Rail transit safety computer platform supporting multiple applications and control method

Abstract

The invention relates to a rail transit safety computer platform supporting multiple applications and a control method, the platform follows a fault-safety principle during design, supports multiple applications and conforms to an EN50129 functional safety SIL4 level, and the computer platform comprises a communication gateway used for providing a unified access entrance; the MPU operation subsystem comprises a redundant backup A system and a redundant backup B system, each system comprises two MPU units, and each MPU unit comprises a platform management virtual machine and N application virtual machines; the switching unit is used for switching the main and standby states of the A system and the B system; and the redundant network is respectively connected with the communication gateway, the MPU operation subsystem and the switching unit to realize internal communication. Compared with the prior art, the method has the advantages of supporting multiple applications, enabling the whole system to be more flexible and the like.

Description

Technical Field

[0001] The present invention relates to a rail transit signal system, and in particular to a rail transit safety computer platform supporting multiple applications and a control method. Background Art

[0002] Rail transit signal system is the core system to ensure rail transit driving safety, provide information services and improve transportation efficiency. The safety computer platform is a fault-oriented safety underlying platform, a general platform serving the rail transit industry signal system, and a core component of the rail transit signal system.

[0003] Traditional security computer platforms generally only support one application. Different applications are deployed on different hardware platforms and need to communicate with each other through secure communication protocols. Due to the existence of delay, the maximum response time of the entire system is often affected, affecting the interval and efficiency of train operation. In addition, in order to achieve the goal of reducing costs and increasing efficiency, rail transit projects have the need to integrate multiple systems with similar functions or structures into one system, such as the interlocking and train control center in the national railway, and the interlocking and regional controller in the urban rail. The existing architecture is difficult to cope with and meet this demand. The current method is basically to realize the control process of integrating multiple applications by reconstructing the application software. However, there are also situations where the performance of the hardware platform does not meet the requirements of multiple application integration. With the rapid development of computer technology, multi-core processors and virtualization technology have become important means to improve system performance, reliability and security. Multi-core virtualization technology runs multiple independent virtual environments on the same physical hardware. The advantages of virtualization technology such as centralized computing, dynamic resource allocation, and full use of system resources realize flexible scheduling and efficient utilization of resources, which helps to reduce energy waste caused by waiting for computing resources, and can provide a new solution for rail transit safety computer platforms.

[0004] After searching, Chinese patent publication number CN113157499A discloses a secure computer platform based on cloud computing. The platform adopts a two-by-two design in the horizontal structure, including a first channel and a second channel, and each channel includes four container images running in a cloud computing environment, wherein the first channel includes a first communication controller, a first task host, a first voting host and a first fault tolerance and safety management unit, and the second channel includes a second communication controller, a second task host, a second voting host and a second fault tolerance and safety management unit; in the vertical structure, a two-out-of-two design is used to vote on input and output using two hosts. If the input and output of the two hosts are consistent, the platform outputs, otherwise it reports a fault. However, the existing patent does not explain how to ensure the functional safety of the relevant architecture, and does not propose relevant technical solutions on how to ensure the isolation of multi-channel images. In addition, the relevant architecture also requires a lot of dedicated software and hardware designs for the secure computer cloud platform, which cannot adapt to large-scale commercial promotion and application.

[0005] The existing secure computer platform generally only supports one application. Different applications are deployed on different hardware platforms and need to communicate with each other through secure communication protocols. Due to the existence of time delay, the maximum response time of the entire system is often affected, affecting the interval and efficiency of train operation. In addition, in order to achieve the goal of reducing costs and increasing efficiency, rail transit projects need to integrate multiple systems with similar functions or structures into one system, and the existing architecture is difficult to meet this demand. Summary of the invention

[0006] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a rail transit safety computer platform and control method that supports multiple applications.

[0007] The purpose of the present invention can be achieved by the following technical solutions:

[0008] According to a first aspect of the present invention, a rail transit safety computer platform supporting multiple applications is provided. The platform is designed in accordance with the fail-safe principle, supports multiple applications and complies with the EN50129 functional safety SIL4 level. The computer platform includes:

[0009] Communication gateway, used to provide a unified access portal;

[0010] The MPU computing subsystem includes redundant backup A series and B series, each of which includes two MPU units. Each MPU unit includes a platform management virtual machine and N application virtual machines.

