Construction method of safety guarantee method for train control system

Abstract

The invention discloses a construction method of a safety guarantee method for a train control system. The construction method comprises the following steps: S1, constructing the train control system based on a demand in combination with an SOTIF technology; s2, identifying a hazard key point / unsafe control behavior in the train control system, and performing directional improvement on the train control system based on the hazard key point / unsafe control behavior; s3, verifying the reliability of the train control system after directional improvement; and S4, carrying out safety adjustment on the train control system after directional improvement and outputting the train control system. The method has the advantage of improving the reliability of the train control system.

Description

Technical Field

[0001] The present invention relates to the field of train operation control, and in particular to a method for constructing a safety assurance method for a train control system. Background Art

[0002] Safety is always the most concerned and core issue of the train control system. At present, the safety assurance method of the train control system's functions is centered on fault-safety-related functional safety, including combined fault safety, inherent fault safety, reactive fault safety and other technologies, corresponding to a series of technologies proposed by functional safety standards in the train control field such as EN50128, EN50129, and EN50128.

[0003] At present, various new technologies are developing rapidly, including positioning, intelligent perception, intelligent control, etc. Introducing new technologies into the field of train control will accelerate the development of my country's rail transit industry, because the safety and reliability of these new technologies have not been verified on a large scale, and they themselves have certain expected possible failures and misuse by personnel, including the interpretability of neural networks and the reliability of communication-based positioning technology. The same problem has also been encountered in the field of road traffic. With the application of intelligent and networked technologies in automobiles, automobiles are also facing more and more new technological challenges. The concept of SOTIF has been introduced in the automotive field. Through the expected functional safety process and technology, in-depth analysis and solutions to problems such as insufficient functions and misuse by personnel are carried out. How to propose a construction method for a safety assurance method for train control systems has become an urgent problem to be solved. Summary of the invention

[0004] The purpose of the present invention is to provide a method for constructing a safety assurance method for a train control system, which has the advantage of improving the safety of the train control system.

[0005] To achieve the above-mentioned purpose, the present invention provides a method for constructing a safety assurance method for a train control system, the construction method comprising: step S1, constructing a train control system based on demand in combination with SOTIF technology; step S2, identifying critical points of hazards / unsafe control behaviors in the train control system, and making targeted improvements to the train control system based on the critical points of hazards / unsafe control behaviors; step S3, verifying the reliability of the train control system after targeted improvements; step S4, making safety adjustments to the train control system after targeted improvements and outputting them.

[0006] Preferably, step S2 comprises: step S21, inputting a risk scenario containing a hazard key point into the train control system and performing a risk assessment, determining whether the risk of the hazard key point is within a threshold range, if so, proceeding to step S22; if not, proceeding to step S23; step S22, determining whether the operating risk of the train control system under the SOTIF-related standard is within a threshold range, if so, indicating that there is no unsafe control behavior, proceeding to step S27; if not, indicating that there is an unsafe control behavior, proceeding to step S23; step S23 ... an unsafe control behavior, proceeding to step S23; step S23, determining whether the operating risk of the train control system under the SOTIF-related standard is within a threshold range, if so, indicating that there is an unsafe control behavior, proceeding to step S23 Control behavior constructs a train control system improvement plan; step S24, improves the existing train control system according to the train control system improvement plan to obtain the train control system to be verified; step S25, determines whether the operation risk of the train control system to be verified under the SOTIF related standards is within the threshold range; if so, it means that there is no unsafe control behavior, and the verification of the train control system to be verified is completed, and enters step S27; if not, enters step S26; step S26, constructs a train control system improvement plan according to the unsafe control behavior, and returns to step S24; step S27, outputs the improved train control system.

[0007] Preferably, the risk scenarios of the critical hazard points include: known risk scenarios and unknown risk scenarios; the known risk scenarios refer to limitations, boundary conditions, and scenario patterns that have been identified and understood; the unknown risk scenarios refer to scenario patterns that have not been foreseen or fully understood during the system design and testing process.

[0008] Preferably, in the step S23, the critical point of hazard is the braking delay caused by the lack of autonomous perception of the train, and an improvement plan for the train control system is constructed for the critical point of hazard; the train control system applicable to the improvement plan includes: a braking module, which realizes the automatic driving operation of the train and the automatic adjustment function of the train operation in the section; RBC, a computer control system based on wireless communication, which can issue train operation permissions and train control information to all trains within its jurisdiction according to the train position, operation, line conditions, dispatching commands and route status; on-board sensors, which read external data; the braking module is respectively connected to the sensor, RBC, and the train, continuously receives information from the on-board sensors, RBC, and the train, and brakes the train according to the received information.

[0009] Preferably, the improvement scheme includes: step T1, detecting the train operating environment through on-board sensors to obtain train operating environment information; step T2, RBC receives the train operating environment information from the on-board sensors, analyzes the train operating environment information and transmits it to the braking module; step T3, the braking module receives the train operating environment information from the sensor, the train operating environment information after analysis by RBC and the train's own operating information, and issues a braking command to the train after analysis; step T4, the train brakes according to the braking command.

[0010] Preferably, in step T4, the braking instructions include: when the visibility around the train can no longer support its normal operation, manual braking is performed; when the train unexpectedly slips, an alarm is issued and manual braking is switched; when the meteorological sensor cannot be connected, an alarm is issued and manual braking is switched; when an obstacle / previous vehicle appears in front of the train, the on-board module controls the train to run at a low speed according to the obstacle distance information / previous vehicle distance information, issues an alarm, and brakes.

[0011] Preferably, in step S23, the hazard key point is adopted as the train positioning wrong track under complex line conditions, and an improvement plan for the train control system is constructed for the hazard key point; the improvement plan includes: step Q1, obtaining the specific error mode of the train positioning wrong track under the complex line condition, and the error mode includes: the train mistakenly travels to other vacant tracks or the train mistakenly travels to tracks occupied by other trains; if the error mode is that the train mistakenly travels to other vacant tracks, enter step Q2; if the error mode is that the train mistakenly travels to tracks occupied by other trains, enter step Q3; step Q2, sending the operating parameters applicable to the vacant track to the train, and adjusting the turnout of the vacant track, and returning the train to the correct track at the next turnout; step Q3, sending the operating parameters after safety adjustment to all trains on tracks occupied by other trains, and adjusting the turnout of the track, and returning the train to the correct track at the next turnout.

