Railway signal safety calculation method and device and safety computer platform

Abstract

The invention relates to a railway signal safety calculation method and device and a safety computer platform. The method comprises the following steps of: performing forward calculation on data input according to a basic processing flow in the railway signal control system through a forward calculation module to obtain a forward calculation result of the data input, receiving the forward calculation result through a reverse calculation module connected with the forward calculation module, and performing reverse calculation on the forward calculation result to obtain a reverse calculation result of the data input; and obtaining a reverse calculation result, so that the railway signal safety calculation device can compare the reverse calculation result with data input according to the reverse calculation result and the data input from the outside of the system or other units, and can calculate the safety of the railway signal according to the consistency and difference of the reverse calculation result and the data input. The problem of heterogeneity of safety redundancy comparison can be mainly solved, common cause failure is avoided as much as possible, and safety is improved.

Description

Technical Field

[0001] The present application relates to the technical field of railway signal control systems, and in particular to a railway signal security calculation method, device and security computer platform. Background Art

[0002] Railways are the main arteries of the national economy. Railway signal control systems are responsible for ensuring operational safety and transport efficiency, placing extremely high demands on system security. my country's railway transportation business is booming, and dangerous failures in railway signal control systems can lead to accidents such as train derailments and collisions, directly impacting the safety of people and property. Consequently, even higher safety requirements are placed on signal control systems.

[0003] my country's current railway signal control system adopts a signal safety control technology architecture with redundancy technology as the core. Core control equipment such as the automatic train protection system, computer interlocking, wireless block center, train control center, and temporary speed limit server mainly use a two-by-two-out-of-two architecture as the main architectural model of the equipment.

[0004] To ensure safety, the design of the two CPU channels participating in the two-out-of-two operation should try to avoid common cause failures, that is, the occurrence of the same fault at the same time. Otherwise, the voting mechanism of the two CPU channels will lose its safety protection function, resulting in incorrect input and output, and then a dangerous situation. Summary of the Invention

[0005] Based on this, it is necessary to provide a railway signal safety calculation method, device and security computer platform that can improve safety in response to the above technical problems.

[0006] In a first aspect, the present application provides a railway signal safety calculation device. The device comprises:

[0007] A forward calculation module, configured to perform forward calculation on the data input according to a basic processing flow in a railway signal control system to obtain a forward calculation result of the data input;

[0008] a reverse calculation module, connected to the forward calculation module, configured to receive the forward calculation result from the forward calculation module, and perform a reverse operation on the forward calculation result to obtain a reverse calculation result;

[0009] The reverse operation is the reverse operation of the forward operation.

[0010] In one embodiment, the device includes a dual computing channel;

[0011] The forward calculation module is provided in one of the two-path calculation channels, and the reverse calculation module is provided in the other of the two-path calculation channels.

[0012] In one embodiment, the forward calculation module is further configured to receive the reverse calculation result from the reverse calculation module, and compare the consistency between the data input and the reverse calculation result to obtain a first comparison result; and / or,

[0013] The reverse calculation module is further configured to receive the data input, and compare the consistency between the data input and the reverse calculation result to obtain a second comparison result;

[0014] The first comparison result and the second comparison result are used to indicate that when the first comparison result and the second comparison result match, the forward calculation result is output as data.

[0015] In one embodiment, the apparatus is configured to:

[0016] If the first comparison result indicates that the data input and the inverse calculation result are consistent, and the second comparison result indicates that the data input and the inverse calculation result are consistent, determining that the first comparison result and the second comparison result match;

[0017] When the first comparison result indicates that the data input and the inverse calculation result are inconsistent, and the second comparison result indicates that the data input and the inverse calculation result are inconsistent, it is determined that the first comparison result and the second comparison result do not match.

[0018] In one embodiment, the device includes a single computing channel;

[0019] The forward calculation module and the reverse calculation module are both arranged in the single-path calculation channel.

[0020] In one embodiment, the single-path computing channel further includes a comparison module, wherein the comparison module is connected to the forward computing module and the reverse computing module;

[0021] The comparison module is used to compare the consistency of the data input and the reverse calculation result to obtain a comparison result; the comparison result is used to indicate that when the data input and the reverse calculation result are consistent, the forward calculation result is used as data output.

