A high-voltage safety system for a multiple locomotive fixed consist and a power supply control method thereof

Abstract

The present application relates to rail transit high-voltage power supply, and discloses a safety system of multi-locomotive fixed marshalling and a power supply control method thereof. The system comprises a redundant power supply topology layer and a hardwired safety platform layer independent of vehicle control software and communication network; the topology layer constructs a through-type or grouping-type power supply topology through high-voltage isolation devices arranged on a high-voltage connection path of the locomotive; the safety platform layer comprises a feedback-type hardwired fault interlocking module connected with key safety nodes of each locomotive and acting on a closing permission loop of a corresponding main circuit breaker, and a hardwired interlocking self-checking module for checking consistency of a target power supply mode, an actual state of the high-voltage isolation device and integrity of the feedback-type hardwired fault interlocking module before closing. When the checking fails, the closing is locked, and when a safety loop is disconnected due to a running fault, the corresponding closing permission is cancelled, so as to realize fault safety and partition protection.

Description

Technical Field

[0001] This invention relates to the field of high-voltage power supply technology for rail transit, and in particular to a high-voltage safety system for fixed multi-locomotive formations and its power supply control method. Background Technology

[0002] With the development of railway freight towards heavy-haul and high-speed operations, the fixed formation or coupled operation of multiple electric locomotives (2 to 4 cars) has become the mainstream technology for increasing transport capacity. Under this mode, in order to meet the huge power demand, the safety and reliability of the high-voltage power supply system has become the cornerstone of ensuring train operation safety and improving transportation efficiency. Once the high-voltage system fails or the control logic malfunctions, it may lead to train operation accidents or major equipment losses.

[0003] In existing technologies, earlier or simplified electric locomotives typically employ simple hard-wired safety circuits. This involves physically connecting the auxiliary contacts of key components such as the main circuit breakers and emergency trip buttons of each locomotive in series using multi-core cables, with the circuit's on / off state controlling the main circuit breaker of the power supply locomotive. While this approach offers the reliability of hard-wired circuits, it generally lacks feedforward overload protection, self-diagnosis, fault location, zone protection, and modular expansion capabilities before power supply. Any abnormality in a contact or line can lead to a complete power outage for the entire locomotive. On the other hand, current electric locomotives also widely employ software interlocking schemes based on train communication networks and vehicle control units. Train communication networks may include twisted-wire train bus (WTB) or Ethernet train backbone (ETB), and vehicle control units may be referred to as CCUs. The security of software interlocking depends on the reliability of the software and communication. Abnormal inputs, strong electromagnetic interference, or communication interruptions may cause protection to fail to operate or malfunction. Systemic design flaws in the software or communication protocols can also lead to common-cause failures. Therefore, it is necessary to establish physical safety permission, interlocking, and forced tripping paths independent of the software and communication networks while maintaining the flexibility of the control system. Summary of the Invention

[0004] This invention provides a high-voltage safety system for fixed multi-locomotive formations and its power supply control method to solve the problems of existing software interlocking schemes lacking independent physical defenses, simple hard-wiring schemes having limited functionality, and traditional high-voltage power supply topologies lacking redundancy and zone protection.

[0005] According to one aspect of the present invention, a high-voltage safety system for fixed multi-locomotive formations is provided. The high-voltage safety system includes a redundant power supply topology layer and a hard-wired safety platform layer independent of vehicle control software and communication networks. The fixed multi-locomotive formation includes multiple locomotives connected via high-voltage connection paths, each locomotive including a pantograph, a main circuit breaker, and a main transformer. The redundant power supply topology layer includes at least one high-voltage isolation device, which includes a high-voltage disconnect switch disposed on the high-voltage connection path between adjacent locomotives and / or an isolation circuit breaker disposed in the high-voltage power supply branch related to the pantograph. The high-voltage disconnect switch is used to connect or disconnect the high-voltage connection path between adjacent locomotives according to a target power supply mode, and the isolation circuit breaker is used to disconnect the high-voltage power supply branch that has experienced a fault. The position auxiliary contact of the high-voltage isolation device is hard-wired connected to the hard-wired safety platform layer. The hard-wired safety platform layer includes a feedback hard-wired fault interlocking module and a hard-wired interlocking self-testing module. The feedback hard-wired fault interlocking module connects the contacts of the key safety nodes of each locomotive in each power supply group through a dedicated hard wire, and is hard-wired connected to the closing permission circuit or closing holding circuit of the main circuit breaker of the power supply locomotive of the power supply group. The hard-wired interlock self-test module includes a static pre-detection circuit and a topology consistency verification circuit. The static pre-detection circuit is used to verify the validity of node address configuration, basic conduction status of the feedback hard-wired fault interlock module, and status of position auxiliary contacts under the initial safe state of pantograph lowering and main circuit breaker opening. The topology consistency verification circuit is used to verify the consistency between the target power supply mode, the actual state of the high-voltage isolator, and the electrical integrity of the feedback hard-wired fault interlock module after the high-voltage isolator operates according to the target power supply mode and before the main circuit breaker closes. If any verification fails, a main circuit breaker closing lockout signal is output. The feedback hard-wired fault interlock module is used to revoke the main circuit breaker closing permission or closing hold signal of the corresponding power supply locomotive when the corresponding safety circuit is disconnected due to an operational fault, so that the corresponding power supply range enters a power failure safety state.

[0006] Optionally, the hard-wired safety platform layer adopts a modular expansion architecture, with the safety modules of each locomotive connected through standardized multi-core cable connectors. Each safety module is equipped with mutually exclusive hardware address terminals for the first, middle, and last car positions, and selects one of the positions via hardware jumpers. When no position is selected or multiple positions are selected simultaneously, a group configuration interlocking signal is output. The feedback-type hard-wired fault interlocking module includes terminal relays and through relays. The address selection of the first or last car position causes the corresponding terminal relay contact to close to seal the end of the protection range, while the address selection of the middle car position causes the corresponding through relay contact to close to connect the upstream and downstream hard-wired interlocking circuits.

