Safety power panel of train interlocking and train control system and safety monitoring method

Abstract

The invention relates to a safety power panel of a train interlocking and train control system and a safety monitoring method. A key equipment control and polling switching module detects input dynamic waves and other modules; the key equipment control and polling switching module cooperates with the dynamic wave absorption and driving module to convert dynamic waves into driving signals to drive the silicon rapid on-off and mechanical static isolation module; when the digital low-voltage side discrete safety guard module receives the failure signal, the silicon rapid on-off and mechanical static isolation module is irreversibly cut off; and the overcurrent protection and isolation cooperation module controls the input current. Compared with the prior art, the safety power panel has the advantages that the upgrading of the safety power panel is realized, the inherent fault natural gravity falling function of the gravity type relay is covered, the integral quick falling function of the dynamic tuning circuit and the gravity type relay is realized, and the arc adhesion protection performance of a large air gap of the gravity type relay is realized; and the target of reducing the cost is achieved on the premise of meeting the function safety.

Description

Technical Field

[0001] The invention relates to a train interlocking and train control system, in particular to a safety power supply board and a safety monitoring method of the train interlocking and train control system. Background Art

[0002] At present, VPS is the safety power supply board of IPS system, which only provides power to the safety output board of IPS system in active switch mode when safety conditions are met. VPS has three 64-pin DIN41612 sockets, the upper and lower two are connected to the external CPU bus, and the middle one is connected to the 12V / 24V power supply and external relay. This external relay is VRD relay.

[0003] The safety output power supply in the train interlocking and train control system is now usually realized by using a safety power board + gravity relay, but gravity relays are expensive and have a long procurement cycle. The design of power board + gravity relay not only takes up space but also has high cost, which cannot meet the growing industry needs.

[0004] After searching, the application publication number CN116405342A discloses a universal vehicle-mounted integrated safety monitoring system and a communication redundancy switching method thereof, which mainly targets the safety monitoring host, performs redundant design in terms of power supply, internal bus and communication interface, reduces the failure points, ensures the normal operation of the integrated safety monitoring system, and prevents the occurrence of problems such as function loss and upload interruption caused by the integrated safety monitoring system's own failure points. The problem of gravity-type relays has not been solved.

[0005] In summary, how to design a small and low-cost train interlocking and train control system safety monitoring device is a technical problem that needs to be solved. Summary of the invention

[0006] The purpose of the present invention is to provide a safety power supply board and a safety monitoring method for a train interlocking and train control system in order to overcome the defects of the above-mentioned prior art in that the board occupies a large space or has a high cost.

[0007] The purpose of the present invention can be achieved by the following technical solutions:

[0008] According to one aspect of the present invention, a safety power supply board for a train interlocking and train control system is provided, wherein the safety power supply board is provided with a key equipment control and polling switching module, a dynamic wave absorption and driving module, a silicon fast on-off and mechanical static isolation module, a digital low-voltage side discrete safety guard module, and an overcurrent protection and isolation coordination module, all of which are connected to the key equipment control and polling switching module;

[0009] Dynamic wave input key equipment control and polling switching module and dynamic wave absorption and driving module, the silicon fast on-off and mechanical static isolation module are connected to all other modules, the overcurrent protection and isolation coordination module is connected to the external power supply, and the silicon fast on-off and mechanical static isolation module is connected to the load;

[0010] The key equipment control and polling switching module detects the input dynamic wave and all other modules, and when the detection is correct, the key equipment control and polling switching module converts the dynamic wave into a drive signal to drive the IGBT part in the silicon fast switching and mechanical static isolation module; the dynamic wave absorption and driving module converts the dynamic wave into a drive signal to drive the relay part in the silicon fast switching and mechanical static isolation module; when the digital low-voltage side discrete safety guard module receives a failure signal, it irreversibly cuts off the silicon fast switching and mechanical static isolation module; the overcurrent protection and isolation collaborative module controls the input current.

[0011] As a preferred technical solution, the key equipment control and polling switching module includes a dynamic wave monitoring and self-test submodule, a main processing unit, a fast switch drive and self-test submodule, and a static safety drive and self-test submodule;

[0012] The dynamic wave monitoring and self-test submodule is connected to the main processing unit, the main processing unit is connected to the fast switch drive and self-test submodule and the static safety drive and self-test submodule, the fast switch drive and self-test submodule is connected to the silicon fast on-off and mechanical static isolation module, and the static safety drive and self-test submodule is connected to the dynamic wave absorption and drive module.

[0013] As a preferred technical solution, the dynamic wave absorption and driving module includes an energy supply submodule and a triode fast switching submodule, two triode fast switching submodules and one energy supply submodule are connected to each other, the dynamic wave is input into the energy supply submodule, the triode fast switching submodule is located between the energy supply submodule and the silicon fast on-off and mechanical static isolation module, and the key equipment control and polling switching module is connected to the triode fast switching submodule.

[0014] As a preferred technical solution, two transistor fast switching sub-modules and an energy supply sub-module form a power supply group, the dynamic wave absorption and driving module includes two power supply groups, one of which performs power supply and the other performs self-test, and the key equipment control and polling switching module controls the four transistors through level signals.