[0022] In one embodiment, the single computing channel further includes two independent clock sources;

[0023] Among them, one clock source is used for calculation processing of the forward calculation module and the reverse calculation module, and the other clock source is used for verification of clock information.

[0024] In a second aspect, the present application also provides a railway signal safety calculation method. The method includes:

[0025] Performing forward calculation on the data input according to the basic processing flow in the railway signal control system to obtain a forward calculation result of the data input;

[0026] Performing a reverse operation on the forward calculation result to obtain a reverse calculation result, wherein the reverse operation is the inverse operation of the forward calculation;

[0027] The data input and the inverse calculation result are compared to obtain a comparison result, and a data output corresponding to the data input is determined according to the comparison result.

[0028] In a third aspect, the present application further provides a railway signal safety computer platform comprising two redundant railway signal safety systems, at least one of which comprises the railway signal safety computing device provided in the first aspect of the present application.

[0029] In a fourth aspect, the present application further provides a railway signal safety computer platform. The platform includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the railway signal safety calculation method provided in the second aspect of the present application when executing the computer program.

[0030] In a fifth aspect, the present application also provides a method for constructing a railway signal safety computer platform. The method comprises the following steps:

[0031] Obtain forward calculation program and reverse calculation program;

[0032] Obtain the number of computing channels in a railway signal safety system;

[0033] When there are two computing channels, one computing channel is controlled to deploy a forward computing program, and the other computing channel is controlled to deploy a reverse computing program.

[0034] In the case where the number of computing channels is single, the forward computing program and the reverse computing program are integrated into a forward computing first and reverse computing second program, and deployed in the single computing channel.

[0035] The above-mentioned railway signal safety calculation method, device and safety computer platform perform forward calculation on the data input according to the basic processing flow in the railway signal control system through the forward calculation module to obtain the forward calculation result of the data input, receive the forward calculation result through the reverse calculation module connected to the forward calculation module, and perform reverse calculation on the forward calculation result to obtain the reverse calculation result, so that the railway signal safety calculation device can compare the reverse calculation result with the data input based on the reverse calculation result and the data input from outside the system or other units, and through the consistency and difference between the reverse calculation result and the data input, it can focus on solving the heterogeneity problem of safety redundancy comparison, minimize common cause failure, and improve safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] FIG1 is a schematic diagram of a two-by-two-take-two architecture according to one embodiment;

[0037] FIG2 is a block diagram of a railway signal safety calculation device according to one embodiment;

[0038] FIG3 is a structural block diagram of a railway signal safety calculation device in another embodiment;

[0039] FIG4 is a structural block diagram of a railway signal safety calculation device according to another embodiment;

[0040] FIG5 is a schematic diagram of a railway signal safety computer platform with dual computing channels in one embodiment;

[0041] FIG6 is a schematic diagram of a railway signal safety computer platform with a single computing channel in one embodiment;

[0042] FIG7 is a schematic flow chart of a railway signal safety calculation method according to one embodiment;

[0043] FIG8 is a flow chart of a method for constructing a railway signal safety computer platform in one embodiment;

[0044] FIG9 is a flow chart of a method for constructing a railway signal safety computer platform in another embodiment;

[0045] FIG10 is a diagram showing the internal structure of a railway signal safety computer platform in one embodiment. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0047] As shown in Figure 1, the 2x2x2 architecture is divided into two systems with redundant hot standby between them, known as a 2x2 relationship. As long as one system is functioning properly, the entire system can function normally, thus addressing reliability, availability, and maintainability (RAM) requirements. Each system has two CPU channels, and the two CPUs compare operations to determine the output, known as a 2x2 relationship. As long as the two CPU channels do not experience the same error, no dangerous output will be generated, thus addressing safety requirements.

[0048] The technical characteristics of the current two-by-two-take-two architecture result in a weak link in the safety control of common cause failures. If the same fault occurs at the same time, the voting mechanism of the two CPU channels will lose its safety protection function, resulting in incorrect input and output, and thus a dangerous situation.