[0007] Optionally, the hard-wired safety platform layer also includes a fault partitioning module. The fault partitioning module includes a safety permission relay corresponding to each power supply group, a topology status relay controlled by the position auxiliary contact of the high-voltage isolation device, and a circuit selection contact. In a through-type power supply topology, the circuit selection contact connects the critical safety nodes of each locomotive within the corresponding protection range into a protection circuit. In a grouped power supply topology, the inter-group circuit selection contact disconnects the cross-group interlocking connection, and the terminal relay contacts at the end of each group respectively close the independent protection circuit of each power supply group. When a critical safety node in any power supply group is disconnected, only the safety permission relay of that power supply group is de-energized and the closing permission of the main circuit breaker of that power supply group is revoked, while other protection circuits remain conductive. When the inter-group status cannot be determined or the position auxiliary contact is inconsistent with the target power supply mode, the closing permission of the main circuit breaker of each affected power supply group is revoked.

[0008] Optionally, the hard-wired safety platform layer also includes a fault latching and indication module. The fault latching and indication module is used to latch the first fault trigger signal when the feedback hard-wired fault interlocking module is disconnected for the first time due to a fault, output the indication information of the fault section and drive the audible and visual alarm device to issue an alarm signal. The first fault trigger signal is held until the reset is completed according to the preset reset conditions.

[0009] Optionally, the multi-car locomotive includes a first locomotive, a second locomotive, and a third locomotive connected in sequence. The first locomotive includes a first pantograph, a first main circuit breaker, and a first main transformer; the second locomotive includes a second pantograph, a second main circuit breaker, and a second main transformer; and the third locomotive includes a third pantograph, a third main circuit breaker, and a third main transformer. A first high-voltage disconnecting switch is installed on the high-voltage connection path between the first locomotive and the second locomotive, and a second high-voltage disconnecting switch is installed on the high-voltage connection path between the second locomotive and the third locomotive. In the three-panel double-panel hot standby mode, both the first and second high-voltage disconnect switches are closed to form a through-type high-voltage busbar; the first and third pantographs are used as the main working pantographs and are in the raised state, while the second pantograph is used as the hot pantograph and is in the lowered state.

[0010] Optionally, when a fault is detected in the third pantograph, which serves as the primary working pantograph, the feedback-type hard-wired fault interlocking module first cancels the closing permission or closing holding signal of the third main circuit breaker, causing the third main circuit breaker to open. After obtaining feedback on the open position of the third main circuit breaker, the third pantograph is lowered. During the switching process, both the first and second high-voltage disconnect switches remain closed, the first and second main circuit breakers remain closed, and the third main circuit breaker remains open. The fault isolation confirmation contact controls the bypass contact, which is used to bypass the feedback on the closed position of the third main circuit breaker due to the opening of the third main circuit breaker during this switching. The third main transformer, grid voltage detection, and other critical safety nodes of the third locomotive are still retained in the hard-wired protection circuit. After confirming that the third pantograph has been lowered, the third main circuit breaker has been opened, both the first and second high-voltage disconnect switches are closed, and the hard-wired protection circuit is intact, the second pantograph is allowed to rise so that power can be supplied to the through-type high-voltage busbar from the first and second pantographs.

[0011] Optionally, the multi-car locomotive includes a first locomotive, a second locomotive, a third locomotive, and a fourth locomotive connected in sequence. The first locomotive and the second locomotive constitute a first power supply group, and the third locomotive and the fourth locomotive constitute a second power supply group. The high-voltage connection path between the first power supply group and the second power supply group remains disconnected. The disconnection is achieved by not installing a high-voltage jumper between the second locomotive and the third locomotive, or by maintaining the disconnection through an inter-group high-voltage isolation device installed between the second locomotive and the third locomotive.

[0012] Optionally, the first, second, third, and fourth locomotives each include a first pantograph, a second pantograph, a third pantograph, and a fourth pantograph, respectively. The high-voltage safety system has a front pantograph mode and a rear pantograph mode. In the front pantograph mode, the first pantograph supplies power to the first power supply group, the third pantograph supplies power to the second power supply group, and the second and fourth pantographs are in standby mode. In the rear pantograph mode, the second pantograph supplies power to the first power supply group, the fourth pantograph supplies power to the second power supply group, and the first and third pantographs are in standby mode.

[0013] Optionally, when a power supply group experiences a fault in its current power pantograph, power supply branch, or critical safety node, the feedback hard-wired fault interlocking module revokes the main circuit breaker closing permission of the power supply locomotive of that power supply group, causing that power supply group to lose power, while the power supply status of the other power supply group remains unchanged. After confirming that the backup pantograph, backup power supply branch, relevant main circuit breaker and high-voltage isolation device in the faulty power supply group are all in a usable state, and the hard-wired interlock self-test module has passed the verification, the faulty power supply group will be switched to the backup pantograph for power supply; if the verification fails, the non-faulty power supply group will continue to provide degraded power supply.

[0014] According to another aspect of the present invention, a power supply control method for fixed multi-locomotive formations is provided, applied to a high-voltage safety system in any embodiment of the present invention, comprising: When the pantograph is in the lowered state and the main circuit breaker is in the open state, the static pre-inspection circuit verifies the node address configuration of each safety module, the basic conduction status of the feedback hard-wired fault interlocking module, and the position feedback status of the high-voltage isolating device. If the static pre-inspection fails, the main circuit breaker remains closed and locked. After the static pre-inspection passes, the target power supply mode is determined according to the operation command, and the corresponding high-voltage isolating device is controlled to physically connect or disconnect the high-voltage connection path between locomotives to construct a power supply topology corresponding to the target power supply mode. After the high-voltage isolator operates and before the main circuit breaker closes, the consistency between the target power supply mode, the actual position feedback of the high-voltage isolator, the circuit selection status of each terminal relay and the through relay, and the electrical integrity of the feedback hard-wired fault interlocking module is verified through the topology consistency verification circuit. If the verification fails, the main circuit breaker closing interlocking signal is output and the fault section information is latched. After the verification is passed, the pantograph corresponding to the target power supply mode is raised, and the main circuit breaker of the corresponding power supply locomotive is closed. During operation, the key safety nodes of each power supply group are monitored through the feedback hard-wired fault interlocking module. When a fault causes the corresponding safety circuit to be disconnected, the closing permission or closing hold signal of the main circuit breaker of the corresponding power supply locomotive is revoked. Before switching to the backup pantograph or restoring power supply, the verification related to the current fault isolation status in the static pre-inspection and topology consistency verification is re-executed.

[0015] This invention utilizes high-voltage isolation devices to limit the high-voltage power supply path before the main circuit breaker closes, thus forming feedforward physical protection. It also employs a feedback-type physical protection system through a hard-wired fault interlocking module, independent of the vehicle control software and communication network, which directly monitors critical safety nodes during operation and acts on the corresponding main circuit breaker's permission or holding circuit. The two types of physical protection are consistently verified by a hard-wired interlocking self-testing module, thereby reducing the risk of protection failure due to software faults, communication interruptions, or inconsistent topology.

