Onboard control device and train control method

Abstract

To safely record control information used for control by an on-vehicle control device and lost by power supply cutoff.SOLUTION: An on-vehicle control device mounted on a train includes a fail-safe CPU having first and second CPUs performing the same arithmetic processing on input information, and first and second nonvolatile memories corresponding to the first and second CPUs. Each of the first and second CPUs takes the control information transmitted from the ground-side device as input information, writes and records the control information in the corresponding first and second non-volatile memories, respectively, and reads the recorded control information from the corresponding first and second non-volatile memories, respectively, and the fail-safe CPU collates the control information read by each of the first and second CPUs, and collates the control information with the control information transmitted from the ground-side device when the collated first results coincide with each other, and, If the compared second results are consistent, the control state based on the consistent control information is determined.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an on-board control device and a train control method for railways. [Background technology]

[0002] In railway operations, a fixed block system is implemented that allows only one train to be on the track per block area, and train detection has traditionally been performed using track circuits for train control. However, in recent years, there has been a movement to reduce the cost of railway communication systems by introducing wireless communication systems for on-board-to-ground transmission, which will enable train detection through position reports from trains.

[0003] In the United States and China, the introduction of the Communication Based Train Control (CBTC) system, which controls trains through wireless communication, is underway. Meanwhile, in Europe, a system called the European Rail Traffic Management System (ERTMS) / European Train Control System (ETCS) has been developed and is being introduced with the aim of improving interoperability by standardizing the signaling systems that differ from country to country.

[0004] Railway safety systems such as the above-mentioned CBTC and ERTMS / ETCS are primarily composed of on-board control devices and wayside devices, which communicate with each other via wireless communication. The on-board control devices detect wayside coils installed on the track to recognize the location information of the point, and perform speed checks based on this location information, train speed information, and running permission signals received from wayside devices via wireless communication. If the train speed exceeds the speed limit, the on-board control devices will apply brake output to control the train's operation.

[0005] Railway safety devices generally require a high level of safety, and are required to have fail-safe capabilities that allow them to safely control railway vehicles even in the event of an abnormality or failure in the safety device itself or in peripheral devices. Existing systems have adopted a configuration in which the fail-safe CPU is equipped with two identical CPUs, and a collating unit collates the operation of the two CPUs to ensure safety. The collating unit compares the results of the two CPUs every calculation cycle, and if a mismatch occurs in the calculation results, the two CPUs stop operating and the system transitions to a safer state.

[0006] Furthermore, Patent Document 1 discloses a technology in which, when a fail-safe device (CPU) is used to control the speed of a train, the soundness of the data exchange unit that exchanges data with the calculation unit is checked to ensure error-free data exchange and system safety, and inconsistencies in pulse count values ​​due to differences in the timing of speed signal capture are prevented, thereby preventing brake output due to the detection of a fault caused by unnecessary speed difference detection.

[0007] Furthermore, Patent Document 2 discloses a technology in which, in order to detect the position of a train, the on-board safety control unit collates information obtained from sensors in a first mode while the train is in commercial operation, and collates information obtained from sensors in a second mode different from the first mode while the train is stopped after commercial operation has ended, thereby reducing power consumption by turning off the power to the on-board safety control unit after commercial operation has ended. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Patent No. 5905697 [Patent Document 2] Japanese Patent Application Laid-Open No. 2016-137731 Summary of the Invention [Problem to be solved by the invention]

[0009] The railway safety system described above controls train safety by exchanging and sharing a variety of control information between the on-board and ground sides, such as control mode and train location information.

[0010] The control mode in which the on-board control device (hereinafter referred to as "on-board control device") performs control is defined based on the state of the on-board control device, the state of the roadside facilities on the track, the state of communication with the groundside equipment, the position information recognized by the on-board side, the operation by the driver, and other conditions. The on-board control device determines the control mode in which it will perform control based on the state of the vehicle, the operation by the driver, and instructions from the groundside equipment. Furthermore, when the on-board control device has established communication with the groundside equipment and is receiving information necessary for train operation and protection from the groundside equipment, it is possible to perform safe train control (hereinafter referred to as "full monitoring mode" for convenience).

