High-speed train overspeed protection system and train control right switching method and system of train controller

Abstract

The present application relates to the field of railway control technology, and discloses a high-speed train overspeed protection system and a train control right switching method and system of an operation controller, comprising the following steps: real-time monitoring of an ATP device operating state, judging whether a switching condition is met; when an ATP device fault is detected or an inter-level switching instruction is received, a train operating state is used, a driver operates an ATP / LKJ selection switch to initiate a train control right switching request; the ATP device outputs a switching confirmation prompt through a human-machine interface DMI and collects a driver confirmation operation; after the driver confirms, the ATP device outputs an emergency braking instruction and disconnects a control connection with a train braking system; the LKJ device enters a monitoring-only non-control mode, wherein a braking output of the LKJ is physically isolated and only performs a running data recording and display function; the LKJ device takes over train operation monitoring, and the driver manually drives the train according to a target speed curve, signal state and line data provided by the LKJ display.

Description

Technical Field

[0001] This invention relates to the field of railway control technology, and in particular to a method and system for switching control rights between a high-speed train overspeed protection system and a train controller. Background Technology

[0002] Train control onboard systems are core equipment for ensuring the safe operation of high-speed railways. In my country, CTCS-3 (C3) and CTCS-2 (C2) train control systems (ATP) are the main control equipment for high-speed trains, while train operation monitoring devices (LKJ) are widely used on conventional lines and as a backup mode for the ATP system. In certain specific operating scenarios, such as the CRH380A-6040 EMU undertaking special transport missions, only CTCS-3 ATP equipment is equipped, without LKJ equipment.

[0003] When such EMUs operate on CTCS-2 level lines, if ground equipment or onboard ATP (Automatic Train Protection) fails, the current solution is for the driver to operate a disconnect switch to switch the ATP into isolation mode, relying entirely on manual driving for safety. This solution has significant drawbacks: First, the switching process must be carried out during the ATP's output braking, which is rushed. If the switching is not timely, it may lead to abnormal train stops, seriously affecting key transportation tasks. Second, in isolation mode, the ATP loses all monitoring functions, and driving safety depends entirely on the driver's lookout and reaction, resulting in insufficient safety redundancy. Although there are existing solutions for switching between ATP and LKJ (Low-Keeper Junction) in the technology, most rely on stopping for switching or ground transponder triggering, which cannot meet the requirement of achieving "seamless" hot standby takeover in the instant of ATP failure. There is a lack of a method and system that can safely, quickly, and automatically switch control from the faulty ATP to the backup LKJ equipment without stopping the train. Summary of the Invention

[0004] This invention provides a method and system for switching control of a high-speed train overspeed protection system and a train controller, in order to solve the problems existing in the current switching methods.

[0005] To achieve the above objectives, the present invention employs the following technical solution:

[0006] In a first aspect, the present invention provides a method for switching control of a high-speed train overspeed protection system and a train controller, comprising the following steps:

[0007] S1. Monitor the operating status of its internal modules and its communication status with ground equipment in real time through ATP equipment, and perform dynamic evaluation based on preset switching condition judgment logic.

[0008] S2. When the switching conditions are met, the driver initiates a request to switch control of the train to the ATP equipment by manually operating the ATP / LKJ selection switch set on the driver's console while the train is running without stopping.

[0009] S3 and ATP devices output switching confirmation prompts in a combination of graphics and voice through their integrated human-machine interface (DMI), and collect the driver's confirmation operation commands.

[0010] S4. Upon receiving the driver's confirmation instruction, the ATP device immediately outputs an emergency braking command and actively disconnects the control circuit connection between itself and the train braking system, thereby physically releasing control.

[0011] S5 and LKJ devices simultaneously enter a monitoring-only mode. In this mode, by placing the brake isolation switch on the LKJ main unit box in the isolation position, the brake output command is physically isolated, and the LKJ device switches to only performing the functions of recording running data, real-time display, and overspeed alarm.

[0012] The S6 and LKJ equipment officially took over the train operation monitoring function. The driver controlled the train operation manually based on the target speed curve, real-time signal status and preset track data provided by the LKJ display.

