JP2012174221A - Control device, communication control device, train control device and train control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize a fail-safe device which enables a communication circuit to be surely disconnected from a line with a simple configuration when detecting a failure of a control device.SOLUTION: The present invention uses a failure detection signal output from a failure detection circuit of a fail-safe calculation section as a baud rate generation clock for a communication circuit. The invention is configured to separate a device from a line when detecting the failure of the calculation section in a manner that stops an operation of a communication circuit by stopping the failure detection signal so as to prevent a communication destination device as well as a system from being affected by an erroneous output.

Description

  The present invention relates to a fail safe function, a control device, a control system, and the like configured to be able to stop safely even when a so-called device, device, system, or the like malfunctions and falls into an abnormal state. In particular, a control having a fail-safe arithmetic unit suitable for a train security system, and having a function of detecting when a fault or failure occurs in the arithmetic unit and reporting the fault detection to other devices, for example The present invention relates to a device, a train control device, and a train control system.

  In systems that require high reliability, such as railway security systems, for example, runaway or erroneous output through a communication circuit due to a failure of a train control device (control unit) related to railway security is the same line regardless of whether it is wired or wireless. It is necessary not to affect the devices and systems connected to the.

  For example, in the signal security system in the mobile block system shown in Patent Document 1, the ground equipment controls each train based on the train position information (report information) sent from each train by radio. A train control device is provided.

  However, if the on-board train controller related to security installed on the train on the car breaks down and the on-vehicle train controller reports incorrect train position information to the ground equipment side, the ground equipment side will change the train position. Misrecognize. And the ground equipment side will perform train control with misrecognition, and a problem arises in safety.

  Therefore, in order to solve the safety problem, when the train control device on the vehicle fails, a mechanism for disconnecting the train control device from the communication line is required. In addition, in order to realize this mechanism, the failure of the train control device (control unit) on the vehicle has been reliably detected, and the failure has occurred in the train control device on the ground equipment side through the communication circuit, wireless communication device, etc. Need to be notified.

  As a method of monitoring the state of the train control device on this vehicle, such as a failure or failure, and notifying other devices such as ground facilities of this state, an alternating signal is used as a control output in a control system with a long control cycle such as in the railway field. A method using an AC signal is used.

  For example, a method as shown in FIG. 6 has been proposed. That is, as shown in FIG. 6, a fail safe including an input 14 (control information such as train speed) and a control calculation unit 10 that executes a desired control calculation and a failure detection circuit 11 that detects a failure of the control calculation unit. The output data 16 of the arithmetic unit 1 and the failure detection circuit 11 is received, and the output information of the control circuit 20 for executing the desired control and the control circuit, that is, the failure information is sent to the radio equipment 5 (wireless communication device) on the ground equipment side. It is a fail-safe control apparatus and train control apparatus provided with the communication control part 2 containing the communication circuit 21 which communicates.

  The fail-safe operation unit 1 (fail-safe controller) including the failure detection circuit 11 performs a failure detection process on the control operation unit 10 and outputs a failure detection signal 15 that is an alternating signal or a fixed value signal to the control circuit 20. Output. Such a configuration is known from Patent Documents 2 and 3, for example. For example, Patent Document 4 discloses a method for monitoring the state of a control device and a communication circuit and disconnecting the communication circuit when a failure is detected.

  As shown in FIG. 7, the control calculation unit 10 of the fail-safe control unit or the fail-safe calculation unit 1 of the train control unit includes two CPUs 101 and 102 for the purpose of improving safety, and has a duplex configuration.

  The failure detection circuit 11 detects whether or not there is a failure in the CPUs 101 and 102 of the control calculation unit 10 and outputs the detection processing result to the communication circuit 21 of the communication control unit 2 as communication data 16. Further, when a failure occurs in the CPUs 101 and 102, a failure signal 15 is output and transmitted to the control circuit 20 of the communication control unit 2.