[0012] Preferably, in step S23, a GSN-based train control expected functional safety analysis method is used to construct a train control system improvement plan for unsafe control behaviors, and the improvement plan includes: step W1, constructing a safety goal based on the unsafe control behavior; step W2, proposing a safety strategy based on the safety goal; step W3, refining the safety strategy to obtain several safety sub-goals; step W4, constructing a train control system improvement plan based on the safety sub-goals.

[0013] Preferably, the unsafe control behavior is that after the front vehicle's approach section is unlocked, the virtually coupled rear vehicle illegally breaks into the front vehicle's approach section; step W1, constructing a safety goal based on the unsafe control behavior: "When the virtually coupled front vehicle enters the front vehicle's approach section, the rear vehicle will not break into the front vehicle's approach section"; step W2, proposing three safety strategies for the safety goal: RBC should correctly send the rear vehicle's operating information to the interlock; when the interlock finds that the rear vehicle cannot brake, the front vehicle's approach section is not unlocked; ensure that the rear vehicle stops before EOA; step W3, refining the three safety strategies to obtain three Safety sub-goal; Safety sub-goal output to RBC: ensure the normal operation and information transmission of RBC; Safety sub-goal output to interlocking: when the interlocking finds that the rear car of the virtual coupling is in a section close to the approach section of the front car, if the distance is insufficient and braking is impossible, the interlocking shall not unlock the section in the approach section of the front car, and the virtual coupling continues to travel; Safety sub-goal output to the on-board equipment: autonomously control the train to stop at a safe distance, and the escape distance shall not exceed the safe distance; Step W4, construct an improvement plan for the train control system according to the safety sub-goal. Construct an improvement plan for the train control system according to the approach section of the front car.

[0014] Preferably, the train control system improvement scheme of step W4 includes: if the front vehicle has already entered the front vehicle approach section, the interlock shall not unlock the front vehicle approach section for the subsequent vehicle; if the front vehicle has not yet entered the front vehicle approach section, the RBC may send an inquiry request to the rear vehicle, if the rear vehicle replies that the vehicle can stop in time, the interlock allows the front vehicle to operate normally; if the front vehicle has not yet entered the front vehicle approach section, the RBC may send an inquiry request to the rear vehicle, if the rear vehicle replies that the vehicle cannot stop, the front vehicle approach section will not be opened.

[0015] Preferably, in step S23, an intelligent STPA method is used to construct an improvement plan for the train control system for unsafe control behaviors, and the improvement plan includes: step E1, confirming the major categories of unsafe control behaviors; step E2, establishing a model suitable for the train control system based on STPA technology; step E3, identifying specific unsafe control behaviors in the train control system based on the model; step E4, substituting the specific unsafe control behaviors into the model for optimization to form safety constraint information; step E5, using the safety constraint information as a reference factor for the train control system improvement plan to construct a train control system improvement plan.

[0016] Preferably, in step E2, the model includes: RBC, which serves as the center for receiving and transmitting data and commands; a number of ATPs, any of which is connected to the RBC signal and maintains continuous data exchange, and is connected to each other by signal and maintains continuous data exchange, so as to realize the automatic driving operation of the train and the automatic adjustment function of the train running in the section; a number of CBIs, any of which is connected to the RBC signal and maintains continuous data exchange, so as to realize the control between the turnouts, signal machines and tracks in the station.

[0017] Preferably, after the step E4 is executed, the step E5 is not entered; the model is optimized using the safety constraint information obtained in the step R4, and then the step E1 is performed again.

[0018] Preferably, the step S26 includes: step S261, extracting unsafe control behaviors of the train control system to be verified under the SOTIF related standards; step S262, performing operational risk assessment on the unsafe control behaviors to obtain operational risk assessment results; step S263, constructing a train control system improvement plan based on the operational risk assessment results.

[0019] Preferably, step S3 includes: using GAN and artificial intelligence to verify the train control system after the directional improvement.

[0020] Preferably, step S4 comprises: combining the directed improved train control system with safety parameters, and performing safety adjustments using a target structure representation method or an extended evidence network method.

[0021] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the aforementioned method for constructing a safety assurance method for a train control system.

[0022] An electronic device includes a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the method for constructing the aforementioned safety assurance method for a train control system is implemented.

[0023] In summary, compared with the prior art, the method for constructing a safety assurance method for a train control system provided by the present invention has the following beneficial effects:

[0024] First, the present invention aims at the safety challenges after the application of new technologies in the train control system, combines the SOTIF technology in the road traffic field with the train control system, and innovatively introduces the SOTIF technology into the train control system.

[0025] Second, in the field of safety assurance of train control systems, SOTIF technology was introduced and combined with the train control process, realizing the organic combination of the two through SOTIF; the risks after the combination of train control and new technologies can be further clarified and evaluated, the key points of the problems can be found, and targeted improvement suggestions can be put forward.

[0026] Third, based on the STPA technology, the present invention introduces model construction, which identifies specific unsafe control behaviors through the model and automatically forms safety constraint information based on the unsafe control behaviors. At the same time, the model is optimized based on the latest safety constraints, and specific unsafe control behaviors are automatically regenerated again, so that the unsafe control behaviors are reduced and the value of the safety constraint information is higher.

[0027] Fourth, based on the existing functional safety technology, the present invention further improves the system safety, especially the safety after the application of new technology.

[0028] Fifth, the present invention proposes a specific solution for the relevant situations of virtual coupled trains; and a train autonomous perception solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A detailed schematic diagram of the construction method.

[0030] Figure 2 Schematic diagram of the connection relationship between train module, sensor, RBC and train for the safety assurance method for the train control system when the critical hazard point is the braking delay caused by the lack of train autonomous perception.

[0031] Figure 3 The key risk point is the lack of autonomous perception of the train.

[0032] Figure 4 The key point of danger is to locate the train on the wrong track under complex line conditions.

[0033] Figure 5 The figure is a GSN-based train control expected functional safety analysis method, which is applicable to the flow chart of step S23.

[0034] Figure 6 A simplified flowchart of the construction method is shown in FIG. DETAILED DESCRIPTION

[0035] The following will be combined with the attached embodiment of the present invention Figure 1 ~Attached Figure 6 , the technical solutions, structural features, objectives achieved and effects in the embodiments of the present invention are described in detail.

