Train dynamic redundancy switching system

Abstract

The invention relates to a train dynamic redundancy switching system which is communicated with a train central control unit and comprises a communication module which is configured to communicate with the train central control unit and receive train data; the processor comprises a processing core, and the processing core is configured to generate verification information according to the train data; the security manager is configured to receive the verification information, judge whether the verification information is correct or not according to the verification information, and obtain judgment times and error times; calculating the quotient of the error frequency and the judgment frequency to obtain a real-time error rate; switching a redundancy mode and generating redundancy mode information according to the real-time error rate and the judgment threshold value; and the gating device is configured to control the communication module to open or close a path for transmitting the train data to the processing core according to the redundancy mode information. According to the method and the device, the problems of resource waste and working efficiency reduction of a traditional redundancy strategy in a high-speed rail control system are solved, the flexibility and the working efficiency of redundancy switching are improved, and resource waste is reduced.

Description

Technical Field

[0001] The present application relates to the field of high-speed rail control systems, and in particular to a train dynamic redundant switching system. Background Art

[0002] At present, in order to correctly perform corresponding operations during the operation of the train, it is necessary to judge whether the received instructions or data are correct, and establish an adaptive fault-tolerant system to improve the train's fault tolerance rate and improve the train's autonomous operation capability.

[0003] In the prior art, fault-tolerant designs of traditional hardware are widely used, among which static redundancy strategies are used more frequently. Static redundancy strategies include fixed dual-module redundancy or triple-module redundancy. During working hours, regardless of the actual fault occurrence rate and the reliability requirements of the train operation environment, the internal modules of dual-module redundancy and triple-module redundancy are always in working condition.

[0004] However, when the existing technologies are applied to high-speed rail control systems, which have dynamic workloads and variable reliability requirements, there are significant problems of resource waste and reduced efficiency. Summary of the invention

[0005] An embodiment of the present application provides a train dynamic redundancy switching system to at least solve the problems in the related art that the static redundancy mode has low flexibility, low efficiency, and excessive resource usage.

[0006] In a first aspect, an embodiment of the present application provides a train dynamic redundancy switching system, wherein the switching system is connected to a train central control unit and includes:

[0007] A communication module is configured to communicate with a train central control unit and receive train data;

[0008] A processor, including a processing core, the processing core being configured to generate verification information based on the train data;

[0009] The security manager is configured to receive the verification information, determine whether the verification information is correct according to the verification information, and obtain the number of determinations and the number of errors; calculate the quotient of the number of errors and the number of determinations to obtain a real-time error rate; switch the redundancy mode according to the real-time error rate and the determination threshold and generate redundancy mode information;

[0010] The selector is configured to control the communication module to open or close the path for transmitting train data to the processing core according to the redundant mode information.

[0011] Switch redundant modes in real time according to train data to improve system reliability, stability and system response speed.

[0012] In some embodiments, the redundant mode information includes multiple redundant information, the processing core includes multiple cores, and multiple judgment threshold intervals that increase successively are set. When the error rate is within a judgment threshold interval, the safety manager starts the corresponding redundant mode and generates redundant information corresponding to the redundant mode; at the same time, the selector activates the communication module according to the received redundant information to transmit one or more paths of train data to one or more cores corresponding to the redundant information.

[0013] Accurately control the data path according to the redundant mode information to ensure the effectiveness and real-time performance of redundant switching and improve system stability.

[0014] In some of the embodiments, the plurality of cores include a first core, a second core, and a third core, and the gate is further configured to:

[0015] When the redundant mode information is the first redundant information, a path for transmitting train data from the communication module to the first core is opened;

[0016] When the redundant mode information is the second redundant information, a path for the communication module to transmit train data to the first core and the second core is opened;

[0017] When the redundant mode information is the third redundant information, the communication module is enabled to transmit the train data to the first core, the second core and the third core.

[0018] By gradually increasing the number of cores, the data processing capability can be further improved and the redundancy reliability of the system can be enhanced.