[0011] A switching unit is used to switch the active and standby status of the A and B systems;

[0012] The redundant network is respectively connected to the communication gateway, the MPU operation subsystem and the switching unit to realize internal communication.

[0013] As a preferred technical solution, the platform management virtual machine performs security management of the entire platform, including judgment of CPU, memory and clock self-check conditions, judgment of application virtual machine health conditions and management of application virtual machine use.

[0014] As a preferred technical solution, there is a corresponding IP mapping relationship between each of the application virtual machines and external data.

[0015] As a preferred technical solution, the application virtual machine is configured according to CPU and memory resources. The application virtual machine can monopolize several CPU cores, and also supports multiple application virtual machines occupying the same CPU core.

[0016] As a preferred technical solution, the application virtual machine includes platform middleware and applications, and the platform middleware is responsible for cycle control, processing of input and output communication protocols, redundancy management, output consistency voting, and diagnostic maintenance.

[0017] As a preferred technical solution, the MPU unit includes an enhanced security virtualization layer to manage physical hardware resources and abstract the physical hardware resources into multiple independent virtual environments, each virtual environment is a virtual machine, and resources between virtual machines are securely isolated.

[0018] As an optimal technical solution, the enhanced security virtualization layer implements hardware self-test functions that comply with EN50129, including instruction self-test, register self-test, memory self-test, memory management unit self-test and clock self-test of all CPU cores, and feeds back the self-test results to the platform management virtual machine.

[0019] As a preferred technical solution, each of the virtual machines runs an independent operating system and application program, and the data security and operation independence between virtual machines are ensured by enhancing the isolation mechanism provided by the secure virtualization layer.

[0020] As a preferred technical solution, a real-time operating system is used as the underlying operating environment of the virtual machine.

[0021] According to a second aspect of the present invention, a control method for a rail transit safety computer platform supporting multiple applications as claimed in any one of claims 1 to 9 is provided, characterized in that it comprises the following steps:

[0022] Step S1, the communication gateway receives external system data;

[0023] Step S2, the communication gateway forwards the external data to the corresponding application virtual machine of the MPU unit according to the IP mapping relationship in the configuration;

[0024] Step S3, the platform middleware of the application virtual machine performs redundancy processing and secure decoding on the data and then puts the data into the application interface buffer;

[0025] Step S4, the platform middleware module of the application virtual machine calls the application interface to perform application logic processing;

[0026] Step S5, the application of the virtual machine processes the data and puts the output data into the application interface buffer;

[0027] Step S6, the platform middleware of the application virtual machine obtains the application output data, performs security encoding, and performs output consistency comparison;

[0028] Step S7, if they are consistent, the platform middleware of the application virtual machine sends the data to the communication gateway, otherwise the virtual machine shuts down;

[0029] Step S8: the communication gateway forwards the data to the external communication system.

[0030] According to a third aspect of the present invention, there is provided an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the method described above is implemented when the processor executes the program.

[0031] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the program implements the method described when executed by a processor.

[0032] Compared with the prior art, the present invention has the following advantages:

[0033] 1) The present invention adopts a design that enhances the virtualization function, so that the secure computer platform supports multiple applications. The platform middleware in each virtual machine can independently control the cycle according to the clock, which facilitates the coexistence of applications with different cycles on the platform, making the entire system more flexible;

[0034] 2) The secure computer platform of the present invention enhances virtualization technology and realizes the time-sharing scheduling function that meets the requirements of ARINC 653, so that the number of virtual machines can be more than the number of CPU cores implemented, so that the number of supported applications is not limited by the number of CPU cores; in addition, the self-checking functions such as CPU / memory / clock are integrated into the time-sharing scheduling, making the design of the security function of the virtual machine platform simpler and more universal;

[0035] 3) The secure computer platform of the present invention utilizes the isolation function of secure virtualization technology, and different applications are deployed in different virtual machines, thus avoiding interference between different applications;

[0036] 4) The full computer platform of the present invention utilizes secure virtualization technology to fully utilize hardware resources, significantly improving resource utilization and system performance; an independent operating environment is constructed for each application, so that old embedded applications can run in it without modification, without destroying the closedness of existing applications and without adding new dependencies, which facilitates the porting of old applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 The secure computer platform system structure of the present invention

[0038] Figure 2 This is a schematic diagram of the structure of the secure computing platform of the present invention.