[0015] As a preferred technical solution, the silicon fast on-off and mechanical static isolation module includes a silicon fast on-off relay timing protection circuit and a mechanical static isolation circuit connected to each other, and the overcurrent protection and isolation coordination module is connected to the mechanical static isolation circuit;

[0016] The silicon fast on-off relay timing protection circuit includes an IGBT or a MOSFET, and the mechanical static isolation circuit includes a mutually exclusive relay group, which is a two-series and two-parallel relay group, and each parallel branch is connected in series with two IGBTs or MOSFETs.

[0017] As a preferred technical solution, the digital low-voltage side discrete safety guard module includes a first hard fuse circuit, which connects the key equipment control and polling switching module with the mechanical static isolation circuit.

[0018] As a preferred technical solution, the overcurrent protection and isolation collaborative module includes an interconnected current acquisition submodule, an overcurrent detection submodule and a second hard fuse circuit, the input current is input into the current acquisition submodule, the overcurrent detection submodule is connected to the key equipment control and polling switching module, and the second hard fuse circuit connects the input current and the mechanical static isolation circuit.

[0019] According to another aspect of the present invention, a safety monitoring method for a safety power supply board of a train interlocking and train control system is provided, using the safety power supply board of the train interlocking and train control system, specifically:

[0020] The key equipment control and polling switching modules conduct safety assessments on dynamic waves and other modules. When the assessment results do not meet the requirements, the external energy supply is cut off by cutting off the silicon fast on / off and mechanical static isolation modules.

[0021] The dynamic wave absorption and driving module converts the energy of the dynamic wave into a level that drives the silicon fast switching and mechanical static isolation modules;

[0022] Silicon fast-on / off and mechanical static isolation modules supply power to the relays to be driven;

[0023] The digital low-voltage side discrete safety guard module monitors the silicon fast on-off and mechanical static isolation modules. If it receives a cut-off instruction from the key equipment control and polling switching module, it will immediately cut off the silicon fast on-off and mechanical static isolation modules.

[0024] The overcurrent protection and isolation collaborative module monitors the input current to prevent overcurrent.

[0025] As a preferred technical solution, the process of evaluating the dynamic wave by the key equipment control and polling switching module is specifically as follows: counting the number of pulses of the dynamic wave, and when the number of pulses meets the requirements, allowing the silicon fast on-off and mechanical static isolation modules to supply power to the outside; otherwise, cutting off the power supply.

[0026] As a preferred technical solution, the process of the key equipment control and polling switching module evaluating other modules is specifically as follows: diagnose the basic health and execution capabilities of the hardware of the dynamic wave absorption and driving module, the silicon fast switching and mechanical static isolation module, the digital low-voltage side discrete safety guard module, and the overcurrent protection and isolation collaborative module. When the diagnosis finds that the module under test does not meet the basic health or has unexpected execution and random failure, the external power supply of the silicon fast switching and mechanical static isolation module is cut off; when the diagnosis finds that the module under test has serious failure or leads to the harmful side, the external power supply of the silicon fast switching and mechanical static isolation module is cut off and the digital low-voltage side discrete safety guard module is blown.

[0027] As a preferred technical solution, if the key equipment control and polling switching module fails, the external energy supply of the silicon fast on-off and mechanical static isolation modules will be cut off and the digital low-voltage side discrete safety guard module will be blown.

[0028] As a preferred technical solution, when the key equipment control and polling switching module detects that a relay in the silicon fast on-off and mechanical static isolation module is stuck during safety assessment, the following steps are specifically included:

[0029] Step S1, powering off and returning the normal relay link to its original position by taking the second method and confirming it;

[0030] Step S2, determine whether the key equipment control and polling switching module is healthy, if not, blow the internal soft fuse; execute step S3;

[0031] Step S3, fuse the digital low-voltage side discrete safety guard module.

[0032] As a preferred technical solution, the fast switch drive and self-test submodule of the key equipment control and polling switching module is connected to the silicon device fast switch of the silicon fast on-off and mechanical static isolation module, and a closed-loop feedback detection is performed; the static safety drive and self-test submodule of the key equipment control and polling switching module is connected to the transistor of the dynamic wave absorption and driving module, and a closed-loop feedback detection is performed.

[0033] As a preferred technical solution, the key equipment control and polling switching module inputs a fast cut-off level to the dynamic wave absorption and driving module, and the transistor fast switch submodule of the dynamic wave absorption and driving module performs ping-pong self-test.

[0034] As a preferred technical solution, the overcurrent detection submodule of the overcurrent protection and isolation collaborative module monitors in real time whether the input current exceeds the rated value, and if so, blows the second hard fuse circuit of the overcurrent protection and isolation collaborative module.

