JPS607441B2 - Failure detection method for vehicle control equipment - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a vehicle control device, and particularly to a failure detection method thereof.

As a vehicle control device, for example, an automatic train stopping device (AT
S) and automatic train operation equipment (ATO).

These devices (ATS, ATO) detect, for example, a point marker provided on the ground on the vehicle, and perform predetermined control based on this point signal.

These devices are designed to ensure the safety of vehicles.
Since high reliability is required, means are generally provided to detect self-failure.

However, if there is a failure in this failure detection means itself, there is a problem in that even if the failure detection means is provided, it is not possible to accurately detect whether or not the device (ATS, ATO) is normal.

An object of the present invention is to provide a fault detection method for detecting a fault in the fault detection means itself.

A feature of the present invention is that each time a point signal is received, a digital signal indicating that the vehicle control device is in a failure state is given to the failure detection means, and the failure is detected depending on whether or not the failure detection means normally detects the failure. The present invention is adapted to detect whether or not the detection means is out of order. FIG. 1 is a diagram showing an example of a vehicle control device equipped with failure detection means, which is a premise of the present invention.

In this figure, 1 is a ground sign, 2 is an onboard device, 3 is a point receiver, 4 is a point signal, 5 is a vehicle control device that performs digital calculations, 51 is a control logic circuit, 52 is a failure detection circuit, 59 is a digital signal for fault detection.

6 is a control output signal, which is a command that the control logic circuit 51 performs a predetermined calculation based on the reception of the point signal 4 and gives to the vehicle equipment.

Reference numeral 7 denotes a failure detection output signal which, when the failure detection circuit 52 detects a failure in the control logic circuit 51, issues a command for, for example, emergency braking.

In this configuration, if there is a failure in the failure detection circuit 52 itself, it is not possible to accurately detect the failure.

For this reason, high performance cannot be expected from the failure detection output signal 7. FIG. 2 is a diagram showing an embodiment of a failure detection method for a vehicle control device according to the present invention.

It has the configuration shown in this figure, and when the above-mentioned failure detection circuit 52 is referred to as a first failure detection means, a second failure detection means for detecting a failure of this first failure detection means is added. There is.

The second failure detection means includes a memory 53, an OR circuit 54,
It consists of a time element circuit 55, and 58 is a fault condition generation command. In the above configuration, when the point signal 4 occurs, the control logic circuit 51 controls the control output signal 6. Meanwhile, memory 53 is set, and the output of memory 53 causes control logic circuit 51 to be placed in a faulty state. If the fault detection circuit 52 is normal at that time, it can be detected from the digital signal 56 that the control logic circuit 51 is faulty.
The output is output and resets the memory 53. When reset, the control logic circuit 51 returns to its normal state, so the output of the failure detection circuit 52 also disappears. If the time element circuit 55 is set so that it does not output for a period slightly longer than the time set in the memory when everything is normal, the failure detection output signal will not be generated and the original control of the vehicle will be maintained. There is no problem. The control logic circuit 51 also includes a memory 5
3 is set, the failure state is forced, so it is necessary to take care not to adversely affect the control output signal 6 at this time.

Although this depends on the configuration of the control logic circuit 51, it is sufficient to simply provide a circuit similar to the time element circuit 55.Next, a case where there is a failure in the control logic circuit 51' will be explained.

If there is a failure in the control logic circuit 51, the failure detection circuit 52 continues to detect the failure regardless of the state of the memory 53, so the failure detection output signal 7 is generated and the failure can be detected.
Also, a case where there is a failure in the failure detection circuit 52 will be explained.

When the memory 53 is set, ``The control logic circuit 51 goes into a failure state, but the failure detection circuit 52 cannot detect it properly.The failure detection circuit 52 does not output any output.For this reason, the memory 53 is not set.'' As a result, the failure detection output signal 7 is generated, and a failure can be detected.As described above, according to this embodiment, when the point signal 4 is generated, the control command generation means 51 generates the digital signal 59 as if there is a failure. is applied to the first failure detection means 52, and this first
By providing second failure detection means 53, 54, and 55 that determine whether or not the failure detection means 52 of the first failure detection means 52 is operating normally, not only failure of the control command generation means 51 but also failure of the first failure detection means 52 can be prevented. It can also detect failures.