[0013] Optionally, the preset switching conditions in step S1 include at least one of the following situations:

[0014] The ATP device detected that continuous communication interruptions with the ground-based CTCS-2 level equipment exceeded a set threshold.

[0015] A malfunction is diagnosed in any critical module of the ATP device, including its core processing module, speed and distance measurement module, or safety computer.

[0016] The train received a command from the ground transponder to switch the train control level from CTCS-2 to CTCS-0.

[0017] The train's current operating speed is below 160 km / h, and the ATP device is not in braking mode.

[0018] Optionally, the monitoring-only mode in step S5 is implemented through a combination of hardware isolation and software shielding, specifically including:

[0019] Hardware level: Operate the physical brake disconnect switch on the LKJ main unit to cut off the electrical connection between the LKJ and the train's service brake and emergency brake circuits;

[0020] Display level: On the human-machine interface of the LKJ monitor, a clear "braking isolation" or "monitoring only" status indicator is continuously displayed;

[0021] At the software level: In the control software of the LKJ equipment, the generation and transmission of all braking control output commands are blocked, while its data acquisition, mileage calculation, speed monitoring and audible and visual alarm functions are retained and run.

[0022] Optionally, steps S4 and S5 of the switching process may further include data recording and synchronization steps:

[0023] The ATP device will record the time of occurrence, triggering conditions, train speed, location information and related equipment status parameters of this switching event in the judicial record unit (JRU).

[0024] The LKJ device synchronously collects and records the current train control status, raw locomotive signals provided by the ATP device, and train operation data through the communication interface.

[0025] Optionally, after step S6, a redundancy check and safe driving step after switching is also included:

[0026] The LKJ device uses its redundancy verification module to compare the locomotive signal it decodes with the original induction coil signal received from the ATP device in real time to verify the consistency between the two.

[0027] If the verification results are inconsistent, the LKJ device will immediately output a graded alarm prompt through its display and voice unit. The driver will then perform driving operations based on the alarm and the actual ground signal display.

[0028] Secondly, embodiments of this application provide a high-speed train overspeed protection system and a train control switching system for implementing any of the methods described in the first aspect, comprising:

[0029] The status monitoring module is used to monitor the operational health status of the ATP equipment, the communication link status with the ground equipment, and the real-time operating parameters of the train in real time.

[0030] The switching control module responds to the driver's operation command initiated by the selection switch or the triggering conditions automatically determined by the system, and the logic controls the orderly switching of vehicle control between ATP and LKJ.

[0031] The human-machine interface module, integrated into the ATP device, includes a DMI display unit and a voice prompt unit, which are used to output clear switching guidance and confirmation prompts to the driver and reliably collect the driver's confirmation feedback.

[0032] The braking control module is used to output emergency braking according to the ATP command during the switching process, and manages the isolation and interlocking of the ATP and LKJ braking outputs through physical circuits and logic control.

[0033] The data logging module, including the JRU on the ATP side and the data logger on the LKJ side, is used to synchronously record events, control status, and key operational data throughout the entire switching process.

[0034] Optionally, the switching control module is integrated inside the ATP host and further includes:

[0035] The switching logic processing unit, based on the input from the status monitoring module, executes a preset switching condition judgment algorithm and generates corresponding switching control commands.

[0036] The signal acquisition unit is used to acquire the physical status signal of the ATP / LKJ selection switch on the control panel in real time;

[0037] The communication interface unit adopts a secure communication protocol and is used to transmit status information synchronization and control handover instructions with the LKJ device.

[0038] Optionally, the braking control module further includes:

[0039] The emergency braking relay circuit adopts a power failure trigger safety design, which triggers emergency braking when the ATP actively disconnects the control connection during the switching process;

[0040] The service brake output circuit has multi-level braking output capability and supports precise braking control from maximum service brake to 1 / 4 level.

[0041] The braking isolation circuit achieves hard-wired isolation between the LKJ equipment's braking output circuit and the train's braking system through a physical isolation switch on the LKJ main unit box.

[0042] Optionally, the system also includes an integrated security enhancement module:

[0043] The redundancy check module, deployed in the LKJ device, is used to compare the original signal provided by the ATP device with the locomotive signal received by the LKJ itself in real time to ensure the consistency of the information source.