  In the communication control unit 2, the communication circuit 21 generates a baud rate based on the frequency 31 of the clock signal output from the clock generation circuit 30, and performs communication between the failsafe arithmetic unit 1 and an external device. The clock generation circuit 30 supplies the communication circuit 21 with a clock signal 33 necessary for the communication circuit 21 to generate a baud rate.

  The control circuit 20 receives the failure detection signal 15, and when the failure detection signal 15 indicates normality, the contact 22 on the communication line 23 is closed and the communication line 23 is maintained as shown in FIG. Communication. When the failure detection signal 15 indicates a failure, the contact 22 is opened as shown in FIG. 8, and the communication line 23 is physically disconnected. Communication of the communication data 16 is continued or interrupted by the contact opening / closing control.

  According to such a configuration, when a failure occurs in the fail safe arithmetic unit 1, it is possible to prevent malfunction due to transmission of erroneous communication data.

JP-A-2-109770 JP-A-7-295844 JP-A-7-183803 JP 2009-88880 A

  However, in the prior art, a contact 22 is provided at the output stage of the communication circuit 21, and the contact is physically controlled to open and close when a failure is detected. Accordingly, since the control circuit 20 for that purpose, the contact point, and the clock generation circuit 30 for driving the control circuit are required, there is a problem that the circuit configuration is complicated and the size is increased. In addition, when the control circuit 20 fails, the communication line 23 is not disconnected and erroneous communication data is transmitted.

  An object of the present invention is to provide a control device and a control system capable of controlling communication through a communication line with a simple configuration when a failure occurs in a control arithmetic unit or the like. Another object of the present invention is to provide a control device and a control system that can prevent transmission of erroneous communication data more reliably.

  In order to achieve the above object, in the present invention, for example, in a control device or control system including a failure detection unit that detects a failure of a control calculation unit and a communication control unit that communicates an output from the failure detection unit to another device. And a control signal generation means for receiving a failure detection signal from the failure detection unit and generating a control signal for controlling communication of the communication control unit from the signal.

  As the control signal generation means, for example, a frequency conversion means that receives a failure detection signal of the failure detection unit of the fail safe arithmetic unit and converts the frequency of the signal into a frequency that can be a clock necessary for communication of the communication circuit of the communication control unit. is there.

  According to the present invention, it is possible to eliminate the need for a control circuit and a contact for disconnecting a line, which have been conventionally required, and to reduce the size of the apparatus. Alternatively, transmission of erroneous communication data can be prevented more reliably.

FIG. 1 is a schematic configuration diagram of a mobile blocking signal security system showing an application example of the present invention. FIG. 2 is a configuration block diagram showing an embodiment of the train control device of the present invention. FIG. 3 is a block diagram for explaining the operation at the time of failure detection of the train control device of the present invention. FIG. 4 is a schematic block diagram showing an example in which a control device is arranged in the train of the present invention. FIG. 5 is a block diagram showing a configuration example of the transmission unit of the communication circuit of the present invention. FIG. 6 is a block diagram showing an example of a conventional configuration of a system that uses an alternating signal for control. FIG. 7 is a block diagram showing a configuration example of the prior art. FIG. 8 is a block diagram showing an operation example at the time of failure detection in the configuration example of the prior art of FIG.

Embodiments of the present invention will be described below with reference to the drawings.
First, a method when a failure occurs in the control device according to the present invention, a fail safe arithmetic unit, and a basic operation of disconnecting a communication line will be described.

  The failure detection circuit 11 of the fail safe calculation unit 1 takes in the state of the control calculation unit 10 as an input 12 and performs a failure detection process of the calculation unit 10. The failure detection circuit 11 converts the result of the failure detection process into an alternating signal or a fixed value signal with a constant period and outputs it as a failure detection signal 15.

  The communication control unit 2 drives the communication circuit 21 in a safe state when the input 15 (failure detection signal) from the failure detection circuit 11 is a signal indicating a failure, and performs an emergency stop or the like when the input is other than that. Do.