[0039] Figure 3 This is a schematic diagram of the structure of the secure computer platform 2oo2 of the present invention;

[0040] Figure 4 is a control flow chart of the secure computer platform of the present invention;

[0041] Figure 5 It is a workflow diagram of the MPU computing unit of the present invention. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0043] The present invention proposes a rail transit safety computer platform that supports multiple applications based on multi-core virtualization technology. By optimizing the hardware architecture, introducing virtualization technology, and building fault redundancy and fault tolerance mechanisms, it supports multiple applications, minimizes the amount of hardware, reduces power consumption and heat generated, and reduces future electronic waste under the premise of ensuring safety, thus achieving the goal of green. The platform has broad application prospects and important social value.

[0044] The platform of the present invention is designed in accordance with the fail-safe principle, supports multiple applications, complies with the requirements of EN50129 functional safety SIL4 level, and has the characteristics of high safety, high reliability, high availability, high maintainability and high performance.

[0045] like Figure 1As shown, a rail transit safety computer platform supporting multiple applications is provided, which includes a communication gateway subsystem, a redundant network, a switching subsystem, and an MPU operation subsystem, wherein the operation subsystem includes two groups of operation processing systems, namely A\B systems, which are redundant hot standby to each other, and each A / B system is composed of two operation units MPU1 and MPU2 that perform 2-out-of-2 operations, marked as A-MPU1, A-MPU2, B-MPU1, and B-MPU2.

[0046] 1) The communication gateway provides a unified access portal and flow control for the entire system.

[0047] 2) Redundant networks provide communication within the system.

[0048] 3) The switching unit provides a manual device, which allows the user to switch the active / standby status of the A / B system;

[0049] 4) The MPU operation subsystem is the core subsystem of the entire secure computer platform, which implements fault tolerance, secure communication data processing, hot standby redundancy management, and provides a working platform and interface for secure application software.

[0050] like Figure 2 and Figure 3 As shown, each MPU unit is specifically:

[0051] 1) Use high-performance multi-core processors as core computing units, optimize the communication and collaboration mechanisms between processors, give full play to the parallel processing capabilities of multi-core processors, and improve the overall computing power of the system.

[0052] 2) On top of the hardware, an enhanced security virtualization function is implemented. The security virtualization function completes the management of basic hardware resources, including CPU, memory, network, storage and other resources, and abstracts physical hardware resources (such as CPU, memory, I / O devices, etc.) into multiple independent virtual environments. Each virtual environment is called a virtual machine instance (VM), and can achieve secure isolation of resources between virtual machines without interfering with each other, ensuring the independence of upper-layer software during runtime, thereby achieving flexible scheduling and efficient utilization of resources. At the same time, the security virtualization layer implements hardware self-test functions that comply with EN50129, including instruction self-test, register self-test, memory self-test, memory management unit self-test, and clock self-test of all CPU cores, and feeds back the self-test results to the platform management virtual machine. The enhanced security virtualization function implements the time-sharing scheduling function that meets the requirements of ARINC 653.

[0053] 3) In virtualization, the system is divided into multiple logical virtual machine partitions according to application needs and security requirements. Each virtual machine runs an independent operating system and application program. The isolation mechanism provided by the virtualization layer ensures data security and operational independence between virtual machines. In view of the real-time requirements of the secure computer platform, a real-time operating system (RTOS) is used as the underlying operating environment of the virtual machine to ensure real-time response of critical tasks and high availability of the system.

[0054] 4) This platform is divided into a platform management virtual machine and several application virtual machines. The application virtual machine can be configured according to the CPU and memory resources. The application virtual machine can occupy several CPU cores exclusively, and it also supports multiple application virtual machines occupying the same CPU core. The platform management virtual machine implements the security management function of the entire platform, including the judgment of the CPU, memory, and clock self-test status, the health status of the application virtual machine, and the management of the application virtual machine. The application virtual machine includes the platform middleware and the application. The platform middleware is responsible for cycle control, input and output communication protocol processing, redundancy management, output consistency voting, and diagnostic maintenance functions.