[0044] The safety interlock module, through hardware relay circuits or safety logic software, ensures that at any given time, only one of the ATP and LKJ devices has braking output authority, fundamentally preventing braking command conflicts.

[0045] Optionally, the system is specifically configured to be suitable for the CRH380A EMU platform and supports a safe and smooth seamless switching of train control in two different scenarios: high reliability requirements for special transport missions and high efficiency requirements for daily operations.

[0046] Beneficial effects:

[0047] The high-speed train overspeed protection system and control handover method provided by this invention, when the ATP (Automatic Train Protection) fails, allows the driver to trigger the handover process, and the system automatically outputs emergency braking and completes the transfer of control, avoiding train stops due to equipment failure and greatly improving operational efficiency, especially ensuring the punctuality and reliability of key tasks such as special transport. By introducing the "monitoring-only" mode of LKJ (Low-speed Train Control Unit), continuous speed monitoring, signal display, and track data support are provided to the driver after ATP failure, forming a safety redundancy of "manual driving + equipment monitoring," significantly reducing the safety risks of relying entirely on manual driving. Through interactive logic such as explicit prompts from DMI (Driver Management Interface), driver confirmation, and full recording by JRU (Junior Train Runner), the human-machine collaboration and traceability of the handover process are ensured. The added redundancy verification and safety interlocking mechanisms effectively prevent signal misjudgment and braking conflicts, further improving the reliability and safety of the entire handover process. Attached Figure Description

[0048] Figure 1 This is a flowchart of a preferred embodiment of the high-speed train overspeed protection system and the train control switching method of the train controller;

[0049] Figure 2 This is a schematic diagram of the high-speed train overspeed protection system and the train control switching system of the operation controller, which is a preferred embodiment of the present invention. Detailed Implementation

[0050] The technical solution of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, the terms "an" or "a" and similar terms do not indicate a quantity limitation, but rather indicate the presence of at least one. The terms "connected" or "linked" and similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up," "down," "left," "right," etc., are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship also changes accordingly.

[0052] Please see Figure 1 This application provides a method for switching control between a high-speed train overspeed protection system and a train controller, comprising the following steps:

[0053] S1. Monitor the operating status of its internal modules and its communication status with ground equipment in real time through ATP equipment, and perform dynamic evaluation based on preset switching condition judgment logic.

[0054] S2. When the switching conditions are met, the driver initiates a request to switch control of the train to the ATP equipment by manually operating the ATP / LKJ selection switch set on the driver's console while the train is running without stopping.

[0055] S3 and ATP devices output switching confirmation prompts in a combination of graphics and voice through their integrated human-machine interface (DMI), and collect the driver's confirmation operation commands.

[0056] S4. Upon receiving the driver's confirmation instruction, the ATP device immediately outputs an emergency braking command and actively disconnects the control circuit connection between itself and the train braking system, thereby physically releasing control.

[0057] S5 and LKJ devices simultaneously enter a monitoring-only mode. In this mode, by placing the brake isolation switch on the LKJ main unit box in the isolation position, the brake output command is physically isolated, and the LKJ device switches to only performing the functions of recording running data, real-time display, and overspeed alarm.

[0058] The S6 and LKJ equipment officially took over the train operation monitoring function. The driver controlled the train operation manually based on the target speed curve, real-time signal status and preset track data provided by the LKJ display.

[0059] Optionally, the preset switching conditions in step S1 include at least one of the following situations:

[0060] The ATP device detected that continuous communication interruptions with the ground-based CTCS-2 level equipment exceeded a set threshold.

[0061] A malfunction is diagnosed in any critical module of the ATP device, including its core processing module, speed and distance measurement module, or safety computer.

[0062] The train received a command from the ground transponder to switch the train control level from CTCS-2 to CTCS-0.

[0063] The train's current operating speed is below 160 km / h, and the ATP device is not in braking mode.

[0064] In the above embodiments, regarding status monitoring and switching condition judgment, when the train is running normally in the CTCS-2 level section, the status monitoring module inside the ATP equipment continuously performs self-diagnosis and environmental perception. This module monitors the operating status of the core modules inside the ATP (such as the Safety Computer SDP, speed and distance measurement unit, BTM transponder transmission module, and STM track circuit information reading module) in real time, and at the same time detects the quality of the communication link with the ground equipment.