[0049] To ensure security and minimize common-cause failures in the two CPU channels participating in a two-out-of-two architecture, the two CPU channels are typically used in a heterogeneous configuration, employing different hardware and software structures and configurations. However, this approach can significantly increase design, development, manufacturing, and maintenance costs. Furthermore, the degree of heterogeneity between the two CPU channels is difficult to assess and guarantee. This means it's difficult to accurately analyze the extent to which common-cause failures can be avoided to ensure the effectiveness of the two-out-of-two mechanism, and it's also difficult to guarantee the effectiveness of specific implementations.

[0050] In order to improve the safety of the railway signal control system, an embodiment of the present application provides a railway signal safety calculation device, as shown in FIG2 , which includes a forward calculation module 202 and a reverse calculation module 204 .

[0051] The forward calculation module 202 is used to perform forward calculation on the data input according to the basic processing flow in the railway signal control system to obtain the forward calculation result of the data input.

[0052] Among them, the railway signal control system may include one or more basic processing units, which are usually used to receive data input from outside the system or other units, and process the data input according to the basic processing flow in the railway signal control system to determine the data output.

[0053] The forward calculation module 202 of the embodiment of the present application performs forward calculation on the data input according to the normal basic processing flow to determine the forward calculation result of the data input, and the forward calculation result serves as the data output preliminarily prepared by the basic processing unit.

[0054] The reverse calculation module 204 is connected to the forward calculation module 202 and is used to receive the forward calculation result from the forward calculation module 202 and perform a reverse operation on the forward calculation result to obtain a reverse calculation result.

[0055] In this embodiment of the present application, the inverse operation of the forward calculation processing performed by forward calculation module 202 is used as the reverse calculation processing by reverse calculation module 204. Reversible computing is a computing model whose calculation process is reversible. In this reversible computing model, the relationship between the previous state and the next state of a transition function is a one-to-one inverse function. In this embodiment of the present application, reverse calculation module 204 receives the forward calculation results from forward calculation module 202 and performs reverse calculation on the forward calculation results to obtain the reverse calculation results.

[0056] The above-mentioned railway signal safety calculation device performs forward calculation on the data input according to the basic processing flow in the railway signal control system through the forward calculation module to obtain the forward calculation result of the data input, receives the forward calculation result through the reverse calculation module connected to the forward calculation module, and performs reverse calculation on the forward calculation result to obtain the reverse calculation result, so that the railway signal safety calculation device can compare the reverse calculation result with the data input based on the reverse calculation result and the data input from outside the system or other units, and through the consistency and difference between the reverse calculation result and the data input, it can focus on solving the heterogeneity problem of safety redundancy comparison, try to avoid common cause failure, and improve safety.

[0057] The following will take the railway signal safety computer platform as an example to specifically explain the railway signal safety computing device provided in the embodiment of the present application.

[0058] The railway signal safety computer platform of the present embodiment includes two or more redundant railway signal safety systems, connected via a redundant communication network. The railway signal safety computing device of the present embodiment can be deployed in at least one railway signal safety system. The railway signal safety computing device of the present embodiment will be described further, using the railway signal safety computing device deployed in a particular railway signal safety system as an example.

[0059] The railway signal safety computing device of an embodiment of the present application may include at least one basic processing unit, which is used to receive data input from outside the system or other units, and process the data input according to the basic processing flow in the railway signal control system to determine the output. The basic processing units are connected through a redundant communication network.

[0060] Exemplarily, a railway signal safety calculation device includes multiple basic processing units, which may include a main control unit, a switch interface unit, and a communication interface unit. The main control unit uses the outputs of the switch interface unit and the communication interface unit as its data input, processes the data input according to the main control unit's basic processing flow, obtains a calculation result, and outputs the calculation result to the switch interface unit and the communication interface unit; the switch interface unit uses external switch quantities of the system as its data input, and outputs the calculation result to the main control unit; and the communication interface unit uses external communication traffic of the system as its data input, processes the data input according to the communication interface unit's basic processing flow, obtains a calculation result, and outputs the calculation result to the main control unit.