[0011] On the other hand, if a component of the on-board control device, such as the radio or ground equipment, fails, the on-board control device will recognize this as an abnormality in full monitoring mode and issue an emergency brake command to the vehicle. Since train operation cannot continue in this state, the on-board control device will transition to a control mode, release the emergency brake, and allow the train to continue operating at a low speed limit (hereafter referred to as "driver responsibility mode" for convenience). In this driver responsibility mode, operation management, cooperation with ground operators, and monitoring of the area ahead of the train while it is running are all carried out under the driver's responsibility.

[0012] In addition, in sections where no ground-side equipment is installed, the on-board control device cannot obtain valid control information from the ground-side equipment, and therefore transitions to a control mode indicating that the section is outside the control area (hereinafter referred to as ``non-installed mode'' for convenience).

[0013] Because the recognition of the above control modes is related to the safety of train operation, a high level of safety is required for the conditions for control mode transition and the inputs required for the transition.

[0014] Conventionally, when a train's power supply is cut off at a depot or other location after a train's operation has ended, the power supply to the on-board control device is also cut off. Furthermore, in some cases, the train may be parked at a depot or on a siding on the main line or at a station, and the power supply may be cut off.

[0015] When a train's power is turned off and then turned back on for the next operation, it is desirable for the control mode recognized by the on-board control device to be the control mode before the power was turned off, in order to ensure smooth operation.It is also desirable for the train's position information to be the information before the power was turned off.

[0016] Conventionally, information held by on-board control devices is lost when the power is cut off, so when the power is next turned on, there is no train position information and the on-board control device starts up in the specified control mode. At this time, normally, the device will temporarily transition to a control mode with restrictions on control, such as non-design mode or driver responsibility mode. Therefore, by using the present invention, control information such as position information and control mode can be recorded in the on-board equipment itself, thereby improving operational convenience.

[0017] Existing on-board control devices do not have position information or control modes when powered on, so they transition to a specified control mode without having position information. To improve operational convenience, external hardware that records the control mode is sometimes installed in addition to the on-board control device. This external hardware consists of hardware such as a magnetic holding relay. When powered on, the state of the external hardware is read and the control mode after startup is determined. The recorded information is only ON / OFF, and it is not possible to record information exceeding 1 bit or additional information such as error detection. Furthermore, if a magnetic holding relay malfunctions and causes the control mode to differ from what it should be, the on-board control device will not be able to detect the malfunction and will transition to the wrong control mode.

[0018] Here, one method for detecting abnormalities in magnetic holding relays is to check their health by turning them on and off at startup, but this does not allow for the detection of failures that occur afterwards.Reliability can be improved by installing multiple magnetic holding relays, but this increases installation costs and poses the problem of worsening maintainability due to hardware failure.

[0019] The present invention records control information in the internal non-volatile memory (hereinafter referred to as "non-volatile memory") of the on-board control device, so that the next time the power is turned on, the device will start up with the control information before the power was cut off. This control information is closely related to the safety functions of the on-board control device. Therefore, a recording and reading method is used to record the information while ensuring safety. Additionally, the present invention enhances safety by having the two CPUs in the fail-safe CPU inside the on-board control device each individually record control information in non-volatile memory and compare the read results. [Means for solving the problem]

[0020] In order to solve the above problem, one representative on-board control device of the present invention comprises a fail-safe CPU having a first CPU and a second CPU that perform the same arithmetic processing on input information, a first non-volatile memory corresponding to the first CPU, and a second non-volatile memory corresponding to the second CPU, and each of the first and second CPUs takes control information transmitted from a ground-side device as input information, writes and records the control information in the corresponding first and second non-volatile memories, and executes a process of reading the recorded control information from the corresponding first and second non-volatile memories, and the fail-safe CPU compares the control information read by each of the first and second CPUs, and if the first comparison result is a match, compares the control information with the control information transmitted from the ground-side device, and if the second comparison result is a match, executes a process of determining the control state based on the matched control information. [Effects of the Invention]

[0021] According to the present invention, when recording control information for an on-board control device, it is possible to prevent errors in the recorded information or in the recognition of the control information for the on-board control device due to hardware failure, etc., thereby enabling safe and reliable recording of control information for the on-board control device. Furthermore, according to the present invention, control information is not lost when the power is turned off, and when the power is turned on again, control is carried out based on the control information before the power was turned on, making it possible to read the control information safely and reliably. Problems, configurations, and effects other than those described above will become apparent from the following description of the preferred embodiment of the invention. [Brief explanation of the drawings]

