Dataflow analysis of vehicle safety computers regarding high-speed maglev transportation based on data priorities

Full Text

INTRODUCTION

Vehicle safety computers (VSCs) are the onboard part of the operation control system (OCS) regarding high-speed maglev and responsible for control and safety protection for maglev trains. They are always located at two sides of maglev trains. Relative to the traditional railway signal systems, they are same as ATP (Auto Train Protection).  For ATP, the software safety integrity level (SIL) of ATP function is SIL-4 [1]. In a word, vehicle safety computers are safety critical software systems, always based on embedded hardware system, and their requirement of real-time and safety are very high.

Due to the complexity of software systems and especially the importance of non-functional requirements including performance, security, or compliance with law increases, to ensure quality properties is hard and often shifted to the operations phase. Fixing issues found in this phase is, however, costly. The data flow analysis enables early detection of requirement violations regarding privacy laws, external service providers, and throughput requirements on the architectural level [2].

With regard to the data flow analysis of vehicle safety computers, three papers are related to this, all written by myself. In [3], the information flow is analyzed and the software architecture is designed for the vehicle control system (VCS). In [4], the information flow analyzed for the OCS. In [5], the information flow is analyzed for the forced stop management of the OCS. However, all these papers are omitted one important point that various data has various priority. To improve the accuracy of dataflow analysis for vehicle safety computers, integrating the data priority is necessary.

How to improve the accuracy of dataflow analysis, some approaches are presented by means of data priorities. In [6], the accuracy improvement of dataflow analysis for cyclic stream processing applications scheduled by static priority preemptive schedulers is presented. In [7], the temporal analysis of static priority preemptive scheduled cyclic streaming applications using CSDF models is introduced. It is worth mentioning that both papers are concerned with big data.

What are executed on vehicle safety computers are consist of dataflow processing applications which regularly contain cyclic data dependencies due to the presence of feedback loops and bounded FIFO buffers. In order to analyze the dataflow of vehicle safety computers with high accuracy improvement, it is considerable to add data priorities to the dataflow model of vehicle safety computers. Therefore, this paper presents the dataflow model with data priorities for vehicle safety computers.

INTERFACE ANALYSIS OF VEHICLE SAFETY COMPUTERS

For each of maglev trains, there are two vehicle safety computers in it. One is vehicle safety computer No.1 (VSC1), and the other is vehicle safety computer No.2 (VSC2). Both vehicle safety computers locate at two ends of a maglev train, i.e. driver’s cabs. Once VSC1 loses the control to a maglev train, VSC2 can make a safety stop of the train. In others word, VSC2 is a standby of VSC1. They are slightly different in functionalities and interfaces. To simplify the dataflow for vehicle safety computers, we only choose VSC1 to analyze the interfaces and data priorities.

VSC1 has physical interfaces to vehicle electrical facilities, which are Locating Unit, Onboard Controller, Driver Console, Forced Stop Button and Braking Unit. By means of Locating Unit, VSC1 can get locating data of a maglev train, such as position, speed and direction. By means of Onboard Controller, VSC1 can control vehicle’s doors, suspension, etc., and get their feedback. By means of Driver Console, VSC1 can receive a driver’ instructions. By means of Forced Stop Button, VSC1 can get a forced stop signal once a driver push the button. By means of Braking Unit, VSC1 can active eddy-current braking unit when the speed profile is infringed.

VSC1 also has physical interface to the Radio System, which fulfill logical interface to decentralized safety computers (DSC). Fig. 1 shows the interfaces of VSC1.

Fig. 1. The interfaces of VSC1

 

DATA PRIORITY ANALYSIS OF VSC1

During the processing cycle of VSC1, various data coming from different data sources may happens at the same time. Because the importance of data is different, VSC1 should distinguish the data priority so that it can process the most important data first.

Table 1 gives the complete analysis of data priorities for VSC1.

 

 Table 1. Data Priorities Analysis of VSC1

Interface Object	Interactive Data	Data	Interface Object
Braking Unit	signal of braking level	VSC1 Braking Unit	VSC1 outputs corresponding braking force level according to the scale of over-speed. Before VSC1 executes a brake, VSC1 needs send a propulsion shutoff request to the interactive DSC. The processing priority is P1.
Locating Unit	location data	Locating UnitàVSC1	After receiving the location data VSC1 generates safety location data. If VSC1 detects that the speed profile is violated for the current stopping point, VSC1 sends a request of propulsion shutoff to the interactive DSC, and then sends a brake signal to the Braking Unit. VSC1 also sends the safety location data to the interactive DSC in order to perform under-speed protection. The processing priority is P2.
Forced Stop Button	forced stop signal	FSàVSC1	After receives a forced stop signal, VSC1 performs a forced stop by prohibiting stopping point stepping, and the train will stopped at the current stopping point. The processing priority is P3.
Onboard Controller	vehicle status	OBCàVSC1	VSC1 detects whether a forced stop signal occurs which is generated by Onboard Controller. If so, VSC1 implements a forced stop by prohibiting stop point stepping, and the maglev train will stop at the current stop point or a service station. VSC1 also sends the vehicle status data the interactive DSC. The processing priority is P4
	vehicle control signals	VSC1àOBC	By sending vehicle control signals to OBC, VSC1 control the suspension, doors, etc. The processing priority is P5.
DSC	stopping point stepping request	VSC1àDSC	VSC1 initiates stopping point stepping to the interactive DSC to fulfill continuous operation. The processing priority is P6.
	line data	DSCàVSC1	VSC1 receives line data from the interactive DSC to generate speed profiles for the following stopping points. The processing priority is P6.
	instructions and status from DSC	DSCàVSC1	DSC manages and controls VSC1 by sending instructions and status data. VSC1 also sends the status data o Driver Console for display. The processing priority is P7.
	requests and vehicle status	VSC1àDSC	VSC1 sends requests and vehicle status to DSC for collaboration and sharing. The processing priority is P7.
Driver Console	operation status	VSC1àDC	VSC1 Sends the operation status to DC for display. The processing priority is P8.
	driver’s instructions	DCàVSC1	VSC1 transparently forwards driver’s instructions to DSC for train control in driver mode. The processing priority is P8.