[0061] The forward calculation module of the embodiment of the present application may include a switch quantity forward calculation module deployed in the switch quantity interface unit, a communication quantity forward calculation module deployed in the communication quantity interface unit, and a master control forward calculation module deployed in the master control unit. The reverse calculation module includes a switch quantity reverse calculation module deployed in the switch quantity interface unit, a communication quantity reverse calculation module deployed in the communication quantity interface unit, and a master control reverse calculation module deployed in the master control unit.

[0062] The switch quantity forward calculation module is configured to process the switch quantity communication input from the external system according to the basic processing flow of the switch quantity interface unit, generating a switch quantity forward calculation result. The switch quantity reverse calculation module is connected to the switch quantity forward calculation module and is configured to receive the switch quantity forward calculation result from the switch quantity forward calculation module and perform a reverse operation on the switch quantity forward calculation result to obtain a switch quantity reverse calculation result. The switch quantity interface unit can determine the calculation result to be output to the main control unit by comparing the switch quantity communication input from the external system with the switch quantity reverse calculation result for consistency or difference.

[0063] The traffic forward calculation module is configured to process the data traffic input from the system according to the basic processing flow of the traffic interface unit, generating a traffic forward calculation result. The traffic reverse calculation module is connected to the traffic forward calculation module and is configured to receive the traffic forward calculation result from the traffic forward calculation module and perform a reverse operation on the traffic forward calculation result to obtain a traffic reverse calculation result. The traffic interface unit can determine the calculation result to be output to the main control unit by comparing the traffic volume input from the system with the traffic reverse calculation result for consistency or difference.

[0064] The master control forward calculation module is configured to process the outputs of the switch quantity interface unit and the communication volume interface unit according to the basic processing flow of the master control unit, thereby generating a master control forward calculation result. The master control reverse calculation module is connected to the master control forward calculation module and is configured to receive the master control forward calculation result from the master control forward calculation module and perform a reverse operation on the master control forward calculation result to obtain a master control reverse calculation result. The master control unit can determine the calculation result to be output to the switch quantity interface unit and the communication volume interface unit by comparing the outputs of the switch quantity interface unit and the communication volume interface unit with the master control reverse calculation result for consistency or difference.

[0065] In some embodiments, referring to FIG3 and FIG4 , the railway signal safety calculation device may include a dual-path calculation channel, wherein the forward calculation module is provided in one of the dual-path calculation channels, and the reverse calculation module is provided in the other of the dual-path calculation channels.

[0066] A computing channel refers to a computing environment configured with a physical CPU, memory, storage devices, input / output interfaces, etc. Dual computing channels are connected via independent communication channels, and the dual computing channels are connected via a bus, an external switch interface, and an external communication interface, respectively.

[0067] In one computing channel of the embodiment of the present application, a physical CPU is configured, and the forward computing module and the reverse computing module are respectively deployed in two different computing channels. Please refer to Figures 3 and 4. The dual computing channel includes a first computing channel and a second computing channel. As an example only, the switch quantity forward computing module of the switch quantity interface unit, the communication quantity forward computing module of the communication quantity interface unit, and the main control forward computing module of the main control unit in Figure 3 are deployed in the first computing channel, and the switch quantity reverse computing module of the switch quantity interface unit, the communication quantity reverse computing module of the communication quantity interface unit, and the main control reverse computing module of the main control unit are deployed in the second computing channel. Alternatively, as shown in Figure 4, the communication quantity reverse computing module in Figure 3 is deployed in the first computing channel, and the communication quantity forward computing module is deployed in the second computing channel, that is, the forward computing module and the reverse computing module of each basic processing unit are respectively deployed in two computing channels.

[0068] In an optional embodiment, when the railway signal safety calculation device includes a dual-path calculation channel, the forward calculation module and the reverse calculation module of the dual-path calculation channel have the same hardware and receive the same input from outside the system or other units, and perform forward calculation and reverse calculation respectively to ensure knowable and effective heterogeneity.

[0069] In an optional embodiment, referring to FIG5 , when the railway signal safety calculation device includes two calculation channels, the forward calculation module of one calculation channel uses data from outside the system or other units as input for forward calculation and sends the forward calculation result to the reverse calculation module of the other calculation channel. The reverse calculation module uses the forward calculation result as input for reverse calculation and sends the reverse calculation result to the forward calculation module of the other calculation channel. Both channels simultaneously compare the reverse calculation result with the data input from outside the system or other units to determine whether they are consistent. Only when both channels are consistent do the main control unit, the switch interface unit, and the communication interface unit output to the outside of the system or other units.