[0016] Based on this, modular group identification, fault zoning and selective isolation, as well as fault latching and indication functions, enable the same hard-wired safety platform to adapt to different grouping and power supply modes, and prioritize the isolation of the affected power supply range in the event of a fault, so that the non-faulty power supply group can maintain power supply, thereby improving the power supply reliability, operational availability and maintenance efficiency of multi-locomotive fixed grouping.

[0017] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments are briefly introduced below. Obviously, the following drawings only show some embodiments of the present invention; those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the high-voltage main circuit topology for triple-unit reconnection with "dual-panel hot standby" provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the high-voltage main circuit and hard-wired safety interlocking circuit for the three-unit reconnection "dual-panel hot standby" provided in the embodiment of the present invention; Figure 3 This is a schematic diagram of the "dual-source dual-group" high-voltage main circuit topology for four-machine interconnection provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the "dual-source dual-group" high-voltage main circuit and hard-wired safety interlocking circuit for four-machine reconnection provided in this embodiment of the invention; Figure 5 This is a flowchart illustrating a power supply control method for fixed multi-locomotive formations provided in an embodiment of the present invention; In the picture: 100 - First locomotive, 110 - First pantograph, 120 - First main circuit breaker, 130 - First main transformer, 200 - Second locomotive, 210 - Second pantograph, 220 - Second main circuit breaker, 230 - Second main transformer, 300 - Third locomotive, 310 - Third pantograph, 320 - Third main circuit breaker, 330 - Third main transformer, 410 - First high-voltage disconnect switch, 420 - Second high-voltage disconnect switch, 510 - First bypass relay, 520 - Second bypass relay, 530 - Third bypass relay, 540 - Fourth bypass relay, 550 - Fifth bypass relay, 560 - Sixth bypass relay, 600 - Fourth locomotive, 610 - Fourth pantograph, 620 - Fourth main circuit breaker, 630 - Fourth main transformer. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used only to distinguish similar objects and are not intended to limit a specific order or sequence; these terms may be used interchangeably unless contradictory. The terms "comprising," "having," and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or units is not limited to the steps or units explicitly listed, but may also include other steps or units not explicitly listed or inherent to it.

[0022] The high-voltage safety system provided in this embodiment includes a redundant power supply topology layer and a hard-wired safety platform layer independent of the vehicle control software and communication network. The redundant power supply topology layer includes the pantograph of each locomotive, the main circuit breaker, the main transformer, the workshop high-voltage connection path, and at least one high-voltage isolation device. The term "high-voltage isolation device" here refers to a higher-level concept than high-voltage disconnect switches and circuit breakers. High-voltage isolation devices include high-voltage disconnect switches installed on the workshop high-voltage connection path between adjacent locomotives and / or circuit breakers installed in the high-voltage power supply branches related to the power supply pantograph. Circuit breakers installed in the high-voltage power supply branches related to the power supply pantograph are used to disconnect the power supply branch when a fault occurs. High-voltage isolation devices are used to connect or disconnect the workshop high-voltage connection path according to the target power supply mode. High-voltage disconnect switches are installed on the workshop high-voltage connection path between adjacent locomotives. High-voltage disconnect switches are used to construct a continuous or grouped high-voltage power supply topology. Circuit breakers are used to disconnect faulty power supply branches. Both high-voltage disconnect switches and circuit breakers provide the actual connection or disconnection status to the hard-wired interlocking self-detection module through position auxiliary contacts. Figures 1 to 4 The first high-voltage disconnector 410 and the second high-voltage disconnector 420 are both high-voltage disconnectors installed on the high-voltage connection path of the workshop; the numbers 120, 220, 320 and 620 are the main circuit breakers for each locomotive to supply power to its own main transformer.

[0023] The hard-wired safety platform layer includes a feedback-type hard-wired fault interlocking module and a hard-wired interlocking self-testing module. The feedback-type hard-wired fault interlocking module connects to the contacts of key safety nodes such as the main circuit breaker, main transformer, grid voltage detection, and pantograph power supply branch status of each locomotive via a dedicated multi-core cable, and is hard-wired to the closing permission circuit or closing holding circuit of the corresponding locomotive's main circuit breaker. Each power supply group is equipped with a safety permission relay, whose coil is connected in series in the protection circuit of that power supply group, and whose permission contact is connected in series in the closing permission or holding circuit of the corresponding locomotive. In a through-type power supply topology, the circuit selection contact connects the safety nodes of each locomotive within the protection range into a single circuit; in a grouped power supply topology, the inter-group circuit selection contact disconnects the cross-group connection, and the terminal relay contacts of each group close the group terminal, making the two power supply groups form independent protection circuits.

[0024] The hard-wired interlock self-test module includes a static pre-detection circuit and a topology consistency verification circuit. The static pre-detection circuit is used to verify the validity of node address configuration, basic conduction status of the feedback hard-wired fault interlock module, and status of position auxiliary contacts under the initial safe state of pantograph lowering and main circuit breaker opening. The topology consistency verification circuit is used to verify the consistency between the target power supply mode, the actual state of the high-voltage isolator, and the electrical integrity of the feedback hard-wired fault interlock module after the high-voltage isolator operates according to the target power supply mode and before the main circuit breaker closes. If any verification fails, a main circuit breaker closing lockout signal is output. The feedback hard-wired fault interlock module is used to revoke the main circuit breaker closing permission or closing hold signal of the corresponding power supply locomotive when the corresponding safety circuit is disconnected due to an operational fault, so that the corresponding power supply range enters a power failure safety state.

[0025] The hard-wired safety platform layer adopts a modular expansion architecture. Safety modules for each locomotive are connected via standardized multi-core cable connectors. Each safety module has mutually exclusive hardware address terminals for the first, middle, and last locomotive positions, and selects one position via hardware jumpers. When no position is selected or multiple positions are selected simultaneously, a group configuration interlocking signal is output. The feedback-type hard-wired fault interlocking module includes terminal relays and through relays. The address selection for the first or last locomotive position closes the corresponding terminal relay contact to close the protection range end, while the address selection for the middle locomotive position closes the corresponding through relay contact to connect the upstream and downstream hard-wired interlocking circuits. The address of the first or last locomotive position closes the corresponding terminal relay contact, and the address of the middle locomotive position closes the through relay contact. The position feedback of adjacent connectors and the position feedback of the high-voltage isolating device jointly determine the protection range. Static pre-check checks the address validity, connector position status, basic conduction status of the feedback-type hard-wired fault interlocking module, and position feedback signal validity before topology operation. Topology consistency verification checks the consistency of the target power supply mode, actual position, and protection circuit selection status after the high-voltage isolating device operation. When any state combination does not meet the preset hardware logic, a closing lockout signal is output, thereby making the safety authorization, lockout, and fault forced tripping paths independent of the vehicle control software or train communication network.