[0019] In some of the embodiments, the security manager is further configured to: in a redundant mode corresponding to a core, receive verification information of the core, verify whether the verification information is correct, and if not, accumulate the number of errors and calculate the error rate again.

[0020] The security manager continuously verifies the core's verification information and automatically handles errors when they occur, effectively improving the stability and reliability of the system.

[0021] In some embodiments, it also includes:

[0022] The interrupt controller is configured to receive interrupt information and redundant mode information, and send the interrupt information to a core corresponding to the redundant mode information.

[0023] Avoid wasting system resources and respond quickly at critical moments through real-time monitoring and interruption control.

[0024] In some embodiments, it also includes:

[0025] The clock manager is configured to receive redundant mode information and control the startup of a core corresponding to the redundant mode information.

[0026] Through the control of the clock manager, it is ensured that each core starts at the appropriate time to avoid system instability caused by timing disorders.

[0027] In some embodiments, it also includes:

[0028] The reset manager is configured to control the processor to reset when the error rate is equal to a fourth determination threshold.

[0029] This ensures that if the error rate is too high, the system can be reinitialized to resume normal working state.

[0030] In some embodiments, it also includes:

[0031] The memory controller is configured to receive and store correct data sent by the security manager when the security manager determines that the verification information is correct.

[0032] When the security manager verifies that the checksum information is correct, the memory controller receives and stores the data to ensure data accuracy and persistence and avoid data loss or errors.

[0033] In some embodiments, it also includes:

[0034] An information acquisition module is configured to obtain the real-time working status of the train and the type of task it is in;

[0035] The control module is configured to switch the redundant mode according to the real-time working status of the train and the type of task it is in, according to preset rules.

[0036] By acquiring the train's operating status in real time, the control module can adjust the redundancy mode according to actual conditions and improve the intelligence level of the system.

[0037] In some embodiments, it also includes:

[0038] The comparison module is configured to determine whether the level of the redundant mode switched by the safety manager is higher than the level of the redundant mode switched by the control module. If so, the train is controlled to execute the redundant mode switched by the control module; if not, the train is controlled to execute the redundant mode switched by the safety manager.

[0039] Through the comparison mechanism of the comparison module, the system can flexibly select the most suitable redundancy mode according to the levels of different redundancy modes and improve the fault tolerance capability.

[0040] Compared with the related technologies, the dynamic redundant switching system for trains provided in the embodiments of the present application executes corresponding redundant modes by analyzing the error rate, the type of tasks received by the train and the real-time working status of the train, and can dynamically switch redundant modes, thereby solving the problems of resource waste and reduced work efficiency of traditional redundant strategies in application scenarios such as high-speed rail control systems with dynamic workloads and variable reliability requirements, and achieving improved flexibility in redundant switching, improved work efficiency, and reduced resource waste.

[0041] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0043] Figure 1 is a structural block diagram of a train dynamic redundant switching system according to an embodiment of the present application;

[0044] Figure 2 is a flow chart of switching redundancy modes of a train dynamic redundancy switching system according to an embodiment of the present application;

[0045] Figure 3 is a flow chart of switching redundancy modes of a train dynamic redundancy switching system according to an embodiment of the present application;

[0046] Figure 4 is a structural block diagram of a train dynamic redundant switching system according to an embodiment of the present application;

[0047] Figure 5 It is a structural block diagram of the processor in the train dynamic redundant switching system according to an embodiment of the present application.

[0048] In the figure:

[0049] 101. Train central control unit; 102. Communication module; 103. Processor; 104. Safety manager; 105. Strobe;

[0050] 401, interrupt controller; 402, clock controller; 403, reset manager; 404, memory controller; 405, on-chip memory unit; 406, DDR memory unit; 407, GPIO controller; 408, timer; 409, GPIO pin; 410, other peripheral controllers; 411, other peripherals;

[0051] 501, the first core; 502, the second core; 503, the third core. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0053] Obviously, the drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can also be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

[0054] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0055] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects before and after are in an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0056] In the fault-tolerant design of traditional hardware, static redundancy mode is widely used to improve system reliability. However, this redundant system has significant resource waste and efficiency reduction problems, especially in application scenarios such as high-speed rail control systems with dynamic workloads and variable reliability requirements.