[0070] Exemplarily, the forward calculation module of one calculation channel is also used to receive the reverse calculation result from the reverse calculation module of another calculation channel, and compare the consistency of the data input and the reverse calculation result to obtain a first comparison result; the reverse calculation module of the other calculation channel can also simultaneously receive the same data input from outside the system or other units, and the reverse calculation module compares the consistency of the data input and the reverse calculation result to obtain a second comparison result; wherein, the first comparison result and the second comparison result are used to indicate that when the first comparison result and the second comparison result match, the forward calculation result is output as data.

[0071] Specifically, when the first comparison result indicates that the data input and the reverse calculation result are consistent, and the second comparison result indicates that the data input and the reverse calculation result are consistent, the first comparison result and the second comparison result are determined to match; when the first comparison result indicates that the data input and the reverse calculation result are inconsistent, and the second comparison result indicates that the data input and the reverse calculation result are inconsistent, the first comparison result and the second comparison result are determined to be mismatched. It is understandable that if the first comparison result indicates that the data input and the reverse calculation result are consistent, and the second comparison result indicates that the data input and the reverse calculation result are inconsistent, or if the first comparison result indicates that the data input and the reverse calculation result are inconsistent, and the second comparison result indicates that the data input and the reverse calculation result are consistent, the first comparison result and the second comparison result are also mismatched.

[0072] As an example, please continue to refer to Figure 5. The forward calculation module and the reverse calculation module of the switch quantity interface unit are the switch quantity forward calculation module and the switch quantity reverse calculation module respectively. The switch quantity forward calculation module can be deployed in the first calculation channel, and the switch quantity reverse calculation module is deployed in the second calculation channel. The first calculation channel and the second calculation channel are connected through an independent communication channel, and the first calculation channel and the second calculation channel are connected through a bus and an external switch quantity interface and an external communication quantity interface respectively.

[0073] The switch quantity forward calculation module of the first calculation channel uses the switch communication volume input from outside the system as the data input of the switch quantity interface unit to perform calculations, obtain the switch quantity forward calculation result, and send the switch quantity forward calculation result to the switch quantity reverse calculation module of the second calculation channel. The switch quantity reverse calculation module of the second calculation channel uses the switch quantity forward calculation result as input to perform reverse calculations, and sends the switch quantity reverse calculation result to the switch quantity forward calculation module of the first calculation channel. The switch quantity reverse calculation module of the second calculation channel also receives the switch communication volume input from outside the system. The switch quantity forward calculation module of the first calculation channel and the switch quantity reverse calculation module of the second calculation channel simultaneously compare the switch quantity reverse calculation result with the switch communication volume input from outside the system to see if they are consistent. Only when both modules of the two channels are relatively consistent will the switch quantity interface unit output the forward calculation result to the main control unit.

[0074] The railway signal safety calculation device provided in the embodiment of the present application utilizes the differences in forward / reverse calculations to focus on solving the heterogeneity problem of safety redundancy comparison. When there are two independent calculation channels, the two channels perform forward and reverse calculations respectively. Due to the natural differences in the calculation processes of forward calculation and reverse calculation, heterogeneity can be guaranteed even if the same hardware structure and computing resources are used. At the same time, most of its implementation process only requires automatic software work. Therefore, it can not only fully evaluate and guarantee the heterogeneity of safety redundancy comparison, but also has strong economic efficiency.

[0075] In some embodiments, referring to FIG6 , the railway signal safety calculation device may include a single calculation channel, in which both the forward calculation module and the reverse calculation module are disposed.

[0076] Exemplarily, the switch quantity forward calculation module and the switch quantity reverse calculation module of the switch quantity interface unit, the communication volume forward calculation module and the communication volume reverse calculation module of the communication volume interface unit, and the main control forward calculation module and the main control reverse calculation module of the main control unit are all deployed in a single computing channel.

[0077] When the main control unit, switch interface unit and communication interface unit of the embodiment of the present application have a single computing channel, this channel receives input from outside the system or other units, first performs forward calculation through the forward calculation module and then performs reverse calculation on the forward calculation result through the reverse calculation module to ensure knowable and effective heterogeneity.