[0026] The hard-wired safety platform layer may also include a fault partitioning module and a fault latching and indication module. The fault partitioning module includes a safety permission relay corresponding to each power supply group, a topology status relay controlled by the position auxiliary contact of the high-voltage isolation device, and a circuit selection contact. In a through-type power supply topology, the circuit selection contact connects the critical safety nodes of each locomotive within the corresponding protection range into a protection circuit. In a grouped power supply topology, the inter-group circuit selection contact disconnects the inter-group interlocking connection, and the terminal relay contacts at the end of each group respectively close the independent protection circuit of each power supply group. When a critical safety node in any power supply group is disconnected, only the safety permission relay of that power supply group is de-energized and the closing permission of the main circuit breaker of that power supply group is revoked, while other protection circuits remain conductive. When the inter-group status cannot be determined or the position auxiliary contact is inconsistent with the target power supply mode, the closing permission of the main circuit breaker of each affected power supply group is revoked. The fault latching and indication module is used to latch the first fault trigger signal when the feedback hard-wired fault interlocking module is disconnected for the first time due to a fault, output the indication information of the fault section and drive the audible and visual alarm device to issue an alarm signal. The first fault trigger signal is held until the reset is completed according to the preset reset conditions.

[0027] Figure 1 This is a schematic diagram of the high-voltage main circuit topology for a three-unit reconnection "dual-panel hot standby" configuration provided in an embodiment of the present invention. Figure 2 The schematic diagram of the high-voltage main circuit and hard-wired safety interlocking circuit for the three-unit reconnection "dual-panel hot standby" provided in the embodiment of the present invention is as follows: Figure 1 and Figure 2 As shown, the high-voltage safety system for fixed multi-locomotive formations provided in this embodiment constructs a power supply network that is both stable in operation and has fault redundancy capability. The multiple locomotives are designated as a first locomotive 100, a second locomotive 200, and a third locomotive 300. The first locomotive 100 includes a first pantograph 110, a first main circuit breaker 120, and a first main transformer 130. The first main circuit breaker 120 is connected in series in the high-voltage circuit between the first pantograph 110 and the first main transformer 130. The second locomotive 200 includes a second pantograph 210, a second main circuit breaker 220, and a second main transformer 230. The second pantograph 210 and the second main transformer 230 are connected in series in the high-voltage circuit between the second pantograph 210 and the second main transformer 230. A second main circuit breaker 220 is connected in series in the high-voltage circuit between locomotives 30 and 30; the third locomotive 300 includes a third pantograph 310, a third main circuit breaker 320 and a third main transformer 330, and a third main circuit breaker 320 is connected in series in the high-voltage circuit between the third pantograph 310 and the third main transformer 330; a first high-voltage disconnect switch 410 and a second high-voltage disconnect switch 420 are respectively installed on the high-voltage circuits of the first locomotive 100 and the third locomotive 300; the first pantograph 110 and the third pantograph 310 are the main working pantographs, and the second pantograph 210 is a hot pantograph, that is, a standby pantograph that is not working under normal circumstances but is ready to take over at any time.

[0028] In the three-locomotive double-pantograph hot standby mode, both the first high-voltage disconnect switch 410 and the second high-voltage disconnect switch 420 are in the ON state, connecting the high-voltage sides of the three locomotives 300 into a through-type high-voltage busbar. The first pantograph 110 and the third pantograph 310 are in the raised state, and the second pantograph 210 is in the lowered standby state; the first main circuit breaker 120, the second main circuit breaker 220, and the third main circuit breaker 320 corresponding to each locomotive are in the OFF state when the corresponding safety permitting conditions are met. The terminal relay contacts of the first and last locomotive positions close the protection range at both ends, and the through-type relay contacts of the middle locomotive positions connect to the safety circuit of the adjacent locomotives, so that the key safety nodes of the three locomotives and the through-type topology state contacts constitute an effective series protection circuit.

[0029] like Figure 1 and Figure 2 The three-panel double-panel hot standby topology shown uses the first pantograph 110 and the third pantograph 310 located at both ends of the train to jointly draw current, which helps to improve the stability and quality of current draw and reduce the probability of arcing caused by instantaneous separation of the pantograph and catenary; the second pantograph 210, as a hot pantograph, can be put into operation after the main pantograph is withdrawn and the interlocking conditions are met.

[0030] See also Figure 1 and Figure 2 When a fault is detected in the third pantograph 310, the feedback-type hard-wired fault interlocking module first cancels the closing permission or closing hold signal of the third main circuit breaker 320, causing the third main circuit breaker 320 to open; after obtaining feedback on the open position of the third main circuit breaker 320, the third pantograph 310 is lowered. The first high-voltage disconnector 410 and the second high-voltage disconnector 420 remain closed during the switching process to maintain the through-type high-voltage busbar between the three locomotives; the first main circuit breaker 120 and the second main circuit breaker 220 remain closed, and the third main circuit breaker 320 remains open. The first bypass relay 510, the second bypass relay 520, and the third bypass relay 530 maintain a continuous hard-wired protection circuit. The corresponding bypass contact of the fourth bypass relay 540 on the third locomotive side remains closed to bypass the closed position feedback of the third main circuit breaker 320 due to the opening of this switch. However, the third main transformer 330, the grid voltage detection, and other key safety nodes of the third locomotive 300 are still retained in the hard-wired protection circuit.

[0031] Only when the feedback from the lowering of the third pantograph 310, the opening feedback from the third main circuit breaker 320, the closing feedback from the first high-voltage disconnector 410 and the second high-voltage disconnector 420, and the complete signal of the through-type hard-wired protection circuit are all valid, will the hard-wired safety platform output permission to raise the second pantograph 210. After the second pantograph 210 is raised, the power supply combination is switched from "first pantograph 110 and third pantograph 310" to "first pantograph 110 and second pantograph 210". The above switching applies to the situation where the fault is located in the third pantograph 310 and other key safety nodes of the third main transformer 330 and the third locomotive 300 remain normal. When the fault involves the high-voltage power supply path of the third main transformer 330 or the third locomotive 300, the above hot standby switching is not performed. Instead, the closing permission of the affected power supply range is revoked and the third locomotive 300 is isolated according to the fault partitioning logic.