[0057] In static redundancy mode, regardless of the actual failure rate and reliability requirements of the train operating environment, all modules are always in working condition, with low flexibility and occupying most of the resources, resulting in resource waste.

[0058] In order to solve the above problems, this embodiment provides a train dynamic redundancy switching system. Figure 1 is a structural block diagram of a train dynamic redundant switching system according to an embodiment of the present application, such as Figure 1 As shown, the switching system is connected to the train central control unit 101, and the switching system includes:

[0059] The communication module 102 is configured to communicate with the train central control unit 101 and receive train data.

[0060] The processor 103 includes a processing core configured to generate verification information according to the train data.

[0061] The security manager 104 is configured to receive the verification information, determine whether the verification information is correct according to the verification information, and obtain the number of determinations and the number of errors; calculate the quotient of the number of errors and the number of determinations to obtain a real-time error rate; switch the redundancy mode and generate redundancy mode information according to the real-time error rate and the determination threshold,

[0062] The selector 105 is configured to control the communication module 102 to open or close the path for transmitting train data to the processing core according to the redundant mode information.

[0063] This embodiment uses the communication module 102 to establish data communication with the train central control unit 101, and transmits the received train data to the processor 103. The processing core in the processor 103 parses the data and generates verification information according to a preset algorithm. The safety manager 104 receives the verification information and verifies it to determine the correctness of the data. Using the safety manager 104 for real-time monitoring can effectively reduce the risk of system failures and ensure the safety of train operation.

[0064] During the judgment process, the security manager 104 counts the number of errors and the number of judgments, and calculates the real-time error rate. The error rate is used to compare with the preset judgment threshold, and decides whether to perform redundant mode switching based on it, which can timely determine whether the system needs to perform redundant mode switching, thereby improving the intelligence of the system.

[0065] The selector 105 controls the data transmission path of the communication module 102 according to the redundant mode information generated by the safety manager 104 to ensure that the train data is transmitted to the correct processing core, thereby realizing dynamic redundant switching and improving the reliability, stability and response speed of the system.

[0066] The redundant mode information includes multiple redundant information, the processing core includes multiple cores, and multiple judgment threshold intervals that are successively increased are set. When the error rate is within a judgment threshold interval, the safety manager starts the corresponding redundant mode and generates redundant information corresponding to the redundant mode. At the same time, the gate opens one or more paths for the communication module to transmit train data to one or more cores corresponding to the redundant information according to the received redundant information.

[0067] The redundant mode information includes first redundant information, second redundant information and third redundant information, and the processing core includes multiple cores. When the error rate is higher than the first judgment threshold and lower than the second judgment threshold, the safety manager 104 starts the first redundant mode and generates the first redundant information; when the error rate is higher than the second judgment threshold and lower than the third judgment threshold, the safety manager 104 starts the second redundant mode and generates the second redundant information; when the error rate is higher than the third judgment threshold and lower than the fourth judgment threshold, the safety manager 104 starts the third redundant mode and generates the third redundant information; at the same time, the selector 105 opens the communication module 102 to transmit multiple paths of train data to one or more cores corresponding to the redundant mode information according to the received redundant mode information.

[0068] This embodiment dynamically adjusts the redundancy mode according to a plurality of preset judgment thresholds when the error rate change is detected. When the error rate exceeds a certain threshold, the security manager 104 generates corresponding redundancy mode information to improve the fault tolerance of the system.

[0069] Through the hierarchical redundancy mechanism, the adaptability of the system is improved, so that it can select the appropriate redundancy mode according to different degrees of error rate, avoiding excessive or insufficient redundancy switching. The selector 105 can accurately control the data path according to the redundancy mode information, ensure the effectiveness and real-time performance of the redundancy switching, and improve the stability of the system.