[0065] The specific logic for determining the switching conditions is as follows:

[0066] Communication interruption: When ATP detects that communication with the ground CTCS-2 level track circuit is continuously interrupted through the STM module for more than a preset 3-second threshold, it determines that the switching conditions are met.

[0067] Internal Fault: If ATP’s self-diagnostic system detects inconsistencies in the safety computer dual-system comparison, a critical power module failure, or any core unit reporting an unrecoverable serious error, it will immediately trigger the internal fault flag.

[0068] Inter-level handover command: When the train passes through a ground transponder group at a specific location, and the BTM receives a message (such as the ETCS-41 packet) containing the level transition information of [CTCS-2→CTCS-0], the system automatically determines that a handover of train control is required.

[0069] Speed ​​and Braking Status: As a parallel safety condition, the system continuously checks whether the train's current speed is below 160 km / h and whether the ATP (Automatic Train Protection) is not in braking output mode. This condition ensures that the switching process is initiated under relatively low-speed and stable system conditions, improving safety.

[0070] In this embodiment, regarding the initiation of a switching request and confirmation via human-machine interaction, when the system determines that any of the aforementioned switching conditions are met, the ATP's DMI will provide an initial warning to the driver. Subsequently, the initiation of the switching request depends on the driver's manual decision and operation: the driver needs to operate the ATP / LKJ selection switch (a physical key switch or self-resetting knob) located on the right-side panel of the dashboard, switching it from the "ATP" position to the "LKJ" position. This operation signal is captured in real time by the signal acquisition unit in the switching control module.

[0071] Next, the system enters the human-machine interaction confirmation phase. The switching control module instructs the human-machine interaction module to pop up a high-priority modal dialog box on the DMI, displaying explicit text such as: "Switching to LKJ mode has been requested. This operation will trigger emergency braking. Confirm execution?", accompanied by a synthesized voice prompt. The driver must click the "Confirm" button on the touchscreen on this interface. This dual confirmation mechanism of "physical switch request + screen touch confirmation" is a key design feature in this embodiment to prevent accidental operation.

[0072] Optionally, the monitoring-only mode in step S5 is implemented through a combination of hardware isolation and software shielding, specifically including:

[0073] Hardware level: Operate the physical brake disconnect switch on the LKJ main unit to cut off the electrical connection between the LKJ and the train's service brake and emergency brake circuits;

[0074] Display level: On the human-machine interface of the LKJ monitor, a clear "braking isolation" or "monitoring only" status indicator is continuously displayed;

[0075] At the software level: In the control software of the LKJ equipment, the generation and transmission of all braking control output commands are blocked, while its data acquisition, mileage calculation, speed monitoring and audible and visual alarm functions are retained and run.

[0076] In the above embodiments, the LKJ entering the "monitoring-only" mode is one of the core innovations of this invention. The following three mechanisms ensure that the LKJ does not generate unexpected braking output when taking over the monitoring function:

[0077] Hardware physical isolation: During system switching or as prompted, the driver or onboard mechanic must operate the brake output isolation switch on the LKJ main unit box, rotating it from the "normal" position to the "isolated" position. This operation directly cuts off all electrical connections between the LKJ main unit and the train brake valve through the brake isolation circuit, achieving the highest level of physical isolation for safety.

[0078] Software logic shielding: The system sends a mode switching command to the LKJ host via the communication network. Upon receiving the command, the LKJ control software (such as the LKJ2000 host program) shields all braking output functions within its internal logic. Even if the overspeed calculation module determines that intervention is necessary, the software will not generate or issue any braking commands.

[0079] Clear Status Display: After successfully entering the mode, the LKJ's display (such as the TSC2 model) continuously displays a red "Brake Isolation" or "Monitoring Only" indicator in a prominent position on the screen (such as the status bar), providing the driver with clear status information.

