Safe output device in full-automatic unmanned wriggling mode scene

Abstract

The invention discloses a safety output device in a full-automatic unmanned wriggling mode scene. The safety output device comprises a safety bus interface module M1, a reset module M2, a PWM control module M3, a DO output module M4 and a DI acquisition module M5. The safety bus interface module M1 sends a self-checking instruction of the device in a power-on initialization stage, and at the moment, the DO safety output module M4 does not output a signal to the outside, and only outputs a signal to the outside after no fault exists in self-checking; the reset module M2 realizes a reset function of the safety bus interface module M1 according to a reset instruction; and the PWM control module M3 adopts a four-mode time-sharing coding strategy to control an external circuit and finally outputs a PWM signal. According to the invention, the safety of the PWM output signal is greatly improved, and the flexibility and universality of the PWM output signal are greatly improved because the duty ratio parameter can be set according to the requirements of a user.

Description

Technical Field

[0001] The present invention belongs to the technical field of rail transit, and particularly relates to the technology of fully automatic driverless trains. Background Art

[0002] After the subway train uses the fully automatic driverless system, if the system crashes in extreme cases, since there is no driver to intervene in time, the train will stop. Usually, it can only wait to be towed away by a tow truck, resulting in large-scale train delays.

[0003] In the fully automatic driverless train system, instructions related to the safe operation of the train and data with high real-time requirements, such as train traction control instructions, etc., are all sent by the on-vehicle signal system host and the TCMS (Train Control and Management System). Once a communication failure occurs between the on-vehicle signal host and the TCMS during this process, the system will give an alarm. After the dispatcher in the control center confirms and authorizes, the signal system will start the creep mode.

[0004] In the creep mode, the signal system outputs a PWM signal. Currently, the conventional method is to add other circuits on the hardware to set the dead time, which makes the circuit more complex and reduces the reliability. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a safe output device in the scenario of the fully automatic driverless creep mode to ensure the safety and reliability of the output PWM signal.

[0006] To solve the above technical problem, the present invention adopts the following technical solutions:

[0007] A safe output device in the scenario of the fully automatic driverless creep mode includes a safety bus interface module M1, a reset module M2, a PWM control module M3, a DO output module M4, and a DI acquisition module M5;

[0008] The safety bus interface module M1 uses a safety protocol to communicate with the core control unit through interface A1, and correspondingly communicates with the reset module M2, the PWM control module M3, the DO output module M4, and the DI acquisition module M5 through interfaces B, C, D, and E;

[0009] The safety bus interface module M1 sends a self-check instruction for this device during the power-on initialization stage. At this time, the DO safety output module M4 does not output signals externally, and only outputs signals externally after the self-check is fault-free;

[0010] The reset module M2 realizes the reset function of the safety bus interface module M1 according to the reset instruction;

[0011] The PWM control module M3 controls the external circuit using a four-mode time-sharing coding strategy and finally outputs a PWM signal:

[0012] The DO output module M4 is used to implement N-channel DO output and self-check signals, and the N-channel self-check signals are sent to the DI acquisition module M5;

[0013] The DI acquisition module M5 is used to implement N-channel DI acquisition;

[0014] The value range of the number of channels N is 1 < N < 12.

[0015] Preferably, in the first mode, pwm_ctl_h and pwm_ctl_l are set to 0, and no PWM signal is output;

[0016] In the second mode, pwm_ctl_h is set to 1 and pwm_ctl_l is set to 0. According to the set duty cycle parameter ζ, the PWM signal outputs a high level;

[0017] In the third mode, both pwm_ctl_h and pwm_ctl_l are set to low level. At this time, no PWM signal is output, and the dead zone protection time is maintained;

[0018] In the fourth mode, pwm_ctl_h is set to low level and pwm_ctl_l is set to high level. At this time, the PWM signal outputs a low level, and the remaining cycle time is maintained.

[0019] Preferably, the DO output module M4 is provided with a soft voting switch SW1 for switching the DO output and self-check signals. When the soft voting switch values are A and A, self-check and DO output are performed respectively.

[0020] Preferably, the DI acquisition module M5 is provided with a soft voting switch SW2. When the soft voting switch value is A, when the safety output device enters the self-check mode, the DI acquisition module M5 reads the data of the DO safety output module M4 for verification; when the soft voting switch value is A, the DI acquisition module M5 acquires external data and sends it to the safety bus interface module M1, and sends it to the core control unit through the safety communication protocol.

[0021] Preferably, the communication coding method of this safety output device adopts the 8bit coding method. It is transmitted in the order of the first low 4 bits and then the high 4 bits. The data address is defined in the way of 0x37 + offset address, and the multi-state machine method is used for assignment. Once an illegal value appears, it is not output externally.

