【正文】
inability by means of redundancy. Design of hardware faulttolerant structure As shown in figure 2, the SIC of four independent ponent units (C11, C12, C21, C22). The faulttolerant architecture adopts dual 2 vote 2 (2v2 2) structure, and a kind of highperformance standardized module has been selected as puting unit which adopts Intel X Scale kernel, 533 MHZ. The operation of SIC is based on a dual twolayer data buses. The high bus adopts the standard Ether and TCP/IP munication protocol, and the low bus is Controller Area Network (CAN). C1 C12 and C2 C22 respectively make up of two safety puting ponents IC1 and IC2, which are of 2v2 structure. And each ponent has an external dynamic circuit watchdog that is set for puting supervision and switching. D i a g n o s i s t e r m i n a lC 1 2 C 2 1 C 2 2amp。W a t c h d o g d r i v e rF a i l s a f e s w i t c hI n p u t m o d l eO u t p u t M o d l eI n t e r f a c eC o n s o l eC 1 1H i g h b u s( E t h e r N E T )L o w b u s( C A N ) Figure 2 Hardware structure of SIC Standardized ponent unit After ponent module is made certain, according to the safetycritical requirements of railway signal interlocking system, we have to do a secondary development on the module. The design includes power supply, interfaces and other embedded circuits. The faulttolerant processing, synchronized puting, and fault diagnosis of SIC mostly depend on the safety software. Here the safety software design method is differing from that of the special puter too. For dedicated puter, the software is often specially designed based on the bare hardware. As restricted by puting ability and application object, a special scheduling program is monly designed as safety software for the puter, and not a universal operating system. The faulttolerant processing and fault diagnosis of the dedicated puter are tightly hardwarecoupled. However, the safety software for SIC is exoteric and loosely hardwarecoupled, and it is based on a standard Linux OS. The safety software is vital element of secondary development. It includes Linux OS adjustment, failsafe process, faulttolerance management, and safety interlocking logic. The hierarchy relations between them are shown in Figure 4. S a f e t y I n t e r l o c k L o g i cF a i l s a f e p r o c e s sF a u l t t o l e r a n c e m a n a g e m e n tL i n u x O S a d j u s t m e n t Figure 4 Safety software hierarchy of SIC Faulttolerant model and safety putation Faulttolerant model The Faulttolerant putation of SIC is of a multilevel model: SIC=F1002D(F2021(Sc11,Sc12),F2021(Sc21,Sc22)) Firstly, basic puting unit Ci1 adopts one algorithm to plete the S Ci1, and Ci2 finishes the SCi2 via a different algorithm, secondly 2 out of 2 (2oo2) safety puting ponent of SIC executes 2oo2 calculation and gets FSICi from the calculation results of SCi1 SCi2, and thirdly, according the states of watchdog and switch unit block, the result of SIC is gotten via a 1 out o