[0070] Figure 2 The flowchart of switching the redundant mode of the train dynamic redundant switching system is shown in Figure 1. Figure 2 As shown, the first redundant mode is the SMR mode, the second redundant mode is the DMR mode, and the third redundant mode is the TMR mode. The redundancy levels of the SMR mode, the DMR mode, and the TMR mode gradually increase. The first judgment threshold can be set to 0. The second judgment threshold can be set to 50%. The third judgment threshold can be set to 80%. The fourth judgment threshold can be set to 100%. During the initial operation of the train dynamic redundant switching system, the switching system is in the SMR mode. It is determined whether the error rate calculated by the safety manager 104 is greater than 50%. If not, the SMR mode is maintained. If so, it is upgraded to the DMR level. After the switching system enters the DMR mode, it is determined whether the error rate calculated by the safety manager 104 is greater than 80%. If so, it is upgraded to the TMR mode. If not, it is further determined whether the error rate is less than 50%. If so, the switching system is adjusted to the SMR mode. If the error rate is greater than 50% and less than 80%, the DMR mode is continued. After the switching system enters the TMR mode, it determines whether the error rate calculated by the security manager 104 is greater than or equal to 100%. If so, the reset manager 403 resets the switching system. If not, it further determines whether the error rate is less than 80%. If so, the switching system is adjusted to the DMR mode. If not, the TMR mode is maintained.

[0071] In some embodiments, such as Figure 5 As shown, the multiple cores include a first core 501, a second core 502 and a third core 503, and the gate 105 is further configured as follows:

[0072] When the redundant mode information is the first redundant information, the communication module 102 is opened to transmit the train data to the first core 501 .

[0073] When the redundant mode information is the second redundant information, the communication module 102 is enabled to transmit the train data to the first core 501 and the second core 502 .

[0074] When the redundant mode information is the third redundant information, the communication module 102 is enabled to transmit the train data to the first core 501 , the second core 502 and the third core 503 .

[0075] After the safety manager 104 adjusts the redundancy mode according to the error rate, the gate 105 controls the data channel so that the train data can be transmitted to different numbers of cores to enhance the redundancy capability of the system and reduce the impact of single point failures. By gradually increasing the number of cores, the data processing capability is further improved and the redundancy reliability of the system is enhanced. When a single core fails, the data can be transmitted to multiple cores to ensure the continuous operation of the system and improve the fault tolerance rate.

[0076] The multiple cores may be RISC-V (Reduced Instruction Set Computer-Five) cores.

[0077] In some of the embodiments, the security manager 104 is further configured to: in a redundant mode corresponding to a core, receive verification information of the core, verify whether the verification information is correct, and if not, accumulate the number of errors and calculate the error rate again.

[0078] In the redundant mode of each core, the security manager 104 receives the verification information from the core and determines whether the information is consistent with the predetermined data. If the verification information is incorrect, the number of errors is accumulated, the real-time error rate is recalculated, and the stability of the core is continuously monitored. This process ensures that the system continues to detect and respond to potential failures in real-time operation. The security manager 104 continuously verifies the verification information of the core and automatically handles errors when they occur, effectively improving the stability and reliability of the system.

[0079] In some embodiments, when the first redundant mode is started and the first redundant information is generated, the check information of the first core 501 is received to verify whether the check information of the first core 501 is correct. If not, the number of errors is increased by one and the error rate is calculated again.

[0080] In some embodiments, when the second redundant mode is started and the second redundant information is generated, verification information of the first core 501 and the second core 502 are received respectively to determine whether the verification information of the first core 501 and the verification information of the second core 502 are the same. If not, the number of errors is increased by one and the error rate is calculated again.

[0081] In some embodiments, when the third redundant mode is started and the third redundant information is generated, verification information of the first core 501, the second core 502 and the third core 503 are received respectively, and it is determined whether the verification information of the first core 501, the second core 502 and the third core 503 are all different. If so, the number of errors is increased by one and the error rate is calculated again.

[0082] The error rate is calculated as follows: Error rate = number of errors / total execution cycle.