[0032] Figure 3 This is a schematic diagram of the "dual-source dual-group" high-voltage main circuit topology for four-unit interconnection provided in an embodiment of the present invention. Figure 4 The schematic diagram of the "dual-source dual-group" high-voltage main circuit and hard-wired safety interlocking circuit for four-machine reconnection provided in the embodiments of the present invention is as follows: Figure 3 and Figure 4 As shown, the first locomotive 100 and the second locomotive 200 form a first power supply group through a high-voltage connection path within the first group, and the third locomotive 300 and the fourth locomotive 600 form a second power supply group through a high-voltage connection path within the second group. The high-voltage connection path between the first power supply group and the second power supply group is kept disconnected, so that the two power supply groups are isolated from each other on the high-voltage side. The disconnection mentioned here can be achieved by not setting a high-voltage jumper between the second locomotive 200 and the third locomotive 300, or by setting an inter-group high-voltage isolation device and keeping it in an disconnected state.

[0033] The first locomotive 100 includes a first pantograph 110, a first main circuit breaker 120, and a first main transformer 130, with the first main circuit breaker 120 connected in series in a high-voltage circuit between the first pantograph 110 and the first main transformer 130; the second locomotive 200 includes a second pantograph 210, a second main circuit breaker 220, and a second main transformer 230, with the second main circuit breaker 220 connected in series in a high-voltage circuit between the second pantograph 210 and the second main transformer 230; the third locomotive 300 includes a third pantograph 310, a third main circuit breaker 320, and a third main transformer 330, with the third main circuit breaker 320 connected in series in a high-voltage circuit between the third pantograph 310 and the third main transformer 330; the fourth locomotive 600 includes a fourth pantograph 610, a fourth main circuit breaker 620, and a fourth main transformer 630, with the fourth main circuit breaker 620 connected in series in a high-voltage circuit between the fourth pantograph 610 and the fourth main transformer 630.

[0034] The first high-voltage disconnect switch 410 is installed in the high-voltage connection path within the group between the first locomotive 100 and the second locomotive 200, and the second high-voltage disconnect switch 420 is installed in the high-voltage connection path within the group between the third locomotive 300 and the fourth locomotive 600. The first pantograph 110 and the second pantograph 210 are two optional current sources for the first power supply group, and the third pantograph 310 and the fourth pantograph 610 are two optional current sources for the second power supply group.

[0035] In the forward pantograph mode, both the first high-voltage disconnect switch 410 and the second high-voltage disconnect switch 420 are in the ON state, and the first pantograph 110 and the third pantograph 310 are in the OPEN state, so that the first pantograph 110 supplies power to the first power supply group and the third pantograph 310 supplies power to the second power supply group; the second pantograph 210 and the fourth pantograph 610 are in the OFF standby state. The main circuit breaker corresponding to each locomotive is in the OFF state when the corresponding safety permission conditions are met, and the terminal relays, through relays and bypass contacts corresponding to each power supply group are configured according to the current topology, so that the hard-wired protection circuits of the first power supply group and the second power supply group are in an effective state.

[0036] In the rear pantograph mode, both the first high-voltage disconnect switch 410 and the second high-voltage disconnect switch 420 are in the ON state, and the second pantograph 210 and the fourth pantograph 610 are in the UP state, so that the second pantograph 210 supplies power to the first power supply group and the fourth pantograph 610 supplies power to the second power supply group; the first pantograph 110 and the third pantograph 310 are in the DROWN standby state. The hard-wired protection circuits of each power supply group are configured according to the power supply and protection range corresponding to the rear pantograph mode.

[0037] As can be seen, the front pantograph mode and the rear pantograph mode constitute two backup current source combinations. The two power supply groups are isolated from each other on the high-voltage side. When the current power supply pantograph or power supply branch of one power supply group fails, it can be switched to the backup pantograph after the power supply group loses power, the backup power supply path is checked and the hard-wired interlocking verification is passed. The other healthy power supply group can maintain power supply during the switching process, thereby improving the continuity of the task.

[0038] See also Figure 3 and Figure 4 In the forward-bow mode, when the main circuit breaker, main transformer, grid voltage detection and other key safety nodes of the second locomotive 200 cause the safety circuit corresponding to the first power supply group to be disconnected due to a fault, the fault is identified as being located in the first power supply group. The fault latching and indication module latches the fault section and alarms. The feedback hard-wired fault interlocking module cancels the closing permission of the main circuit breaker of the power supply locomotive of the first power supply group, causing the first power supply group to lose power.

[0039] The hard-wired protection circuit and power supply status of the second power supply group remain unchanged, and the train can be maintained in degraded operation by the second power supply group. If only the second pantograph 210 in the lowered standby state is detected to be unavailable, and the fault does not cause the loss of the critical safety clearance conditions of the first power supply group, the fault of the standby pantograph can be latched and indicated, while maintaining the current front pantograph mode; the specific detection conditions and interlocking range can be set according to the actual safety circuit.

[0040] If a fault occurs in the first pantograph 110, the first main circuit breaker 120, or an associated power supply branch that is currently supplying power to the first power supply group, the feedback-type hard-wired fault interlocking module will revoke the closing permission of the first power supply group, causing the first power supply group to lose power. Only after confirming that the second pantograph 210, the second main circuit breaker 220, the backup power supply path of the first power supply group, and the relevant high-voltage isolation devices are all in a usable state, and the hard-wired interlocking self-testing module has passed the verification, is the first power supply group allowed to switch to be powered by the second pantograph 210.

[0041] Therefore, the determination state relationship of the zoned hard-wired protection is as follows: when the target power supply mode is consistent with the position feedback of the high-voltage isolation device, the group-end terminal relay and the intra-group through relay are in the corresponding positions, and all critical safety nodes of the group are closed, the safety permission relay of the group is energized; when any critical safety node is open, only the safety permission relay of the group is de-energized and the closing permission of the main circuit breaker of the locomotive powered by the group is revoked; the other group maintains power supply when all the above conditions are met. When the inter-group isolation state cannot be determined, the address combination is invalid, the fault involves common safety conditions, or any consistency check fails, the closing permission of each affected power supply group is revoked according to the fault-safe principle.