[0078] In an optional embodiment, when the railway signal safety calculation device includes a single calculation channel, the main control unit, the switch interface unit and the communication interface unit compare the reverse calculation results with the data input from outside the system or other units to see if they are consistent. Only when they are consistent, the main control unit, the switch interface unit and the communication interface unit can output to the outside of the system or other units.

[0079] Exemplarily, the single-channel computing channel also includes a comparison module, which is connected to the forward computing module and the reverse computing module; the comparison module is used to compare the consistency of the data input and the reverse computing result to obtain a comparison result; the comparison result is used to indicate that when the data input and the reverse computing result are consistent, the forward computing result is used as the data output.

[0080] For example, the switch quantity interface unit also includes a switch quantity comparison module. The switch quantity comparison module compares the switch quantity reverse calculation result with the switch communication quantity input from the system to determine whether they are consistent. If the switch quantity reverse calculation result and the switch communication quantity input from the system are consistent, the switch quantity comparison module outputs the forward calculation result to the main control unit. The communication quantity comparison module of the communication quantity interface unit and the main control comparison module of the main control unit are not further described here.

[0081] In an optional embodiment, the single-channel computing channel further includes two independent clock sources, wherein one clock source is used for computing processing of the forward computing module and the reverse computing module, and the other clock source is used for verifying clock information.

[0082] For example, when the main control unit, the switch quantity interface unit and the communication quantity interface unit have a single computing channel, the main control unit, the switch quantity interface unit and the communication quantity interface unit have two independent clock sources, one of which is used for the calculation of this channel, and the other is used for the verification of clock information, thereby preventing the failure of a single clock source from causing time errors in the calculation results.

[0083] A single-channel calculation channel can ensure the correctness of the calculation content through forward and reverse calculations, but cannot solve the problem of the speed of the calculation process. This is because the calculation formula is performed under the clock beat. If there is an error in the clock source, the calculation will be faster or slower, and ultimately the output result will be faster or slower. Adding an independent clock source for verification can avoid dangerous failures as much as possible.

[0084] Specifically, when the main control unit, the switch quantity interface unit and the communication quantity interface unit have a single calculation channel, if the above-mentioned comparison reverse calculation result is consistent with the data input, the other clock information is verified and output in two cases: 1) When the output is a switch quantity, the two clock source information is used to drive the switch quantity. Only when both clock sources drive the switch quantity to "1", the switch quantity is output as "1", otherwise the output switch quantity is "0" (when the two clock sources are inconsistent, the output is guaranteed to be "0", that is, the safety side); 2) When the output is communication quantity, the time verification information generated by the two clock sources is added to the output communication data packet at the same time, and then the communication quantity is output (when the two clock sources are inconsistent, the receiver of the communication data can verify it, thereby discarding the data with clock problems and performing safety side processing).

[0085] The railway signal safety calculation platform provided in the embodiment of the present application utilizes the differences in forward / reverse calculations to focus on solving the heterogeneity problem of safety redundancy comparison. When there is only one calculation channel, forward and reverse calculations are performed in chronological order. Due to the natural differences in the calculation processes of forward and reverse calculations, heterogeneity can be guaranteed even when using the same hardware structure and computing resources. At the same time, most of its implementation process only requires automatic software work. Therefore, it can not only fully evaluate and guarantee the heterogeneity of safety redundancy comparison, but also has strong economic efficiency.

[0086] Each module in the railway signal safety computing device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0087] Based on the same inventive concept, embodiments of the present application also provide a railway signal safety calculation method applied to the aforementioned railway signal safety calculation device. The solution provided by this railway signal safety calculation method is similar to the solution described in the aforementioned railway signal safety calculation device. Therefore, the specific limitations in one or more railway signal safety calculation method embodiments provided below can be found in the above-described limitations on the railway signal safety calculation device and will not be further elaborated here.

[0088] In one embodiment, as shown in FIG7 , a railway signal safety calculation method is provided, the method comprising:

[0089] Step 702: Perform forward calculation on the data input according to the basic processing flow in the railway signal control system to obtain the forward calculation result of the data input.