  According to the configuration of the prior art shown in FIGS. 6, 7, and 8 as a configuration for performing an emergency stop or the like by the input 15 (failure detection signal) from the failure detection circuit 11, the malfunction due to the communication data at the time of the failure is prevented. However, as described above, there are problems such as a complicated circuit configuration, an increase in size, and transmission of erroneous communication data.

  In order to correct such a problem, an embodiment of the present invention is provided with a means for generating a clock signal necessary for a communication circuit based on a failure detection signal, for example, a frequency conversion means, for example, in a train control device or a control system. It is a thing.

  Hereinafter, detailed embodiments of the present invention will be described with reference to FIGS. The following embodiment is a case where the present invention is applied to an automatic train control device ATC in a mobile block signal protection system using wireless communication. In addition, the same number is attached | subjected to the same part as the prior art shown in FIGS.

  First, referring to FIG. 1, an automatic train control device ATC in a mobile blockage type signal security system will be briefly described.

  The control unit 40 of the train security device calculates the position of the train on the basis of information such as the traveling speed 46 and wheel diameter of the own train and information received from the ground facility (wireless base 5) side, and based on the calculation. The location information 50 is communicated and reported to the ground wireless base 5 via the wireless device 42.

  Based on the position information 50 received from each train, the wireless base 5 wirelessly transmits control information 51 necessary for safely controlling the train, such as the target stop position of each train and the speed limit in that section. To send.

  Each train receives the control information 51 via the wireless device 42. When the wireless device 42 receives the control information 51, the control unit 40 calculates the speed limit pattern 45 based on the control information 51 and information stored in the own train such as deceleration performance.

  The calculated speed limit pattern 45 is compared with the traveling speed 46 of the train by the speed checking unit 41 and controlled so that the train can travel safely. Specifically, when the traveling speed 46 exceeds the speed limit, the brake command 43 is output (brake output), and the train stops in a state where the safety margin distance 52 with the preceding train is secured and collides. Control not to.

  In addition, when a malfunction of the apparatus is detected by the control unit 40 and the speed checking unit 41 that perform calculation and processing related to safety, there is no guarantee that safe control can be performed, so the brake command 43 is output in the same manner as described above. It has a structure.

As a device that the fail-safe arithmetic unit performs communication processing, communication between the on-board device and the ground device, or communication between the control unit and the wireless device in the on-board device is raised.
Hereinafter, in the present embodiment, the interface of the control unit in the on-board device to the wireless device will be described as an example. However, the present invention is not limited to the control unit in the on-board device. It is also applicable to the control unit.

  FIG. 4 is a schematic block diagram of the on-vehicle device, that is, the control unit 40 (train control device) in the train. Arithmetic processing in the control unit 40 is mainly performed by the fail-safe arithmetic unit 1. The fail safe calculation unit 1 takes in other input information 47 such as the current train speed 46, the operation of the driver, the state of other devices, and the like as the input 14 for information necessary for train control. In addition, information acquired through exchanges with other devices installed in the train, such as control information 51 received via the wireless device 42 and the communication control unit 2, is captured as communication data 16. On the basis of the captured information, the fail safe arithmetic unit 1 performs various arithmetic processes and failure detection. This arithmetic processing and failure detection may be realized by a well-known method.

  The results (communication data 16) of various arithmetic processes performed by the fail safe arithmetic unit 1 are transmitted to other devices and used for actual train control and system control. For example, as shown in FIG. 4, the speed limit pattern 45 generated by the failsafe computing unit 1 is transmitted to the speed checking unit 41, and compared with the current train speed 46 by the speed checking unit 41, if necessary. The train is controlled by performing a brake command output 43 or the like.

Moreover, when performing communication to the other device or the ground facility side, the fail safe calculation unit 1 performs transmission processing with the other device via the communication control unit 2 in the control unit.
FIG. 4 shows a communication interface to the wireless device 42 as an example. In the communication control unit 2, in addition to the communication data 16 generated by the fail-safe operation unit 1, the failure detection signal 44 is input as an input, and not only the communication data is transferred to other devices but also the line disconnection at the time of failure, etc. It also controls the communication circuit.

