Secure communication method and device for automatic train control system and medium

Abstract

The invention relates to a safety communication method, equipment and medium for an automatic train control system, the method realizes effective control of SIL2 equipment on SIL4 equipment through a safety communication protocol, the SIL2 equipment is an automatic train monitoring system (ATS), the SIL4 equipment is a vehicle-mounted controller (VOBC), the ATS issues a safety command to the VOBC through the safety communication protocol, and the SIL4 equipment is a vehicle-mounted controller (VOBC). And the dispatching terminal remotely operates the unmanned train to carry out danger avoiding action. Compared with the prior art, a more reliable safe operation mechanism is provided for the unmanned train, the overall efficiency and safety of train operation are greatly improved, and meanwhile the riding experience of passengers is improved.

Description

Technical Field

[0001] The present invention relates to a train automatic control system, and in particular to a safety communication method, equipment and medium for a train automatic control system. Background Art

[0002] In the operation of the train automatic control system (CBTC), the train maintains close communication with key components such as the trackside equipment (ZC), the automatic train monitoring system (ATS), and the computer interlocking (CI). This communication enables the train to exchange information with external devices in real time, including train position speed, turnout status, and platform information, thereby achieving precise control of train operations. In the current interoperability specifications, the communication between these devices mostly relies on the Railway Signal Security Communication (RSSP-I) protocol based on UDP. This network protocol uses principles such as timestamps, feedback messages, and dual-channel verification to protect data frame duplication, loss, disorder, errors, and timeouts to ensure efficient and reliable data transmission.

[0003] In the design of rail transit safety architecture, the vehicle-mounted controller (VOBC), ZC and CI are all SIL4 devices, while ATS is a SIL2 device. Due to the difference in safety levels, relying solely on the RSSP-I protocol does not allow the SIL2-level ATS to directly control the SIL4-level VOBC to perform safety actions. However, in unmanned driving mode, once the train faces an emergency, manual intervention through the ATS interface is still required. For example, in the face of sudden flooding and earthquake outside the car, or sudden smoke and fire inside the car, the VOBC's automatic train protection system (ATP) needs to take evasive measures quickly. In this case, the unmanned train may not be able to respond to the ATS's evasive instructions in time due to the lack of real-time response from the driver, thus posing a threat to the safety of train operation. In addition, if a passenger accidentally triggers the escape handle, the VOBC will trigger an emergency brake (EB). At this time, the driver needs to enter the train from the outside to release the EB state. This process will undoubtedly seriously affect operational efficiency and passenger satisfaction.

[0004] After searching, Chinese patent publication number CN104442932A discloses a remote vehicle management system based on a rail transit integrated automation system. The dispatcher at the control center can monitor the vehicle operation status at the control center. As an important part of fully automatic driving, it greatly reduces the work that the driver is responsible for. The central dispatcher can monitor the status of multiple vehicles and focus on handling abnormal situations, which improves the automation level of the system. Parameters such as vehicle temperature can be set remotely, which improves the service level for passengers under fully automatic driving. The central dispatcher can detect vehicle fault status in time and can make efficient and accurate response strategies. However, this patent still has safety hazards during remote control. Therefore, how to provide a new safety communication protocol to achieve effective control of SIL4 equipment by SIL2 equipment and further improve the overall efficiency and safety of train operation has become a technical problem that needs to be solved. Summary of the invention

[0005] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a safe communication method, device and medium for a train automatic control system.

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] According to the first aspect of the present invention, a safety communication method for a train automatic control system is provided, which realizes effective control of a SIL2 device over a SIL4 device through a safety communication protocol. The SIL2 device is an automatic train monitoring system ATS, and the SIL4 device is an on-board controller VOBC. The ATS issues a safety command to the VOBC through a safety communication protocol, so that the dispatching terminal remotely operates the unmanned train to perform risk avoidance actions.

[0008] As a preferred technical solution, the method comprises the following steps:

[0009] Step S1, ATS is triggered to send an emergency alarm;

[0010] Step S2, ATS continues to send the first setting information packet to VOBC;

[0011] Step S3, after receiving the first setting information packet, VOBC continuously sends the first confirmation information packet to ATS;

[0012] Step S4, after receiving the first confirmation information packet, ATS stops sending the first setting information packet to VOBC and starts to continuously send the second setting information packet;

[0013] Step S5, after receiving the secondary setting information packet, VOBC executes the ATS command, stops sending the first confirmation information packet to ATS, and starts to send the second confirmation information packet continuously for a period of time;

[0014] Step S6: After receiving the secondary confirmation information packet, ATS stops sending the secondary setting information packet to VOBC.