[0090] Step 704: Perform a reverse operation on the forward calculation result to obtain a reverse calculation result, wherein the reverse operation is the inverse operation of the forward calculation.

[0091] Step 706: Compare the data input and the inverse calculation result to obtain a comparison result, and determine the data output corresponding to the data input according to the comparison result.

[0092] In one embodiment, as shown in FIG8 , a method for constructing a railway signal safety computer platform is provided, the method comprising:

[0093] Step 802: Obtain a forward calculation program and a reverse calculation program.

[0094] Step 804: Obtain the number of computing channels in a railway signal safety system.

[0095] Step 806: When there are two computing channels, control one computing channel to deploy a forward computing program, and control the other computing channel to deploy a reverse computing program.

[0096] Step 808: In the case that the number of computing channels is only one, the forward computing program and the reverse computing program are integrated into a forward computing first and reverse computing second program, and deployed in the single computing channel.

[0097] For example, the railway signal safety computer platform based on reversible computing can be implemented in two structures: a dual-path computing channel structure and a single-path computing channel structure. Both structures have two redundant systems. Each system consists of a main control unit, a switch interface unit, a communication interface unit, and a redundant communication network connecting the units. The redundant systems are connected through the redundant communication network. When implemented according to the dual-path computing channel structure, the two computing channels deploy forward computing and reverse computing respectively. When implemented according to the single-path computing channel structure, a clock source independent of the computing channel needs to be set. Generally, the dual-path computing channel structure can utilize the hardware of the original two-by-two safety computer platform and be implemented by deploying different platform software, avoiding the cost of new hardware development. The single-path computing channel structure is suitable for situations where hardware needs to be upgraded or newly developed, as well as for situations where COTS hardware meets the requirements. Since only one computing channel is required, the hardware cost is reduced.

[0098] Please refer to Figure 9. The railway signal safety computer platform based on reversible computing can use reversible programming languages ​​and non-reversible programming languages ​​to develop platform software. When implementing using a non-reversible programming language, a conversion tool software is required to convert the forward calculation program into a reverse calculation program. Since most current programming languages ​​are non-reversible, conversion tool software is generally required. This software needs to be customized according to the different programming languages. Next, based on the dual-channel computing channel structure and the single-channel computing channel structure, the forward calculation program and the reverse calculation program are deployed simultaneously in the dual-channel computing channel, or integrated in a single-channel computing channel in a sequential order. Finally, a comparison program for the forward and reverse calculations is integrated. This comparison program is used to compare the consistency between the reverse calculation results and the data input.

[0099] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0100] Based on the same inventive concept, embodiments of the present application further provide a railway signal safety computer platform including a railway signal safety computing device. The implementation solutions provided by the railway signal safety computer platform are similar to those described in the aforementioned railway signal safety computing device. Therefore, the specific limitations of one or more railway signal safety computer platform embodiments provided below can be found in the aforementioned limitations of the railway signal safety computing device and will not be further elaborated here.

[0101] In one embodiment, the railway signal safety computer platform includes two redundant systems connected via a redundant communication network. Each system includes a railway signal safety computing device, which includes a main control unit, a switch interface unit, and a communication interface unit, all of which are connected via a redundant communication network.

[0102] In one embodiment, the two systems of the railway signal safety computer platform have sufficient independence, where independence includes the use of independent isolated power supply modules, the electrical clearance and materials between the two systems meeting the reinforced insulation requirements, the addition of isolation devices to the communication interface between the two systems, and the addition of shielding and grounding to prevent the impact of electromagnetic radiation between them.

[0103] Current methods for addressing the common cause failure problem of two-out-of-two channels in a two-by-two-out-of-two architecture of railway signal safety computer platforms are not economical, and the effectiveness of the solution cannot be fully evaluated and guaranteed. The railway signal safety computer platform provided in the embodiments of the present application proposes a new method for addressing common cause failure, thereby reducing the cost of solving this problem and enabling a more comprehensive evaluation of the implementation effect, thereby ensuring that the common cause failure problem is effectively resolved.