[0055] like Figure 4 As shown in Table 1, the control steps of the present invention are as follows:

[0056] 1) Communication gateways R and B receive external system data;

[0057] 2) Communication gateways R and B forward external data to the application virtual machine i corresponding to MPU1 / 2 according to the IP mapping relationship in the configuration (as shown in Table 1);

[0058] 3) The platform middleware of the MPU1 / 2 application virtual machine processes the data redundantly, decodes it securely, and puts it into the application interface buffer;

[0059] 4) The platform middleware module of the MPU1 / 2 application virtual machine calls the application interface to perform application logic processing;

[0060] 5) The MPU1 / 2 application virtual machine processes the data and puts the output data into the application interface buffer;

[0061] 6) The platform middleware of the MPU1 / 2 application virtual machine obtains the application output data, performs security encoding, and performs output consistency comparison;

[0062] 7) If they are consistent, the platform middleware of the MPU1 / 2 application virtual machine sends the data to the communication gateways R and B respectively, otherwise the virtual machine crashes;

[0063] 8) Communication gateways R and B forward the data to the external communication system;

[0064] Table 1

[0065]

[0066] Taking the two-by-two-take-two system as an example, combined with the secure computer platform to which the present invention has been applied, the specific implementation process of the present invention is as follows:

[0067] like Figure 1 As shown, the present invention includes redundant power supplies, redundant networks, communication gateways, switching units, redundant MPU computing subsystems, secure virtualization, basic hardware equipment, etc.; Figure 2 As shown, A-MPU1 and A-MPU2 are powered by one power supply, and B-MPU1 and B-MPU2 are powered by one power supply; Gateway-R is powered by a separate power supply, which also supplies power to the switching unit; Gateway-B is powered by a separate power supply, which also supplies power to the switching unit; Figure 3 As shown in the figure, each system consists of two computing units, MPU1 and MPU2, which perform 2-out-of-2 operations; for each MPU, there is a secure virtualization software between the basic hardware devices, which creates a platform management virtual machine partition and several application virtual machine partitions. The hardware system uses a 4-core Feiteng CPU E2000Q based on the ARM V8 (Advanced RISC Machine) architecture. The CPU includes 4 identical advanced reduced instruction set machines ARMv8, which is an SMP (Symmetric Multi-Processing) architecture. Compared with AMP (Asymmetric Multi-Processing), all CPUs in the SMP architecture are equal in status, without master-slave or master-secondary distinction. They can independently execute tasks and access system resources; the computing unit and gateway unit are based on E2000Q, self-developed hardware boards, which include Ethernet interfaces, memory, hard disks, etc.; the self-developed enhanced secure real-time virtualization software is deployed on the MPU computing unit to ensure real-time performance and secure isolation between different virtual machines. The virtualization software can allocate resources such as CPU, memory, network, storage, etc. to different virtual machines according to the configuration. Real-time operating systems such as vxworks, reworks, syslixOS, etc. can be deployed in the platform management virtual machine and application virtual machine; the gateway unit directly deploys the embedded Linux operating system.

[0068] Figure 5 The workflow of the present invention is described in detail as follows:

[0069] 1) Power on the system;

[0070] 2) The system loads secure virtualization software;

[0071] 3) The secure virtualization software creates and loads a virtual machine according to the configuration, and the MPU1 / MPU2 application virtual machine enters the ready state;

[0072] 4) MPU1 / MPU2 application virtual machine negotiates with the other system on the timing of entering the main cycle;

[0073] 5) After the MPU1 / MPU2 application virtual machine enters the main cycle, its redundancy management module performs master-slave judgment. If it is the master, it switches to 6.1; if it is the slave, it switches to 7.1;

[0074] 6.1) The main MPU1 / MPU2 application virtual machine sends clock synchronization information to the peer system;

[0075] 6.2) The main MPU1 / MPU2 applies the virtual machine to process security data and triggers the application logic to process security data;

[0076] 6.3) The main MPU1 / MPU2 application virtual machine obtains data from the application for security voting; if it passes, it proceeds to 6.4, otherwise it proceeds to 8;

[0077] 6.4) The main MPU1 / MPU2 application virtual machine outputs the data obtained from the application;

[0078] 6.5) The main MPU1 / MPU2 application virtual machine sends its own status data to the standby system;

[0079] 6.6) The main MPU1 / MPU2 application virtual machine returns to 5) and enters the next cycle;

[0080] 7.1) The slave MPU1 / MPU2 application virtual machine performs clock synchronization processing with the master MPU1 / MPU2 application virtual machine;

[0081] 7.2) Obtain the status data to be synchronized from the MPU1 / MPU2 application virtual machine. If OK, refresh the local information synchronously;

[0082] 7.3) Apply the virtual machine from MPU1 / MPU2 to process the security data and trigger the application logic to process the security data;

[0083] 7.4) The MPU1 / MPU2 application virtual machine obtains data from the application for security voting; if it passes, it returns to 5) and enters the next cycle;

[0084] Otherwise go to 8;

[0085] 8) The MPU1 / MPU2 application virtual machine enters the safe state and remains.