[0042] After the fault has been cleared or the faulty branch has been isolated, the system can perform mode switching based on the health status of the backup power supply path. Taking the switching of the first power supply group from the front pantograph mode to the rear pantograph mode as an example, after the second pantograph 210, the second main circuit breaker 220, and the high-voltage connection path within the group are all available and the hard-wired interlocking self-test passes, the first pantograph 110 is lowered and the second pantograph 210 is raised, and the first power supply group is switched to be powered by the second pantograph 210. The second power supply group can maintain its original power supply or switch independently depending on its own status; if the backup path verification fails, it will continue to operate under degraded conditions from the healthy power supply group.

[0043] In a three-unit continuous power supply topology, when the current power supply pantograph or its associated power supply branch fails, the power supply permit affected by the failure is first revoked and the faulty branch is isolated. Then, the status of the remaining main pantograph, hot pantograph, and continuous high-voltage busbar determines whether switching is allowed. In a four-unit grouped power supply topology, when a power supply group fails, the power supply permit of that power supply group is revoked first, while the other power supply group continues to supply power.

[0044] When the fault location cannot be determined by the hardware interval identification logic, the fault involves the common safety conditions of multiple power supply groups, or the status of the high-voltage isolation device is inconsistent with the target power supply mode, the hard-wired safety platform outputs a closing lockout or cancels the closing hold signal of the main circuit breaker within the affected area according to the fault safety principle, so that the corresponding power supply area enters a power outage safety state. The fault latching and indication module latches the first fault section and alarms for location and maintenance.

[0045] The aforementioned hard-wired permission, interlocking, and forced tripping paths are independent of the vehicle control software and train communication network, thus enabling physical safety protection to be implemented even in the event of software malfunction or communication interruption. The zoned implementation also prevents healthy power supply groups from losing power due to partial faults in other power supply groups, thereby improving system availability.

[0046] Based on the above embodiments, the hard-wired safety platform layer may further include a fault latching and indication module. The fault latching and indication module is triggered and maintains the initial fault trigger signal when the feedback-type hard-wired fault interlocking module is first disconnected due to a fault, outputs indication information corresponding to the faulty section, and drives the audible and visual alarm device to issue an alarm signal.

[0047] The fault zoning module applies a detection level from one end of each hardwired protection circuit and acquires the levels of the forward and backward hardwired interfaces of adjacent safety modules. When the detection point closer to the detection level input has a detection level and the detection point farther from the detection level input has no detection level, the locomotive safety module or workshop connection section between the two detection points is identified as the fault section; the location of the fault section is determined by the hardware address of the safety module where the level change occurs. In the four-machine grouped power supply topology, the first power supply group and the second power supply group apply detection levels from the ends of their respective protection circuits. The fault location is only identified within the power supply group and does not propagate across group boundaries. The fault latching and indication module latches the hardware address of the first level change and outputs corresponding indications and alarms. The information is retained until a reset is completed according to the preset reset conditions.

[0048] Figure 5 This is a flowchart illustrating a power supply control method for fixed multi-locomotive formations provided in an embodiment of the present invention. The power supply control method for fixed multi-locomotive formations is applied to the high-voltage safety system of fixed multi-locomotive formations in any embodiment of the present invention, such as... Figure 5 As shown, the power supply control method for this multi-locomotive fixed formation includes: S110. When the pantograph is in the lowered state and the main circuit breaker is in the open state, the static pre-inspection circuit verifies the node address configuration of each safety module, the basic conduction status of the feedback hard-wired fault interlocking module, and the position feedback status of the high-voltage isolation device. If the static pre-inspection fails, the main circuit breaker remains closed and locked. After the static pre-inspection passes, the target power supply mode is determined according to the operation command, and the corresponding high-voltage isolation device is controlled to physically connect or disconnect the high-voltage connection path between locomotives to construct a power supply topology corresponding to the target power supply mode.

[0049] Specifically, the static pre-inspection circuit first checks whether the hardware address of the first, middle, or last parking space of each safety module is a unique and valid selection, whether adjacent multi-core cable connectors are in place, whether the feedback-type hard-wired fault interlocking module has basic conduction conditions, and whether there are any abnormal combinations of simultaneous valid or invalid feedback of the high-voltage isolating devices' connection and disconnection. After the static pre-inspection passes, the circuit controls the corresponding high-voltage isolating devices to connect or disconnect the high-voltage connection path according to the target power supply mode. After the action is completed, the topology consistency verification circuit checks whether the actual position of each high-voltage isolating device, the circuit selection status of the terminal relay and the through relay, and the electrical integrity of the feedback-type hard-wired fault interlocking module are consistent with the target power supply mode. If any check fails, the circuit outputs a main circuit breaker closing interlocking signal and drives the fault latching and indication module to alarm.

[0050] Through a two-stage verification process, the "basic health check before topology operation" and the "target status confirmation after topology operation" can be separated: the former prevents the high-voltage isolating device from being driven when the address is invalid, the connector is disconnected, the position feedback is contradictory, or the interlocking circuit itself does not meet the operating conditions; the latter prevents the pantograph from being raised and the circuit breaker from being closed when the actual position of the high-voltage isolating device is inconsistent with the protection range. The judgment is implemented by hardware contacts, relays, and hard-wired logic, without relying on vehicle control software or operating system.

[0051] S120. After the high-voltage isolating device has completed its operation and before the main circuit breaker is closed, the consistency between the target power supply mode, the actual position feedback of the high-voltage isolating device, the circuit selection status of each terminal relay and the through relay, and the electrical integrity of the feedback hard-wired fault interlocking module is verified through the topology consistency verification circuit. If the verification fails, the main circuit breaker closing interlocking signal is output and the fault section information is latched.

[0052] S130. After the verification is passed, the pantograph corresponding to the target power supply mode is raised, and the main circuit breaker of the corresponding power supply locomotive is closed. During operation, the key safety nodes of each power supply group are monitored through the feedback hard-wired fault interlocking module. When the fault causes the corresponding safety circuit to be disconnected, the closing permission or closing hold signal of the main circuit breaker of the corresponding power supply locomotive is revoked. Before switching to the backup pantograph or restoring power supply, the verification related to the current fault isolation state in the static pre-inspection and topology consistency verification is re-executed.