[0035] As a preferred technical solution, the dynamic wave is a modulated pulse group with a protocol, and the dynamic wave modulation method is:

[0036] A positive pulse with a width of 50us plus a low level with a width of 50us is taken as a minimum unit. Ten minimum units are used to form a 1ms pulse group. A low level lasting for 1ms after the 1ms pulse group constitutes a 2ms signal. Repeating the 2ms signal gives a dynamic wave.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] 1) The present invention adds a key equipment control and polling switching module, a dynamic wave absorption and driving module, a silicon fast on-off and mechanical static isolation module, a digital low-voltage side discrete safety guard module, and an overcurrent protection and isolation coordination module to the safety power supply board, thereby realizing the upgrade and transformation of the safety power supply board, replacing the gravity-type relay, and covering the inherent fault natural gravity drop function of the gravity-type relay, the overall fast drop function of the existing dynamic tuning circuit and the gravity-type relay, and the arc adhesion protection performance of the gravity-type relay with a large air gap. The goal of cost reduction is achieved by removing the gravity-type relay under the premise of meeting functional safety;

[0039] 2) The transistor switch node of the present invention is placed after the dynamic energy supply. Therefore, once the key equipment control and polling switching module finds that the dynamic wave is incorrect, the transistor will immediately cut off the relay faster, which is beneficial to the faster shutdown of the relay; from the perspective of availability and reliability, it is more appropriate and reasonable to separate the relay from the reaction fault safety category. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a schematic diagram of the connection relationship of the five modules of the present invention;

[0041] Figure 2 This is a schematic diagram of the structure of the key equipment control and polling switching module of the present invention;

[0042] Figure 3 This is a schematic diagram of the structure of the dynamic wave absorption and driving module of the present invention;

[0043] Figure 4 It is a schematic diagram of converting the dynamic wave into the energy of driving the relay according to the present invention;

[0044] Figure 5 This is a schematic diagram of the structure of the silicon fast switching and mechanical static isolation module of the present invention;

[0045] Figure 6 This is a structural schematic diagram of the digital low-voltage side discrete safety guard module of the present invention;

[0046] Figure 7This is a schematic diagram of the structure of the overcurrent protection and isolation collaborative module of the present invention;

[0047] The numbers in the figure show:

[0048] 1. Key equipment control and polling switching module, 11. Dynamic wave monitoring and self-test submodule, 12. Main processing unit, 13. Fast switch drive and self-test submodule, 14. Static safety drive and self-test submodule, 2. Dynamic wave absorption and drive module, 21. Energy supply submodule, 22. Transistor fast switch submodule, 3. Silicon fast on-off and mechanical static isolation module, 31. Silicon fast on-off relay timing protection circuit, 311. Silicon device fast switch, 32. Mechanical static isolation circuit, 321. Relay, 4. Digital low-voltage side discrete safety guard module, 5. Overcurrent protection and isolation coordination module, 51. Current acquisition submodule, 52. Overcurrent detection submodule. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0050] Example 1

[0051] like Figure 1 As shown, the present invention provides a safety power supply board for a train interlocking and train control system, based on the interlocking and train control system software and the interlocking and train control application software remain unchanged, the digital safety principle of the VPS front-end software remains unchanged, and no additional software development cost and investment are added. The VRD gravity relay 321 is deleted, and 5 circuit modules are added at the same time, namely: module 1-key equipment control and polling switching module 1, module 2-dynamic wave absorption and drive module 2, module 3-silicon fast switching and mechanical static isolation module 3, module 4-digital low-voltage side discrete safety guard module 4, module 5-overcurrent protection and isolation coordination module 5.

[0052] The above five modules work together to achieve a safe replacement for the gravity-type relay 321, while ensuring the integrity of functional safety. Among them, module 1 and module 2 directly face the dynamic waves from the NISAL domain. Module 1 is responsible for monitoring the safety of the dynamic wave, and at the same time manages the safety of modules 2, 3, 4, and 5 online. Module 2 is responsible for converting and absorbing the dynamic wave energy into a DC drive signal to drive the small mutually exclusive relay 321 in module 3. The purpose of module 4 is that once a major safety failure occurs, the present invention will cut off module 3 in an irreversible manner, making it impossible for module 3 to supply power to the output relay cluster. Module 5 is load constraint, that is, control of the external output current, including current monitoring and overcurrent protection. The following is a detailed introduction to each module.

[0053] NISAL: Numeric Integrated Security Assurance Logic is a technology used to ensure system security and is widely used in high-security systems. NISAL technology ensures system security by combining multiple security mechanisms, such as online self-diagnosis, differentiated design, and secure clocks.

[0054] The dynamic wave is a modulated pulse group with a protocol. The design method is to use a positive pulse with a width of 50us plus a low level with a width of 50us as a minimum unit, and then use 10 of this minimum unit to form a 1ms pulse group, followed by a continuous 1ms low level, and then two 1ms form a 2ms periodic signal. In a single 2ms cycle, the first 1 millisecond is a 10-cycle square wave of 100us; the next 1 millisecond is a continuous low level. Therefore, this 2ms is used as an intermediate unit to match the CPU clock cycle with a period of 50ms. In every 50ms in a large system, the 2ms signal is continuous most of the time, but the protocol will create a 6ms window period, that is, there is a pure low level state with no signal for 3 consecutive 2ms.

