Signal system and control right switching method thereof

Abstract

The invention provides a signal system and a control right switching method thereof. The system comprises a first train control subsystem, a second train control subsystem and a fusion interface unit, the first train control subsystem comprises interlocking equipment; the second train control subsystem comprises a resource controller and an object controller; the fusion interface unit comprises a first interface for connecting the interlocking equipment and the resource controller, a second interface for connecting the interlocking equipment and the object controller, and a third interface for connecting the resource controller and the object controller; the signal system is configured as follows: one subsystem is used as a main system, the other subsystem is used as a standby system, when the main system needs to be switched, a control right state can be handed over through the first interface, and the standby system can monitor and control trackside equipment through the second interface and the third interface. And control right switching from the main system to the standby system is completed. After the main system breaks down, the standby system can be rapidly switched to continue operation, and the operation influence caused by the signal system fault is reduced.

Description

Technical Field

[0001] This invention relates to the field of rail transit technology, and in particular to a signaling system and a method for switching control of the same. Background Technology

[0002] Urban rail transit signaling systems are the core of ensuring the safe and efficient operation of trains. Currently, Communication-Based Train Control (CBTC) systems are mature and widely used, becoming the mainstream choice for new and upgraded lines. Through continuous vehicle-to-ground communication and the principle of moving block signaling, they achieve high-density, high-safety automated train operation.

[0003] Meanwhile, next-generation train operation control technologies are constantly evolving, characterized by a control architecture centered on resource management and enhanced autonomous perception and operational decision-making capabilities for trains. These new architectures theoretically offer greater system flexibility and simplification potential. However, these new technologies have not yet undergone long-term reliability verification through large-scale engineering applications, and their stability and maturity in engineering applications remain to be confirmed. Therefore, in reliability upgrades or renovation projects on existing lines, owners typically still prefer the less technically risky and well-proven CBTC system.

[0004] Existing technical solutions have significant shortcomings: If a line is equipped with only a single-type signaling system, such as a pure CBTC system, a failure in the core equipment of this system will lead to service interruptions or require significant degrading of operations, significantly impacting the reliability and service level of urban rail transit. Although theoretically a backup subsystem of the same type can be configured for the CBTC system, this would greatly increase construction costs and system complexity, making it not an economically efficient solution. On the other hand, if we wait for the next-generation technology to fully mature before applying it, we cannot leverage its technical characteristics at this stage to provide a heterogeneous and effective backup for the existing highly reliable CBTC system, thus failing to fundamentally improve the availability and resilience of the entire signaling system.

[0005] Therefore, the industry urgently needs an innovative solution that can effectively integrate new technologies with resource management and autonomous train operation capabilities, while fully leveraging existing mature and reliable CBTC systems, to construct a heterogeneous and redundant system. The key issue this system needs to address is the ability to quickly switch to the backup system in the event of a primary system failure, thereby minimizing operational downtime and reducing the operational impact of signaling system failures. Summary of the Invention

[0006] This invention provides a signaling system and its control switching method to address the shortcomings of existing technologies, such as high operational interruption risk due to single-point failures in the signaling system and the lack of reliable integration and rapid switching mechanisms between heterogeneous systems. This invention enables rapid switching to a backup system to continue operation after a primary system failure during operation, achieving seamless failover and rapid operational recovery between primary and backup heterogeneous systems, thus reducing the operational impact of signaling system failures. The technical solution proposed by this invention is as follows: In a first aspect, the present invention provides a signaling system, including a first train control subsystem, a second train control subsystem, and a fusion interface unit; The first train control subsystem includes interlocking equipment; The second train control subsystem includes a resource controller and an object controller; The fusion interface unit includes: The first interface connects the interlocking device and the resource controller, and is used to transmit the control status and switching instructions of the trackside equipment between the interlocking device and the resource controller; the switching instructions are used to instruct the resource controller to take over or relinquish control of the trackside equipment. The second interface connects the interlocking device and the object controller, and is used by the interlocking device to obtain the status of the trackside equipment through the object controller. The third interface connects the resource controller and the object controller, and is used by the resource controller to control the trackside equipment through the object controller. The signaling system is configured such that one subsystem is the primary system and the other subsystem is the backup system. When the primary system needs to be switched, the system can transfer control status through the first interface and monitor and control the trackside equipment through the second and third interfaces, thereby completing the switch of control from the primary system to the backup system.

[0007] Optionally, the first train control subsystem further includes a first onboard device and a zone controller; the second train control subsystem further includes a second onboard device. The signaling system is configured by default to use the first train control subsystem as the primary system and the second train control subsystem as the backup system. In the primary system mode, the train is operated by the first onboard equipment according to the movement authorization of the area controller, and the trackside equipment is controlled by the interlocking equipment; After switching to the standby system mode, the train is operated by the second onboard equipment based on its own perception and the resources requested from the resource controller, and the trackside equipment is controlled by the resource controller through the object controller.