[0080] In this embodiment, after the LKJ takeover and manual driving are completed, the train enters a backup mode of "LKJ monitoring + manual driving". The driver manually operates the train based on the target-distance pattern curve, the status of the forward signal, the permissible speed and gradient provided by the LKJ display. The LKJ equipment continues to execute its complete monitoring algorithm and issues audible and visual alarms in case of abnormalities such as speeding, but the braking output is completely disabled, forming an effective safety redundancy of "equipment alarm, manual execution".

[0081] Optionally, steps S4 and S5 of the switching process may further include data recording and synchronization steps:

[0082] The ATP device will record the time of occurrence, triggering conditions, train speed, location information and related equipment status parameters of this switching event in the judicial record unit (JRU).

[0083] The LKJ device synchronously collects and records the current train control status, raw locomotive signals provided by the ATP device, and train operation data through the communication interface.

[0084] Optionally, after step S6, a redundancy check and safe driving step after switching is also included:

[0085] The LKJ device uses its redundancy verification module to compare the locomotive signal it decodes with the original induction coil signal received from the ATP device in real time to verify the consistency between the two.

[0086] If the verification results are inconsistent, the LKJ device will immediately output a graded alarm prompt through its display and voice unit. The driver will then perform driving operations based on the alarm and the actual ground signal display.

[0087] In the above embodiments, to ensure process traceability and operational security, the system synchronously performs the following operations in the background for data recording and redundancy verification:

[0088] Full-process data recording: The data loggers on the ATP side (JRU) and LKJ side operate synchronously. They record the entire switching event sequence with high-precision timestamps, including: trigger conditions, driver operation time points, braking command output time, changes in control status, and related speed and position signals. This provides a complete and reliable data chain for post-event safety analysis.

[0089] Signal Redundancy Verification: After the switchover is complete, the redundancy verification module within the LKJ device is activated. This module compares in real time the track circuit information received by the LKJ via its own STM with the original induction coil signals forwarded from the ATP device via the MVB bus. If a code inconsistency is detected (e.g., the LKJ decodes to HU code, but the ATP transmits UU code), the LKJ will immediately display a "Signal Inconsistency" alarm and issue a strong voice prompt. Upon receiving this alarm, the driver must take preventative measures such as reducing speed and rely on the actual display of the ground signal as the final driving basis, thus effectively mitigating the risk of a single signal source failure.

[0090] like Figure 2As shown in the embodiments of this application, a high-speed train overspeed protection system and a train control switching system for implementing a method for switching control authority between a high-speed train overspeed protection system and a train controller is also provided, comprising:

[0091] The status monitoring module is used to monitor the operational health status of the ATP equipment, the communication link status with the ground equipment, and the real-time operating parameters of the train in real time.

[0092] The switching control module responds to the driver's operation command initiated by the selection switch or the triggering conditions automatically determined by the system, and the logic controls the orderly switching of vehicle control between ATP and LKJ.

[0093] The human-machine interface module, integrated into the ATP device, includes a DMI display unit and a voice prompt unit, which are used to output clear switching guidance and confirmation prompts to the driver and reliably collect the driver's confirmation feedback.

[0094] The braking control module is used to output emergency braking according to the ATP command during the switching process, and manages the isolation and interlocking of the ATP and LKJ braking outputs through physical circuits and logic control.

[0095] The data logging module, including the JRU on the ATP side and the data logger on the LKJ side, is used to synchronously record events, control status, and key operational data throughout the entire switching process.

[0096] Optionally, the switching control module is integrated inside the ATP host and further includes:

[0097] The switching logic processing unit, based on the input from the status monitoring module, executes a preset switching condition judgment algorithm and generates corresponding switching control commands.

[0098] The signal acquisition unit is used to acquire the physical status signal of the ATP / LKJ selection switch on the control panel in real time;

[0099] The communication interface unit adopts a secure communication protocol and is used to transmit status information synchronization and control handover instructions with the LKJ device.

[0100] Optionally, the braking control module further includes:

[0101] The emergency braking relay circuit adopts a power failure trigger safety design, which triggers emergency braking when the ATP actively disconnects the control connection during the switching process;

[0102] The service brake output circuit has multi-level braking output capability and supports precise braking control from maximum service brake to 1 / 4 level.