[0086] The embodiment of the present invention also provides an electronic device including a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or computer program instructions loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0087] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0088] The processing unit performs the various methods and processes described above, such as the method of the present invention. For example, in some embodiments, the method of the present invention can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the CPU, one or more steps of the method of the present invention described above can be performed. Alternatively, in other embodiments, the CPU can be configured to perform the method of the present invention by any other appropriate means (e.g., by means of firmware).

[0089] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0090] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0091] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0092] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A rail transit safety computer platform supporting multiple applications, characterized in that: The platform is designed to follow the fail-safe principle, supports multiple applications and complies with the EN50129 functional safety SIL4 level. The computer platform includes: Communication gateway, used to provide a unified access portal; The MPU computing subsystem includes redundant backup A series and B series, each of which includes two MPU units. Each MPU unit includes a platform management virtual machine and N application virtual machines. A switching unit is used to switch the active and standby status of the A and B systems; The redundant network is respectively connected to the communication gateway, the MPU operation subsystem and the switching unit to realize internal communication.

2. According to claim 1, a rail transit safety computer platform supporting multiple applications is characterized in that: The platform management virtual machine performs security management of the entire platform, including judgment of CPU, memory and clock self-check conditions, judgment of application virtual machine health conditions and management of application virtual machine usage.

3. According to claim 1, a rail transit safety computer platform supporting multiple applications is characterized in that: There is a corresponding IP mapping relationship between each of the application virtual machines and external data.

4. According to claim 1, a rail transit safety computer platform supporting multiple applications is characterized in that: The application virtual machine is configured according to CPU and memory resources. The application virtual machine can monopolize several CPU cores, and also supports multiple application virtual machines occupying the same CPU core.

5. According to claim 1, a rail transit safety computer platform supporting multiple applications is characterized in that: The application virtual machine includes platform middleware and applications. The platform middleware is responsible for cycle control, processing of input and output communication protocols, redundancy management, output consistency voting, and diagnostic maintenance.

6. According to claim 1, a rail transit safety computer platform supporting multiple applications is characterized in that: The MPU unit includes an enhanced security virtualization layer, which manages physical hardware resources and abstracts the physical hardware resources into multiple independent virtual environments, each of which is a virtual machine, and securely isolates resources between virtual machines.

7. A rail transit safety computer platform supporting multiple applications according to claim 6, characterized in that: The enhanced security virtualization layer implements hardware self-test functions that comply with EN50129, including instruction self-test, register self-test, memory self-test, memory management unit self-test, and clock self-test of all CPU cores, and feeds back the self-test results to the platform management virtual machine.

8. A rail transit safety computer platform supporting multiple applications according to claim 6, characterized in that: Each of the virtual machines runs an independent operating system and application program, and the data security and operation independence between virtual machines are ensured by enhancing the isolation mechanism provided by the secure virtualization layer.

9. A rail transit safety computer platform supporting multiple applications according to claim 6, characterized in that: A real-time operating system is used as the underlying operating environment of the virtual machine.

10. A control method for a rail transit safety computer platform supporting multiple applications as claimed in any one of claims 1 to 9, characterized in that: The following steps are involved: Step S1, the communication gateway receives external system data; Step S2, the communication gateway forwards the external data to the corresponding application virtual machine of the MPU unit according to the IP mapping relationship in the configuration; Step S3, the platform middleware of the application virtual machine performs redundancy processing and secure decoding on the data and then puts the data into the application interface buffer; Step S4, the platform middleware module of the application virtual machine calls the application interface to perform application logic processing; Step S5, the application of the virtual machine processes the data and puts the output data into the application interface buffer; Step S6, the platform middleware of the application virtual machine obtains the application output data, performs security encoding, and performs output consistency comparison; Step S7, if they are consistent, the platform middleware of the application virtual machine sends the data to the communication gateway, otherwise the virtual machine shuts down; Step S8: the communication gateway forwards the data to the external communication system.

11. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to claim 10 is implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to claim 10 is implemented.

Images