A dual-active trackside safety platform system in the same city, a primary and backup arbitration method and equipment

Abstract

This invention relates to a dual-active trackside security platform system within the same city, a primary / backup arbitration method, and equipment. The system includes two independently deployed centers and a distributed arbitration point. Each center contains multiple redundantly designed replicas. All replicas in both centers exchange primary / backup negotiation messages. Based on these messages, replicas make primary / backup decisions according to primary / backup update rules and update their own primary / backup status. Each center can only have one primary replica; the others are redundant backup replicas. Replicas send heartbeats to the distributed arbitration point, which periodically sends health reports to each replica, informing them of its health status and primary / backup status. When a replica fails to receive messages from the other center, it uses health reports and primary / backup status information to assist in deciding which primary replica to use, and the primary replica then outputs data. Compared to existing technologies, this invention offers advantages such as rapid primary replica decision-making and ensuring a unique primary replica in case of inter-center communication anomalies.

Description

Technical Field

[0001] This invention relates to the field of rail transit safety control, and in particular to a dual-live trackside safety platform system, a primary and backup arbitration method, and equipment. Background Technology

[0002] With the continuous development of railway signaling systems, the trackside safety platform, as a core component of these systems, is crucial for the safety of railway operations. The trackside safety platform serves as a safety assurance system for trackside equipment in rail transit (such as subways and urban rail transit), handling control commands and data interaction for this equipment, and must meet high reliability and low latency safety requirements. Currently, trackside safety platforms typically employ redundant designs to improve system reliability, with a dual-active architecture within the same city being a common high-availability solution.

[0003] Traditional trackside safety platform systems typically employ a primary / backup redundant architecture, consisting of a primary system and a backup system. When the primary system fails, the backup system takes over. However, this architecture has limitations when facing complex failure scenarios. For example, if the communication link between the primary and backup systems is lost, both systems may mistakenly identify themselves as the primary system, leading to conflicting system outputs.

[0004] Currently, there are some related technologies in the field of high availability of distributed systems. A search reveals Chinese invention patent application publication number CN112346912A, which discloses a stateful service master-slave high availability system and method based on a network file system. This system uses a load balancing module to direct all external traffic to the primary replica and switches traffic to the backup replica when the primary replica fails, ensuring uninterrupted service. However, this solution is mainly designed for microservice architectures and does not consider the special security requirements of railway signaling systems.

[0005] Chinese invention patent application publication number CN105681005A discloses a security system with a dual-master arbitration mechanism and identity recognition, which ensures the uniqueness of output valid data through a third-party arbitration device. While this system solves the dual-master conflict problem, it does not provide a complete solution for rapid master-slave failover in active-active scenarios within the same city.

[0006] Existing technologies have the following shortcomings: First, when all replicas in one center fail and there is no primary replica, existing technologies lack an effective mechanism to ensure that the other center can quickly determine the primary replica. Second, when one center experiences a power outage, existing technologies cannot guarantee that the other center can promptly detect and quickly determine the primary replica. Finally, when the communication link between centers is completely broken, existing technologies cannot effectively prevent the situation where both centers have primary replicas, and cannot guarantee that exactly one primary replica outputs messages to external systems. These problems are particularly prominent in scenarios with extremely high safety requirements, such as railway signaling systems, and may lead to system output conflicts or service interruptions, affecting railway operation safety.

[0007] Therefore, a dual-live trackside safety platform system within the same city is needed to ensure system reliability and safety under various complex fault scenarios in order to solve the above-mentioned technical problems. Summary of the Invention

[0008] The purpose of this invention is to overcome the shortcomings of the existing technology and provide a dual-active trackside security platform system in the same city. The system includes two independently deployed centers and a distributed arbitration point, where one center is the counterpart center of the other center. Each center contains multiple redundant replicas. All replicas in the two centers exchange primary / secondary negotiation messages. Based on the primary / secondary negotiation messages, replicas make primary / secondary decisions according to the primary / secondary update rules and update their own primary / secondary status. The two centers can only make decisions on a maximum of one primary replica. Each replica consists of two MPU computing modules, forming a dual-channel, two-out-of-two architecture; Each replica periodically sends a heartbeat message to the distributed arbitration point, along with its respective primary / standby status; The distributed arbitration point periodically sends health reports to each replica, informing each replica of its health status and primary / standby status; When a replica fails to receive messages from the other party's central control, the primary replica is assisted in making decisions based on health reports and primary / backup status.