[0015] As a preferred technical solution, the emergency state alarm in step S1 is collected by the ATS from the train or is actively triggered by the ATS.

[0016] As a preferred technical solution, the waiting time for the VOBC to receive the first confirmation information packet and the second setting information packet uses the same timer or is timed separately and is pre-stored in the configuration file of the VOBC.

[0017] As a preferred technical solution, the VOBC selects to execute different commands according to different conditions, and these command execution logics are pre-stored in the configuration file of the VOBC.

[0018] As a preferred technical solution, the ATS and VOBC periodically send UDP network packets to each other, and each packet contains multiple message sub-packets.

[0019] As a preferred technical solution, there is a message type parameter in the packet header of the first setting information packet and the second setting information packet, which is used to identify different sub-packet types.

[0020] As a preferred technical solution, the first setting information package and the second setting information package are sent only after the operator operates on the ATS interface, and are used to issue commands in case of train emergencies.

[0021] As a preferred technical solution, the first setting information package and the second setting information package contain the following parameters: ATS equipment number, ATS cycle number, train equipment number, abnormal reason code, setting command code and CRC64-bit check code.

[0022] As a preferred technical solution, the first confirmation information packet and the second confirmation information packet are used to confirm and feedback the setting command sent by the ATS, including the following parameters: ATS equipment number, train equipment number, train cycle number, command execution result and CRC64-bit check code.

[0023] According to a second aspect of the present invention, there is provided an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and the method described above is implemented when the processor executes the program.

[0024] According to a third aspect of the present invention, there is provided a computer-readable storage medium having a computer program stored thereon, wherein the program implements the method described above when executed by a processor.

[0025] Compared with the prior art, the present invention has the following advantages:

[0026] 1) The present invention can effectively solve the evacuation problem of unmanned trains. Taking the interaction between ATS and VOBC as an example, the SIL2 system sends instructions to the SIL4 system to realize the evacuation of passengers in the unmanned driving mode of the train. The present invention significantly improves the efficiency of passenger evacuation in sudden emergencies, thereby greatly enhancing the safety of the subway system.

[0027] 2) The present invention proposes an effective solution to the problem of EB caused by accidentally touching the handle on unmanned trains. When an unmanned train is running, if a passenger accidentally touches the emergency escape handle and causes the train EB to stop, the existing solution usually requires the driver to get on the train and take over manually. However, this patent solution allows the ATS operator to remotely check the status inside the train through the on-board intercom and surveillance cameras. If it is accidentally touched, the emergency state can be remotely turned off, the EB can be released, and the train can continue to run. This greatly reduces the time passengers stay on the train, improves the availability of the subway operation system, and enhances the passengers' riding experience.

[0028] 3) The present invention uses a double confirmation method to ensure the accuracy of the issued command. Taking the interaction between ATS and VOBC as an example, when ATS learns of the emergency state, it can first pop up a window to ask the ATS operator to issue a command, and then a second pop-up window to ask the operator to confirm. This method reduces the risk of incorrect operation caused by operator accidental touch or misjudgment, and enables the ATS operator to think about the consequences of the executed command. Therefore, the reliability of the subway system is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a timing diagram of network communication between ATS and VOBC of the present invention;

[0030] Figure 2 It is the communication flow chart of VOBC and ATS in the emergency state triggered by the train;

[0031] Figure 3 It is a flow chart of the communication between VOBC and ATS in the emergency state triggered by ATS;

[0032] Figure 4 This is a diagram showing the structure of the network packet sent by the ATS of the present invention to the VOBC;

[0033] Figure 5 This is a diagram of the structure of the VOBC packet sent to the ATS network in the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0035] The present invention proposes an innovative safety communication method, which aims to achieve effective control of SIL4 equipment by SIL2 equipment. Through the method proposed by the present invention, ATS can issue safety commands to VOBC through this method, so that the dispatcher can remotely operate the unmanned train to perform risk avoidance actions. This protocol provides a more reliable safety operation mechanism for unmanned trains, which not only greatly improves the overall efficiency and safety of train operation, but also improves the riding experience of passengers.

[0036] First reference Figure 1 , introduces the network communication method of the present invention. Next, the communication process between VOBC and ATS equipment is described:

[0037] Step S1: ATS is triggered into emergency state.

[0038] Step S2: ATS continues to send initial setup information packets to VOBC.