[0055] Module 1--Key equipment control and polling switching module 1

[0056] like Figure 2 As shown, the key equipment control and polling switching module 1 includes a dynamic wave monitoring and self-test submodule 11, a main processing unit 12 (CPU), a fast switch drive and self-test submodule 13, and a static safety drive and self-test submodule 14.

[0057] This module is based on a combined fault-safe design, that is, an independent dual-channel architecture is used to obtain front-end input information, and interactive voting is performed on the acquisition of collected information, intermediate state voting is performed during the operation and processing, and pre-output voting is performed before the final output. Output is allowed only when the calculation results of the dual channels are consistent. If there is any inconsistency, the output needs to be turned off to guide the system to the safe side. Each single channel is configured with a CPU and an FPGA. The CPU serves as the main processing unit 12, and the FPGA is an off-chip co-processing unit.

[0058] The first major safety function of module 1 is to collect the dynamic wave input from the previous NISAL domain and evaluate the correctness and accuracy of the previous dynamic wave. The dynamic wave is a unique modulated pulse group with a protocol, so the dynamic wave is counted in a pulse counting manner, and the number of pulses is used to judge the health of the previous large system to decide whether to continue to supply energy.

[0059] When the dynamic wave count meets the requirements, it is allowed to maintain the power supply to the external 24V; when the dynamic wave count does not meet the requirements, the external 24V is directly and quickly shut down in an active manner.

[0060] Another major safety function of module 1 is to diagnose the basic hardware health of modules 2, 3, 4, and 5 online and verify the control ability of module 1 over them. Regardless of whether the counting result of dynamic waves by module 1 is correct or not: when online diagnosis finds unexpected execution and random failure, if the failure occurs in modules 2-5, the external 24V power supply is cut off; if the failure detected in modules 2-5 is serious or leads to the hazard side, not only the external 24V power supply is cut off, but also the hard fuse must be blown to lock into a safe state, and the hard fuse is module 4; if the failure occurs in module 1, such as CPU failure, the 24V power supply is also turned off and the hard fuse is blown;

[0061] The soft fuse only solves the communication security, while the discrete output security relies on the hard fuse. After the CPU is offline, the hard fuse is responsible for the safe state escape protection.

[0062] Module 2 - Dynamic Wave Absorption and Driving Module 2

[0063] like Figure 3 As shown, the input of module 2 comes from the dynamic wave of the NISAL domain. If the NISAL domain operation is correct, the modulated pulse group with the protocol is output. The function of module 2 is to connect this dynamic mechanism and convert the online dynamic energy into the level of the driving relay 321. Specifically, it absorbs the dynamic wave generated by the previous software to produce an energy conversion effect. The actual switch method is to use two series and two parallel small mutually exclusive relays 321. At the same time, in order to realize the digital ping-pong online polling self-test, module 1 must be added to cooperate for fast level control (based on triode switch control and included in the self-test). This switch forms an "and" relationship with the existing safety dynamic wave. Output is allowed only when both are satisfied.

[0064] The internal design has two dynamic-to-static energy supply submodules 21 and four transistor fast switch submodules 22. The dynamic energy is continuously designed because it needs to match the previous stage safety dynamic wave signal. That is, when the dynamic wave signal continues to exist (all modules are healthy), the system is ensured to be reliably and continuously powered. Module 1 directly controls the four transistors through level signals, matching the four external relays 321 to form a two-series and two-parallel control method. That is, when the digital processing unit needs to energize relays 321A and C, it has online self-test relays 321B and D, that is, by controlling the corresponding transistors to switch on and off relays 321B and D to verify the health of relays 321 and the previous stage gating circuit online.

[0065] In the circuit system, the transistor switch node is placed after the dynamic energy supply, and it cannot affect the output power supply when self-checking is required. Therefore, once module 1 finds that the dynamic wave is incorrect, it will immediately use the transistor to cut off the relay 321 faster, which is beneficial for the faster shutdown of the relay 321. Considering that the dynamic to static energy needs a delay from the discharge to the closing of the relay 321, and the inductance of the relay 321 coil also has a delay. Compared with the detection method, the use of transistor switches is faster.

[0066] Therefore, in the "two parallel" relays 321, the switch of a single relay 321 must have a separate gate signal and dynamic wave signal AND function. That is to ensure that one relay 321 in the "two parallel" only needs to operate the gate signal to realize the switch during self-test without turning on and off the dynamic wave. The dynamic wave is used as a separate shared mode by both relays 321. In addition to the disappearance of the dynamic wave (AND logic), the switch of the relay 321, in the case of unexpected disconnection (dynamic wave continues), the relay 321 that needs self-test can directly control the on and off of the transistor through the gate level to achieve the control of the on and off of the relay 321.