[0009] As a preferred technical solution, when the replica fails to receive messages from the other party's center, the step of using health reports and primary / backup status to assist in decision-making for the primary replica includes: If the health report shows that all copies of the other party's center are in an unhealthy state, then all copies of the other party's center will be set to an unavailable state, and this center will decide on the primary copy itself. If the health report shows that the other party's copy is in both healthy and unhealthy state, then the copy in the unhealthy state of the other party's copy is marked as down. If the counterparty's healthy copy is the primary copy, then our backup copy will not be upgraded to the primary copy; otherwise, if the counterparty's healthy copy is a backup copy, our center will decide on the primary copy itself.

[0010] As a preferred technical solution, all replicas perform the following processing based on the received primary / standby negotiation message: If the primary and backup status information of the two channels within the replica is inconsistent, the system will crash directly. If inter-replica communication is normal, each replica will proactively help other replicas check their dual-channel primary / backup negotiation messages. If a replica is found to be abnormal, the abnormal replica will be set to a down state.

[0011] As a preferred technical solution, if a center cannot receive messages or health reports from the other center, the center with a primary replica will decide on the primary replica itself, while the center without a primary replica will not make a decision.

[0012] As a preferred technical solution, there is only one primary replica between the two centers, and the others are backup replicas. The backup replicas and the primary replica are kept in clock and data synchronization.

[0013] As a preferred technical solution, the distributed arbitration points include multiple arbitration points, which communicate with each other using a distributed arbitration protocol to ensure consistency in decision-making.

[0014] As a preferred technical solution, the distributed arbitration point marks the health status of the corresponding replica of the MPU computing module based on whether a heartbeat has been received, specifically including: If a distributed arbitration point receives a heartbeat from a certain MPU computing module, it sets the corresponding replica of that MPU computing module as healthy; If the distributed arbitration point does not receive a heartbeat from a certain MPU computing module, then the corresponding replica of that MPU computing module is set to unhealthy.

[0015] As a preferred technical solution, each center also includes a communication module responsible for communication between the center and the outside world; The distributed arbitration points and centers are connected via fiber optic communication, and the two centers are periodically synchronized.

[0016] As a preferred technical solution, the replicas exchange key data with each other and mark the status of the replicas based on the key data, including: If the critical data for dual-channel verification of a replica is abnormal, the system will crash immediately. When communication between replicas is normal, replicas will help each other check their dual-channel critical data. If there is an anomaly, it will be marked as down. Key data includes output data CRC, synchronization data CRC, period number, and self-test result.

[0017] According to another aspect of the present invention, a primary / backup arbitration method for a dual-active trackside safety platform system in the same city is provided, the method comprising: Each replica periodically sends a heartbeat message to the distributed arbitration point, along with its own primary / standby status. The distributed arbitration point marks the health status of the corresponding replica of the MPU computing module based on whether it receives a heartbeat; The distributed arbitration point periodically sends health reports to each replica, informing each replica of its health and primary / standby status; Primary / standby negotiation interaction process: Each replica exchanges primary / standby negotiation messages, including its own primary / standby status; if the primary / standby information within a replica is inconsistent, it will crash directly; if the communication between replicas is normal, each replica will actively help other replicas check their dual-channel primary / standby negotiation messages; if a replica is found to be abnormal, the abnormal replica will be set to a crash state. Key data interaction process: The status of replicas is marked according to key data, including if the dual-channel verification key data of a replica is abnormal, it will directly crash; when the communication between replicas is normal, replicas will help each other check their dual-channel key data, and if there is an abnormality, it will be marked as a crash state. When a replica fails to receive messages from the other party's central server, the primary replica is assisted in making decisions based on health reports and primary / standby status, and the primary replica outputs data to the outside world.

[0018] As a preferred technical solution, the process by which the distributed arbitration point marks the health status of the corresponding replica of the MPU computing module based on whether a heartbeat has been received includes: If a distributed arbitration point receives a heartbeat from a certain MPU computing module, it sets the corresponding replica of that MPU computing module as healthy; If the distributed arbitration point does not receive a heartbeat from a certain MPU computing module, then the corresponding replica of that MPU computing module is set to unhealthy.