  Hereinafter, a configuration example in the control unit 40 will be described with reference to FIG. That is, the operations of the fail safe calculation unit 1 and the communication control unit 2 in the present embodiment will be specifically described.

  The control unit 40 performs processing for the input 14 (control information such as train speed) and outputs the data 16 that is the processing result, and the CPUs 101 and 102, and the failure detection that confirms the soundness of the CPU. A communication control unit 2 including a fail safe arithmetic unit 1 having a circuit 11 and further having a communication circuit 21 for transmitting and receiving communication data when communicating between the fail safe arithmetic unit 1 and an external device (for example, a wireless device 42). And a frequency conversion circuit 32 that supplies a clock 33 necessary for the communication circuit 21 to generate a baud rate.

  The CPU 101 and the CPU 102 use the control information such as the train speed as an input 14, and perform arithmetic processing on the input 14 and output communication data 16 as a result of the calculation. The failure detection circuit 11 checks the soundness of the duplicated CPUs 101 and 102, and outputs a failure detection signal 15 when a failure is detected. For example, the failure detection circuit 15 is a comparison circuit that detects a match / mismatch between corresponding signals in two CPUs (processor modules) and outputs the failure detection signal 15 to the outside of the fail-safe arithmetic unit 1 (semiconductor chip). Signals to be compared include CPU bus write data in the CPU 101 and the CPU 102, an address signal of the control circuit, and an operation flag output by the arithmetic unit. As described above, the failure detection signal 15 is an alternating signal (low level) when normal, and other than that (high level) when failure occurs.

  The control unit 40 takes in the control information described above as the input 14 and performs a calculation process in the fail-safe calculation unit 1. In the fail-safe calculation unit 1, based on the control information in the CPU 101 and CPU 102 which are duplicated calculation processing units, for example, the calculation of the speed limit pattern calculated from the stop limit position and the speed limit, the own train speed, Calculation processing such as the current position of the own train calculated from the information such as the diameter of the own train wheel is performed, and the processing result is associated with the failure detection circuit 11.

  The failure detection circuit 11 confirms the soundness of the CPUs 101 and 102 of the arithmetic processing unit and outputs a failure detection signal 15. The method of judging the soundness of the arithmetic processing unit of the failure detection circuit 11 is a method of comparing the arithmetic results output from the CPUs 101 and 102 of the multiplexed arithmetic processing units and judging the normal part by coincidence or majority decision. There is also a self-diagnosis that incorporates a failure detection circuit inside the arithmetic processing unit.

  In this configuration, the failure detection circuit 11 is described as an example in which the outputs of the CPU 101 and CPU 102 of the former arithmetic processing unit are compared. The failure detection circuit 11 compares the calculation results of both the CPUs 101 and 102 and determines that they are normal as long as they match, and outputs an alternating signal having a fixed period as the failure detection signal 15. When the calculation results of the CPU 101 and the CPU 102 do not coincide with each other, a fixed signal that is electrically fixed at a high level (High) or a low level (Low) is output as the failure detection signal 15.

  The frequency conversion circuit 32 receives a failure detection signal 15 from the failure detection circuit 11 and generates control signal (clock signal / communication baud rate) for controlling communication of the communication control unit 7 (clock signal generation unit / communication). Baud rate generating means). Specifically, it is a frequency conversion circuit that converts the frequency of the failure detection signal 15 into a frequency that can be a clock signal 33 required by the communication circuit 21 of the communication control unit 2.

  The communication control unit 2 is supplied with communication data 16 (data content) to be transmitted to another device and a clock signal 33 obtained by frequency-converting the failure detection signal 15 by the frequency conversion circuit 32 from the fail-safe operation unit 1.