 

DATAFLOW ANALYSIS OF VSC1 WITH DATA PRIORITY

VSC1 has three main function modules:

1. The Safety Locating module: It receives location data from Locating Unit and generates safety location data. In the meantime, it maintains a storage area to store the safety location data, such as speed, positon and direction of a maglev train. Moreover, it distributes the safety location data to the Vehicle Protection module, the Speed Profile Monitoring module, and DSC.
2. The Vehicle Protection module: It receives control instructions (such as opening doors, levitating the maglev, etc.) from DSC and send corresponding signals to Onboard Controller. Meanwhile it receives feedback from Onboard Controller and detects whether any forced stop signal occurs. In addition, it receives the forced stop signal from Forced Stop Button. Once a stop signal is detected, it sends an instruction that prohibits stopping point stepping to the Speed Profile Monitoring module. It receives driver instruction from Driver Console and transparently transmits to DSC. In the meantime, it maintains a storage area to store the vehicle status data, like status of doors, suspension of a maglev train. Moreover, it distributes the vehicle status data to the Speed Profile Monitoring module and DSC.
3. The Speed Profile Monitoring module: It is the core module of VSC1 and depends on three kind of data: safety location data from the Safety Locating module, vehicle data from the Vehicle Protection module, and line data from DSC. In the meantime, it maintains a storage area to store the operation data. It is responsible for monitoring the speed profile according to the current stopping point. When the speed profile is infringed, it actives eddy-current braking after sending a request to DSC to perform a propulsion shutoff.

 

According to the function modules and data priority analysis of VSC1, we present the dataflow model with data priorities as Fig. 2.

Fig. 2. The dataflow of VSC1 with data priorities

 

CONCLUSION

Vehicle safety computers are safety critical systems and the safety integrity level are same as ATP.  If the data priority is omitted, the dataflow model for vehicle safety computers will be less accurate.

To simplify the problem for vehicle safety computers, we choose VSC1 as a representative for vehicle safety computers to analyze.

The interfaces to VSC1 include Locating Unit, Onboard Controller, Driver Console, Forced Stop Button, Braking Unit and DSC.

The various data from different interactive sources include signal of braking level, location data, forced stop signal, vehicle status, vehicle control signals, stopping point stepping request, line data, instructions and status from DSC, requests and vehicle status from VSC1, operation status and driver’s instructions. Their processing priorities are assigned from P1 to P8 according to the importance analysis.

VSC1 has three main function modules: The Safety Locating module, The Vehicle Protection module and The Speed Profile Monitoring module. The three function modules of VSC1 have their dataflow and storage area respectively. According to the analysis of data priority and data process, the data flow model of VSC1 is established.

ACKNOWLEDGEMENTS

This work is supported by the National Key R&D Program of the 13^th Five-year Plan, Research on Simulation Verification and Design Optimization of Key Technologies for High Speed Maglev Transportation System (No. 2016YFB1200602-02). This work is also supported by Fund of Shanghai Cooperative Innovation Center for Maglev and Rail Transit.

About the authors

Yijun Chen

Tongji University

Author for correspondence.
Email: chenyijun@tongji.edu.cn
ORCID iD: 0000-0001-8665-4619

master, senior engineer

China, 4800 Caoan Road, Shanghai

Yi Yu

Tongji University

Email: 12164@tongji.edu.cn
ORCID iD: 0000-0002-5763-4931

doctor, professor

China, 4800 Caoan Road, Shanghai

Huahua Zhao

Tongji University

Email: 12126@tongji.edu.cn
ORCID iD: 0000-0002-1210-3782

master, engineer

China, 4800 Caoan Road, Shanghai

Fangqi Zhang

Tongji University

Email: 12176@tongji.edu.cn
ORCID iD: 0000-0002-6994-1074

master, engineer

China, 4800 Caoan Road, Shanghai

Hui Lin

Tongji University

Email: 12124@tongji.edu.cn
ORCID iD: 0000-0003-3945-1370

bachelor, engineer

China, 4800 Caoan Road, Shanghai

Wei Nai

2 Tongji Zhejiang College

Email: alexni@tongji.edu.cn
ORCID iD: 0000-0002-4656-7040

doctor, lecturer

China, Jiaxing

References

Supplementary files