[0036] It should be noted that the drawings are in a very simplified form and use non-precise proportions. They are only used to conveniently and clearly assist in explaining the embodiments of the present invention, and are not used to limit the conditions for the implementation of the present invention. Therefore, they have no substantive technical significance. Any structural modification, change in proportional relationship or adjustment of size should still fall within the scope of the technical content disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0037] It should be noted that, in the present invention, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only the elements explicitly listed, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0038] The present invention provides a safety assurance method for a train control system, the core of which is to apply SOTIF (Safety of The Intended Functionality) technology to a train control system (train control system).

[0039] Here, let us first explain SOTIF. The so-called SOTIF - Safety of the Intended Functionality, refers to the relationship between expected behavior, prescribed behavior and actual behavior.

[0040] Expected behavior: Regardless of any technical limitations, the user's expected behavior of the driving system is the ideal behavior, representing 100% scenario applicability and safety, and reflecting the user and society's expectations of the system behavior. For example, the expected behavior of the emergency brake system should be zero false triggering and zero missed triggering.

[0041] Prescribed behavior: Prescribed behavior is the expected behavior after considering the constraints of the real world. It is the definition of the developer when the system actually runs. The specific constraints can be legal, technical, cost, user experience, etc.

[0042] Actual behavior: refers to the actual behavior exhibited during system operation and use.

[0043] The expected functional safety technology is dedicated to increasing the overlap rate of these three behaviors, thereby reducing the probability of inconsistencies with expectations. Its purpose is to achieve safety and unity.

[0044] Regarding the train control system, the train control system must include corresponding train control technologies (train control technologies). The combination of many train control technologies supports the operation of the entire train control system. The train control technologies include but are not limited to:

[0045] Autonomous train interval control technology, which realizes train interval control based on relative braking distance;

[0046] Train autonomous positioning technology, which achieves train safety through the expected functions of fusion algorithms such as filtering, satellite and communication positioning sources;

[0047] Train autonomous perception technology, which ensures train safety through the expected functions of AI-related algorithms such as image recognition;

[0048] Train intelligent driving technology realizes intelligent train control technology; FAO (Fully Automatic Operation) technology improves the reliability, safety, availability and maintainability of the train control system.

[0049] In addition, it should be noted that the design and development of train control technology should comply with EN50126 (Rail transit. Reliability. Availability. Maintainability and safety specifications and verification), EN50129 (Railway application communications. Signal and processing systems. Safety-related electronic systems for signals), EN50128 (Railway applications. Communications. Signal and processing systems. Railway control and protection system software), SOTIF related standards, such as ISO 21448 (Standard for establishing safety requirements for driver assistance systems and functions in autonomous vehicles), GB / T 43267 (Safety of intended functions of road vehicles) and other relevant national regulations.

[0050] Therefore, the present invention is a construction method for a safety assurance method for a train control system. What the present invention aims to achieve is to integrate the SOTIF technology with the train control system to achieve safety assurance of the train control system;

[0051] like Figure 6 As shown, the construction method includes:

[0052] Step S1, constructing a train control system based on demand and combining SOTIF technology;

[0053] The requirements include: laws and regulations, national standards and other related requirements, such as the aforementioned EN50129, ISO 21448, GB / T 43267, etc.;

[0054] In addition, during the construction of the train control system, as mentioned above, even if it is constructed in accordance with laws, regulations, national standards and other relevant requirements, during the actual operation of the train control system, there will be a situation where the system control behavior in the train control system is inconsistent with laws, regulations, national standards and other relevant requirements; here it is necessary to analyze the constructed train control system in practice and optimize the train control system in order to achieve the expected goal (see the preferred embodiment of step S2 described later for details).

[0055] Step S2, identifying the critical points of hazards / unsafe control behaviors in the train control system, and making targeted improvements to the train control system based on the critical points of hazards / unsafe control behaviors;

[0056] Here, the key hazards are the factors that affect the safety and efficiency of train operation during the operation of the train control system; for example,

[0057] The lack of autonomous perception capabilities of trains;

[0058] The train cannot autonomously locate itself under complex line conditions;

[0059] The train cannot accurately control the interval between trains, etc.

[0060] Step S2 is to make targeted improvements to the train control system by analyzing the key points of damage.

[0061] The following are some targeted improvement measures based on key hazard points:

[0062] (1) The lack of autonomous perception capability of the train; improving the performance of basic components, including the performance of input positioning sensors and autonomous perception sensors, so as to improve the positioning accuracy of the train and the accuracy of identification of train models; or by linking the train to satellites and taking advantage of the high accuracy of satellite positioning, improving the train's ability to identify obstacles and the reliability of autonomous perception in rainy and snowy weather.

[0063] (2) The frequency of inspection of train operating equipment is low; by adding an independent inspection procedure to the train control system, the operating environment and internal operating status of the train operating equipment are inspected; for example, the environment in which the train operating equipment is located is inspected to see whether it meets the placement safety requirements; the working status of the train operating equipment is inspected to see whether it meets the operating requirements.

[0064] (3) Lack of monitoring of train operation safety. Safety can be improved by setting up redundant sensors, redundant control equipment, etc., using multiple independent and different sensors to collect information and using different algorithms for safety verification. For example, using multiple independent and different sensors such as images and lidar; using different algorithms to calculate the safety requirements and indicators of the same function, so as to achieve effective monitoring of train operation safety.

[0065] (4) The capabilities of the equipment controlled by the train control system are insufficient. This can be solved by changing the constraints of the train control system itself, where the constraints refer to the response thresholds of the train control system under different circumstances. For example, when the distance between the train and the preceding train is 1 km, an alarm should be sounded. However, since the emergency braking capability of the train is insufficient, after changing the constraints, an alarm will be sounded at 2 km.

[0066] (5) The train lacks operational stability in different scenarios. By improving the design and algorithm of the train control system, the applicable scenarios of the train control system will be further updated, and the error value between the train control system in unknown application scenarios and inapplicable application scenarios and normal operation will be gradually reduced.

[0067] Here, the unsafe control behavior refers to a specific control behavior that has a negative impact on the train control system, and the unsafe control behavior includes: failure to provide control information, premature control, late control, out-of-order control, premature control stop, and too long control application. As for how to judge unsafe control behavior, the reference standard of "operation risk of train control system under SOTIF related standards" can be introduced (see step S22 described later for details).

[0068] Then, step S2 as a whole is an operation to carry out targeted improvement on the critical hazardous points / unsafe control behaviors in the train control system.