[0022] The technical solution adopted by the present invention is that within a complete PWM cycle, the programmable device of this safety output device controls pwm_ctl_h and pwm_ctl_l respectively through the dual-source four-mode time-sharing coding strategy to drive the external hardware circuit, and finally drives the train traction motor.

[0023] Therefore, it has the following beneficial effects:

[0024] 1. Greatly improve the safety of the PWM output signal.

[0025] 2. The duty cycle parameter ζ is not a fixed value and can be set according to the user's needs, greatly improving the flexibility and versatility of the PWM output signal.

[0026] 3. Compared with the prior art of adding a circuit for setting the dead time in the hardware circuit, it avoids increasing the complexity of the circuit and can ensure the reliability of the output PWM signal.

[0027] 4. Before each power-on, self-check is performed and no signal is output externally at this time; after the self-check is fault-free, the signal is output externally, enabling the programmable device to make full use of the system idle time to achieve non-stop full-channel self-check, greatly improving the testability and test coverage integrity of the executable unit, and also improving the reliability and safety of the executable unit.

[0028] 5. When an abnormality is detected, an instruction is sent to the reset module M2 to implement the reset function of the safety bus interface module M1, cut off the communication link of the abnormal information, and ensure the transmission of the safety information of the safety bus module M1.

[0029] 6. By using the soft voting switch, on the one hand, the module reuse rate is improved and the capacity occupied by the executable instructions is reduced.

[0030] 7. The multi-state machine method is used for assignment. Once an illegal value appears, it enters the protection mode, that is, no output is made externally, ensuring the safety of the executable unit.

[0031] The specific technical solution and its beneficial effects of the present invention will be described in detail in the following specific embodiments in combination with the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The present invention will be further described below in combination with the drawings and specific embodiments:

[0033] Figure 1 It is a schematic diagram of a safety output device in the scenario of a fully automatic driverless creeping mode;

[0034] Figure 2 It is a schematic diagram of the PWM output principle. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0035] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and in no way limits the present invention and its application or use. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0036] Embodiment 1

[0037] As Figure 1 shown, in the scenario of a fully automatic driverless peristaltic mode, the safety output device is connected to the core control unit and the external circuit. Specifically, the safety output device can be set on a programmable device (such as an FPGA) and executed by writing executable instructions to achieve safety output. It includes a safety bus interface module M1, a reset module M2, a PWM control module M3, a DO output module M4, and a DI acquisition module M5.

[0038] Among them, the safety bus interface module M1 uses a safety protocol to communicate with the core control unit through interface A1, and correspondingly realizes communication with the reset module M2, the PWM control module M3, the DO output module M4, and the DI acquisition module M5 through interfaces B, C, D, and E.

[0039] The safety bus interface module M1 sends a self-check instruction of the device during the power-on initialization stage. At this time, the DO safety output module M4 does not output signals externally, and only outputs signals externally after the self-check is fault-free. Before each power-on, a self-check is performed, and no signals are output externally at this time; after the self-check is fault-free, signals are output externally, enabling the programmable device to make full use of the system idle time to achieve non-stop full-channel self-check, greatly improving the testability and test coverage integrity of the executable unit, and also improving the reliability and safety of the executable unit.

[0040] When the core control board detects an abnormality, the core control board issues an instruction to the reset module M2 through interface A2, and the reset module M2 realizes the reset function of the safety bus interface module M1 according to the reset instruction. The reset function of the safety bus interface module M1 is realized, and the communication link of the abnormal information is cut off to ensure the transmission of the safety information of the safety bus module M1.

[0041] The PWM control module M3 uses a four-mode time-sharing coding strategy to control the external circuit and finally outputs a PWM signal.

[0042] The DO output module M4 is used to realize N-channel DO output and self-check signals, and the N-channel self-check signals are sent to the DI acquisition module M5.

[0043] The DI acquisition module M5 is used to implement N-channel DI acquisition.

[0044] The value range of the number of channels N is 1 < N < 12, and the specific value is selected within this range.

[0045] The DO output module M4 is provided with a soft voting switch SW1, which is used to switch the DO output and the self-check signal. When the soft voting switch values are A and A respectively, self-check and DO output are performed.

[0046] As Figure 2 shown, in this embodiment, within a complete PWM cycle, the pwm_ctl_h and pwm_ctl_l are respectively controlled by the dual-source four-mode time-sharing coding strategy to drive the external hardware circuit, and finally drive the train traction motor, greatly improving the safety of the PWM output signal.

[0047] In the first mode, pwm_ctl_h and pwm_ctl_l are set to 0, and no PWM signal is output.

[0048] In the second mode, pwm_ctl_h is set to 1 and pwm_ctl_l is set to 0. According to the set duty cycle parameter ζ, the PWM signal outputs a high level.

[0049] In the third mode, both pwm_ctl_h and pwm_ctl_l are set to a low level. At this time, no PWM signal is output, and the dead-time protection time is maintained.