[0067] From the perspective of system architecture, although the disconnection time of relay 321 is generally short, considering the discrete differences in the parameters of components and relay 321 itself, if relay 321 is included in the self-test of the reaction fault safety time, although the self-test can detect whether relay 321 meets the time requirement, it is very likely that the final software closed-loop confirmation exceeds the allowable fault reaction time (although it does not need to be disconnected at that moment) due to the analog characteristics of relay 321, including the jitter tolerance of module 1. However, the need to disconnect the large system is equivalent to an inevitable event that may occur at any time. Therefore, exceeding the fault reaction time must be considered to have a tendency to cause harm and ultimately fail the self-test. This will actually cause the system to be unstable and unavailable. From the perspective of availability and reliability, it is more appropriate and reasonable to separate relay 321 from the category of reaction fault safety.

[0068] Module 3 - Silicon fast switching and mechanical static isolation module 3

[0069] like Figure 4 As shown, the silicon fast on-off and mechanical static isolation module 3 includes a silicon fast on-off relay timing protection circuit 31 and a mechanical static isolation circuit 32 that are interconnected. The silicon fast on-off relay timing protection circuit 31 has an operation speed of micro-nanoseconds, and the mechanical static isolation circuit 32 has an operation speed of tens of milliseconds. The overcurrent protection and isolation coordination module 5 is connected to the mechanical static isolation circuit 32; the silicon fast on-off relay timing protection circuit 31 includes an IGBT or a MOSFET, and the mechanical static isolation circuit 32 includes a group of mutually exclusive relays 321. The small mutually exclusive relay 321 group and the IGBT (or MOSFET) construct the final output. The small mutually exclusive relay 321 has multiple normally open contacts to form a series condition in a single relay 321. It is planned to use a two-series and two-parallel relay 321 group, and at the same time, two IGBTs are connected in series in each 2oo2 path. In particular, unlike the application of the traditional two-out-of-two relay 321, the traditional combination fault does not have very high requirements for the safety reaction time of the fault response and fault disconnection after the first channel has an error. It is usually based on natural time levels such as seconds, minutes, and hours, depending on the self-checking frequency in the combination fault and the acceptable hazard occurrence rate level. However, the safety reaction time reserved for large systems must be less than 70ms. Therefore, the fault reaction time of the combination fault must be less than 70ms, and it is part of BIT (built in test). IGBT is used to separate the relay 321 from the reaction fault system. Under the timing protection of IGBT, a single relay 321 theoretically only needs a single normally open contact. If double disconnection is required, another normally open contact is occupied. During the ping-pong process, when the two AC relays 321 are actually powered on, they are monitored in real time. At the same time, the two BD relays 321 can perform switching actions to verify that they have the ability to switch from the on state to the off state. The roles of AC and BD can be interchanged to ultimately achieve that all modules have online self-checking without affecting availability.

[0070] In the actual BIT process, from making and releasing the trigger conditions for disconnection to the reliable detection of fault exposure and the final judgment of whether the rapid disconnection is successful, the total time consumption of the whole process must be less than 70ms and leave enough margin, which puts forward faster and higher requirements for fault response. However, the switching speed of relay 321 usually has a possible range from tens of milliseconds to tens of milliseconds according to the manufacturer's datasheet. More importantly, if it involves the digital processing mechanism at the same time, the full closed-loop self-test process of relay 321 includes but is not limited to the following factors during operation: virtual fault manufacturing trigger, real fault detection, tolerance filtering of mechanical jitter of relay 321, and final judgment; there must be delay tolerance due to the jitter of the contact of relay 321 in the process. Even if BIT is set to less than 70 milliseconds after compression, it may be feasible, but BIT itself must be stable enough to support reliability. If the software is forced to delay due to the characteristics of relay 321, it is easy to cause the self-test judgment to fail (too much tolerance is not available in this design). Therefore, this design adopts a differentiated design of rapid disconnection and static isolation for 24V output. That is, use dual IGBTs for fast disconnection (involving fault response time) and dual relays 321 for static isolation (allocating out the response fault system). When the IGBT path has been disconnected and detected as valid by the CPU, the falling time of the small relay 321 is no longer within the response fault safety system. The following figure is about the 24V control design. Two strings of IGBTs (or MOSFETs) are placed in front of the relay 321 to assume the function of fast switching. And it constitutes a closed-loop self-test. The health of the recovery circuit of the voltage detection will also be included in the online diagnosis. The silicon device used for fast switching, considering that the digital control unit itself may fail, resulting in no effective management of the silicon device failure once offline (the silicon device has a breakdown short circuit), so two strings of small mutually exclusive relays 321 groups are set at the back end for static isolation (irreversible after matching with a 12V hard fuse).

[0071] In order to prevent the relay 321 from arcing during self-test, IGBT is also used to protect the relay 321 switching timing and realize the relay 321 to operate at zero current. The single-channel CPU of the digital processing platform controls one relay 321 in the two strings; and the purpose is to make the system testable, that is, not interrupt the output power supply during operation. The two parallel links are alternately cycled in a ping-pong manner to support the current non-power supply link to perform online BIT (verify the IGBT from on to off, and the relay 321 from on to off).