[0022] [Figure 1] 1 is a block diagram showing a schematic configuration of a railway system according to the present invention; [Figure 2] 1 is a block diagram showing an example of the configuration of an on-board control device according to the present invention together with related devices. [Figure 3] FIG. 2 is a flowchart showing an example of an operation mode (processing flow) relating to a control information recording process according to the present invention. [Figure 4] 3 is a flowchart showing an example of an operation mode (processing flow) relating to a process for reading recorded information when a vehicle power source is turned on according to the present invention. FIG. [Figure 5] FIG. 10 is a diagram showing the transition of recording states in a nonvolatile memory. DETAILED DESCRIPTION OF THE INVENTION

[0023] Hereinafter, examples will be described as modes for carrying out the present invention with reference to the drawings. Note that the present invention is not limited to these examples. In addition, in the description of the drawings, the same parts are designated by the same reference numerals. [Example]

[0024] FIG. 1 is a block diagram showing a schematic configuration of a railway system according to the present invention. The train 1 is equipped with an on-board control device 2 that controls the train 1, an on-board communication device 3 that communicates information with ground equipment 5 to control the train 1, and a power supply device 4 that supplies power to operate at least the on-board control device 2 and the on-board communication device 3.

[0025] On the other hand, on the ground side, there are ground equipment 5 that detects the state of the train 1 and creates control information to be sent to the on-board control device 2, and ground communication equipment 6 that sends the control information from the ground equipment 5 to the train 1. In addition, on the route, a ground coil 7 is installed, which has information on the position on the route.

[0026] Furthermore, the train 1 is equipped with a speed sensor 9 that outputs the running speed of the train 1 to the on-board control device 2 as train speed information, an on-board sensor 8 that detects ground sensors 7 installed on the track to recognize the position of the train 1 on the line and outputs the train's position on the line to the on-board control device 2, and a brake control device 10 that applies the brakes to the vehicle in response to a brake command from the on-board control device 2. When the train speed exceeds the speed limit or when an abnormality is detected, the on-board control device 2 outputs a brake command to the brake control device 10 to slow down or stop the train 1.

[0027] The ground device 5 transmits the train's location detected by the on-board control device 2 via a train detection device installed on the line on which the train 1 is operated, and similarly, the travel permission information for each train to proceed based on the location of other trains on the line, to the on-board control device 2 via the ground communication device 6 and the on-board communication device 3.

[0028] The on-board control device 2 also controls the train 1 based on the running permission information transmitted from the ground device 5. At this time, the on-board control device 2 recognizes the control state, such as the control mode for executing control, according to the on-track position information, whether or not the on-track position is recognized, the installation status of the train 1 and the ground equipment on the route the train is traveling on, and the state of the on-board control device 2.

[0029] The control state can be switched by the on-board control device 2 in several ways, including autonomously determining the state of the on-board control device 2, by the driver or maintenance personnel using a switch mounted on the train, or by the wayside device 5 issuing a control command to the on-board control device 2. Wireless communication is preferable for sending and receiving information between the on-board communication device 3 and the wayside communication device 6, but the form of wireless communication is not critical.

[0030] Before the train 1 starts operation, it is energized in a depot or the like, and while the power supply unit 4 is operating, the on-board control device 2 obtains power to operate. Furthermore, unless there is an abnormality in the power supply system, the on-board control device 2 continues to operate while the train is in operation by supplying power from the power supply unit 4. After the train 1 has finished operation and moved to a depot or the like, the power supply to the train 1 is cut off. At this time, the power supply unit 4 also cuts off the power supply, and the on-board control unit 2 also stops operating.

[0031] Generally, the power supply device 4 supplies power not only to the on-board control device 2 but also to other devices mounted on the train 1. Generally, the power supply device 4 uses power obtained by the train 1 via a pantograph or the like, which is converted via a power converter or the like, but the form in which the train 1 and the power supply device 4 obtain power does not matter.

[0032] FIG. 2 is a block diagram showing an example of the configuration of the on-board control device 2 according to the present invention together with related devices. The on-board control device 2 includes a fail-safe CPU (FS-CPU) 11, a nonvolatile memory A14 of the A system, and a nonvolatile memory B15 of the B system.