[0050] In the fourth mode, pwm_ctl_h is set to a low level and pwm_ctl_l is set to a high level. At this time, the PWM signal outputs a low level, and the remaining cycle time is maintained.

[0051] Among them, the dead time is 10 μs (i.e., the response time of the MOS tube), preventing Figure 2 the high and low level control circuits from acting simultaneously, resulting in abnormal PWM signals. The frequency of the PWM signal is 500 Hz, and the period is 2 ms.

[0052] Since the duty cycle parameter ζ is not a fixed value and can be set according to the user's needs, the flexibility and versatility of the PWM output signal are greatly improved.

[0053] And compared with the existing technology that adds a circuit for setting the dead time in the hardware circuit, it avoids increasing the complexity of the circuit and can ensure the reliability of the output PWM signal.

[0054] The DI acquisition module M5 is provided with a soft voting switch SW2. When the soft voting switch value is A and the device enters the self-check mode, the DI acquisition module M5 reads the data of the DO safety output module M4 for verification; when the soft voting switch value is A, the DI acquisition module M5 acquires external data, sends it to the safety bus interface module M1, and sends it to the core control unit through the safety communication protocol.

[0055] Through the use of the soft voting switch in the above-mentioned DO output module M4 and DI acquisition module M5, on the one hand, the module reuse rate is improved, and the capacity occupied by the executable instructions is reduced.

[0056] The communication coding method of this safety output device adopts an 8-bit coding method. It is transmitted in the order of the lower 4 bits first and then the higher 4 bits. The data address is defined in the way of (0x37 + offset address) (the offset address is 0 to 11). The multi-state machine method is used for assignment. Once an illegal value appears, it enters the protection mode, that is, it does not output externally, ensuring the safety of the executable unit.

[0057] The above is only the specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Those skilled in the art should understand that the present invention includes but is not limited to the content described in the above specific implementation manner. Any modification that does not deviate from the function and structural principle of the present invention will be included in the scope of the claims.

Claims

1. Safety output device in the scenario of fully automatic driverless peristaltic mode, characterized in that, It includes a safety bus interface module M1, a reset module M2, a PWM control module M3, a DO output module M4, and a DI acquisition module M5; The safety bus interface module M1 uses a safety protocol to communicate with the core control unit through interface A1, and correspondingly realizes communication with the reset module M2, the PWM control module M3, the DO output module M4, and the DI acquisition module M5 through interfaces B, C, D, and E; The safety bus interface module M1 sends a self-check instruction of the device during the power-on initialization stage. At this time, the DO safety output module M4 does not output signals externally and only outputs signals after the self-check is fault-free; The reset module M2 realizes the reset function of the safety bus interface module M1 according to the reset instruction; The PWM control module M3 adopts a four-mode time-sharing coding strategy to control the external circuit and finally outputs a PWM signal: The DO output module M4 is used to realize N-channel DO output and self-check signals, and the N-channel self-check signals are sent to the DI acquisition module M5; The DI acquisition module M5 is used to realize N-channel DI acquisition; The value range of the number of channels N is 1 < N < 12.

2. The safety output device in the fully automatic driverless peristaltic mode scenario according to claim 1, wherein, In the first mode, pwm_ctl_h and pwm_ctl_l are set to 0, and no PWM signal is output; In the second mode, pwm_ctl_h is set to 1 and pwm_ctl_l is set to 0. According to the set duty cycle parameter ζ, the PWM signal outputs a high level; In the third mode, both pwm_ctl_h and pwm_ctl_l are set to low level. At this time, no PWM signal is output, and the dead zone protection time is maintained; In the fourth mode, pwm_ctl_h is set to low level and pwm_ctl_l is set to high level. At this time, the PWM signal outputs a low level and maintains the remaining cycle time.

3. The safety output device in the fully automatic driverless peristaltic mode scenario according to claim 1, wherein The DO output module M4 is provided with a soft voting switch SW1 for switching the DO output and the self-check signal. When the soft voting switch values are A and A, self-check and DO output are performed respectively.

4. The safety output device in the fully automatic driverless peristaltic mode scenario according to claim 1, characterized in that, The DI acquisition module M5 is provided with a soft voting switch SW2. When the soft voting switch value is A, when the safety output device enters the self-check mode, the DI acquisition module M5 reads the data of the DO safety output module M4 for verification; when the soft voting switch value is A, the DI acquisition module M5 acquires external data and sends it to the safety bus interface module M1, and then sends it to the core control unit through the safety communication protocol.

5. The safety output device in the fully automatic driverless peristaltic mode scenario according to claim 1, wherein The communication coding method of this safety output device adopts an 8-bit coding method. It is transmitted in the order of the lower 4 bits first and then the higher 4 bits. The data address is defined in the way of 0x37 + offset address, and a multi-state machine method is used for assignment. Once an illegal value appears, no output is made externally.

Images