[0019] As a preferred technical solution, when the replica fails to receive messages from the other party's center, the step of using health reports and primary / backup status to assist in decision-making for the primary replica includes: If the health report shows that all copies of the other party's center are in an unhealthy state, then all copies of the other party's center will be set to an unavailable state, and this center will decide on the primary copy itself. If the health report shows that the other party's copy is in both healthy and unhealthy state, then the copy in the unhealthy state of the other party's copy is marked as down. If the counterparty's healthy copy is the primary copy, then our backup copy will not be upgraded to the primary copy; otherwise, if the counterparty's healthy copy is a backup copy, our center will decide on the primary copy itself.

[0020] As a preferred technical solution, the method further includes: if a center cannot receive messages from the other center or receive a health report, the center with a primary replica shall decide on the primary replica itself, while the center without a primary replica shall not make a decision.

[0021] According to a third aspect of the present invention, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the program to implement the method described thereon.

[0022] According to a fourth aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described thereon.

[0023] Compared with the prior art, the present invention has the following beneficial effects: 1) The trackside safety platform system of this invention includes two centers and a distributed arbitration point participating in the primary / secondary replica decision-making process. Each center includes N replicas, and each replica consists of two MPU computing modules, forming a dual-channel, two-out-of-two architecture. The entire system is an N-times-two-out-of-two architecture. Replicas make primary / secondary replica decisions based on exchanged primary / secondary negotiation messages and according to primary / secondary update rules. When a replica cannot receive messages from the other center (including when the other center loses power, the communication link between centers is completely disconnected, or all replicas in the other center are down), the primary replica decision is assisted by health reports and primary / secondary status. This system's primary / secondary replica decision-making mechanism based on primary / secondary negotiation messages solves the problem that when one center fails and has no primary replica, the other center can promptly detect and quickly decide on a primary replica. When communication between the two centers is disconnected, the system effectively ensures that only one primary replica outputs messages to the external system based on health reports and primary / secondary status, ensuring reliable operation of the trackside system even when communication between the two centers is disconnected, achieving high availability and data consistency.

[0024] 2) In this invention, each replica negotiates primary and backup messages or key data with each other. They will help each other check their dual-channel primary and backup negotiation messages or key data, and mark the status of replicas according to the primary and backup negotiation messages or key data. This will help identify faulty replicas in advance, prevent abnormal replicas from participating in system operation, and enable the primary replica to be selected more quickly during the next primary and backup update, thereby reducing decision-making time and ensuring the smooth operation of the system.

[0025] 3) When the present invention fails to receive messages from the other party's center or receive health reports, the center with a primary replica decides to establish a primary replica, while the center without a primary replica does not make a decision, ensuring that there is one and only one primary replica outputting messages to the external system. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the structure of the same-city dual-live trackside safety platform system in this invention; Figure 2 This is a schematic diagram of the copy processing timing flow in this invention. Detailed Implementation

[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] This embodiment relates to a dual-active trackside safety platform system within the same city. It ensures that when all replicas in one center fail and there is no primary replica, the other center can quickly determine a primary replica and continue communication with external systems, achieving dual-active operation within the same city. It ensures that when one center loses power, the other center can quickly determine a primary replica and continue communication; and it ensures that when the communication link between centers is completely broken, it prevents both centers from having primary replicas, guaranteeing that there is exactly one primary replica to output messages to external systems.

[0029] Figure 1 This diagram illustrates the structure of the same-city active-active security platform system in this invention. Two independent centers are deployed within the same city, both simultaneously in an active and available state (rather than a "primary and backup" configuration). This allows for load sharing and ensures uninterrupted system operation if one center fails, with the other quickly taking over. The system includes a first center (Center 0), a second center (Center 1), and a distributed arbitration point, all connected by fiber optic cables for high-speed communication. Center 1 is the counterpart to Center 0, and Center 0 is also the counterpart to Center 1. Each center and the arbitration point are internally connected via a high-performance network. This security platform system adopts an N-by-two architecture. Each center includes multiple sets of MPU computing modules (e.g., center 0 has replicas consisting of A-MPU1 / 2 and B-MPU1 / 2; center 1 has replicas consisting of C-MPU1 / 2 and D-MPU1 / 2), as well as a communication module (Com Module) responsible for communication between the center and external systems. The modules within each center are connected via a high-speed network (typically using copper DAC, shielded twisted pair, or unshielded twisted pair) to enable high-speed interaction. Centers are connected to each other, and centers and arbitration points are connected via fiber optic cables. The two MPU computing units of one replica are not limited to a single center and can be deployed across centers.

