Research on the construction of the 2oo2D architecture for railway vehicle network systems

[Objective] This study aims to construct a 2oo2D architecture for railway vehicle network systems that complies with the safety function specifications of standards such as IEC 62278 and EN 50128, ensuring the safety and reliability of train control functions. [Method]: The 2oo2D architecture is employed to deploy the safety and non-safety functions of the Train Control and Management System (TCMS) on separate processors (CPUs). Specifically, CPU1 runs the safety functions, while CPU2 runs the non-safety functions. A fail-safe mechanism is implemented through the monitoring of heartbeat signals, health status diagnosis, and master-standby switching logic between the primary and backup Central Control Units (CCU). The safety of the architecture is verified through delay analysis and safety scenario testing (such as normal braking, emergency braking, and vigilance button status judgment). [Result & Conclusion] The study shows that the master-standby switching delay of the CCU during initial power-up is 140ms, and the maximum switching delay in the event of a physical core failure of the CPU is 80ms. In the normal braking scenario, the delay in braking distance caused by CCU failure switching (4.67 m) is significantly less than the emergency braking distance and does not affect the safe stopping of the train. Functions such as air braking and vigilance button signal acquisition meet the required safety time thresholds during the switching process. This architecture achieves the SIL2 safety level for the TCMS through hardware separation and redundancy design, providing a feasible solution for the safety architecture design of TCMS.