[0033] The fail-safe CPU (FS-CPU) 11 receives control information from the wayside equipment 5 via the wayside communication device 6 and the on-board communication device 3, and also receives train speed information and train track position information from the speed sensor 9 and the on-board terminal 8, and performs calculations based on this information. Here, the fail-safe CPU (FS-CPU) 11 has two CPUs inside: CPU-A12 for system A and CPU-B13 for system B, and a collating unit 16 that collates the calculation results of CPU-A12 for system A and CPU-B13 for system B.

[0034] The nonvolatile memory-A14 of the A system records information from the CPU-A12 of the A system, and the nonvolatile memory-B15 of the B system records information from the CPU-B13 of the B system.

[0035] The A-system CPU-A 12 and the B-system CPU-B 13 that make up the fail-safe CPU (FS-CPU) 11 operate on the same software. Therefore, basically, both CPUs execute the same calculation process using the same software with the same input, and the calculation results and output of each are the same values.

[0036] The calculation results and outputs are compared by a comparison unit 16 in the fail-safe CPU (FS-CPU) 11, and if the comparison results are identical, the processing is deemed to be normal and operation continues. On the other hand, if an anomaly causes a mismatch in the comparison results, the fail-safe CPU (FS-CPU) 11 detects the anomaly, outputs an anomaly detection signal to the outside, and also outputs a brake command to the brake control device 10 for the train 1.

[0037] Next, the control information recording process according to the present invention will be described. FIG. 3 is a flowchart showing an example of an operation mode (processing flow) related to the control information recording process according to the present invention.

[0038] The ground equipment 5 creates control information for the train 1 based on various control information received from the on-board control device 2 via the on-board communication device 3 and the ground communication device 6. In the following flowcharts, it is assumed that commands from the ground include control information accompanied by records.

[0039] In step S31, the on-board control device 2 receives the control information transmitted by the trackside device 5 via the trackside communication device 6 and the on-board communication device 3. The received control information is taken into the fail-safe CPU (FS-CPU) 11 (CPU-A12 of system A and CPU-B13 of system B), and each of the CPU-A12 of system A and CPU-B13 of system B executes processing based on the received control information.

[0040] In this recording process, the command from the ground includes control information for recording. Based on the control information received from the ground equipment, the CPU-A12 of the A system and the CPU-B13 of the B system in the fail-safe CPU (FS-CPU) 11 implemented in the on-board control device 2 each perform processing.

[0041] In step S32, the CPU-A12 of the A system and the CPU-B13 of the B system write control information to the nonvolatile memory-A14 of the A system and the nonvolatile memory-B15 of the B system connected thereto, respectively.

[0042] In step S33, the nonvolatile memory-A14 of the A system and the nonvolatile memory-B15 of the B system hold the data written by the CPU-A12 of the A system and the CPU-B13 of the B system. Here, the nonvolatile memory is assumed to be a flash ROM or the like, which does not lose data even when the power supply to the device is cut off and can read data in response to access from the CPU. For example, the nonvolatile memory is not limited to a flash ROM, but may be a hard disk or nonvolatile RAM.

[0043] In step S34, after the write process is completed, the CPU-A 12 of the A system and the CPU-B 13 of the B system each read out the recorded data.

[0044] In step S35, the collating unit 16 of the fail-safe CPU (FS-CPU) 11 collates the results obtained by the CPU-A 12 of the A system and the CPU-B 13 of the B system. If the result of the comparison shows a match, the read control information is compared with the control information received from the ground device 5 in step S36.

[0045] If the control information from the ground device 5 matches the read control information, the control state based on the control information is determined in step S37 and is reflected in subsequent control. If the control state is determined, the fail-safe CPU (FS-CPU) 11 reports the determination of the control state to the ground device 5 in step S38.

[0046] On the other hand, if the collation result in step S35 or step S36 is a mismatch, the collation unit 16 of the fail-safe CPU (FS-CPU) 11 detects an abnormality in step S39. If this abnormality is detected, the fail-safe CPU (FS-CPU) 11 outputs a brake command to the brake control device 10 to stop the train 1 in order to ensure the safety of the train 1. At this time, depending on the use of the control information and the impact on operations, the on-board control device 2 itself may be transitioned to a failure state.

[0047] In step S38, the fail-safe CPU (FS-CPU) 11 reports the status of the on-board control device 2 to the ground equipment 5. If the control status was determined in the previous step S37, the fail-safe CPU (FS-CPU) 11 notifies the ground equipment 5 that the control status has been determined. If an abnormality was detected in the previous step S39, the fail-safe CPU (FS-CPU) 11 notifies the ground equipment 5 of the detected abnormality.