[0030] Each replica in each center consists of two MPU computing modules. These two modules operate simultaneously and compare results to ensure the reliability of the single replica's computation, forming a two-out-of-two architecture. Because each replica uses a two-out-of-two architecture, if one MPU computing module fails, the other MPU computing module will continue operating and ensure the replica's availability. If the entire replica fails, other backup replicas within the center will quickly take over, without affecting the primary replica's business operations.

[0031] Each of the two centers has only one primary replica, while the others are backup replicas. The backup replicas and the primary replica are kept in clock and data synchronization as a redundant backup.

[0032] The arbitration point and the two centers are connected by fiber optic cables to maintain periodic synchronization and achieve high-speed communication. The arbitration point participates in the decision-making of the primary replica, avoiding the situation where multiple centers have primary replicas at the same time.

[0033] To ensure uninterrupted connectivity between centers and arbitration points, multiple arbitration points (AP1, AP2, ..., APn) can be configured. These arbitration points communicate using a distributed arbitration protocol to ensure decision consistency. The role of distributed arbitration is as follows: When no messages are received from the other center (including when the other center is powered off, the inter-center communication link is completely broken, or all replicas of the other center are down), the health status of the health report helps quickly determine if the other center is in a completely inactive state, such as a power outage. In this case, the local center can independently decide on the primary replica. When no messages are received from the other center, the health status and primary / backup status of the health report help determine if the centers are disconnected, thus ensuring that primary replica decisions are made as often as possible, and also ensuring that neither of the two disconnected centers decides on a primary replica, preventing dual-primary status.

[0034] N replicas are distributed across two centers according to backup requirements. Figure 1 As shown in the diagram with N=4, meaning four replicas are distributed across two centers (multiple replicas serve as redundant backups to avoid the risk of single-replica failure), each replica operates on a dual-channel, two-out-of-two basis. Synchronization is maintained periodically within the system, between replicas, and at the arbitration point. A system has only one primary replica, and only the primary replica can output data to external systems.

[0035] Each replica periodically sends a heartbeat message to the arbitration point, and the arbitration point periodically sends a health report to each replica.

[0036] Each instance makes decisions regarding the primary instance through inter-instance communication and with the assistance of health reports.

[0037] This invention achieves seamless fault switching and a global single primary replica through "dual-center physical redundancy + replica-level logical redundancy + arbitration point global coordination". This same-city dual-active trackside safety platform system can still ensure the reliable operation of the system even when communication between the two centers is interrupted, achieving high availability and data consistency, and meeting the strict requirements of high availability and high security in trackside scenarios.

[0038] This embodiment also relates to a primary / backup arbitration method for a dual-active trackside safety platform in the same city, such as... Figure 2 The process of the primary / backup arbitration method of this invention (taking cycle N as an example) is a cyclical process in which the primary replica and other replicas execute in parallel and interact synchronously (after which cycle N+1 begins), including... S1, Input Processing: The primary replica and other replicas each receive external / internal input data.

[0039] S2, Primary / Backup Negotiation Interaction: Each replica exchanges primary / backup negotiation messages, including its own primary / backup status, i.e., whether it is the primary replica or the backup replica; If the primary and backup information within the replicas is inconsistent, the system will crash directly. If the communication between replicas is normal, they will check each other's dual-channel primary and backup negotiation messages, and if there is an abnormality, they will be marked as crashed.

[0040] S3, Health Report Receipt and Processing: The arbitration point regularly sends health reports to all replicas (including the health and primary / backup status of all replicas); After receiving a copy, update its understanding of the status of other copies based on the report.

[0041] S4, Primary / Secondary Update: Based on the primary / secondary negotiation message and health report, decide on the primary replica (only 1 primary replica) according to the primary / secondary update rules, and update its own primary / secondary status.

[0042] The primary / standby negotiation message includes primary / standby status (primary replica, standby replica), sharding, synchronization status (whether it is synchronized with the primary replica), health status, and replica ID. Sharding includes primary replica sharding and AUTO sharding, and synchronization status includes synchronized and not synchronized. Primary / standby update rules include: a) If the tier is in the main instance tier, and the main instance is healthy, then it will remain the main instance; if the main instance is faulty, then there will be no main instance.