  The communication circuit 21 receives the clock signal 33, generates a baud rate of the set communication speed, and also, for example, the position of the own train transmitted to the radio base 5 (see FIG. 1) of the ground facility via the radio device 42. The communication data 16 such as information is received, converted into a format suitable for communication with other devices on the ground facility, and the communication data 23 is transmitted to the other devices.

The failure detection signal 15 is an equivalent signal to the clock signal 33 because it is output as an alternating signal having a fixed period. However, since the alternating signal used as the failure detection signal 15 is used as an input to a device having a long control cycle, a frequency f ₂ lower than the clock frequency f ₁ required for the communication circuit 21 is used. Also, the frequency f ₂ is set according to the communication speed of the communication circuit 21.
Communication speed is generated by dividing the frequency f _2. For example, the communication baud rate S is set to S = f ₂ / ((2 ^ a) × N) including two coefficients a and N, where a is 0-8. , N is assumed to be a communication circuit that can be set as an integer between 1 and 255. When 9600 bps is generated when the input f ₂ is 28 MHz, an error of 0.11% is generated, but if it is 36 MHz, a baud rate can be generated with an error of 0%. When attempting to generate a 38400bps is about 0.023% of errors _{f 2} is at 28 MHz, 0.053% error comes out at 36 MHz.
As described above, since the communication speed error varies depending on the frequency of the input clock signal, it is necessary to change the frequency of the input clock signal in accordance with the communication speed to be used.
The setting of the frequency f ₂ of the clock signal may be configured to control so as to automatically detect the frequency of the frequency converting circuit 32 to the communication speed of the communication circuit 21 changes, and configured to switch manually May be.

  Therefore, the frequency is converted through the frequency conversion circuit 32 so that the failure detection signal 15 has a clock signal frequency 33 suitable as a baud rate generation clock (communication speed control clock) of the communication circuit 21. The converted clock signal frequency 33 is input to the communication circuit 21 as a clock, thereby driving the communication circuit 21.

  Here, the communication circuit 21 generates the communication data 23 based on the input of the clock signal frequency for generating the baud rate of the communication circuit 21 and the communication data 16 from the fail-safe arithmetic unit 1, and outputs the communication data 23. An example will be described with reference to FIG.

FIG. 5 is a configuration example of a portion related to data transmission in the communication circuit 21.
The communication circuit 21 receives as input the communication data 16 from the fail-safe operation unit 1 and the clock signal 33 in which the failure detection signal 15 is converted to an appropriate frequency by the frequency conversion circuit 32.
The communication data 16 is supplied to the transmission control circuit 215 of the communication control unit 2 via the arithmetic unit interface circuit 211 of the communication control unit 2. The clock signal 33 is supplied to the clock frequency dividing circuit 212 as control information related to baud rate generation and the like.

  The clock frequency dividing circuit 212 divides the frequency of the clock signal 33 in accordance with the clock signal 33 and the control signal from the arithmetic unit interface circuit 1 (the arithmetic unit interface circuit 211), and outputs a divided clock. The communication baud rate generation circuit 213 receives the frequency-divided clock from the clock frequency dividing circuit 211 and generates a communication baud rate 214. The communication baud rate 214 is the number of times digital data can be modulated / demodulated per second.

  That is, the number of times of data modulation / demodulation is defined by generating a baud rate. The transmission control circuit 215 calculates the bit width of the communication data at the defined baud rate, modulates / demodulates the communication data 16 passed through the calculation unit interface circuit 211, and outputs it as communication data 23 on the communication line.

  When a failure is detected by the fail safe arithmetic unit 1, a signal in which the alternating signal of the failure detection signal 15 is electrically fixed at a high level (High) or a low level (Low) is output. When the fixed signal is input to the frequency conversion circuit 32, the frequency conversion circuit 32 cannot generate a clock signal as shown in FIG. 3, and a fixed signal is input to the communication circuit 21 as a clock signal 33 for generating a baud rate. Is done. As a result, the operation of the communication circuit 21 is stopped.