[0104] In one embodiment, a railway signal safety computer platform is provided. The internal structure of the railway signal safety computer platform may be shown in Figure 10. The railway signal safety computer platform includes a processor, memory, an input / output (I / O) interface, and a communication interface. The processor, memory, and I / O interface are connected via a system bus, and the communication interface is connected to the system bus via the I / O interface. The processor of the railway signal safety computer platform provides computing and control capabilities. The computer device's memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operating system and computer program stored in the non-volatile storage medium. The I / O interface of the railway signal safety computer platform is used to exchange information between the processor and external devices. The communication interface of the railway signal safety computer platform is used to communicate with external terminals via a network connection. When executed by the processor, the computer program implements a railway signal safety computing method.

[0105] Those skilled in the art will understand that the structure shown in FIG10 is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0106] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0107] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), data processing logic devices based on quantum computing, and the like.

[0108] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0109] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A railway signal safety calculation device, characterized in that: The device comprises: A forward calculation module, used to perform forward calculation on the data input according to the basic processing flow in the railway signal control system to obtain the forward calculation result of the data input; a reverse calculation module, connected to the forward calculation module, for receiving the forward calculation result from the forward calculation module, and performing a reverse operation on the forward calculation result to obtain a reverse calculation result; The reverse operation is the reverse operation of the forward operation.

2. The device according to claim 1, characterized in that The device includes a dual-path computing channel; The forward calculation module is arranged in one of the two-way calculation channels, and the reverse calculation module is arranged in the other of the two-way calculation channels.

3. The device according to claim 2, characterized in that The forward calculation module is further used to receive the reverse calculation result from the reverse calculation module, and compare the consistency between the data input and the reverse calculation result to obtain a first comparison result; and / or, The reverse calculation module is further used to receive the data input, and compare the consistency between the data input and the reverse calculation result to obtain a second comparison result; The first comparison result and the second comparison result are used to indicate that when the first comparison result and the second comparison result match, the forward calculation result is output as data.

4. The device according to claim 3, characterized in that The device is configured to: When the first comparison result indicates that the data input and the inverse calculation result are consistent, and the second comparison result indicates that the data input and the inverse calculation result are consistent, determining that the first comparison result and the second comparison result match; When the first comparison result indicates that the data input and the inverse calculation result are inconsistent, and the second comparison result indicates that the data input and the inverse calculation result are inconsistent, it is determined that the first comparison result and the second comparison result do not match.

5. The device according to claim 1, characterized in that The device includes a single computing channel; The forward calculation module and the reverse calculation module are both arranged in the single-channel calculation channel.

6. The device according to claim 5, characterized in that The single-path calculation channel further includes a comparison module, and the comparison module is connected to the forward calculation module and the reverse calculation module; The comparison module is used to compare the consistency between the data input and the reverse calculation result to obtain a comparison result; The comparison result is used to indicate that when the data input and the reverse calculation result are consistent, the forward calculation result is output as data.

7. The device according to claim 6, characterized in that The single-channel computing channel also includes two independent clock sources; Among them, one clock source is used for calculation processing of the forward calculation module and the reverse calculation module, and the other clock source is used for checking clock information.

8. A railway signal safety calculation method, characterized in that: The method comprises: Performing forward calculation on the data input according to the basic processing flow in the railway signal control system to obtain the forward calculation result of the data input; Performing a reverse operation on the forward calculation result to obtain a reverse calculation result, wherein the reverse operation is an inverse operation of the forward calculation; The data input and the inverse calculation result are compared to obtain a comparison result, and a data output corresponding to the data input is determined according to the comparison result.

9. A railway signal safety computer platform, characterized in that: It comprises two sets of railway signal safety systems with redundant relationship; at least one set of railway signal safety systems comprises the railway signal safety computing device as claimed in any one of claims 1 to 7.

10. A method for constructing a railway signal safety computer platform, characterized in that: The method comprises: Obtain forward calculation program and reverse calculation program; Get the number of computing channels in a railway signal safety system; When there are two computing channels, one computing channel is controlled to deploy a forward computing program, and the other computing channel is controlled to deploy a reverse computing program; In the case that the number of computing channels is one, the forward computing program and the reverse computing program are integrated into a forward computing first and reverse computing second program, and deployed in the single computing channel.

Images