[0072] Module 4 - Digital low voltage side discrete safety guard module 4

[0073] like Figure 5As shown, the digital low-voltage side discrete safety guard module 4 includes a first hard fuse circuit, which is directly controlled by module 1. Module 1 sends an instruction to module 4 to cut off the first hard fuse circuit. The cutoff itself is for the 12V power supply of the four relay 321 coils in the mechanical static isolation. When module 4 is irreversibly blown, it is ensured that the coil sides of several relays 321 are no longer powered. Regardless of the presence or absence of dynamic waves, the system will shut down the output. The first hard fuse circuit connects the key equipment control and polling switching module 1 with the mechanical static isolation circuit 32. The ultimate goal of module 4 is safe escape protection, and this action link is not included in the safety response time. The safety of module 1 depends on self-test and two-out-of-two high-quality voting. If module 1 itself fails, the soft fuse needs to be blown. If module 1 finds that failures have occurred in other modules, the power supply of the relay 321 coil must be irreversibly cut off on the digital low-voltage side.

[0074] In extreme cases, if a relay 321 is found to be stuck during self-test or operation, module 1 must first power on a healthy relay 321 link and confirm the process through the two-way method, and then blow the irreversible Hardware Fuse on the 12V side (whether the soft fuse blows depends on whether module 1 is healthy. If module 1 itself has no faults, the soft fuse may not blow); at the same time, another 24V side fuse on the external direct power supply link is triggered.

[0075] Module 5 - Overcurrent protection and isolation coordination module 5

[0076] like Figure 6 As shown, the overcurrent protection and isolation coordination module 5 includes an interconnected current acquisition submodule 51, an overcurrent detection submodule 52 and a second hard fuse circuit. Module 5 is an overcurrent protection during the external 24V direct power supply process, monitoring the size of the allowed output current and cutting off the output when it is too large; module 5 is directly controlled by module 1. Module 5 has an additional layer of physical protection when the relay 321 of module 3 fails; and monitors the size of the allowed output current and cuts off the output when it is too large.

[0077] Module 5 performs electrical safety protection for the relay 321 group in the silicon fast on-off and mechanical static isolation module 3. It has the safety function of protecting the related contacts of the relay 321 under the external continuous abnormal large energy impact. In this scheme, four small mutually exclusive relays 321 are used in two series and two parallel. However, the small relay 321 has a current limit. When there is a large energy impact from the outside, the safety property of the mutually exclusive relay 321 fails, resulting in the loss of the safety property that the normally open and normally closed relays 321 cannot be turned on at the same time. Therefore, it is necessary to increase the monitoring of the usage scenario to make it clear that the contact current of our 24V output relay 321 is allowed to be used only when the safety premise is met. When there is a situation where the rated current is exceeded (detected), the CPU must blow the fuse as soon as possible. This fuse is connected in series in the external 24V output power.

[0078] Example 2

[0079] The present invention provides a safety monitoring method for a safety power supply board of a train interlocking and train control system, specifically:

[0080] The key equipment control and polling switching module 1 performs a safety assessment on the dynamic wave and other modules, counts the number of pulses of the dynamic wave, and allows the silicon fast on-off and mechanical static isolation module 3 to supply energy to the outside when the number of pulses meets the requirements; otherwise, the energy supply is cut off; the basic health and execution capability of the hardware of the dynamic wave absorption and driving module 2, the silicon fast on-off and mechanical static isolation module 3, the digital low-voltage side discrete safety guard module 4, and the overcurrent protection and isolation coordination module 5 are diagnosed. When the diagnosis finds that the tested module does not reach the basic health or has unexpected execution and random failure, the external energy supply of the silicon fast on-off and mechanical static isolation module 3 is cut off; when the diagnosis finds that the tested module has a serious failure or leads to the harmful side, the external energy supply of the silicon fast on-off and mechanical static isolation module 3 is cut off and the digital low-voltage side discrete safety guard module 4 is blown. If the key equipment control and polling switching module 1 fails, the external energy supply of the silicon fast on-off and mechanical static isolation module 3 is cut off and the digital low-voltage side discrete safety guard module 4 is blown.

[0081] When the key equipment control and polling switching module 1 detects that a relay 321 in the silicon fast on-off and mechanical static isolation module 3 is stuck during the safety assessment, the normal relay 321 link is powered off and returned to its original position and confirmed by taking two methods; determines whether the key equipment control and polling switching module 1 is healthy, and if not, blows the soft fuse inside it; and blows the digital low-voltage side discrete safety guard module 4.

[0082] The fast switch drive and self-test submodule 13 of the key equipment control and polling switching module 1 is connected to the silicon device fast switch 311 of the silicon fast on-off and mechanical static isolation module 3, and performs closed-loop feedback detection; the static safety drive and self-test submodule 14 of the key equipment control and polling switching module 1 is connected to the transistor of the dynamic wave absorption and driving module 2, and performs closed-loop feedback detection; drives the IGBT and the small mutually exclusive relay 321.

[0083] The key equipment control and polling switching module 1 inputs a fast cut-off level to the dynamic wave absorption and driving module 2, and the triode fast switch submodule 22 of the dynamic wave absorption and driving module 2 performs a ping-pong self-test.