[0069] Step S3, verifying the reliability of the train control system after the directional improvement;

[0070] Based on the existing verification and confirmation modes of the existing train control system (such as the relevant verification and confirmation modes in EN50126 and EN50128 standards), GAN (Generative Adversarial Networks) and artificial intelligence are introduced for verification to ensure that the train control system meets the relevant standards and has sufficient confidence during operation;

[0071] Among them, the GAN is a powerful model with the ability to generate new samples. Sample generation is the core capability of GAN. GAN consists of two parts: a generative network and a discriminative network. The generative network is responsible for generating new samples, while the discriminative network is responsible for judging whether these samples are real and whether they meet the set conditions. GAN continuously improves the quality and diversity of generated samples by conducting adversarial training on the generative network and the discriminative network. The train control system is introduced into the GAN model, and the reliability of the train control system after directional improvement is confirmed through continuous generation and judgment.

[0072] In addition, the reliability of the train control system after targeted improvement can be verified by combining fuzzy reasoning, random scenario generation, acceptable disturbance generation, metamorphosis testing, knowledge and data-driven methods in GAN with sample generation.

[0073] Step S4, making safety adjustments to the train control system after directional improvement and outputting the results;

[0074] After step S3, the train control system is now almost complete. In order to achieve a better control effect, step S4 is to combine the targeted improved train control system with safety parameters (such as the safety parameters in the EN50126 and EN50128 standards) and use the target structure representation method (a method proposed by MISRA, including ideal conceptual parameters that can achieve expected safety, where MISRA stands for The Motor Industry Software Reliability Association, a multinational automotive industry association in the UK) or the extended evidence network method (a modeling method used to represent the uncertainty of the train control system and the environment and the uncertainty of data propagation) to make safety adjustments to ensure the safety of the train control system.

[0075] like Figure 1 As shown, in the construction path, the most important step is step S2, because it is the purpose of the present invention to continuously improve the train control system to meet actual needs. Targeted improvement of the train control system based on hazard key points and unsafe control behaviors will help to further strengthen the train control system, further reduce the operating risks of the train control system under the SOTIF related standards, and ensure the safety of train operation under the control of the train control system.

[0076] like Figure 1 As shown, step S2 includes:

[0077] Step S21, inputting a risk scenario containing a critical point of danger to the train control system and performing a risk assessment to determine whether the risk of the critical point of danger is within a set threshold range. If so, proceeding to step S22; if not, proceeding to step S23;

[0078] The threshold range is confirmed in advance and can be obtained by analyzing the historical data under the critical point of the hazard, or by calculating using other models. This input method is used because it is necessary to make targeted improvements to the train control system based on the critical point of the hazard.

[0079] If the risk of a critical hazard point is within the threshold range, it means that the critical hazard point is not sufficient to affect the train control system and can be ignored; if it is not within the threshold range, it means that the critical hazard point is more serious and needs to be processed later.

[0080] Step S22, determining whether the operation risk of the train control system under the SOTIF-related standards is within the set threshold range. If it is within the threshold range, it means that there is no unsafe control behavior, and the process goes to step S27; if it is not within the threshold range, it means that there is an unsafe control behavior, and the process goes to step S23;

[0081] Among them, it is because of the existence of unsafe control behavior that operational risks are generated; this step S22 makes another judgment based on the risk of critical points that have been judged in the aforementioned step S21; because even if the risk of critical points is within the threshold range, other problems in the train control system itself are not ruled out, so the train control system needs to be judged by the SOTIF related standards for the threshold value of operational risks, thereby ensuring the accuracy of the train control system; if it is within the threshold range, it means that the current train control system is perfect, so it can be directly output; if it is not within the threshold range, it means that unsafe control behavior exists, so the unsafe control behavior should be processed later.

[0082] Step S23, constructing a train control system improvement plan based on the critical points of danger and / or unsafe control behaviors.

[0083] Step S24, improving the existing train control system according to the train control system improvement plan to obtain a train control system to be verified;

[0084] Among them, the "existing train control system" is the train control system currently in use (that is, the train control system formed in step S1). This train control system may have hazardous key points / unsafe control behaviors, and the "train control system improvement plan" is designed based on the "existing train control system" to obtain the "train control system to be verified"; because even if there is an improvement process, a subsequent verification process is still needed to prove its stability before it can be output.

[0085] Step S25, determine whether the operating risk of the "train control system to be verified" under the SOTIF related standards is within the threshold range; if it is within the threshold range, it means that there is no unsafe control behavior, the verification of the train control system to be verified is completed, and enter step S27; if it is not within the threshold range, enter step S26;

[0086] The judgment under the SOTIF related standards here is similar to step S22 and will not be repeated here.

[0087] Step S26, constructing a train control system improvement plan based on the unsafe control behavior, and returning to step S24;

[0088] At this time, a loop is formed. If there is unsafe control behavior, the existing train control system in step S24 is the train control system to be verified in the previous cycle, and through the solution of step S26, a new train control system to be verified is formed, and then the loop is re-entered.

[0089] It should be noted here that the train control system improvement plan for critical hazard points will only be carried out once, at which time all the problems at the critical hazard points have been solved, while the system improvement plan for unsafe control behaviors cannot be solved in one go, so there may be multiple cycles.

[0090] Step S27, outputting the improved train control system.

[0091] Specifically, in step S21, the risk scenarios of the critical points include:

[0092] Known risk scenarios and unknown risk scenarios;

[0093] The known risk scenarios refer to those limitations, boundary conditions, and scenario modes that have been identified and understood, which may affect the expected functions of the system and cause safety issues, including known safety issues and known unsafe issues, including issues identified by in-depth analysis of systematic failures, issues analyzed based on random failures, and issues that cannot be solved temporarily after analysis but have clear boundaries and controllable impact ranges;

[0094] The unknown risk scenarios refer to those scenario modes that are not foreseen or fully understood during the system design and testing process. They may be due to the novelty of the technology, resulting in the inability to make judgments based on current capabilities. They may also be due to human negligence, resulting in problems that should be known but cannot be identified. These include perception failures caused by unknown severe weather and other environments, unknown problems caused by the interpretability of deep networks, and unknown problems caused by the human complexity of design, development, and operation personnel.

[0095] The purpose of inputting this type of data is to use known risk scenarios and unknown risk scenarios as the input of original data, so as to reduce the probability of occurrence of known hazard scenarios horizontally and compress the probability of unknown hazard scenarios vertically to an acceptable level, thereby improving the operational safety of the train control system.