[0043] b) If the gear is in AUTO mode, and the primary copy is healthy, it will remain the primary copy. If the primary copy fails, only copies in the synchronized state are eligible to be promoted to primary copy. If there are multiple backup copies in the synchronized state, the copy with the smallest copy ID will be promoted to primary copy.

[0044] S5, Output Processing: The main replica and other replicas each prepare their own output data (only the main replica is ultimately output to the outside world).

[0045] S6, Key Data Interaction: Each copy exchanges key data with the others; If a replica's dual-channel (two MPU processing modules) verification of critical data fails, it will crash directly; other replicas will check its critical data, and if any fails, it will be marked as crashed.

[0046] S7, send a heartbeat to the arbitration point: Each MPU (compute unit within a replica) sends a heartbeat to the arbitration point; The arbitration point marks the MPU as healthy (H) or unhealthy (UH) based on whether a heartbeat is received.

[0047] S8, data synchronization and output: The primary replica sends synchronization data to other replicas, and the other replicas receive the synchronization data (keeping the data consistent). The primary replica outputs data to external systems.

[0048] Additionally, when communication between centers / between a center and an arbitration point is interrupted, an extra decision rule will be triggered in the event of communication failure: 1. If a center cannot receive messages from the other center, it needs to check the health report of the distributed arbitration point. If the health report shows that the health status of all replicas of the other center is UH, then set all replicas of the other center to a down state, and this center will decide on the primary replica itself. 2. If the other party's center has H and UH replicas: mark the other party's center UH replica as down. If the other party's center H replica is the primary replica, the backup replica in this center will not be promoted to primary. If the other party's center H replica is a backup replica, this center will decide on the primary replica itself. 3. If you do not receive messages from the other party's center or health reports: Centers with a primary copy make their own decisions, while centers without a primary copy do not make decisions.

[0049] This invention ensures consistency between primary and backup states and high system availability through periodic synchronization and multi-dimensional verification (heartbeat, health report, key data).

[0050] This embodiment also relates to a primary / backup arbitration method for a dual-active trackside safety platform in the same city. The primary / backup arbitration method of the present invention includes: 1) After the corresponding MPU operation module of each replica starts up, it should send a heartbeat to the arbitration point in each heartbeat cycle and bring in its own primary and backup status; 2) After receiving a heartbeat from a certain MPU computing module, the distributed arbitration point sets the corresponding replica of the MPU computing module to healthy (H); if no heartbeat is received from a certain MPU computing module, the corresponding replica of the MPU computing module is set to unhealthy (UH). 3) The distributed arbitration point sends a health report to the replicas of both centers every cycle, including the health status of all replicas and the primary / standby status; 4) Inter-replica primary / standby negotiation messages: If the primary / standby information of the two MPU computing modules within a single replica is inconsistent, that replica is in a down state. If communication between replicas is normal, each replica helps other replicas check their dual-channel primary / standby negotiation messages. If a replica is found to be abnormal, it is set to a down state. Based on the primary / standby negotiation messages, the primary replica decision is made according to the primary / standby update rules, and its own primary / standby status is updated. Each replica helps other replicas check dual-channel data and actively determines whether other replicas are heading towards a down state, for quick decision-making on the primary replica in the next primary / standby update.

[0051] 5) Each replica exchanges key data. If the key data of a replica is abnormal in the dual-channel verification, the replica will crash. 6) Each replica helps other replicas check their dual-channel critical data. If a replica fails to check, it is set to a crash state.

[0052] 7) Data synchronization is performed between replicas, and the primary replica outputs data to external systems: This embodiment also relates to a primary / backup arbitration method for a dual-active trackside safety platform in the same city. Figure 2 The processing timing description for each cycle of this invention includes: 1. The replica's MPU operation module will exchange primary and backup negotiation messages, which include primary and backup status information.

[0053] 2. If the system determines that the primary and backup information for the two channels are inconsistent, the system will crash.

[0054] 3. Each replica needs to help other replicas verify the consistency of its dual-channel primary and backup information. If it is determined that the dual channels of a replica are inconsistent, then the replica should be set to a down state. 4. The MPU processing module of each replica receives and processes health reports, and records the health status and primary / standby status of each replica; 5. Health report information should only be used as an auxiliary tool when the copy cannot receive messages from the other party's center.