[0084] The dynamic wave absorption and driving module 2 converts the energy of the dynamic wave into a level for driving the silicon fast switching and mechanical static isolation module 3 .

[0085] The silicon fast switching and mechanical static isolation module 3 supplies power to the relay 321 to be driven.

[0086] The digital low-voltage side discrete safety guard module 4 monitors the silicon fast on-off and mechanical static isolation module 3. If a cut-off instruction is received from the key equipment control and polling switching module 1, the silicon fast on-off and mechanical static isolation module 3 is immediately cut off.

[0087] The overcurrent protection and isolation cooperative module 5 monitors the input current to prevent overcurrent; if the input current exceeds the limit, the second hard fuse circuit of the overcurrent protection and isolation cooperative module 5 is blown.

[0088] The present invention optimizes circuit design, replaces the gravity-type relay 321 and other methods, thereby meeting the system safety requirements and optimizing the actual occupied space, thereby enhancing the practicality and scientificity of the system.

[0089] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A safety power supply board for a train interlocking and train control system, characterized in that: The safety power board is provided with a key equipment control and polling switching module (1), a dynamic wave absorption and driving module (2) connected to the key equipment control and polling switching module (1), a silicon fast on-off and mechanical static isolation module (3), a digital low-voltage side discrete safety guard module (4) and an overcurrent protection and isolation coordination module (5); Dynamic wave input key equipment control and polling switching module (1) and dynamic wave absorption and driving module (2), the silicon fast on-off and mechanical static isolation module (3) is connected to all other modules, the overcurrent protection and isolation coordination module (5) is connected to an external power supply, and the silicon fast on-off and mechanical static isolation module (3) is connected to a load; The key equipment control and polling switching module (1) detects the input dynamic wave and all other modules, and when the detection is correct, the key equipment control and polling switching module converts the dynamic wave into a drive signal to drive the IGBT part in the silicon fast switching and mechanical static isolation module (3); the dynamic wave absorption and driving module (2) converts the dynamic wave into a drive signal to drive the relay part in the silicon fast switching and mechanical static isolation module (3); When the digital low-voltage side discrete safety guard module (4) receives a failure signal, it irreversibly cuts off the silicon fast switching and mechanical static isolation module (3); the overcurrent protection and isolation coordination module (5) controls the input current.

2. A safety power supply board for a train interlocking and train control system according to claim 1, characterized in that: The key equipment control and polling switching module (1) comprises a dynamic wave monitoring and self-checking submodule (11), a main processing unit (12), a fast switch driving and self-checking submodule (13), and a static safety driving and self-checking submodule (14); The dynamic wave monitoring and self-checking submodule (11) is connected to a main processing unit (12), the main processing unit (12) is connected to a fast switch driving and self-checking submodule (13) and a static safety driving and self-checking submodule (14), the fast switch driving and self-checking submodule (13) is connected to a silicon fast switching and mechanical static isolation module (3), and the static safety driving and self-checking submodule (14) is connected to a dynamic wave absorption and driving module (2).

3. A safety power supply board for a train interlocking and train control system according to claim 1, characterized in that: The dynamic wave absorption and driving module (2) comprises an energy supply submodule (21) and a triode fast switch submodule (22); two triode fast switch submodules (22) and one energy supply submodule (21) are connected to each other; the dynamic wave is input into the energy supply submodule (21); the triode fast switch submodule (22) is located between the energy supply submodule (21) and the silicon fast on / off and mechanical static isolation module (3); and the key equipment control and polling switching module (1) is connected to the triode fast switch submodule (22).

4. A safety power supply board for a train interlocking and train control system according to claim 3, characterized in that: Two triode fast switch submodules (22) and an energy supply submodule (21) form a power supply group, the dynamic wave absorption and driving module (2) includes two power supply groups, one of which performs power supply and the other performs self-test, and the key equipment control and polling switching module (1) controls four triodes through level signals.

5. A safety power supply board for a train interlocking and train control system according to claim 1, characterized in that: The silicon fast on-off and mechanical static isolation module (3) comprises a silicon fast on-off relay timing protection circuit (31) and a mechanical static isolation circuit (32) which are connected to each other, and the overcurrent protection and isolation coordination module (5) is connected to the mechanical static isolation circuit (32); The silicon fast on-off relay timing protection circuit (31) comprises an IGBT or a MOSFET, and the mechanical static isolation circuit (32) comprises a mutually exclusive relay (321) group, wherein the mutually exclusive relay (321) group comprises a two-series and two-parallel relay (321) group, and each parallel branch is connected in series with two IGBTs or MOSFETs.

6. A safety power supply board for a train interlocking and train control system according to claim 5, characterized in that: The digital low-voltage side discrete safety guard module (4) comprises a first hard fuse circuit, wherein the first hard fuse circuit connects the key equipment control and polling switching module (1) and the mechanical static isolation circuit (32).