[0008] Optionally, the signaling system further includes automatic train monitoring equipment, which is shared by the first train control subsystem and the second train control subsystem.

[0009] Optionally, the situations in which the primary system needs to be switched include: the signal system detecting a malfunction in the on-board equipment or interlocking equipment of the primary system, or receiving a manual switching command.

[0010] Optionally, the control handover includes the coordination of train control handover and trackside equipment control handover; wherein, trackside equipment control is transferred through the first interface, and after the handover is completed, train control is switched to the on-board equipment corresponding to the subsystem currently controlling the trackside equipment.

[0011] In a second aspect, the present invention also provides a method for switching control of a signal system, applied to the signal system as described in the first aspect, the method comprising: Monitor and determine whether the primary system needs to be switched over; When it is determined that a switch is needed, the switchover process is triggered; In response to the switching process, a switching command is sent to the resource controller through the first interface in the fusion interface unit, and the control status of the trackside equipment is transferred between the interlocking equipment and the resource controller; After the transfer of control, the resource controller and object controller in the second train control subsystem take over the monitoring and control of the trackside equipment through the second interface and the third interface, thus completing the switch of control from the primary system to the backup system.

[0012] Optionally, the monitoring and determination of whether the primary system needs to be switched over includes: Monitor the operating status of the on-board equipment or interlocking equipment in the main system; When a malfunction is detected in the vehicle-mounted equipment or the interlocking equipment, or when a manual switching command is received, it is determined that a switch is required.

[0013] Optionally, the control status information transferred through the first interface includes at least: the locked status of the turnout, the open status of the signal, and the occupied and idle status of the track section.

[0014] Optionally, the method further includes: before transferring control status through the first interface, the signaling system performs a consistency check on the current trackside equipment status through the second interface to ensure the continuity of status before and after the switch.

[0015] Optionally, when a fault is detected in the on-board equipment of the primary system, the method further includes: At the same time or after the transfer of control of the trackside equipment, the train control is switched from the on-board equipment of the first train control subsystem to the on-board equipment of the second train control subsystem.

[0016] Based on the above technical solution, the beneficial effects of the present invention compared with the prior art are as follows: The signaling system and its control switching method provided by this invention include two heterogeneous subsystems: a first train control subsystem (containing interlocking equipment) and a second train control subsystem (containing a resource controller and an object controller), one primary and one backup. When the primary system fails, the backup system can take over operation, avoiding operational interruptions due to a single system failure and improving system reliability. In existing technologies, configuring a backup subsystem of the same standard for a CBTC system increases construction costs and system complexity, and is not an economical solution. This invention's signaling system uses heterogeneous subsystems as backups, eliminating the need for a backup subsystem of the same standard, thus reducing costs and simplifying system complexity while providing a reliable backup method.

[0017] This invention also includes a fusion interface unit comprising three interfaces. The first interface connects the interlocking equipment and the resource controller, used to transmit the control status and switching commands of the trackside equipment between them, enabling the two heterogeneous subsystems to communicate and coordinate regarding trackside equipment control. The second interface connects the interlocking equipment and the object controller, allowing the interlocking equipment to obtain the trackside equipment status through the object controller. The third interface connects the resource controller and the object controller, enabling the resource controller to control the trackside equipment through the object controller. These three interfaces achieve reliable functional fusion of the two heterogeneous subsystems, laying the foundation for rapid switching. The signaling system is configured with one subsystem as the primary system and the other as the backup system. When the primary system needs to be switched, the control status is transferred through the first interface, while the second and third interfaces enable the backup system to monitor and control the trackside equipment, thus completing the switch of control from the primary system to the backup system. This design allows for rapid switching to the backup system to continue operation after a primary system failure during operation, achieving seamless failover and rapid operational recovery of the heterogeneous primary and backup systems, reducing the operational impact of signaling system failures.

[0018] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained through the structures particularly pointed out in the description and the drawings.

[0019] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram of the signal system provided by the present invention.

[0022] Figure 2 This is a schematic diagram of the fusion interface unit provided by the present invention.

[0023] Figure 3 This is one of the flowcharts illustrating the signal system control switching method provided by the present invention.

[0024] Figure 4 This is the second flowchart of the signal system control switching method provided by the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0026] The following is combined Figures 1-4 The present invention describes the signal system and the method for switching control.

[0027] Reference Figure 1 As shown, the signaling system includes a first train control subsystem, a second train control subsystem, and a fusion interface unit. In a preferred configuration of this embodiment, the first train control subsystem adopts a Communication-Based Train Control (CBTC) system, and the second train control subsystem adopts a Perception Based Train Autonomous Control System (PB-TACS).

[0028] The first train control subsystem includes interlocking equipment, which is located beside the track or in the control center and is the core ground equipment for ensuring train operation safety. It is responsible for establishing and executing the mandatory interlocking logic relationship between signals, switches, and train routes, ensuring the safety of operations such as route processing, signal locking, and signal unlocking.