[0083] In some embodiments, BCH code (Bose-Chaudhuri-Hocquenghem Code) is used as an error correction code (ECC) mechanism, and ECC hardware logic is integrated inside the switching system, so that check bits can be quickly generated when the first core 501, the second core 502, and the third core 503 are running. After receiving the operation logic of multiple cores, the security manager 104 directly verifies through the transmitted data and the accompanying ECC bits.

[0084] In some embodiments, such as Figure 4 As shown, the switching system further includes: an interrupt controller 401 configured to receive interrupt information and redundant mode information, and send the interrupt information to a core corresponding to the redundant mode information.

[0085] When receiving the redundant mode information, the interrupt controller 401 triggers the corresponding interrupt operation based on the information. By dynamically monitoring and switching the redundant mode of each core, when a specific error or abnormal situation is detected, the interrupt controller 401 will immediately send an interrupt signal to the relevant core to instruct it to perform necessary self-checks or recovery operations. The interrupt mechanism enables the system to interrupt in time and perform necessary processing when an unexpected situation occurs, ensuring that the train system is not affected. Through real-time monitoring and interrupt control, system resource waste is avoided and rapid response is made at critical moments.

[0086] In some embodiments, when the redundant mode information is the first redundant information, the interrupt information is sent to the first core 501 .

[0087] In some embodiments, when the redundant mode information is the second redundant information, part of the interrupt information is sent to the first core 501 , and the rest of the interrupt information is sent to the second core 502 .

[0088] In some embodiments, when the redundant mode information is the third redundant information, part of the interrupt information is sent to the first core 501, part of the interrupt information is sent to the second core 502, and the rest of the interrupt information is sent to the third core 503.

[0089] In some embodiments, such as Figure 4 As shown, the switching system further includes: a clock manager configured to receive redundant mode information and control the startup of a core corresponding to the redundant mode information.

[0090] The clock manager automatically adjusts the startup order and timing of each core in the system based on the redundant mode information. For each redundant mode, the clock manager controls the startup timing of the relevant cores to ensure that the cores can work together in different redundant modes, maximize processing efficiency, and ensure smooth operation of the system under different working conditions. Through the control of the clock manager, it is ensured that each core starts at the appropriate time to avoid system instability caused by timing disorder.

[0091] In some embodiments, when the redundant mode information is the first redundant information, the first core 501 is controlled to be turned on.

[0092] In some embodiments, when the redundant mode information is the second redundant information, both the first core 501 and the second core 502 are controlled to be turned on.

[0093] In some embodiments, when the redundant mode information is the third redundant information, the first core 501 , the second core 502 , and the third core 503 are all controlled to be turned on.

[0094] In actual application, after the switching system is powered on, the switching system is in SMR mode by default. The clock controller 402 provides a standard clock for the first core 501, and the second core 502 and the third core 503 do not provide a clock, so the first core 501 operates normally, and the second core 502 and the third core 503 are in a closed state and do not operate. The gate 105 opens a channel for data transmission between the first core 501 and the communication module 102. The interrupt controller 401 sends all the interrupt information generated by the peripheral to the first core 501.

[0095] In SMR mode, the security manager 104 uses an error correction code mechanism to check the logical operation results of the first core 501. When a check error occurs, it adds 1 to the error counter and calculates the error rate.

[0096] When the error rate is lower than 50%, the redundancy mode remains unchanged; when the error rate is between 50% and 80%, the security manager 104 adjusts the redundancy mode to the DMR mode.

[0097] In DMR mode, the clock controller 402 provides a normal clock to the second core 502, and the other cores remain unchanged. The gate 105 opens the channels for data transmission between the first core 501, the second core 502 and the communication module 102. The interrupt controller 401 migrates part of the interrupt information from the first core 501 to the second core 502 to reduce the load of the first core 501.

[0098] In DMR mode, the security manager 104 receives the results of logical operations from the first core 501 and the second core 502, and compares the two sets of data after the verification is completed. If the data is consistent, the data is sent to the memory manager. If the data is inconsistent, the error count is increased by 1, and the error rate is calculated in real time.