[0055] (1) If the health status of the other party's central replica is UH, then set the other party's central replica to a down state.

[0056] (2) If the health status of the other party's central replica is H and UH, then set the replica in the UH state to the down state; check whether the replica of the other party's central replica H is the primary replica. If it is the primary replica, then the backup of this center cannot be promoted to primary; if the replica of the other party's central replica H is the backup replica, this center can decide the primary replica itself. (3) If the health report of the arbitration point is not received, the center that has the primary copy can make a decision on the primary copy in this center according to the primary and backup update rules; the center that does not have the primary copy cannot make a decision on the primary copy.

[0057] 6. The MPU calculation module of each replica determines the primary replica based on the global primary-backup negotiation message and the primary-backup update rules.

[0058] 7. The MPU operation modules of each replica will exchange key data messages, which include key data related to two-to-two operations, such as output data CRC, synchronization data CRC, period number, self-test result, etc.

[0059] 8. Verify critical data in both channels within the copy. For example, the output data CRC should be consistent, the period number should be consistent, and the self-test results should all be normal. Any problem with the verification of critical data will lead to system crash.

[0060] 9. Each replica needs to help other replicas verify their dual-channel critical data. If the verification fails, the replica should be set to an unavailable state. 10. Each replica's MPU processing module sends a heartbeat to the arbitration point; 11. The primary replica should send synchronization data to other non-synchronized backup replicas. The backup replicas should learn the synchronization data sent by the primary replica, thereby achieving synchronization with the primary replica.

[0061] 12. The primary replica outputs data to external systems.

[0062] The electronic device of this invention includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) or loaded from a storage unit into random access memory (RAM). The RAM may also store various programs and data required for device operation. The CPU, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0063] Multiple components in the device are connected to the I / O interface, including: input units such as keyboards and mice; output units such as various types of displays and speakers; storage units such as disks and optical discs; and communication units such as network interface cards (NICs), modems, and wireless transceivers. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0064] The processing unit performs the various methods and processes described above. For example, in some embodiments, the methods may be implemented as computer software programs tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the CPU, one or more steps of the methods described above may be performed. Alternatively, in other embodiments, the CPU may be configured to execute the methods by any other suitable means (e.g., by means of firmware).

[0065] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0066] The program code used to implement the methods of the present invention can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0067] In the context of this invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0068] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A dual-active trackside safety platform system within the same city, characterized in that, The system includes two independently deployed centers and a distributed arbitration point, with one center serving as the counterpart to the other. Each center contains multiple redundant replicas, and all replicas in the dual centers exchange primary / backup negotiation messages. The replica makes decisions about the primary replica based on the primary-slave negotiation message and according to the primary-slave update rules, and updates its own primary-slave status. The dual centers can only make decisions about a maximum of one primary replica. Each replica consists of two MPU computing modules, forming a dual-channel, two-out-of-two architecture; Each replica periodically sends a heartbeat message to the distributed arbitration point, along with its respective primary / standby status; The distributed arbitration point periodically sends health reports to each replica, informing each replica of its health status and primary / standby status; When a replica fails to receive messages from the other party's central control, the primary replica is assisted in making decisions based on health reports and primary / standby status. When a replica fails to receive messages from the other party's central control, the primary replica's decision-making assistance based on health reports and primary / standby status includes: If the health report shows that all copies of the other party's center are in an unhealthy state, then all copies of the other party's center will be set to an unavailable state, and this center will decide on the primary copy itself. If the health report shows that the health status of the other party's central copy is both healthy and unhealthy, then the copy with the unhealthy status of the other party's central copy is marked as down. If the counterparty's healthy copy is the primary copy, then the backup copy in this center will not be upgraded to the primary copy; otherwise, if the counterparty's healthy copy is a backup copy, this center will decide on the primary copy itself. All replicas process the received primary / backup negotiation message as follows: If the primary and backup status information of the two channels within the replica is inconsistent, the system will crash directly. If inter-replica communication is normal, each replica will actively help other replicas check their dual-channel primary / backup negotiation messages. If a replica is found to be abnormal, the abnormal replica will be set to a down state. The aforementioned exchange of key data between replicas, and marking the status of replicas based on the key data, includes: If critical data for dual-channel verification of a replica is found to be abnormal, the system will crash immediately. When communication between replicas is normal, replicas will help each other check their dual-channel critical data. If there is an anomaly, it will be marked as down. Key data includes output data CRC, synchronization data CRC, period number, and self-test result.