[0096] In addition, when describing known risk scenarios and unknown risk scenarios, the description should include: function name, function description, function activation conditions, function main scenarios, other common function scenarios, function takeover, design operation scope, including space and time, other scope constraints, system composition architecture, including perception, decision-making, execution layer architecture, system performance indicators, a list of trigger conditions corresponding to known functional deficiencies, safety strategies, alarms and degradation strategies, etc.; this description method is derived from the national standard GB / T 43267 (Expected Functional Safety of Road Vehicles) for expected functional safety in the road traffic field.

[0097] There is no restriction or order for the use of known risk scenarios and unknown risk scenarios. They can be used simultaneously or individually.

[0098] The step S26 comprises:

[0099] Step S261, extracting unsafe control behaviors of the “train control system to be verified” under SOTIF related standards;

[0100] Step S262, performing an operation risk assessment on the unsafe control behavior to obtain an operation risk assessment result;

[0101] Specifically, it can identify and evaluate the functions that are put into use when the train control system has unsafe control behaviors, as well as the difference between the response of the train control system in this situation and the expected value;

[0102] Step S263: construct a train control system improvement plan based on the operation risk assessment results.

[0103] Because of the aforementioned operational risk assessment results, it is relatively convenient to design a plan at this time; this idea can also be used in step S23 to more accurately construct a train control system improvement plan through evaluation; after being improved according to the train control system improvement plan, the outputted safety assurance method for the train control system can ensure that the probability of train failures and dangers is further reduced in application.

[0104] The above introduces how to construct a safety assurance method for a train control system, that is, how to apply the SOTIF technology to the train control system; in a specific embodiment, because the corresponding hazard key points / unsafe control behaviors in the construction process are different, the output method will be different, and the following will be described from the perspective of the hazard key points.

[0105] In a specific embodiment, in step S23 of the construction method, the critical point of hazard is taken as the lack of autonomous perception of the train, and a train control system improvement plan is constructed for the critical point of hazard.

[0106] A specific implementation example is introduced here; autonomous train perception has not yet been maturely applied in the train control system, and in harsh environments such as wind, rain and snow, the train control system still relies heavily on external input and cannot complete autonomous perception.

[0107] like Figure 2 As shown, this embodiment is based on the fact that the key point of hazard is the lack of autonomous perception of the train, which leads to braking delay. At this time, the train control system is equipped with an ATP (Automatic Train Protection) or ATO (Automatic Train Operation) module, hereinafter collectively referred to as a "brake module"; the brake module is respectively connected to the sensor, RBC (Radio Block Center), and the train, and continuously receives information from the sensor, RBC, and the train, such as external environment information from the sensor, train control command information from the RBC, and operation status information from the vehicle.

[0108] Among them, the function of the ATP is to automatically brake the train when it exceeds the specified speed. When the on-board equipment receives the ground speed limit information, it compares the information with the actual speed after processing. When the actual speed of the train exceeds the speed limit, ATP brakes the train.

[0109] The ATO is a device that automatically controls the operation of a train, and can realize the automatic driving operation of the train and the automatic adjustment function of the train operation in the section; the ATP and ATO both play the role of controlling the operation of the train, so they are called "brake modules".

[0110] The RBC is a computer control system based on wireless communication. It can issue train operation permits and train control information to all trains within its jurisdiction according to the train location, operation status, line status, dispatching commands and route status. It is the core part of the ground equipment.

[0111] That is, this embodiment is a method for constructing a safety assurance method for a train control system, which adopts the critical point of hazard as the lack of autonomous perception of the train resulting in braking delay, and constructs an improvement plan for the train control system for the critical point of hazard; the purpose of the improvement plan for the train control system is to strengthen the autonomous environmental perception and protection function of the train, enable the train to autonomously perceive the surrounding weather and obstacles, and automatically control the train's running speed to a safe level.

[0112] The train control system improvement plan includes:

[0113] Step T1, detecting the train running environment through on-board sensors to obtain train running environment information;

[0114] The on-board sensors include, but are not limited to, meteorological sensors, distance sensors, etc.; the train running environment information includes meteorological information, distance information to the preceding vehicle, etc.

[0115] Step T2, RBC receives train operation environment information from onboard sensors, analyzes the train operation environment information and transmits it to the brake module;

[0116] Step T3, the braking module receives the train operation environment information from the sensor, the train operation environment information after RBC analysis, and the train's own operation information, and issues a braking command to the train after analysis;

[0117] Among them, the train's own operating information is the inherent property of the train itself, such as the speed of the train, the direction of the train, the friction coefficient of the train's brake pads, etc.; here, it is necessary not only to transmit the analyzed train operating environment information, but also to transmit the original train operating environment information data to ensure the comprehensiveness of the braking module's judgment data.

[0118] Step T4: the train brakes according to the braking command.

[0119] The specific implementation parameters of this solution are as follows:

[0120] The activation of the vehicle-mounted sensor in step T1 should simultaneously meet the following conditions, that is, the conditions that should be met simultaneously to activate the solution are:

[0121] (1) The train's onboard sensors are in normal operation, and the onboard sensors self-check that the surrounding lighting conditions meet the onboard sensor perception requirements;

[0122] (2) The train's meteorological sensors are intact and the self-check surrounding lighting conditions meet the meteorological sensor perception requirements;

[0123] (3) The external environment of train operation is harsh and the adhesion conditions of train tracks are poor.

[0124] For example, the environmental conditions applicable to this solution are: the on-board sensors detect rain and snow outside and ice on the tracks through image sensors (cameras, lidar, etc.), and the meteorological sensors detect the presence of rain and snow. The train control system receives the severe environment information sent by the on-board sensors and initiates the solution.

[0125] In addition, the vehicle-mounted sensor in step T1 has the following problems in actual operation:

[0126] (1) After the rain and snow stop and before the track returns to normal, the ability to sense the slipperiness of the track is insufficient;

[0127] (2) The ambient weather report is inaccurate;

[0128] (3) Visibility is low.

[0129] For this problem, the following operations can be added in step T1 to improve the accuracy of obtaining train operating environment information:

[0130] (1) Based on the historical data of train operation, set the rain and snow weather correction parameters to determine the track slipperiness or manually confirm the track slipperiness;

[0131] (2) Add a track inspection vehicle. When it rains or snows, the track inspection vehicle will automatically operate, which is equivalent to a manual confirmation method;

[0132] (3) The equipment detects the surrounding visibility based on sensors. When visibility conditions cannot meet the requirements, it outputs relevant safety information to the train control system and train personnel, and manually changes part of the train control system operations to manual operations.