7. A safety power supply board for a train interlocking and train control system according to claim 5, characterized in that: The overcurrent protection and isolation coordination module (5) comprises a current acquisition submodule (51), an overcurrent detection submodule (52) and a second hard fuse circuit which are interconnected, the input current is input into the current acquisition submodule (51), the overcurrent detection submodule (52) is connected to the key equipment control and polling switching module (1), and the second hard fuse circuit connects the input current and the mechanical static isolation circuit (32).

8. A safety monitoring method for a safety power board of a train interlocking and train control system, characterized in that: The safety power supply board of the train interlocking and train control system according to claim 1 is specifically: The key equipment control and polling switching module (1) performs safety assessment on the dynamic wave and other modules. When the assessment result does not meet the requirements, the silicon fast on-off and mechanical static isolation module (3) is cut off to supply external energy; The dynamic wave absorption and driving module (2) converts the energy of the dynamic wave into a voltage level for driving the silicon fast switching and mechanical static isolation module (3); The silicon fast on / off and mechanical static isolation module (3) supplies power to the relay to be driven (321); The digital low-voltage side discrete safety guard module (4) monitors the silicon fast on-off and mechanical static isolation module (3), and immediately cuts off the silicon fast on-off and mechanical static isolation module (3) if a cut-off instruction is received from the key equipment control and polling switching module (1); The overcurrent protection and isolation coordination module (5) monitors the input current to prevent overcurrent.

9. The safety monitoring method of the safety power board of the train interlocking and train control system according to claim 1, characterized in that: The process of evaluating the dynamic wave by the key equipment control and polling switching module (1) is specifically as follows: the number of pulses of the dynamic wave is counted, and when the number of pulses meets the requirement, the silicon fast on-off and mechanical static isolation module (3) is allowed to supply energy to the outside; otherwise, the energy supply is cut off.

10. The safety monitoring method of the safety power board of the train interlocking and train control system according to claim 1, characterized in that: The process of the key equipment control and polling switching module (1) evaluating other modules is specifically as follows: diagnosing the basic health and execution capability of the hardware of the dynamic wave absorption and driving module (2), the silicon fast switching and mechanical static isolation module (3), the digital low-voltage side discrete safety guard module (4) and the overcurrent protection and isolation coordination module (5); when the diagnosis finds that the tested module does not reach the basic health or has unexpected execution and random failure, the silicon fast switching and mechanical static isolation module (3) is cut off from external power supply; when the diagnosis finds that the tested module has a serious failure or leads to the hazard side, the silicon fast switching and mechanical static isolation module (3) is cut off from external power supply and the digital low-voltage side discrete safety guard module (4) is blown.

11. A safety monitoring method for a safety power board of a train interlocking and train control system according to claim 1, characterized in that: If the key equipment control and polling switching module (1) fails, the silicon fast on / off and mechanical static isolation module (3) will be cut off from supplying external energy and the digital low-voltage side discrete safety guard module (4) will be fused.

12. A safety monitoring method for a safety power board of a train interlocking and train control system according to claim 1, characterized in that: When the key equipment control and polling switching module (1) detects that a relay (321) in the silicon fast on / off and mechanical static isolation module (3) is stuck during safety assessment, the following steps are specifically included: Step S1, powering off and returning the normal relay (321) link to its original position by adopting the second method and confirming it; Step S2, determining whether the key equipment control and polling switching module (1) is healthy, and if not, blowing the internal soft fuse; executing step S3; Step S3, fuse the digital low-voltage side discrete safety guard module (4).

13. The safety monitoring method of the safety power board of the train interlocking and train control system according to claim 1, characterized in that: The fast switch drive and self-test submodule (13) of the key equipment control and polling switching module (1) is connected to the silicon device fast switch (311) of the silicon fast on-off and mechanical static isolation module (3), and a closed-loop feedback detection is performed; the static safety drive and self-test submodule (14) of the key equipment control and polling switching module (1) is connected to the triode of the dynamic wave absorption and driving module (2), and a closed-loop feedback detection is performed.

14. A safety monitoring method for a safety power board of a train interlocking and train control system according to claim 1, characterized in that: The key equipment control and polling switching module (1) inputs a fast cut-off level to the dynamic wave absorption and driving module (2), and the triode fast switch submodule (22) of the dynamic wave absorption and driving module (2) performs a ping-pong self-test.

15. The safety monitoring method of the safety power board of the train interlocking and train control system according to claim 1, characterized in that: The overcurrent detection submodule (52) of the overcurrent protection and isolation collaborative module (5) monitors in real time whether the input current exceeds the rated value, and if so, blows the second hard fuse circuit of the overcurrent protection and isolation collaborative module (5).

16. A safety monitoring method for a safety power board of a train interlocking and train control system according to claim 1, characterized in that: The dynamic wave is a modulated pulse group with a protocol. The dynamic wave modulation method is: A positive pulse with a width of 50us plus a low level with a width of 50us is taken as a minimum unit. Ten minimum units are used to form a 1ms pulse group. A low level lasting for 1ms after the 1ms pulse group constitutes a 2ms signal. Repeating the 2ms signal gives a dynamic wave.

Images