[0039] Step S3: After receiving the first setting information packet, VOBC continues to send the first confirmation information packet to ATS.

[0040] Step S4: After receiving the first confirmation information packet, ATS stops sending the first setting information packet to VOBC and starts to continuously send the second setting information packet.

[0041] Step S5: After receiving the secondary setting information packet, VOBC executes the ATS command, stops sending the first confirmation information packet to ATS, and starts to send the second confirmation information packet continuously for a period of time.

[0042] Step S6: After receiving the secondary confirmation information packet, ATS stops sending the secondary setting information packet to VOBC.

[0043] In step S1, the ATS can obtain emergency status alarms from the train or can be triggered by the ATS. Figure 2 and Figure 3 The method of the present invention is described in the actual train operation scenario:

[0044] Step T1: When the train is running, if the sensors in the train detect fire alarms, smoke alarms, flooding alarms, etc., or the emergency handle in the passenger area is pulled down, or the emergency handle in the driver's area is pulled down, then go to step T2. If the ATS detects an emergency outside the train, such as an earthquake, foreign objects intruding the track, or a platform fire alarm, then go to step T5.

[0045] Step T2: The train enters emergency mode and VOBC executes the default safety command.

[0046] Step T3: The train informs the ATS that the train has entered emergency mode through a periodic operation information sub-packet.

[0047] Step T4: The train will wait for an ATS command for a period of time. If the ATS command is not received within the time limit, go to step T11. If the handle is pulled down quickly multiple times within the time limit, go to step T13. If the first setting information packet sent by ATS is received within the time limit, go to step T8.

[0048] Step T5: ATS continues to send initial setup information packets to the train.

[0049] Step T6: After receiving the ATS message, the train enters emergency mode.

[0050] Step T7: The train sends the first confirmation packet to ATS.

[0051] Step T8: The train waits for the ATS's secondary confirmation packet within a certain period of time. If it is received within the time limit, go to step T9. If it is exceeded, go to step T11. If the handle is pulled down quickly multiple times during the waiting period, go to step T13. If a new initial setup packet is received within the time limit, go to step T7.

[0052] Step T9: The train executes the command of ATS and continues to send a second confirmation command to ATS.

[0053] Step T10: If the ATS instruction is successfully executed, go to step T12. If the ATS instruction is not successfully executed, go to step T11.

[0054] Step T11, VOBC runs the default security command and ends the process after execution is completed.

[0055] Step T12: VOBC executes the security command issued by ATS and ends the process after execution.

[0056] Step T13: VOBC makes the train stop urgently and opens the door. The process ends after the execution is completed.

[0057] In the above steps T4 and S8, the waiting time is configurable and can be set according to project requirements. The waiting time for the first and second confirmation message packets can use the same timer or be timed separately. These parameters can be pre-stored in the configuration file of VOBC.

[0058] In the above steps T11 and S13, the default command triggered by timeout and the door opening command triggered by multiple rapid pull-downs of the handle can be configured according to different projects. VOBC can choose to execute different commands according to different conditions (such as whether the train loses braking force, whether a fire is detected, etc.). These command execution logics can be pre-stored in the configuration file of VOBC.

[0059] The above communication process describes four types of network message packets. The following will explain the structure and function of these message packets in detail:

[0060] ATS and VOBC periodically send UDP network packets to each other, each packet contains multiple message sub-packets. The network packets follow the RSSP-I protocol to ensure the timeliness, order and integrity of the messages.

[0061] The network packet sent by ATS to VOBC is as follows Figure 4 As shown. The RSSP-I package contains the first setting information sub-package, the second setting information sub-package, etc. There is a message type parameter in the sub-package header to identify different sub-package types. The first setting information sub-package and the second setting information sub-package will only be sent after the operator operates on the ATS interface, and are used to issue commands in train emergencies. The first setting sub-package or the second setting sub-package contains the following parameters: ATS equipment number, ATS cycle number, train equipment number, abnormal reason code, setting command code, CRC64-bit check code. The setting command code includes but is not limited to: canceling the train emergency mode, resetting the handle state, opening or locking a side door, opening or locking an emergency escape door, emergency stop of the train or continuing to drive to the evacuation area, etc. The above commands can be executed in multiple combinations, and the commands can also be executed immediately or delayed for a period of time. The setting command code can be configured and changed according to the needs of different projects.