[0099] When the error rate reaches above 80%, the safety manager 104 switches the redundancy mode to the TMR mode. If the error rate gradually decreases to below 50%, the safety manager 104 switches the redundancy mode back to the SMR mode.

[0100] When switching back to SMR mode, the security manager 104 notifies the interrupt controller 401 to migrate the interrupt information located in the second core 502 to the first core 501, and then notifies the selector 105 to close the channel for data transmission between the second core 502 and the communication module 102. After completion, the clock controller 402 is notified to turn off the clock of the second core 502, so that the second core 502 is in a closed state.

[0101] In TMR mode, the clock controller 402 provides normal clocks for the first core 501, the second core 502 and the third core 503, the selector 105 opens all channels for data transmission between the first core 501, the second core 502 and the third core 503 and the communication module 102, and the interrupt controller 401 redistributes all interrupt information evenly to the first core 501, the second core 502 and the third core 503.

[0102] In TMR mode, the security manager 104 will receive the logical operation results from the first core 501, the second core 502 and the third core 503. After the verification is completed, the data of the three cores will be compared. If two of them have the same data, the data will be taken as correct data and sent to the memory controller 404. If the data of the three cores are completely different, the error count will be increased by 1, and the error rate will be calculated in real time.

[0103] If the error rate is greater than or equal to 100%, the safety manager 104 will notify the reset manager 403 to reset the entire switching system. If the error rate gradually decreases to below 80%, the safety manager 104 will switch the redundancy mode back to the DMR mode.

[0104] Switching back to DMR mode, the security manager 104 notifies the interrupt controller 401 to migrate the interrupt information located in the third core 503 to the first core 501 and the second core 502, and then notifies the selector 105 to close the channel for data transmission between the third core 503 and the communication module 102. After completion, the clock controller 402 is notified to turn off the clock of the third core 503, so that the third core 503 is in a closed state.

[0105] In some embodiments, such as Figure 4 As shown, the switching system further includes: a reset manager 403 configured to control the processor 103 to reset when the error rate is equal to a fourth judgment threshold.

[0106] The reset manager 403 monitors the error rate of the system in real time. Once it detects that the error rate reaches or exceeds the fourth judgment threshold, the reset manager 403 immediately triggers the reset operation of the processor 103. This ensures that when the error rate is too high, the system can be reinitialized to restore the normal working state. When the system error rate is too high, timely reset can avoid the spread of faults and protect the overall stability of the system. Through the automatic reset function, the system operation can be quickly restored without manual intervention, reducing the fault handling time.

[0107] In some embodiments, such as Figure 4 As shown, the switching system also includes: a memory controller 404, which is configured to receive and store correct data sent by the security manager 104 when the security manager 104 determines that the verification information is correct.

[0108] When the security manager 104 verifies that the checksum information is correct, the memory controller 404 receives and stores the data to ensure the accuracy and persistence of the data and avoid data loss or errors. The data can be used for further analysis or recovery operations in subsequent processing to ensure the data integrity of the system during long-term operation, and to quickly rebuild the operating state during fault recovery, thereby reducing recovery time.

[0109] In some of the embodiments, the switching system further includes: an information acquisition module configured to acquire the real-time working status of the train and the type of task it is in.

[0110] The control module is configured to switch the redundant mode according to the real-time working status of the train and the type of task it is in, according to preset rules.

[0111] The information acquisition module monitors the working status of the train in real time, acquires information according to the type of task the train is in, and transmits it to the control module. Based on this information and preset rules, the control module dynamically selects and switches the redundancy mode to optimize the operating efficiency of the train system. By acquiring the working status of the train in real time, the control module can adjust the redundancy mode according to actual conditions and improve the intelligence level of the system. Flexible switching of the redundancy mode according to the task type helps optimize the utilization of system resources and avoid unnecessary redundant consumption.

[0112] In some of the embodiments, the switching system also includes: a comparison module, configured to determine whether the level of the redundant mode switched by the safety manager 104 is higher than the level of the redundant mode switched by the control module. If so, the train is controlled to execute the redundant mode switched by the control module; if not, the train is controlled to execute the redundant mode switched by the safety manager 104.