[0133] (4) The equipment extracts the temperature, humidity, and image features of the surrounding environment and compares them with historical data and parameters. If the difference exceeds the allowable threshold, an alarm should be given and manual operation should be switched.

[0134] In step T4, the braking instruction includes:

[0135] (1) When the visibility around the train is no longer able to support its normal operation, manual braking is performed;

[0136] (2) When a train unexpectedly slips, an alarm is sounded and manual braking is performed;

[0137] (3) When the meteorological sensor fails to connect, an alarm is sounded and manual braking is performed;

[0138] (4) If an obstacle / previous vehicle appears in front of the train, the on-board module controls the train to run at a low speed, issues an alarm, and applies brakes based on the obstacle distance information / previous vehicle distance information.

[0139] In addition, the train braking in step T4 has the following problems in actual operation:

[0140] (1) Under slippery track conditions, the anti-skid capability of the leading vehicle is not as good as expected.

[0141] For this problem, the following strategies are proposed:

[0142] (1) When calculating the braking distance in rainy and snowy conditions, the train's runaway distance should be appropriately considered.

[0143] like Figure 3 As shown, in another embodiment, in step S23 of the construction method, a hazard key point is used to locate the train in the wrong track under complex line conditions, and an improvement plan for the train control system is constructed for the hazard key point.

[0144] The purpose of the train control system improvement plan is to enhance the safe operation of trains. The train control system improvement plan includes:

[0145] Step Q1, obtaining a specific error mode of the train positioning wrong track under the complex line condition;

[0146] The error modes include: the train mistakenly runs to other vacant tracks or the train mistakenly runs to tracks occupied by other trains;

[0147] If the error mode is that the train mistakenly travels to other vacant tracks, go to step Q2;

[0148] The harmful consequence of the train mistakenly running to other vacant tracks is that the operating parameters such as speed and acceleration adapted to the train running on different tracks are inconsistent; therefore, derailment may occur in this case.

[0149] If the error mode is that the train mistakenly runs onto a track occupied by another train, go to step Q3;

[0150] The harmful consequence of the train running onto the track occupied by other trains by mistake is that because the train runs onto the track occupied by other trains, there are the wrongly running train and at least one normally running train on the same track; so when this happens, a rear-end collision may occur.

[0151] Step Q2, sending the operating parameters applicable to the vacant track to the train, and adjusting the switch of the vacant track, so that the train returns to the correct track at the next switch;

[0152] Step Q3, sending the safety-adjusted operating parameters to all trains on the track occupied by other trains, and adjusting the switches on the track to return the train to the correct track at the next switch;

[0153] Among them, the operating parameters after safety adjustment are explained. Because there are at least two trains (this train and other trains) occupying the track, it is necessary to collect the operating parameters of all trains and perform corresponding calculations to obtain the operating parameters under safe operation, so that the train can safely return to the correct track.

[0154] In addition, the situation where the train is positioned on the wrong track can be avoided by designing an advance reminder mechanism. Specifically, this can be achieved by designing signal lights and enhancing the driver's attention. By designing appropriate signal light schemes and improving the driver's attention, the safety risks of train autonomous positioning in some scenarios can be effectively avoided.

[0155] For example, when the train starts on the correct track, the train control on-board equipment must actively send a prompt to the driver, reminding him to pay attention to the status of the signal light ahead: when the light is found to be on and red, or off but not a permission signal, brake in time. The prompt should be a repeated reminder, requiring the driver to confirm repeatedly until the train issues an instruction to drive.

[0156] The following will be explained from the perspective of unsafe control behavior.

[0157] In step S23 of the construction method, other methods may be used to construct a train control system improvement plan for the unsafe control behavior, thereby achieving better technical effects.

[0158] The following will introduce a specific embodiment of step S23 using two methods to construct a train control system improvement method for unsafe control behavior.

[0159] like Figure 4 As shown, this case proposes to adopt a train control expected functional safety analysis method based on GSN (Goal structuring notation) to construct a train control system improvement plan for unsafe control behaviors, which is applicable to step S23; the improvement plan includes:

[0160] Step W1, construct safety goals based on unsafe control behaviors;

[0161] Step W2, propose security strategies based on security goals;

[0162] Step W3, refine the security strategy and obtain several security sub-goals;

[0163] Step W4: Build a train control system improvement plan based on the safety sub-goal.

[0164] For example, in a specific embodiment, the unsafe control behavior is that after the front vehicle's approach section is unlocked, the virtually coupled rear vehicle illegally enters the front vehicle's approach section; the safety goal for this unsafe control behavior is: "When the virtually coupled front vehicle enters the front vehicle's approach section, the rear vehicle will not enter the front vehicle's approach section." A safety strategy is proposed for this safety goal.

[0165] Here, the aforementioned concepts are explained:

[0166] Virtual coupling is a system that connects several trains through communication. Several trains travel along the same route, at the same speed, and in the same direction. Taking into account communication delays, the trains should maintain the same braking characteristics.

[0167] In such a group of trains, the front and rear trains must have a sufficient safety distance during the process to ensure that the rear train can brake and stop at the last known position of the front train. Therefore, the safety distance between the front and rear trains must be more than several kilometers. Generally, the route section of a single train can be adjusted and changed.

[0168] However, in actual applications, the rear vehicle may intrude into the route section belonging to the front vehicle due to objective or subjective human factors such as the rear vehicle's failure to brake in time and the brake system's failure to react in time.

[0169] In this regard, three security strategies are proposed for security goals:

[0170] (1) RBC should correctly send the following vehicle's operation information to the interlocking;

[0171] (2) When the interlock finds that the rear vehicle cannot brake, the front vehicle’s approach section will not be unlocked;

[0172] (3) Ensure that the following vehicle stops before the EOA (End of Authority, speed limit sign);

[0173] The three safety strategies are refined into three safety sub-goals, which are the safety sub-goals for RBC, interlocking and on-board equipment:

[0174] (1) Security sub-goal output to RBC: ensuring the normal operation and transmission of information by RBC;

[0175] (2) Output to the safety sub-goal of the interlocking; when the interlocking finds that the rear vehicle of the virtual coupling is in a section close to the approaching path of the front vehicle, if the distance is insufficient and the brake cannot be applied, the interlocking shall not unlock the section in the approaching path of the front vehicle, and the virtual coupling continues to travel;

[0176] (3) Safety sub-goal output to on-board equipment: autonomously control the train to stop at a safe distance, and the runaway distance must not exceed the safe distance.