[0048] As described above, when control information is received, it is written and recorded, then read, and after each system is verified, it is verified against the received control information, and if all match, the control state based on this control information is confirmed. This prevents unintended information from being recorded.

[0049] If an abnormality is detected in the read process of step S34, the process may be started again from the write process of step S32. However, if an abnormality is found in the read collation result even after the write process has been performed multiple times, it is considered that this is due to a hardware failure, and therefore it is desirable to treat this as an abnormality or failure of the on-board control device 2.

[0050] The operation mode (processing flow) related to the control information recording process described above is performed every time control information is received from the ground device 5 and reflected in the control state. As a result, even if the vehicle power supply is cut off at an unintended timing, the state at the time of power supply cut-off is retained as recorded information, preventing a situation in which intended data is not recorded when the power supply is cut off.

[0051] Next, the process of reading recorded information when the vehicle power is turned on will be described. FIG. 4 is a flowchart showing an example of an operation mode (processing flow) relating to a process for reading recorded information when the vehicle power supply is turned on according to the present invention.

[0052] After completing an operation, the train travels to the depot, where the power to the train is cut off until the next operation. At this time, the power to the equipment on board the train is also cut off. When the train is used for the next operation, the power to the train is turned on at the depot, and the power to the equipment on board the train is also turned on.

[0053] In step S51, the power supply for the train 1 is turned on again. In step S52, the fail-safe CPU (FS-CPU) 11 performs an initialization process.

[0054] In step S53, the CPU-A12 of the A system and the CPU-B13 of the B system in the fail-safe CPU (FS-CPU) 11 read out the control information recorded in the nonvolatile memory-A14 of the A system and the nonvolatile memory-B15 of the B system, respectively.

[0055] In step S54, the collating unit 16 of the fail-safe CPU (FS-CPU) 11 collates each of the read control information to check whether they match. If they match, in step S55 the fail-safe CPU (FS-CPU) 11 completes the reading, assuming that the control information has been read correctly. On the other hand, if they do not match, in step S58, the collating unit 16 of the fail-safe CPU (FS-CPU) 11 determines that an abnormality has been detected.

[0056] In step S56, after completing the reading of the control information in the previous step S55, the CPU-A 12 of the A system and the CPU-B 13 of the B system in the fail-safe CPU (FS-CPU) 11 erase the control information recorded in the nonvolatile memory-A 14 of the A system and the nonvolatile memory-B 15 of the B system, respectively. This erasure process is performed to prevent the recorded information from remaining abnormal and causing an abnormal state every time the system is started up.

[0057] In step S57, after erasing the control information in the previous step S56, CPU-A12 of the A system and CPU-B13 of the B system in the fail-safe CPU (FS-CPU) 11 use the control information read in step S55 to write it to nonvolatile memory-A14 of the A system and nonvolatile memory-B15 of the B system, respectively. This writing procedure is performed in the same manner as in the flowchart shown in Figure 3 (the control information read in the previous step S55 is used as the control information in step S31 in Figure 3), and when it is confirmed that the control information has been written correctly, the control state based on this control information is determined. This prevents the power from being cut off before the next update of control information occurs when the data obtained from the nonvolatile memory during the initialization process is confirmed, and prevents the data to be read out the next time the device is started up from being lost.

[0058] In step S59, after detecting an abnormality due to a mismatch, the CPU-A12 of the A system and the CPU-B13 of the B system in the fail-safe CPU (FS-CPU) 11 erase the control information recorded in the non-volatile memory-A14 of the A system and the non-volatile memory-B15 of the B system, respectively, as in step S56.

[0059] In the case where the control information recorded due to abnormality detection in this step S59 is erased, or in the case where the product has just been shipped, the information read from the nonvolatile memory (nonvolatile memory-A14 and nonvolatile memory-B15) corresponding to each of the CPUs of the A and B systems (CPU-A12 and CPU-B13) is in an unwritten (unrecorded) state, so the CPUs of the A and B systems treat it as if there is no recorded information.

[0060] Here, if the fail-safe CPU (FS-CPU) 11 recognizes that there is no recorded information, it regards the control state as the initial setting (default) state and carries out subsequent control. In this state, the comparison judgment in the previous step S54 matches the information that there is no recorded information, so there is no risk of detecting an abnormality.