[0113] The comparison module compares the redundancy mode levels selected by the safety manager 104 and the control module to determine which mode is more appropriate. If the redundancy mode level selected by the safety manager 104 is higher, the selection of the safety manager 104 is executed first; otherwise, the redundancy mode of the control module is executed to ensure that the system operates according to the highest level of redundancy mode. Through the comparison mechanism of the comparison module, the system can flexibly select the most suitable redundancy mode according to the levels of different redundancy modes to improve fault tolerance. Selecting a more efficient redundancy mode according to actual conditions helps to improve the working efficiency and safety of the train system.

[0114] like Figure 3 As shown, the switching system is adapted to a software, and the switching system enters the default SMR mode after startup. The software obtains the current working state and task type of the train in real time. The current working state of the train includes but is not limited to: starting stage, acceleration stage, uniform speed running stage, deceleration or braking stage, parking and standby stage, etc. Task types include but are not limited to data reception, data analysis and data output. In data reception, the switching system can receive speed signals and braking signals. In data output, the system can output switch control and pantograph lifting information.

[0115] The current software determines whether the SMR mode meets the conditions based on the current working status or mission type of the train.

[0116] For example, when the train is stopped or at a constant speed, the SMR mode can be selected. When the train is accelerating, the error rate is low but the real-time requirement is high, so the DMR mode can be selected. When the train is braking, the highest reliability is required, so the TMR mode is used.

[0117] For example, data reception and transmission, emergency braking tasks require the highest redundancy level, and the TMR mode is selected to ensure the reliability of train operation.

[0118] If the conditions are met, the SMR mode is maintained. If not, the software obtains the real-time redundant mode of the processor 103 from the security manager 104.

[0119] If the obtained redundancy level meets the current working state and task type, the redundancy level parameters of the software itself will be updated. If the current redundancy level of the hardware does not meet the requirements, the software will issue a higher level redundancy mechanism mode. For example, in the initial state, the software maintains the SMR mode. If the software needs to be upgraded to the DMR mode, but the hardware is in the TMR mode at this time, if the error rate is lower than 80%, it can be switched to DMR. If the error rate is higher than 80%, it remains unchanged.

[0120] When the software determines that the redundancy mode adapted to the current working state and task type can be a redundancy mode of a lower level, a redundancy mode of a lower level than the current redundancy mode is issued.

[0121] In order to prevent the switching system from adjusting the redundancy mode according to the error rate and the redundancy mode adjusted by the software command to ensure the reliability and security of the system, the following conditions are set: If the level of the redundancy mode issued by the software is lower than the level of the redundancy mode adopted by the current switching system according to the real-time error rate, the redundancy mode remains unchanged. If the level of the redundancy mode issued by the software is higher than the level of the redundancy mode of the current switching system, it is immediately switched to the redundancy level mode issued by the software, and the non-downgrading flag is set to prevent the switching system from automatically adjusting the redundancy mode according to the error rate, resulting in a reduction in the redundancy mode level. If the real-time error rate gradually exceeds the judgment threshold, the switching system automatically adjusts the redundancy mode and increases the level of the redundancy mode. If the redundancy level issued by the software is lower than the redundancy level of the current hardware, and the error rate of the hardware at this time meets the issued redundancy level, it is switched to the issued redundancy level. If the redundancy level issued by the software is SMR mode, after the switching system switches to SMR mode, the non-downgrading flag is cleared, and the switching system automatically adjusts the redundancy mode and the level of the redundancy mode.

[0122] like Figure 4 As shown, the train dynamic redundant switching system also includes an on-chip memory unit 405 and a DDR memory unit 406. The memory controller 404 is connected to and communicates with the on-chip memory unit 405 and the DDR memory unit 406 respectively to control the on-chip memory unit 405 and the DDR memory unit 406 to store data.

[0123] The DDR memory unit 406 may be configured as a double data rate synchronous dynamic random access memory.