2. The same-city dual-active trackside safety platform system according to claim 1, characterized in that, If a center cannot receive messages or health reports from the other center, the center with a primary replica will decide on the primary replica itself, while the center without a primary replica will not make a decision.

3. The same-city dual-active trackside safety platform system according to claim 1, characterized in that, There is only one primary replica in each of the two centers, and the others are backup replicas. The backup replicas and the primary replica are kept in clock and data synchronization.

4. The same-city dual-active trackside safety platform system according to claim 1, characterized in that, The distributed arbitration points include at least two arbitration points, which communicate with each other using a distributed arbitration protocol to ensure decision consistency.

5. The same-city dual-active trackside safety platform system according to claim 1, characterized in that, The distributed arbitration point marks the health status of the corresponding replica of the MPU computing module based on whether a heartbeat is received, specifically including: If a distributed arbitration point receives a heartbeat from a certain MPU computing module, it sets the corresponding replica of that MPU computing module as healthy; If the distributed arbitration point does not receive a heartbeat from a certain MPU computing module, then the corresponding replica of that MPU computing module is set to unhealthy.

6. The same-city dual-active trackside safety platform system according to claim 1, characterized in that, Each center also includes a communication module responsible for communication between the center and the outside world; The distributed arbitration points and centers are connected via fiber optic communication, and the two centers are periodically synchronized.

7. A primary / backup arbitration method using the same-city dual-active trackside safety platform system as described in any one of claims 1 to 6, characterized in that, The method includes: Each replica periodically sends a heartbeat message to the distributed arbitration point, along with its own primary / standby status. The distributed arbitration point marks the health status of the corresponding replica of the MPU computing module based on whether it receives a heartbeat; The distributed arbitration point periodically sends health reports to each replica, informing each replica of its health and primary / standby status; Primary / standby negotiation interaction process: Each replica exchanges primary / standby negotiation messages, including its own primary / standby status; if the primary / standby information within a replica is inconsistent, it will crash directly; if the communication between replicas is normal, each replica will actively help other replicas check their dual-channel primary / standby negotiation messages; if a replica is found to be abnormal, the abnormal replica will be set to a crash state. Key data interaction process: The status of replicas is marked according to key data, including if the dual-channel verification key data of a replica is abnormal, it will directly crash; when the communication between replicas is normal, replicas will help each other check their dual-channel key data, and if there is an abnormality, it will be marked as a crash state. When a replica fails to receive messages from the other party's central server, the primary replica is assisted in making decisions based on health reports and primary / standby status, and the primary replica outputs data to the outside world.

8. The primary and backup arbitration method according to claim 7, characterized in that, The process by which the distributed arbitration point marks the health status of the corresponding replica of the MPU computing module based on whether it receives a heartbeat includes: If a distributed arbitration point receives a heartbeat from a certain MPU computing module, it sets the corresponding replica of that MPU computing module as healthy; If the distributed arbitration point does not receive a heartbeat from a certain MPU computing module, then the corresponding replica of that MPU computing module is set to unhealthy.

9. The primary and backup arbitration method according to claim 7, characterized in that, When a replica fails to receive messages from the other party's central server, the primary replica's decision-making assistance based on health reports and primary / standby status includes: If the health report shows that all copies of the other party's center are in an unhealthy state, then all copies of the other party's center will be set to an unavailable state, and this center will decide on the primary copy itself. If the health report shows that the health status of the other party's central copy is both healthy and unhealthy, then the copy with the unhealthy status of the other party's central copy is marked as down. If the counterparty's healthy copy is the primary copy, then our backup copy will not be upgraded to the primary copy; otherwise, if the counterparty's healthy copy is a backup copy, our center will decide on the primary copy itself.

10. The primary and backup arbitration method according to claim 7, characterized in that, The method further includes: if a center cannot receive messages from the other center or receive a health report, the center with a primary replica will decide on the primary replica itself, while the center without a primary replica will not make a decision.

11. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 7 to 10.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 7 to 10.

Images