[0061] Furthermore, if there is a record in either the A or B system CPU (CPU-A12 or CPU-B13) and there is no record in the other system, it will be treated as an anomaly detection due to a mismatch.In this case, the information recorded in the non-volatile memory will also be erased. In addition, when the on-board control device is in the initial setting (default) state, the on-board control device will perform the operation specified as the initial setting on the safe side.

[0062] As described above, the on-board control device 2 can continue to apply the control information and control status that it held when the power was turned off the next time the power is turned on without losing them. Also, if an abnormality is detected in the recording medium, the recorded information, or the reading process, the on-board control device 2 will implement control to keep the train 1 safe.

[0063] Next, a status report from the on-board control device to the trackside device will be described. When the control state is determined or when an abnormality is detected, the on-board control device 2 reports the state to the wayside device 5, as shown in the flowchart in Figure 3. The wayside device 5 monitors the control state of the on-board devices, and if the control state is as intended, it sends information related to operation to the on-board control device 2 and continues operation.

[0064] On the other hand, if the ground equipment 5 receives information from the on-board control device 2 indicating an abnormal state or information that differs from the state managed by the ground equipment 5, the ground equipment 5 will ensure the safety of the train 1 by issuing an emergency stop instruction to the on-board control device 2 depending on the situation of the train 1.

[0065] The condition for the records stored in the on-board control device 2 to be valid is that the position where the power to the train 1 was cut off and the position where the power was turned on again match. However, in the unlikely event that the train 1 moved when the power was cut off, the position of the train 1 can be reported to the wayside device 5, allowing the wayside device to detect an abnormality.

[0066] In addition, if any abnormality is detected, the driver will be notified, so that the driver can check the abnormality in the on-board control device 2 and, if necessary, contact the operations management department to ensure that operations continue.

[0067] Next, the recording state of the nonvolatile memory will be described. FIG. 5 is a diagram showing the transition of the recording state in the nonvolatile memory. The nonvolatile memories (A-system nonvolatile memory A14 and B-system nonvolatile memory B15) according to the present invention have states intended for recording by the functions described above. The nonvolatile memories (A-system nonvolatile memory A14 and B-system nonvolatile memory B15) connected to the A-system and B-system CPUs (CPU-A12 and CPU-B13), respectively, have the same configuration.

[0068] Here, a state in which data has been erased by the corresponding CPU, or a state in which data has been erased but no writing has been performed by the CPU, is considered to be an "unwritten state," as shown in the left block of Figure 5. On the other hand, the state in which the corresponding CPU has written data is referred to as a "written state," as shown in the right block of FIG.

[0069] The above-mentioned two recording states are changed by the data processing by the CPU shown in FIG. When the power is cut off and the data written in the recording area needs to be read, the CPUs of the A and B systems each read from the corresponding nonvolatile memory, and if the data has already been written, read it as recorded data.

[0070] However, depending on the type of nonvolatile memory, once data has been written, it may not be possible to overwrite the same area. In this case, the data must be erased before writing can be performed.

[0071] In addition, since nonvolatile memories generally have multiple recording areas, the recording area may be divided into multiple areas depending on the amount of information to be recorded. Even when the same information is handled, the recording area may be switched depending on the timing of writing.

[0072] Furthermore, in order to detect errors in the recorded data, in addition to the control information, an error detection code such as a CRC (Cyclic Redundancy Check) may be added to the recorded information. Also, multiple recording areas may be provided, and one piece of information to be recorded may be recorded in multiple areas. In this case, the data in one of the recording areas may be bit-inverted.

[0073] According to the above-described embodiment, the present invention includes at least the following aspects. <Aspect 1> An on-board control device mounted on a train includes a fail-safe CPU having a first CPU and a second CPU that perform the same arithmetic processing on input information, a first non-volatile memory corresponding to the first CPU, and a second non-volatile memory corresponding to the second CPU, wherein the first and second CPUs each receive control information transmitted from a ground-side device as input information, write and record the control information in the corresponding first and second non-volatile memories, and execute a process of reading the recorded control information from the corresponding first and second non-volatile memories, and the fail-safe CPU compares the control information read by the first and second CPUs, and if the first comparison result is a match, compares the control information with the control information transmitted from the ground-side device, and if the second comparison result is a match, executes a process of determining a control state based on the matched control information.

