Reliability Analysis And Implementation Of Fully Automatic Operation System On-board Equipment

FAO system is a train operation control system which can use the automated control system to fully replace the train driver’s task. In the FAO system, the drivers and train crews are no longer arranged and the train will be completely driven by ATO equipment. ATO equipment’s failure will lead to serious consequences to the train, thus the reliability of the ATO equipment is highly required.In order to meet the demand for high reliability of ATO, a dynamic fault tree method is used to research the reliability of different on-board equipment structure. Then, the paper finished the hardware design and software design based on the RM48micro controller unit. At last, a testing platform is built to test switching-performance of ATO, verifying the reasonability of switching-mechanism. The specific research contents of the paper are as follows.(1) The reliability analysis of FAO on-board equipment. Considering the current research status of FAO system and its on-board equipment, the paper firstly analyze the principle structure and fault switching mechanism of FAO on-board equipment, and then adopt the dynamic fault tree method to compare and analyze the reliability of on-board equipment which adopting hot standby redundancy ATO combined with different structure of ATP. The results show that the on-board equipment employed by head/tail structure of VOBC,2out of3structure of ATP and hot standby redundancy ATO can meet the high reliability requirement and more economic.(2)The hardware design of hot standby redundancy ATO. RM48chip is the first safety microcontroller unit which adopts dual-core floating-point lock-step based on ARM Cortex-R4F. The chip can use its own hardware architecture to achieve online diagnostic functions to monitor the internal failures, which can maximize the performan ce and reduce software overhead. The RM48chip pass the SIL3safety standard certification. A hot standby redundancy ATO is designed based RM48chip. Different with other hot standby solutions, this design can monitor the working status of RM48microcotroller in real-time, and also the status of CAN communication(3) The software design of hot standby redundancy ATO. The software design is important to ensure switching between master and slave machine as well as the data synchronization. This paper manages to judge the working condition of processing units A and B by detecting he CAN bus message ID, at the same time, use the task synchronization to ensure the smooth handover process.(4)Building ATO testing-platform and testing the switching-performance of ATO. ATO can monitor the working status of RM48microprocessor in real-time, along with CAN communication. Under the help of ATO testing-platform, the paper verify the switching performance caused by microcontroller and CAN communication failure by the method of hardware fault injection.The studies above show that the reliability indicator MTBF of VOBC employing hot standby redundancy ATO is higher than105hours, reaching the reliability index MTBF>2.5×105of VOBC used in Beijing airport FAO line.At the same time, the switching-tests have verified that the ATO can achieve seamless switching, and the switching-time is less than ATO duty cycle (200ms),meeting the design requirements.