[0177] The train control system improvement plan is constructed according to the preceding vehicle approach section, so the train control system improvement plan is as follows:

[0178] RBC shall send information about whether the rear vehicle is in the section close to the front vehicle to the interlocking. If it is found that the rear vehicle of the original virtual coupling is in the section close to the front vehicle, it shall be handled in three cases:

[0179] (1) If the preceding vehicle has already entered the preceding vehicle approach section, the interlock shall not unlock the preceding vehicle approach section for the following vehicle;

[0180] (2) At this time, if the front vehicle has not yet entered the front vehicle approach section, the RBC can send an inquiry request to the rear vehicle. If the rear vehicle replies that it can stop in time, the interlock allows the front vehicle to operate normally;

[0181] (3) If the vehicle ahead has not yet entered the route section, RBC can send an inquiry request to the vehicle behind. If the vehicle behind replies that it cannot stop, the route section will not be opened.

[0182] The above is a combination of a GSN-based train control expected functional safety analysis method and step S23. The following will introduce another method and step S23.

[0183] like Figure 5As shown, in another preferred embodiment, it is proposed here to use an intelligent STPA (Systems Theoretic Process Analysis) method to construct a train control system improvement plan for unsafe control behaviors. The S2 step can gradually improve the unsafe control behavior to achieve the expected goal.

[0184] The improvement scheme includes:

[0185] Step E1, identify the major categories of unsafe control actions;

[0186] Step E2, establishing a model suitable for the train control system based on STPA technology;

[0187] Step E3, identifying specific unsafe control behaviors in the train control system according to the model;

[0188] Step E4, substituting specific unsafe control behaviors into the model for optimization to form safety constraint information;

[0189] Step E5: Using the safety constraint information as a reference factor for the train control system improvement plan to construct the train control system improvement plan.

[0190] The following are specific embodiments:

[0191] In step E1, in the embodiment, the major category of unsafe control behavior is random failure of cloud data center equipment leading to dangerous alarms;

[0192] In step E2, the model includes: RBC, which serves as the center for receiving and transmitting data and commands; a number of ATPs, any of which is connected to the RBC signal and maintains continuous data exchange, and is connected to each other by signal and maintains continuous data exchange, so as to realize the automatic driving operation of the train and the automatic adjustment function of the train operation in the section; a number of CBIs (Computer Based Interlocking, computer interlocking), any of which is connected to the RBC signal and maintains continuous data exchange, so as to realize the control between the turnouts, signal machines and tracks in the station.

[0193] In step E3, since the large category has been obtained in step E1, the model here can locate the specific unsafe control behavior more quickly. In this embodiment, the specific unsafe control behavior located is that the RBC sends an erroneous driving permit to the train;

[0194] In step E4, RBC sends an erroneous driving permit to the train. This specific unsafe control behavior is substituted into the aforementioned model for optimization to obtain safety constraint information; the safety constraint information includes the operation behavior of each component (RBC, ATP, CBI), and the operation behavior of the operator, etc.

[0195] In a preferred embodiment, after step E4 is executed, step E5 is not entered; the model is optimized with the safety constraint information obtained in step E4, and then step E1 is performed again. This is called model optimization, and the model optimization can be performed several times according to actual conditions; model optimization can increase the value of the safety constraint information finally obtained.

[0196] Although the content of the present invention has been described in detail through the above preferred embodiments, it should be appreciated that the above description should not be considered as a limitation of the present invention. After reading the above content, it will be apparent to those skilled in the art that various modifications and substitutions of the present invention will occur. Therefore, the protection scope of the present invention should be limited by the appended claims.

Claims

1. A method for constructing a safety assurance method for a train control system, characterized in that: The construction method comprises: Step S1, constructing a train control system based on demand and combining SOTIF technology; Step S2, identifying critical points of danger / unsafe control behaviors in the train control system, and making targeted improvements to the train control system based on the critical points of danger / unsafe control behaviors; Step S3, verifying the reliability of the train control system after the directional improvement; Step S4, making safety adjustments to the train control system after directional improvement and outputting the results.

2. The method for constructing a safety assurance method for a train control system according to claim 1, characterized in that: The step S2 comprises: Step S21, inputting a risk scenario containing a critical point of danger to the train control system and performing a risk assessment to determine whether the risk of the critical point of danger is within a threshold range, if so, proceeding to step S22; if not, proceeding to step S23; Step S22, determining whether the operation risk of the train control system under the SOTIF-related standards is within the threshold range. If so, it means that there is no unsafe control behavior, and the process goes to step S27; if not, it means that there is an unsafe control behavior, and the process goes to step S23; Step S23, constructing a train control system improvement plan according to the critical points of danger and / or unsafe control behaviors; Step S24, improving the existing train control system according to the train control system improvement plan to obtain a train control system to be verified; Step S25, determining whether the operating risk of the train control system to be verified under the SOTIF-related standards is within the threshold range; if so, it means that there is no unsafe control behavior, the verification of the train control system to be verified is completed, and the process proceeds to step S27; if not, the process proceeds to step S26; Step S26, constructing a train control system improvement plan based on the unsafe control behavior, and returning to step S24; Step S27, outputting the improved train control system.

3. The method for constructing a safety assurance method for a train control system according to claim 2, characterized in that: The risk scenarios of the critical hazard points include: known risk scenarios and unknown risk scenarios; The known risk scenarios refer to the limitations, boundary conditions, and scenario patterns that have been identified and understood; The unknown risk scenarios refer to scenario modes that are not foreseen or fully understood during the system design and testing process.

4. The method for constructing a safety assurance method for a train control system according to claim 3, characterized in that: In the step S23, the critical point of the hazard is that the lack of train autonomous perception causes braking delay, and a train control system improvement plan is constructed for the critical point of the hazard; The train control system to which the improved scheme is applicable includes: Braking module, which realizes the automatic driving of trains and the automatic adjustment of train operation in sections; RBC, a computer control system based on wireless communication, can issue train operation permits and train control information to all trains within its jurisdiction based on train location, operation, line conditions, dispatching orders and route status; On-board sensors to read external data; The brake module is respectively connected to the sensor, RBC, and train, continuously receives information from the on-board sensor, RBC, and train, and brakes the train according to the received information.

5. The method for constructing a safety assurance method for a train control system according to claim 4, characterized in that: The improvement scheme includes: Step T1, detecting the train running environment through on-board sensors to obtain train running environment information; Step T2, RBC receives train operation environment information from onboard sensors, analyzes the train operation environment information and transmits it to the brake module; Step T3, the braking module receives the train operation environment information from the sensor, the train operation environment information after RBC analysis, and the train's own operation information, and issues a braking command to the train after analysis; Step T4: the train brakes according to the braking command.