[0124] The interrupt controller 401 of the train dynamic redundant switching system is connected and communicated with the GPIO controller 407, the timer 408 and other peripheral controllers 410 to receive interrupt signals. Among them, the interrupt signal includes the interrupt signal generated by the serial port and the network card. The interrupt signal is used to notify the train dynamic redundant switching system that there is external data to be processed. When the external device requires the train dynamic redundant switching system to process data, an interrupt signal will be sent to the train dynamic redundant switching system.

[0125] The GPIO controller 407 can be configured as a general purpose input and output controller. The GPIO controller 407 is connected to and communicates with the GPIO pin 409 .

[0126] Other peripheral controllers 410 communicate with other peripherals 411

[0127] It should be noted that the above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor 103; or the above modules can be located in different processors 103 in any combination.

[0128] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0129] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A train dynamic redundant switching system, the switching system is connected to the train central control unit, characterized in that: include: A communication module is configured to communicate with a train central control unit and receive train data; A processor, including a processing core, the processing core being configured to generate verification information based on the train data; The security manager is configured to receive the verification information, determine whether the verification information is correct according to the verification information, and obtain the number of determinations and the number of errors; Calculate the quotient of the number of errors and the number of judgments to obtain a real-time error rate; switch the redundancy mode and generate redundant mode information according to the real-time error rate and the judgment threshold; The selector is configured to control the communication module to open or close the path for transmitting train data to the processing core according to the redundant mode information.

2. The train dynamic redundant switching system according to claim 1, characterized in that: The redundant mode information includes multiple redundant information, the processing core includes multiple cores, and multiple judgment threshold intervals that increase in sequence are set. When the error rate is within a judgment threshold interval, the safety manager starts the corresponding redundant mode and generates redundant information corresponding to the redundant mode; at the same time, the selector activates the communication module according to the received redundant information to transmit one or more paths of train data to one or more cores corresponding to the redundant information.

3. The train dynamic redundant switching system according to claim 2, characterized in that: The plurality of cores include a first core, a second core, and a third core, and the gate is further configured to: When the redundant mode information is the first redundant information, a path for transmitting train data from the communication module to the first core is opened; When the redundant mode information is the second redundant information, a path for the communication module to transmit train data to the first core and the second core is opened; When the redundant mode information is the third redundant information, the communication module is enabled to transmit the train data to the first core, the second core and the third core.

4. The train dynamic redundant switching system according to claim 2, characterized in that: The security manager is further configured to: in a redundant mode corresponding to a core, receive verification information of the core, verify whether the verification information is correct, and if not, accumulate the number of errors and calculate the error rate again.

5. The train dynamic redundant switching system according to claim 2, characterized in that: Also includes: The interrupt controller is configured to receive interrupt information and redundant mode information, and send the interrupt information to a core corresponding to the redundant mode information.

6. The train dynamic redundant switching system according to claim 2, characterized in that: Also includes: The clock manager is configured to receive redundant mode information and control the startup of a core corresponding to the redundant mode information.

7. The train dynamic redundant switching system according to claim 2, characterized in that: Also includes: The reset manager is configured to control the processor to reset when the error rate is equal to a fourth determination threshold.

8. The train dynamic redundant switching system according to claim 1, characterized in that: Also includes: The memory controller is configured to receive and store correct data sent by the security manager when the security manager determines that the verification information is correct.

9. The train dynamic redundancy mechanism switching system according to claim 1, characterized in that: Also includes: An information acquisition module is configured to obtain the real-time working status of the train and the type of task it is in; The control module is configured to switch the redundant mode according to the real-time working status of the train and the type of task it is in, according to preset rules.

10. The train dynamic redundant switching system according to claim 9, characterized in that: Also includes: The comparison module is configured to determine whether the level of the redundant mode switched by the safety manager is higher than the level of the redundant mode switched by the control module. If so, the train is controlled to execute the redundant mode switched by the control module; if not, the train is controlled to execute the redundant mode switched by the safety manager.

Images