[0103] The braking isolation circuit achieves hard-wired isolation between the LKJ equipment's braking output circuit and the train's braking system through a physical isolation switch on the LKJ main unit box.

[0104] In the above embodiments, for ATP control release and safety braking, after obtaining final confirmation from the driver, the system immediately executes the core safety operation of control transfer. The switching control module sends a sequence of commands to the braking control module:

[0105] Triggering emergency braking: The ATP controls the de-energization of its internal emergency braking relay (EBR). This relay adopts a de-energized safety design, where its normally closed contacts open, thereby disconnecting the train's emergency braking loop, and the train begins to apply maximum service braking or emergency braking.

[0106] Active disconnection of control connection: At the same time, the ATP controls all its commonly used braking output relays to lose power, physically and completely disconnecting the control circuit between the ATP and the train braking system, thus completing the active and safe release of control.

[0107] Optionally, the system also includes an integrated security enhancement module:

[0108] The redundancy check module, deployed in the LKJ device, is used to compare the original signal provided by the ATP device with the locomotive signal received by the LKJ itself in real time to ensure the consistency of the information source.

[0109] The safety interlock module, through hardware relay circuits or safety logic software, ensures that at any given time, only one of the ATP and LKJ devices has braking output authority, fundamentally preventing braking command conflicts.

[0110] In the above embodiments, a system-level safety interlock serves as the ultimate safety barrier, and the system is designed with a safety interlock module. This module implements its logic through a hardware interlock relay circuit: when the ATP controls the vehicle, it activates a relay, and the normally closed contact of the relay opens, putting the effective braking output circuit of the LKJ in an open circuit state; during the switching process, the state of the relay changes, but it works in conjunction with the physical isolating switch of the LKJ to ensure that at any time, the braking outputs of the ATP and the LKJ are absolutely mutually exclusive both electrically and logically, fundamentally eliminating the safety accidents that may be caused by braking command conflicts between devices.

[0111] Optionally, the system is specifically configured to be suitable for the CRH380A EMU platform and supports a safe and smooth seamless switching of train control in two different scenarios: high reliability requirements for special transport missions and high efficiency requirements for daily operations.

[0112] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method for switching control authority between a high-speed train overspeed protection system and a train controller, characterized in that, Includes the following steps: S1. Monitor the operating status of its internal modules and its communication status with ground equipment in real time through ATP equipment, and perform dynamic evaluation based on preset switching condition judgment logic. S2. When the switching conditions are met, the driver initiates a request to switch control of the train to the ATP equipment by manually operating the ATP / LKJ selection switch set on the driver's console while the train is running without stopping. S3 and ATP devices output switching confirmation prompts in a combination of graphics and voice through their integrated human-machine interface (DMI), and collect the driver's confirmation operation commands. S4. Upon receiving the driver's confirmation instruction, the ATP device immediately outputs an emergency braking command and actively disconnects the control circuit connection between itself and the train braking system, thereby physically releasing control. S5 and LKJ devices simultaneously enter a monitoring-only mode. In this mode, by placing the brake isolation switch on the LKJ main unit box in the isolation position, the brake output command is physically isolated, and the LKJ device switches to only performing the functions of recording running data, real-time display, and overspeed alarm. The S6 and LKJ equipment officially took over the train operation monitoring function. The driver controlled the train operation manually based on the target speed curve, real-time signal status and preset track data provided by the LKJ display.

2. The method for switching control of a high-speed train overspeed protection system and a train controller according to claim 1, characterized in that, The preset switching conditions in step S1 include at least one of the following situations: The ATP device detected that continuous communication interruptions with the ground-based CTCS-2 level equipment exceeded a set threshold. A malfunction is diagnosed in any critical module of the ATP device, including its core processing module, speed and distance measurement module, or safety computer. The train received a command from the ground transponder to switch the train control level from CTCS-2 to CTCS-0. The train's current operating speed is below 160 km / h, and the ATP device is not in braking mode.