[0074] <Aspect 2> In the on-board control device described in the above aspect 1, if the first result and the second result do not match, the fail-safe CPU detects this as an abnormality in the on-board control device and outputs a brake command.

[0075] <Aspect 3> In the on-board control device according to the second aspect, the fail-safe CPU notifies the wayside device that the control state has been determined or that there is an abnormality.

[0076] <Aspect 4> In an on-board control device described in any one of the above-mentioned aspects 1 to 3, when the on-board control device is powered on, the first and second CPUs each read out control information recorded in the corresponding first and second non-volatile memories, the fail-safe CPU compares the control information read out by the first and second CPUs, and if the third comparison results in a match, the read out control information replaces the control information transmitted from the ground device and becomes input information for the first and second CPUs, each of the first and second CPUs executes the read processing described in the above-mentioned aspect 1, and the fail-safe CPU executes the processing for determining the control state described in the above-mentioned aspect 1.

[0077] <Aspect 5> In the on-board control device described in aspect 4 above, whether the third result is a match or not, the first and second CPUs each erase the control information recorded in the first and second non-volatile memories, respectively, after determining the third result.

[0078] <Aspect 6> In the on-board control device described in the above-mentioned aspect 4 or aspect 5, the fail-safe CPU considers the control state to be the initial setting state when the information read from the corresponding first and second non-volatile memories by the first and second CPUs, respectively, is not yet written.

[0079] <Aspect 7> In an on-board control device according to any one of aspects 4 to 6, the fail-safe CPU detects an abnormality in the on-board control device if any of the first result, the second result, or the third result does not match.

[0080] <Aspect 8> In the on-board control device according to any one of the first to seventh aspects, an error detection code is added to the control information.

[0081] <Aspect 9> In the on-board control device according to the seventh aspect, the fail-safe CPU notifies the wayside device that the control state has been determined or that there is an abnormality.

[0082] <Aspect 10> A train control method using a fail-safe CPU having a first CPU and a second CPU that perform the same arithmetic processing on input information, wherein the first and second CPUs each write and record the input control information into a first and a second non-volatile memory corresponding to the first and second CPUs, respectively, and execute a process of reading the recorded control information from the corresponding first and second non-volatile memory, and the fail-safe CPU compares the recorded control information read by the first and second CPUs, respectively, and if the first comparison result is a match, compares the control information with the input control information, and if the second comparison result is a match, executes a process of determining a control state based on the matched control information.

[0083] <Aspect 11> In the train control method described in aspect 10 above, if the first result or the second result does not match, the fail-safe CPU detects this as an abnormality in the on-board control device and outputs a brake command.

[0084] <Aspect 12> In the train control method described in the above-mentioned aspect 10 or aspect 11, when the power supply for driving the fail-safe CPU is turned on, the first and second CPUs each read out the control information recorded in the corresponding first and second non-volatile memories, the fail-safe CPU compares the control information read out by the first and second CPUs, and if the third comparison results in a match, the read out control information replaces the input control information and becomes the input information for the first and second CPUs, and the first and second CPUs each execute the read out process described in the above-mentioned aspect 10, and the fail-safe CPU executes the process for determining the control state described in the above-mentioned aspect 10.

[0085] <Aspect 13> In the train control method described in aspect 12 above, whether the third result is a match or not, the first and second CPUs each erase the control information recorded in the first and second non-volatile memories, respectively, after determining the third result.

[0086] <Aspect 14> In the train control method described in the above-mentioned aspect 12 or aspect 13, if the information read from the corresponding first and second non-volatile memories by the first and second CPUs is not yet written, the fail-safe CPU regards the control state as the initial setting state.

[0087] <Aspect 15> In a train control method described in any one of the above aspects 12 to 14, the fail-safe CPU detects an abnormality if any of the first result, the second result, or the third result does not match.