In addition, since it is determined whether there is a failure in the mill that receives the point signal, it is highly reliable because it can be checked whether the circuit is normal or not whenever control is required. It is a figure which shows another Example of this invention.

This example is the same as the example shown in Figure 2, but shows a case where there are multiple types of point signals (in the figure, there are three types: 4a, 4b, and 4c). 56 is an OR circuit. .

All other operations are the same. FIG. 4 is a diagram showing another embodiment of the present invention.

In this example, the failure detection circuit 52 performs a parity check, and the failure detection circuit 52 performs a parity check from the control logic circuit 51.
A case is shown in which the signals 59 to 1 are n digital signals 59a to 59n. 57 is an exclusive OR circuit, which is provided only for the signal 59a in the figure.

A fault condition generation command 58 is then given to this exclusive OR circuit 57. Therefore, when the memory 53 is set, a parity error occurs and the failure detection circuit 52
If it is normal, it should be detected, so the failure state of the failure detection circuit 52 can be determined. In this example, the exclusive OR circuit 57 is provided only for one signal 59a, but since it is important to generate a parity error, it may be provided not only for the signal 59a but also for an odd number of signals. In this example, when the memory 53 is set, only the signal going to the failure detection circuit 52 is changed, and unlike the other examples described above, the original operation of the control logic circuit 51 is not affected. The above is parity.

Although an example of failure detection by checking has been described, in accordance with the present invention,
Needless to say, any digital fault detection means such as the well-known CRC (Cyclic Redundancy Code) checksum check or watch dog timer can be applied. FIG. 5 is a diagram showing another embodiment of the present invention. In the example shown in this figure, the point signal 4 is applied to the control logic circuit 51 via the memory 53. The output of the memory 53 is used to temporarily put the control logic circuit 51 into a faulty state and to generate the signal 6 originally required for vehicle control. Other than that, the failure detection operation and the like are the same as in the previous embodiment, so the explanation thereof will be omitted. In this embodiment, the point signal 4 is stored in the memory 5.
3 to the control logic circuit 51, a temporally stable signal can be obtained. FIG. 6 is a diagram showing another embodiment of the present invention.

In this example, the memory 53 is stored in a box 3 containing the point receiver 3.
It is located within 1. Further, a time element circuit 55a similar to the time element circuit 55 is provided. The functions and effects of this embodiment are almost the same as those of the embodiment shown in FIG.

However, in the case of this embodiment, when the point signal cannot be transmitted to the control logic circuit 51 due to a disconnection or the like, the memory 53 remains set, so the failure detection output signal 7a is output and failure detection is performed. Therefore, it is possible to confirm whether or not signals are exchanged normally between the point receiver 3 and the control logic circuit 51, which are generally housed in a separate box. As described above, according to the present invention, it is possible to provide a failure detection method for a vehicle control device that can also detect a failure of the failure detection means itself.

[Brief explanation of the drawing]

FIG. 1 is a diagram for explaining the technology that is the premise of the present invention,
FIG. 2 is a diagram showing one embodiment of a failure detection system for a vehicle control device according to the present invention, and FIGS. 3 to 6 are diagrams showing other embodiments of the present invention, respectively. Explanation of symbols, 1... Point sign, 2...
Onboard child, 3...point receiver, 4...point signal,
5...Vehicle control device, 51...Control logic circuit, 52...Failure detection circuit, 53...Memory, 54...OR circuit, 55...Time Elementary circuit. younger brother l
Figure 2 Figure 3 Figure 4 Figure 5 Little brother diagram

Claims (1)

[Scope of Claims] 1. A point marker provided on the ground side, a point signal generating means for detecting the point marker on the top of the vehicle and generating a point signal, and performing a predetermined digital calculation upon receiving the point signal. In a vehicle control device comprising a control command generation means for giving a control command to vehicle equipment, and a first failure detection means for detecting a failure of the control command generation means, when the point signal is generated, the control command generation means gives a digital signal as if there is a failure to the first failure detection means,
A failure detection method for a vehicle control device, characterized in that a second failure detection means is provided for determining whether or not the first failure detection means operates normally. 2. A failure detection method for a vehicle control device according to claim 1, wherein the second failure detection means forcibly brings the control command generation means into a failure state. 3. A failure of a vehicle control device according to claim 1, wherein the second failure detection means changes only the digital signal provided from the control command generation means to the first failure detection means. Detection method.