization detection is carried out; if the number i reaches the first preset value, the synchronization fault is located in the slave CPU, and the slave CPU is isolated at the same time; if the number j reaches the first preset value and there is an instruction to isolate the slave CPU, the slave CPU terminates operation and waits for the system to be reorganized; if the number j reaches the first preset value and there is no instruction to isolate the slave CPU and the waiting time is reached, the synchronization fault is located in the main CPU, and the main CPU is isolated to reorganize the system.

[0075] If the main CPU test information is not received and the waiting time is reached, it is determined whether there is an instruction to isolate the slave CPU; if there is an instruction to isolate the slave CPU, the slave CPU terminates operation and waits for system reorganization; if there is no instruction to isolate the slave CPU and the waiting time is reached, the synchronous fault is located in the main CPU, and the main CPU is isolated to reorganize the system.

[0076] like Figure 8 , Fig. 9 As shown, the first preset value is 3. After the dual CPU synchronization detection of the control system starts, the main CPU unit first writes the synchronization detection signal to the dual-port RAM. After the slave CPU unit reads the detection signal, it sends a response signal to the main CPU through the dual-port RAM. If the main CPU unit receives the correct response signal from the slave CPU unit in time, it is said that the system has passed the synchronization detection. At this time, the two CPUs end the detection program together and start to execute the next control task of the system. If the main CPU does not receive the response signal from the slave CPU within the specified time or the received response signal is always incorrect, the main CPU determines that the dual CPU synchronization fails due to the failure of the slave CPU. At this time, the main CPU sends the mutual detection fault signal of the slave CPU to the CPLD to isolate the slave CPU.

[0077] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. An EMA control system for a vehicle-mounted station, characterized in that: It includes a dual CPU module, a dual CPU communication module, a data selector module, a fault-tolerant management module and an arbitration switching module. The dual CPU module controls the output and input of data. The dual CPU module includes a master CPU unit and a slave CPU unit. The dual CPU communication module uses a RAM communication method to achieve communication between different CPUs. The arbitration switching module determines the output channel of the control system. The fault-tolerant management module achieves monitoring and fault detection through CPU synchronization detection, RAM self-checking and dual CPU comparison arbitration. Among them, the outputs of the main CPU unit and the slave CPU unit are transmitted to the arbitration switching module and the data selector module. According to the judgment result of the arbitration switching module, the data selector module is controlled to use the output of the main CPU unit or the slave CPU unit as the system output, and disturbance-free switching is achieved through the data selector module.

2. The EMA control system for a vehicle-mounted station according to claim 1, characterized in that: The arbitration switching module adopts CPLD.

3. The EMA control system for a vehicle-mounted station according to claim 1, characterized in that: The process of dual CPU comparison arbitration comprises the following steps: S1. Compare input data; S2. If the input data are relatively consistent, the input data is processed to obtain intermediate data, and the intermediate data is compared; S3. If the intermediate data are relatively consistent, the intermediate data are processed to obtain output data; S4. If the third-level comparison status bit is not 0, the output data is used as the system output.

4. The EMA control system for a vehicle-mounted station according to claim 3, characterized in that: If the input data is not consistent, the first-level comparison status bit is set, and the last correct output value is used as the input data for data processing; if the intermediate data is not consistent, the second-level comparison status bit is set, and the last correct output value is used as the intermediate data; If the output data comparison is inconsistent, the third-level comparison status bit is set and the last correct output value is used as the output data.

5. The EMA control system for a vehicle-mounted station according to claim 4, characterized in that: If the third-level comparison status bit is 0, the last correct output value is used as the system output and if the second-level comparison status bit and the first-level comparison status bit are not 0, an interrupt is generated and the system performs self-diagnosis; if the second-level comparison status bit is 0, the last correct output value is used as input data for data processing; if the second-level comparison status bit is not 0 and the first-level comparison status bit is 0, the last correct output value is used as input data for input data comparison.

6. The EMA control system for a vehicle-mounted station according to claim 1, characterized in that: The RAM self-test process includes the following steps: S5, write 0 to RAM; S6. If the RAM read result is 0, write DBX to the odd address; S7, if the inverse code of the odd address is correct, write DBX to the even address; S8. If the even address inverse is correct, restore the unit content; S9. If it is the last unit, the RAM test passes and the RAM is normal; if it is not the last unit, write 0 to the RAM.

7. The EMA control system for a vehicle-mounted station according to claim 6, characterized in that: If the RAM read result is not 0, the odd address inverse is incorrect, or the even address inverse is incorrect, the RAM is faulty.

8. The EMA control system for a vehicle-mounted station according to claim 1, characterized in that: The main CPU unit includes a main CPU, the slave CPU unit includes a slave CPU, and the CPU synchronization detection process includes the following steps: the main CPU and the slave CPU enter a synchronization detection program, suspend the task and delay; if each time a response message from the slave CPU is received and the response message is incorrect or no response message from the slave CPU is received and the waiting time is reached, the number of i increases once, and if each time a response message is sent to the main CPU once, the number of j increases once; the initial values ​​of the number i and the number j are 0.

9. The EMA control system for a vehicle-mounted station according to claim 8, characterized in that: If the response information is correct, the dual CPU synchronization detection is carried out; if the number i reaches the first preset value, the synchronization fault is located in the slave CPU, and the slave CPU is isolated at the same time; if the number j reaches the first preset value and there is an instruction to isolate the slave CPU, the slave CPU terminates operation and waits for the system to be reorganized; if the number j reaches the first preset value and there is no instruction to isolate the slave CPU and the waiting time is reached, the synchronization fault is located in the main CPU, and the main CPU is isolated to reorganize the system.

10. The EMA control system for a vehicle-mounted station according to claim 9, characterized in that: If the main CPU test information is not received and the waiting time is reached, it is determined whether there is an instruction to isolate the slave CPU; if there is an instruction to isolate the slave CPU, the slave CPU terminates operation and waits for system reorganization; if there is no instruction to isolate the slave CPU and the waiting time is reached, the synchronous fault is located in the main CPU, and the main CPU is isolated to reorganize the system.

Images