3. The method for switching control rights between the high-speed train overspeed protection system and the train controller according to claim 1, characterized in that, The monitoring-only mode in step S5 is implemented through a combination of hardware isolation and software shielding, specifically including: Hardware level: Operate the physical brake disconnect switch on the LKJ main unit to cut off the electrical connection between the LKJ and the train's service brake and emergency brake circuits; Display level: On the human-machine interface of the LKJ monitor, a clear "braking isolation" or "monitoring only" status indicator is continuously displayed; At the software level: In the control software of the LKJ equipment, the generation and transmission of all braking control output commands are blocked, while its data acquisition, mileage calculation, speed monitoring and audible and visual alarm functions are retained and run.

4. The method for switching control rights between the high-speed train overspeed protection system and the train controller according to claim 1, characterized in that, Steps S4 and S5 of the switching process also include data recording and synchronization steps: The ATP device will record the time of occurrence, triggering conditions, train speed, location information and related equipment status parameters of this switching event in the judicial record unit (JRU). The LKJ device synchronously collects and records the current train control status, raw locomotive signals provided by the ATP device, and train operation data through the communication interface.

5. The method for switching control rights between the high-speed train overspeed protection system and the train controller according to claim 1, characterized in that, Following step S6, the process also includes redundancy verification and safe driving steps after the switchover: The LKJ device uses its redundancy verification module to compare the locomotive signal it decodes with the original induction coil signal received from the ATP device in real time to verify the consistency between the two. If the verification results are inconsistent, the LKJ device will immediately output a graded alarm prompt through its display and voice unit. The driver will then perform driving operations based on the alarm and the actual ground signal display.

6. A high-speed train overspeed protection system and a train control switching system for implementing the method of any one of claims 1-5, characterized in that, include: The status monitoring module is used to monitor the operational health status of the ATP equipment, the communication link status with the ground equipment, and the real-time operating parameters of the train in real time. The switching control module responds to the driver's operation command initiated by the selection switch or the triggering conditions automatically determined by the system, and the logic controls the orderly switching of vehicle control between ATP and LKJ. The human-machine interface module, integrated into the ATP device, includes a DMI display unit and a voice prompt unit, which are used to output clear switching guidance and confirmation prompts to the driver and reliably collect the driver's confirmation feedback. The braking control module is used to output emergency braking according to the ATP command during the switching process, and manages the isolation and interlocking of the ATP and LKJ braking outputs through physical circuits and logic control. The data logging module, including the JRU on the ATP side and the data logger on the LKJ side, is used to synchronously record events, control status, and key operational data throughout the entire switching process.

7. The high-speed train overspeed protection system and the train control switching system of the operation controller according to claim 6, characterized in that, The switching control module is integrated inside the ATP host and further includes: The switching logic processing unit, based on the input from the status monitoring module, executes a preset switching condition judgment algorithm and generates corresponding switching control commands. The signal acquisition unit is used to acquire the physical status signal of the ATP / LKJ selection switch on the control panel in real time; The communication interface unit adopts a secure communication protocol and is used to transmit status information synchronization and control handover instructions with the LKJ device.

8. The high-speed train overspeed protection system and the train control switching system of the operation controller according to claim 6, characterized in that, The braking control module further includes: The emergency braking relay circuit adopts a power failure trigger safety design, which triggers emergency braking when the ATP actively disconnects the control connection during the switching process; The service brake output circuit has multi-level braking output capability and supports precise braking control from maximum service brake to 1 / 4 level. The braking isolation circuit achieves hard-wired isolation between the LKJ equipment's braking output circuit and the train's braking system through a physical isolation switch on the LKJ main unit box.

9. The high-speed train overspeed protection system and the train control switching system of the operation controller according to claim 6, characterized in that, The system also includes an integrated security enhancement module: The redundancy check module, deployed in the LKJ device, is used to compare the original signal provided by the ATP device with the locomotive signal received by the LKJ itself in real time to ensure the consistency of the information source. The safety interlock module, through hardware relay circuits or safety logic software, ensures that at any given time, only one of the ATP and LKJ devices has braking output authority, fundamentally preventing braking command conflicts.

10. The high-speed train overspeed protection system and the train control switching system of the operation controller according to claim 6, characterized in that, The system is specifically configured for the CRH380A EMU platform and supports a safe and smooth seamless switching of train control in two different scenarios: high reliability requirements for special transport missions and high efficiency requirements for daily operations.

Images