[0088] Although the embodiments have been described above as modes for carrying out the present invention, the present invention is not limited to the above-described embodiments, and various modifications are possible within the scope of the gist of the present invention. [Explanation of symbols]

[0089] 1 Train, 2 On-board control device, 3 On-board communication device, 4 Power supply device, 5 Ground device, 6 ground communication device, 7 ground coil, 8 on-board coil, 9 speed sensor, 10 brake control device, 11 fail-safe CPU (FS-CPU), 12 CPU-A, 13 CPU-B, 14 Non-volatile memory-A, 15 Non-volatile memory-B, 16 Verification unit

Claims

1. An on-board control device mounted on a train, a fail-safe CPU having a first CPU and a second CPU that perform the same arithmetic processing on input information; a first nonvolatile memory corresponding to the first CPU; a second nonvolatile memory corresponding to the second CPU; Equipped with each of the first and second CPUs receives control information transmitted from a ground device as input information, writes and records the control information in the corresponding first and second nonvolatile memories, and reads the recorded control information from the corresponding first and second nonvolatile memories; The fail-safe CPU compares the control information read by the first and second CPUs, and if the first comparison result shows a match, compares the control information with the control information transmitted from the ground device, and if the second comparison result shows a match, executes a process of determining a control state based on the matched control information. An on-board control device characterized by:

2. The on-board control device according to claim 1, When the first result and the second result do not match, the fail-safe CPU detects this as an abnormality in the on-board control device and outputs a brake command. An on-board control device characterized by:

3. The on-board control device according to claim 2, The fail-safe CPU notifies the ground-side device of the determination of the control state or the abnormality. An on-board control device characterized by:

4. The on-board control device according to claim 1, When the on-board control device is powered on, each of the first and second CPUs reads the control information recorded in the corresponding first and second nonvolatile memories, the fail-safe CPU compares the control information read by each of the first and second CPUs, and if the third comparison results in a match, replaces the read control information with the control information transmitted from the ground device and sets it as the input information of each of the first and second CPUs; The first and second CPUs each execute the read process described in claim 1, and the fail-safe CPU executes the process of determining the control state described in claim 1. An on-board control device characterized by:

5. The on-board control device according to claim 4, Whether the third result is a match or not, the first and second CPUs erase the control information recorded in the first and second nonvolatile memories, respectively, after determining the third result. An on-board control device characterized by:

6. The on-board control device according to claim 4, The fail-safe CPU regards the control state as an initial setting state when the information read from the first and second nonvolatile memories corresponding to the first and second CPUs is not written. An on-board control device characterized by:

7. The on-board control device according to any one of claims 4 to 6, The fail-safe CPU detects a mismatch between the first result, the second result, and the third result as an abnormality in the on-board control device. An on-board control device characterized by:

8. The on-board control device according to any one of claims 1 to 6, An error detection code is added to the control information. An on-board control device characterized by:

9. The on-board control device according to claim 7, The fail-safe CPU notifies the ground-side device of the determination of the control state or the abnormality. An on-board control device characterized by:

10. A train control method, comprising: A fail-safe CPU having a first CPU and a second CPU that perform the same arithmetic processing on input information is used, each of the first and second CPUs writes and records the input control information in a first and second nonvolatile memory corresponding to the first and second CPUs, respectively, and executes a process of reading the recorded control information from the corresponding first and second nonvolatile memory, respectively; The fail-safe CPU compares the recorded control information read by the first and second CPUs, and if the first comparison result is a match, compares the control information with the input control information, and if the second comparison result is a match, executes a process of determining a control state based on the matched control information. A train control method characterized by:

11. The train control method according to claim 10, When the first result and the second result do not match, the fail-safe CPU detects this as an abnormality and outputs a brake command. A train control method characterized by:

12. The train control method according to claim 10, When the power supply for driving the fail-safe CPU is turned on, each of the first and second CPUs reads the control information recorded in the corresponding first and second nonvolatile memories, the fail-safe CPU compares the control information read by each of the first and second CPUs, and if the third comparison result is a match, replaces the read control information with the input control information and sets it as the input information of each of the first and second CPUs; The first and second CPUs each execute a read process as set forth in claim 10, and the fail-safe CPU executes a process for determining a control state as set forth in claim 10. A train control method characterized by:

13. The train control method according to claim 12, Whether the third result is a match or not, the first and second CPUs erase the control information recorded in the first and second nonvolatile memories, respectively, after determining the third result. A train control method characterized by:

14. The train control method according to claim 12, The fail-safe CPU regards the control state as an initial setting state when the information read from the first and second nonvolatile memories corresponding to the first and second CPUs is not written. A train control method characterized by:

15. A train control method according to any one of claims 12 to 14, The fail-safe CPU detects an abnormality when any of the first result, the second result, and the third result does not match. A train control method characterized by:

Images