[0062] The network packet structure sent by VOBC to ATS is as follows Figure 5As shown, the RSSP-I packet contains the first confirmation information sub-packet and the reconfirmation information sub-packet. Similar to the packet sent by ATS, the identification of different sub-packet types depends on the sub-packet header. The first confirmation information sub-packet and the reconfirmation information sub-packet are used to confirm and feedback the setting command sent by ATS. The first confirmation sub-packet and the reconfirmation sub-packet contain the following parameters: ATS equipment number, train equipment number, train cycle number, command execution result, CRC64-bit check code. The command execution result parameter can tell the ATS whether the command has been successfully executed, or is currently in the execution state, or feedback the reason for the execution failure.

[0063] It should be understood that the present invention describes a safe communication method for a SIL2 system to control a SIL4 system, which can be implemented as communication between various modules of a railway signal system. For example, the present invention can be implemented as an interaction between an ATS and a train onboard control system. The software on the onboard system and the ATS contains code that can perform this function. It should be understood that the triggering method and operation strategy described above in this article can be modified by a person skilled in the art according to the needs of the project.

[0064] The embodiment of the present invention also provides an electronic device including a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or computer program instructions loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0065] Multiple components in the device are connected to the I / O interface, including: input units, such as keyboards, mice, etc.; output units, such as various types of displays, speakers, etc.; storage units, such as disks, optical disks, etc.; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunication networks.

[0066] The processing unit performs the various methods and processes described above, such as the method of the present invention. For example, in some embodiments, the method of the present invention can be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program can be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into RAM and executed by the CPU, one or more steps of the method of the present invention described above can be performed. Alternatively, in other embodiments, the CPU can be configured to perform the method of the present invention by any other appropriate means (e.g., by means of firmware).

[0067] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0068] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0069] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0070] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A secure communication method for a train automatic control system, characterized in that: The method realizes effective control of SIL4 equipment by SIL2 equipment through a safety communication protocol. The SIL2 equipment is an automatic train monitoring system ATS, and the SIL4 equipment is a vehicle-mounted controller VOBC. The ATS issues a safety command to the VOBC through a safety communication protocol, so that the dispatching terminal remotely controls the unmanned train to perform risk avoidance actions.

2. A secure communication method for a train automatic control system according to claim 1, characterized in that: The method comprises the following steps: Step S1, ATS is triggered to send an emergency alarm; Step S2, ATS continues to send the first setting information packet to VOBC; Step S3, after receiving the first setting information packet, VOBC continuously sends the first confirmation information packet to ATS; Step S4, after receiving the first confirmation information packet, ATS stops sending the first setting information packet to VOBC and starts to continuously send the second setting information packet; Step S5, after receiving the secondary setting information packet, VOBC executes the ATS command, stops sending the first confirmation information packet to ATS, and starts to send the second confirmation information packet continuously for a period of time; Step S6: After receiving the secondary confirmation information packet, ATS stops sending the secondary setting information packet to VOBC.

3. A secure communication method for a train automatic control system according to claim 2, characterized in that: The emergency state alarm in step S1 is acquired by the ATS from the train or is actively triggered by the ATS.

4. A secure communication method for a train automatic control system according to claim 2, characterized in that: The waiting time for the VOBC to receive the first confirmation information packet and the second setting information packet uses the same timer or is timed separately and is pre-stored in the configuration file of the VOBC.

5. A secure communication method for a train automatic control system according to claim 2, characterized in that: The VOBC selects and executes different commands according to different conditions, and the execution logic of these commands is pre-stored in the configuration file of the VOBC.

6. A secure communication method for a train automatic control system according to claim 2, characterized in that: The ATS and VOBC periodically send UDP network packets to each other, and each packet contains multiple message sub-packets.

7. A secure communication method for a train automatic control system according to claim 2, characterized in that: The packet headers of the first setting information packet and the second setting information packet contain a message type parameter for identifying different sub-packet types.

8. A secure communication method for a train automatic control system according to claim 2, characterized in that: The first setting information package and the second setting information package are sent only after the operator operates on the ATS interface, and are used to issue commands in case of train emergencies.

9. A secure communication method for a train automatic control system according to claim 2, characterized in that: The first setting information packet and the second setting information packet contain the following parameters: ATS equipment number, ATS cycle number, train equipment number, abnormal reason code, setting command code and CRC64-bit check code.

10. A secure communication method for a train automatic control system according to claim 2, characterized in that: The first confirmation information packet and the second confirmation information packet are used to confirm and feedback the setting command sent by the ATS, and include the following parameters: ATS equipment number, train equipment number, train cycle number, command execution result and CRC64-bit check code.

11. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to any one of claims 1 to 10 is implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images