  The baud rate is generated by performing processing such as frequency division on the clock signal 33 for baud rate generation input to the communication circuit 21. Since the clock signal 33 becomes a fixed signal, the baud rate cannot be generated inside the communication circuit 21. Thereby, the function of modulating / demodulating the communication data of the transmission control circuit 215 is stopped, and the input / output of the communication data to be transmitted on the communication line 23 based on the communication data 16 from the fail safe arithmetic unit 1 becomes impossible. That is, the control unit 40 is in a state where communication data cannot be input / output.

  Therefore, when the failure is detected by the fail safe arithmetic unit 1, the control unit 40 cannot output the communication data 23, and thus the communication line of the communication data 23 is electrically disconnected. Even when the communication line of the failure detection signal 15 is short-circuited or disconnected, the signal is not an alternating signal and is fixed to one side, so that a failure state occurs and the communication circuit 21 stops.

  According to the embodiment described above, the communication circuit 21 cannot reliably output communication data (disconnect from the line) when the fail-safe operation unit 1 fails or when the communication line of the failure detection signal 15 is short-circuited / disconnected. The transmission apparatus can be realized with a simple configuration.

  In addition, according to the present embodiment, the frequency detection circuit 32 of the failure detection signal is replaced with the clock generation circuit of the prior art, and the frequency converted failure detection signal is input as the clock of the communication circuit. The control circuit and the contact section for disconnecting the line are not necessary, and the circuit configuration is reduced as compared with the conventional configuration.

  In this embodiment, unintended data output from the communication circuit can be stopped more reliably. Stopping the clock supply of the communication circuit stops the data output processing itself to the communication line. Therefore, erroneous output can be more reliably prevented than physical line disconnection based on the assumption that conventional erroneous data is output on the line. In addition, the circuit configuration for controlling the communication line disconnection from the output of the failure detection circuit is simplified, and the processing until the line disconnection is reduced, so that the line is disconnected earlier. Due to the above two points, in this embodiment, prevention of unintended data output from the communication circuit can be realized more reliably than in the conventional configuration.

  Furthermore, the effect of reducing the circuit configuration and the number of parts constituting the circuit not only reduces the cost, but also leads to a decrease in the failure rate. If the circuit configuration is simplified and the number of parts is reduced, the cause of failure of the entire system is reduced. The failure factor reduction as a system means a failure rate reduction as a system.

  In the above embodiment, the description has been made on the assumption that the disconnection of the communication circuit based on the failure detection signal of the face-safe arithmetic unit is applied to the train (railway) control device, but this control device is specific to the train control device. The present invention is not limited to this, and can be applied to a device that is required to stop the operation including the interruption of the communication circuit to ensure safety when a failure of the device is detected. For example, the present invention can be applied to fields such as factory production line devices and traffic lights.

  In the above embodiment, the configuration has been described in which the fault detection signal, which is an alternating signal, is frequency-converted by the frequency conversion circuit to generate the clock signal to the communication circuit, but the present invention is not limited to this embodiment. For example, the failure detection signal 15 is input to the clock generation circuit 30, and the clock generation circuit has a function of stopping clock generation when the failure detection signal is a signal indicating a failure, that is, a high level or a low level. The effect of the present invention can also be achieved by an embodiment having a function of outputting only a signal fixed to (Low).

  In addition, when a failure detection signal indicating a failure is generated by the failure detection circuit, the communication circuit has means for preventing the clock signal from being input to the communication circuit, or means for stopping the generation of the clock signal itself. There may be an embodiment in which it is impossible to generate the communication data 23 by the communication circuit by outputting only the signal fixed to the high level (Low) or the low level (Low). Also according to this embodiment, it is possible to prevent unintended data from the communication circuit from being output, and to perform more reliably than in the past.