[0053] In the three-locomotive double-pantograph hot standby mode, both the first and second high-voltage isolation devices are connected, making the three locomotives form a through high-voltage busbar; in the four-locomotive double-source double-group mode, the first locomotive and the second locomotive form the first power supply group, and the third locomotive and the fourth locomotive form the second power supply group, and the high-voltage connection path between the two power supply groups remains disconnected.

[0054] After the target power supply topology is constructed and verified, the selected power supply pantograph is raised. In the three-pantograph hot standby mode, the first and third pantographs can be raised while the second pantograph remains lowered; in the four-pantograph dual-source dual-group front pantograph mode, the first and third pantographs can be raised while the second and fourth pantographs remain lowered.

[0055] The pantograph supplies high-voltage electricity from the overhead contact line to the high-voltage busbar of the corresponding power supply group, and distributes it to each locomotive via high-voltage jumpers and connected high-voltage connection branches within the group. The main circuit breakers of each locomotive then supply power to the corresponding main transformer. Each main circuit breaker closes only when the target power supply mode, the actual state of the high-voltage isolation devices, and the hard-wired protection circuit all meet the permissible conditions.

[0056] During train operation, the feedback-type hard-wired fault interlocking module monitors in real time the contact status of key safety nodes within each protection range, such as the main circuit breaker, main transformer, grid voltage detection, and pantograph power supply branch status. In a continuous protection circuit, when any key safety node is disconnected, the corresponding safety permission relay is de-energized and the closing permission for that continuous protection range is revoked. In a grouped protection circuit, when any key safety node of a power supply group is disconnected, only the safety permission relay of that group is de-energized, while the safety permission relay of a healthy power supply group remains energized as long as its own circuit is intact and the topology is consistent. When the inter-group isolation status cannot be determined or the fault involves common safety conditions, the closing permission of each affected power supply group is revoked.

[0057] After troubleshooting or isolating the faulty branch, first, re-perform the static pre-check related to the faulty section under the current isolation state to confirm that the address configuration, connectors, location feedback, and backup branch meet the basic requirements; then, control the high-voltage isolation device according to the recovery target and perform a topology consistency check. Power supply can only be restored or the backup pantograph can only be activated after both stages of the check have passed; if either check fails, the circuit breaker will remain locked and the fault latching information will be retained.

[0058] The power supply control method in this embodiment follows the logic of static pre-inspection under initial safe conditions, determining the target mode, constructing the high-voltage power supply topology, topology consistency verification, pantograph raising and closing, operation monitoring and fault protection, and re-verification and recovery after fault isolation. By setting the safety authorization, interlocking, and forced tripping paths as independent hard-wired circuits, the impact of software judgment and network communication on fault protection can be reduced, and the fault response can be made mainly dependent on the action time of hardware detection and execution devices.

[0059] It should be understood that each step can be refined or combined without violating its safety dependencies; among them, static pre-inspection should be completed before the high-voltage isolator performs the target topology operation, topology consistency verification should be completed after the high-voltage isolator operates and before the power supply pantograph is raised and the main circuit breaker is closed, operation monitoring and fault protection should be continuously executed after power supply is established, and verification related to the current isolation state should be re-executed before restoring or switching the standby pantograph, and no closing interlocking condition should be bypassed by adjusting the steps.

[0060] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A high-voltage safety system for fixed multi-locomotive formations, characterized in that, The system includes a redundant power supply topology layer and a hard-wired safety platform layer independent of the vehicle control software and communication network. The multi-locomotive fixed formation includes multiple locomotives connected by a high-voltage connection path, and each locomotive includes a pantograph, a main circuit breaker, and a main transformer. The redundant power supply topology layer includes at least one high-voltage isolation device, which includes a high-voltage disconnect switch installed on the high-voltage connection path between adjacent locomotives and / or an isolation circuit breaker installed in the high-voltage power supply branch related to the power supply pantograph. The high-voltage disconnect switch is used to connect or disconnect the high-voltage connection path between adjacent locomotives according to the target power supply mode, and the isolation circuit breaker is used to disconnect the high-voltage power supply branch that has failed. The position auxiliary contact of the high-voltage isolation device is hard-wired connected to the hard-wired safety platform layer. The hard-wired safety platform layer includes a feedback-type hard-wired fault interlocking module and a hard-wired interlocking self-detection module. The feedback-type hard-wired fault interlocking module connects the contacts of the key safety nodes of each locomotive in each power supply group through a dedicated hard wire, and is hard-wired connected to the closing permission circuit or closing holding circuit of the main circuit breaker of the power supply locomotive of the power supply group. The hard-wired interlock self-test module includes a static pre-detection circuit and a topology consistency verification circuit. The static pre-detection circuit is used to verify the node address configuration, the basic conduction state of the feedback hard-wired fault interlock module, and the status validity of the position auxiliary contacts under the initial safe state of pantograph lowering and main circuit breaker opening. The topology consistency verification circuit is used to verify the consistency between the target power supply mode, the actual state of the high-voltage isolation device, and the electrical integrity of the feedback hard-wired fault interlock module after the high-voltage isolation device operates according to the target power supply mode and before the main circuit breaker closes. If any verification fails, a main circuit breaker closing lockout signal is output. The feedback hard-wired fault interlock module is used to revoke the main circuit breaker closing permission or closing hold signal of the corresponding power supply locomotive when an operational fault causes the corresponding safety circuit to disconnect, so that the corresponding power supply range enters a power outage safety state.

2. The high-voltage safety system according to claim 1, characterized in that, The hard-wired safety platform layer adopts a modular expansion architecture, with the safety modules of each locomotive connected via standardized multi-core cable connectors. Each safety module is equipped with mutually exclusive hardware address terminals for the first, middle, and last car positions, and selects one of these positions via hardware jumpers. When no position is selected or multiple positions are selected simultaneously, a group configuration interlocking signal is output. The feedback-type hard-wired fault interlocking module includes terminal relays and through relays. The address selection of the first or last car position causes the corresponding terminal relay contact to close to seal the end of the protection range, while the address selection of the middle car position causes the corresponding through relay contact to close to connect the upstream and downstream hard-wired interlocking circuits.