6. The method for constructing a safety assurance method for a train control system according to claim 5, characterized in that: In step T4, the braking instruction includes: When the visibility around the train is no longer able to support its normal operation, manual braking is performed; When the train unexpectedly slips, an alarm is sounded and the brakes are manually operated; When the meteorological sensor fails to connect, an alarm is sounded and manual braking is performed; If an obstacle / previous vehicle appears in front of the train, the on-board module controls the train to run at a low speed, issues an alarm, and applies brakes based on the obstacle distance information / previous vehicle distance information.

7. The method for constructing a safety assurance method for a train control system according to claim 3, characterized in that: In the step S23, the critical point of the hazard is used to locate the train in the wrong track under the complex line condition, and an improvement plan of the train control system is constructed for the critical point of the hazard; The improvement scheme includes: Step Q1, obtaining the specific error mode of the train positioning wrong track under the complex line condition, wherein the error mode includes: the train mistakenly runs to other vacant tracks or the train mistakenly runs to tracks occupied by other trains; if the error mode is that the train mistakenly runs to other vacant tracks, proceed to step Q2; if the error mode is that the train mistakenly runs to tracks occupied by other trains, proceed to step Q3; Step Q2, sending the operating parameters applicable to the vacant track to the train, and adjusting the switch of the vacant track, so that the train returns to the correct track at the next switch; Step Q3, sending the safely adjusted operating parameters to all trains on the track occupied by other trains, and adjusting the switches on the track to return the train to the correct track at the next switch.

8. The method for constructing a safety assurance method for a train control system according to claim 3, characterized in that: In step S23, a train control system improvement plan is constructed for unsafe control behaviors using a train control expected function safety analysis method based on GSN. The improvement plan includes: Step W1, construct safety goals based on unsafe control behaviors; Step W2, propose security strategies based on security goals; Step W3, refine the security strategy and obtain several security sub-goals; Step W4: Build a train control system improvement plan based on the safety sub-goal.

9. The method for constructing a safety assurance method for a train control system according to claim 8, characterized in that: The unsafe control behavior is that after the front vehicle approach section is unlocked, the rear vehicle is virtually connected and illegally enters the front vehicle approach section; Step W1, constructing a safety goal based on the unsafe control behavior: "When the virtual coupled front vehicle enters the front vehicle approach section, the rear vehicle will not enter the front vehicle approach section"; Step W2, three safety strategies are proposed for the safety goal: RBC should correctly send the operation information of the rear vehicle to the interlock; when the interlock finds that the rear vehicle cannot brake, the front vehicle’s approach section will not be unlocked; ensure that the rear vehicle stops before the EOA; Step W3, refine the three security policies to obtain three security sub-goals; Security sub-goals output to RBC: Ensure the normal operation and transmission of information by RBC; Output to the safety sub-goal of the interlock: when the interlock finds that the rear vehicle of the virtual coupling is in a section close to the approaching route of the front vehicle, if the distance is insufficient and the brake cannot be applied, the interlock shall not unlock the section in the approaching route of the front vehicle, and the virtual coupling continues to travel; The safety sub-goal output to the on-board equipment is: autonomously control the train to stop at a safe distance, and the escape distance must not exceed the safe distance; Step W4, constructing a train control system improvement plan based on the safety sub-goal and constructing a train control system improvement plan based on the preceding vehicle approach section.

10. The method for constructing a safety assurance method for a train control system according to claim 9, characterized in that: The train control system improvement scheme of step W4 includes: If the preceding vehicle has already entered the preceding vehicle approach section, the interlock shall not unlock the preceding vehicle approach section for the following vehicle; If the front vehicle has not yet entered the front vehicle approach section, the RBC can send an inquiry request to the rear vehicle. If the rear vehicle replies that it can stop in time, the interlock allows the front vehicle to operate normally; If the front vehicle has not yet entered the front vehicle approach section, RBC can send an inquiry request to the rear vehicle. If the rear vehicle replies that it cannot stop, the front vehicle approach section will not be opened.

11. The method for constructing a safety assurance method for a train control system according to claim 3, characterized in that: In step S23, an intelligent STPA method is used to construct a train control system improvement plan for the unsafe control behavior, and the improvement plan includes: Step E1, identify the major categories of unsafe control actions; Step E2, establishing a model suitable for the train control system based on STPA technology; Step E3, identifying specific unsafe control behaviors in the train control system according to the model; Step E4, substituting specific unsafe control behaviors into the model for optimization to form safety constraint information; Step E5: Using the safety constraint information as a reference factor for the train control system improvement plan to construct the train control system improvement plan.

12. The method for constructing a safety assurance method for a train control system according to claim 11, characterized in that: In step E2, the model includes: RBC, which serves as the center for receiving and transmitting data and commands; a number of ATPs, any of which is connected to the RBC signal and maintains continuous data exchange, and is connected to each other by signal and maintains continuous data exchange, so as to realize the automatic driving operation of the train and the automatic adjustment function of the train running in the section; a number of CBIs, any of which is connected to the RBC signal and maintains continuous data exchange, so as to realize the control between the turnouts, signal machines and tracks in the station.

13. The method for constructing a safety assurance method for a train control system according to claim 12, characterized in that: After the step E4 is executed, the step E5 is not entered; the model is optimized using the safety constraint information obtained in the step R4, and then the step E1 is performed again.

14. The method for constructing a safety assurance method for a train control system according to claim 3, characterized in that: The step S26 comprises: Step S261, extracting unsafe control behaviors of the train control system to be verified under SOTIF related standards; Step S262, performing an operation risk assessment on the unsafe control behavior to obtain an operation risk assessment result; Step S263: construct a train control system improvement plan based on the operation risk assessment results.

15. The method for constructing a safety assurance method for a train control system according to claim 3, characterized in that: The step S3 comprises: GAN and artificial intelligence are used to verify the improved train control system.

16. The method for constructing a safety assurance method for a train control system according to claim 3, characterized in that: The step S4 comprises: The improved train control system is combined with safety parameters and safety adjustments are made using the target structure representation method or the extended evidence network method.

17. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements a method for constructing a safety assurance method for a train control system as described in any one of claims 1-16.

18. An electronic device, characterized in that: It comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, a method for constructing a safety assurance method for a train control system as described in any one of claims 1 to 16 is implemented.

Images