DESCRIPTION OF SYMBOLS 1 Fail safe calculating part 11 Failure detection circuit 15 Failure detection signal 16 Clock signal 101, 102 CPU
2 Communication control unit 21 Communication circuit 4 Train 40 Control unit (control device)
41 Speed checking unit 42 Wireless device 43 Brake command (brake output)
44 Fault detection signal 45 Control speed signal 46 Train speed signal 5 Wireless base 214 Communication baud rate

Claims (8)

A CPU that processes input signals and outputs communication data; and a fail-safe arithmetic unit that includes a failure detection circuit that detects a failure of the CPU and outputs a failure detection signal;
A communication control unit that receives the communication data output from the fail-safe operation unit, modulates and demodulates the communication data using a clock signal, and communicates to an external device;
A clock signal generating means for supplying a clock signal to the communication control unit,
The clock signal generation means receives the failure detection signal from the failure detection circuit, and stops generation of the clock signal or generates a fixed signal when the failure detection signal intended for failure is received. A control device characterized by that. The control device according to claim 1,
The failure detection circuit outputs an alternating signal as the failure detection signal when no failure is detected,
The clock signal generation means receives an alternating signal as the failure detection signal, converts the frequency of the alternating signal to a frequency required for modulation / demodulation of communication data performed by a communication control unit, and generates the clock signal. The control device characterized by being. The control device according to claim 2, wherein
The communication control unit
A clock frequency dividing circuit for frequency-dividing the frequency-converted clock signal based on communication data from the fail-safe operation unit and outputting a frequency-divided signal;
And a communication baud rate generating circuit for generating a communication baud rate from the frequency-divided signal of the clock frequency dividing circuit. In the control device according to any one of claims 1 to 3,
The communication control unit receives a failure detection signal including a fixed signal from the failure detection circuit when the failure detection circuit detects a failure of the CPU, and stops or fixes the supply of the clock signal to the communication control unit. A control device characterized by being a control means for supplying a signal. A CPU that processes control information used for control of the railway vehicle as an input signal;
A failure detection circuit that monitors a processing result of the CPU to detect a failure, outputs a failure detection signal as an alternating signal or a fixed signal, and outputs the processing result as communication data;
A communication circuit that captures the communication data as an input and generates the data that can be communicated to an external device based on the clock signal;
Taking in the alternating signal or fixed signal output from the failure detection circuit, when taking in the alternating signal, to output a clock signal for generating data communicable to an external device in the communication circuit,
Communication control means that does not output a clock signal for generating data that can be communicated to an external device in the communication control unit when the fixed signal is captured;
A train control device characterized by comprising: In the train control device according to claim 5,
The communication control means is a frequency conversion device that converts an alternating frequency of the failure detection signal into an alternating frequency suitable for generating data that the communication circuit can communicate with an external device,
The said frequency converter inputs the clock signal of the converted alternating frequency into the said communication circuit, The train control apparatus characterized by the above-mentioned. In the train control device according to claim 5 or 6,
When the failure detection circuit detects a failure of the CPU, it outputs the failure detection signal as a fixed signal,
The communication control unit stops output of a clock signal for generating data communicable with an external device by the communication control unit, and stops a communication operation by the communication circuit. . A CPU that takes in control information for running and stopping the railway vehicle as input and performs arithmetic processing;
Monitors the calculation result of the CPU, outputs the calculation result as communication data, outputs an alternating signal as a failure signal when the CPU is operating normally, and detects a failure of the CPU as a failure detection signal A failure detection circuit that outputs a fixed signal;
A communication circuit that takes in the communication data of the calculation result of the CPU as an input, and communicates the acquired input to another device based on a clock signal;
A wireless device for communicating communication data of the communication circuit to the ground equipment side;
The alternating signal or the fixed signal output from the failure detection circuit is captured, and when the alternating signal is captured, communication of the communication data is continued with the communication circuit, and when the fixed signal is captured, the clock signal As a train control system, a communication control means for generating a control signal for interrupting communication of communication data by the communication circuit of the communication control unit is provided.

Images