3. The high-voltage safety system according to claim 1, characterized in that, The hard-wired safety platform layer also includes a fault partitioning module, which includes a safety permission relay corresponding to each power supply group, a topology status relay controlled by the position auxiliary contact of the high-voltage isolation device, and a circuit selection contact. In a through-type power supply topology, the circuit selection contact connects the critical safety nodes of each locomotive within the corresponding protection range into a protection circuit. In a grouped power supply topology, the inter-group circuit selection contact disconnects the cross-group interlocking connection, and the terminal relay contact at the end of each group closes the independent protection circuit of each power supply group. When a critical safety node in any power supply group is disconnected, only the safety permission relay of that power supply group is de-energized and the closing permission of the main circuit breaker of that power supply group is revoked, while other protection circuits remain conductive. When the inter-group status cannot be determined or the position auxiliary contact is inconsistent with the target power supply mode, the closing permission of the main circuit breaker of each affected power supply group is revoked.

4. The high-voltage safety system according to claim 1, characterized in that, The hard-wired safety platform layer also includes a fault latching and indication module. The fault latching and indication module is used to latch the first fault trigger signal when the feedback hard-wired fault interlocking module is disconnected for the first time due to a fault, output the indication information of the fault section and drive the audible and visual alarm device to issue an alarm signal. The first fault trigger signal is held until the reset is completed according to the preset reset conditions.

5. The high-voltage safety system according to claim 1, characterized in that, The multi-car locomotive comprises a first locomotive, a second locomotive, and a third locomotive connected in sequence. The first locomotive includes a first pantograph, a first main circuit breaker, and a first main transformer. The second locomotive includes a second pantograph, a second main circuit breaker, and a second main transformer. The third locomotive includes a third pantograph, a third main circuit breaker, and a third main transformer. A first high-voltage disconnecting switch is installed on the high-voltage connection path between the first locomotive and the second locomotive, and a second high-voltage disconnecting switch is installed on the high-voltage connection path between the second locomotive and the third locomotive. In the three-panel double-panel hot standby mode, both the first and second high-voltage disconnect switches are closed to form a through-type high-voltage busbar; the first and third pantographs are used as the main working pantographs and are in the raised state, while the second pantograph is used as the hot pantograph and is in the lowered state.

6. The high-voltage safety system according to claim 5, characterized in that, When a fault is detected in the third pantograph, which serves as the primary working pantograph, the feedback-type hard-wired fault interlocking module first cancels the closing permission or closing hold signal of the third main circuit breaker, causing the third main circuit breaker to open; after obtaining feedback on the open position of the third main circuit breaker, the third pantograph is lowered; during the switching process, both the first and second high-voltage disconnect switches remain closed, the first and second main circuit breakers remain closed, and the third main circuit breaker remains open, confirmed by the fault isolation contact. A bypass contact is controlled to bypass the closing position feedback of the third main circuit breaker, which is changed due to the opening of the circuit breaker during this switching operation. The third main transformer of the third locomotive, the grid voltage detection, and other key safety nodes remain in the hard-wired protection circuit. After confirming that the third pantograph has been lowered, the third main circuit breaker has been opened, the first high-voltage disconnect switch and the second high-voltage disconnect switch are both closed, and the hard-wired protection circuit is intact, the second pantograph is allowed to be raised so that power can be supplied to the through-type high-voltage busbar by the first pantograph and the second pantograph.

7. The high-voltage safety system according to claim 1, characterized in that, The multi-car locomotive includes a first locomotive, a second locomotive, a third locomotive, and a fourth locomotive connected in sequence. The first locomotive and the second locomotive constitute a first power supply group, and the third locomotive and the fourth locomotive constitute a second power supply group. The high-voltage connection path between the first power supply group and the second power supply group remains disconnected. The disconnection is achieved by not installing a high-voltage jumper between the second locomotive and the third locomotive, or by maintaining the disconnection through an inter-group high-voltage isolation device installed between the second locomotive and the third locomotive.

8. The high-voltage safety system according to claim 7, characterized in that, The first locomotive, the second locomotive, the third locomotive, and the fourth locomotive each include a first pantograph, a second pantograph, a third pantograph, and a fourth pantograph; the high-voltage safety system has a front pantograph mode and a rear pantograph mode. In the front pantograph mode, the first pantograph supplies power to the first power supply group, the third pantograph supplies power to the second power supply group, and the second and fourth pantographs are in standby mode. In the rear pantograph mode, the second pantograph supplies power to the first power supply group, the fourth pantograph supplies power to the second power supply group, and the first pantograph and the third pantograph are in standby mode.

9. The high-voltage safety system according to claim 7, characterized in that, When a power supply group experiences a fault in its current power pantograph, power supply branch, or critical safety node, the feedback hard-wired fault interlocking module revokes the main circuit breaker closing permission of the power supply locomotive of that power supply group, causing that power supply group to lose power, while the power supply status of the other power supply group remains unchanged. After confirming that the backup pantograph, backup power supply branch, relevant main circuit breaker and high-voltage isolation device in the faulty power supply group are all in a usable state, and the hard-wired interlock self-test module passes the verification, the faulty power supply group is switched to the backup pantograph for power supply; if the verification fails, the non-faulty power supply group continues to provide degraded power supply.

10. A power supply control method for fixed multi-locomotive formations, characterized in that, The high-voltage safety system applied to any one of claims 1-9 comprises: When the pantograph is in the lowered state and the main circuit breaker is in the open state, the static pre-inspection circuit verifies the node address configuration of each safety module, the basic conduction status of the feedback hard-wired fault interlocking module, and the position feedback status of the high-voltage isolation device. If the static pre-inspection fails, the main circuit breaker remains closed and locked. After the static pre-inspection passes, the target power supply mode is determined according to the operation command, and the corresponding high-voltage isolation device is controlled to physically connect or disconnect the high-voltage connection path between locomotives to construct a power supply topology corresponding to the target power supply mode. After the high-voltage isolating device completes its operation and before the main circuit breaker closes, the consistency between the target power supply mode, the actual position feedback of the high-voltage isolating device, the circuit selection status of each terminal relay and the through relay, and the electrical integrity of the feedback hard-wired fault interlocking module is verified through a topology consistency verification circuit. If the verification fails, the main circuit breaker closing interlocking signal is output and the fault section information is latched. After the verification is passed, the pantograph corresponding to the target power supply mode is raised, and the main circuit breaker of the corresponding power supply locomotive is closed. During operation, the key safety nodes of each power supply group are monitored through the feedback hard-wired fault interlocking module. When a fault causes the corresponding safety circuit to be disconnected, the closing permission or closing hold signal of the main circuit breaker of the corresponding power supply locomotive is revoked. Before switching to the backup pantograph or restoring power supply, the verification related to the current fault isolation state in the static pre-inspection and the topology consistency verification is re-executed.

Images