[0029] The second train control subsystem includes a resource controller and an object controller. The resource controller is the core ground logic unit of the PB-TACS system. Its core function is to centrally manage the usage rights of all trackside equipment, such as switches, signals, and track sections. It receives resource requests from onboard equipment, performs safety assessments and dynamic allocation based on the global resource status, and ensures the safety and efficiency of train routes by locking and releasing resources. The object controller acts as an execution and perception intermediary between the resource controller and the trackside equipment. It collects real-time status data from the trackside equipment, such as switch positions, track section occupancy or vacancy, and signal light positions, and receives control commands from the resource controller, forwarding them to the corresponding trackside equipment for execution. Simultaneously, it is also responsible for providing the train with a static map and dynamic occupancy information of the track resources within its jurisdiction.

[0030] Reference Figure 2 As shown, the communication protocol architecture adopted by the fusion interface unit combines existing interface protocols with newly added interface protocols. The fusion interface unit includes a first interface, a second interface, and a third interface. Wherein: The first interface is the resource controller-interlocking equipment interface, connecting the interlocking equipment and the resource controller. It is used to transmit the control status and switching instructions of the trackside equipment between the interlocking equipment and the resource controller. Transmitting the control status refers to continuously or periodically transmitting the current actual control status of the trackside equipment; for example, control resides with the interlocking equipment or with the resource controller. The switching instructions are used to instruct the resource controller to take over or relinquish control of the trackside equipment. When a switching is required, an explicit switching instruction is sent through this interface. This instruction instructs the resource controller to prepare to take over control or instructs the interlocking equipment to prepare to relinquish control. The instruction may include key information such as the switching reason, fault code, switching range, and expected switching time.

[0031] The second interface is the object controller-interlocking equipment interface, connecting the interlocking equipment and the object controller. This allows the interlocking equipment to obtain the status of trackside equipment through the object controller. When the interlocking equipment is acting as the primary device, it can obtain the latest status of all trackside equipment in real time and transparently through the object controller. For example, the interlocking equipment obtains the position status of signals, platform screen doors (PSDs), emergency closure devices, and turnouts through the object controller; the interlocking system also sends control commands to signals, PSDs, and turnouts through the object controller.

[0032] The third interface is the object controller / resource controller interface, connecting the resource controller and the object controller. It allows the resource controller to control trackside equipment through the object controller. Once the resource controller gains control, it sends specific control commands, such as switching switches to position or opening signals, to the object controller via this interface. The object controller executes these commands and feeds back the results to the resource controller. For example, the resource controller obtains the position status of signals, PSDs, emergency closures, and switches through the object controller; the resource controller also sends control commands to signals, PSDs, and switches through the object controller.

[0033] The signaling system is configured such that one subsystem is the primary system and the other subsystem is the backup system. When the primary system needs to be switched, the system can transfer control status through the first interface and monitor and control the trackside equipment through the second and third interfaces, thereby completing the switch of control from the primary system to the backup system.

[0034] The signaling system of this invention is designed to automatically or manually initiate a switching process when the primary system needs to be switched due to equipment failure, such as onboard equipment or interlocking equipment. The core of the switching process is to first complete the logical transfer of control status through a first interface, after which the signaling system automatically guides the control flow: the monitoring information flow from trackside equipment switches from the second interface to being reported to the resource controller via a third interface; the control command flow switches from the interlocking equipment to being issued by the resource controller through the third interface. This process ultimately achieves a complete and secure switch of control from the primary system to the backup system.

[0035] In existing technologies, if a railway line is equipped with only a single-standard signaling system, such as a pure CBTC system, a failure of core equipment can lead to operational service interruptions or significant degradation. The signaling system of this invention comprises two heterogeneous subsystems: a first train control subsystem (e.g., based on CBTC principles, including interlocking equipment) and a second train control subsystem (including resource controllers and object controllers), one primary and one backup. When the primary system fails, the backup system can take over operation, avoiding operational interruptions due to a single system failure and improving system reliability. Configuring a backup subsystem of the same standard for a CBTC system in existing technologies increases construction costs and system complexity, making it an uneconomical solution. The signaling system of this invention uses heterogeneous subsystems as backups, eliminating the need for identical backup subsystems, thus reducing costs and simplifying system complexity while providing a reliable backup method.

[0036] This invention also includes a fusion interface unit comprising three interfaces. The first interface connects the interlocking equipment and the resource controller, used to transmit the control status and switching commands of the trackside equipment between them, enabling the two heterogeneous subsystems to communicate and coordinate regarding trackside equipment control. The second interface connects the interlocking equipment and the object controller, allowing the interlocking equipment to obtain the trackside equipment status through the object controller. The third interface connects the resource controller and the object controller, enabling the resource controller to control the trackside equipment through the object controller. These three interfaces achieve reliable functional fusion of the two heterogeneous subsystems, laying the foundation for rapid switching. The signaling system is configured with one subsystem as the primary system and the other as the backup system. When the primary system needs to be switched, the control status is transferred through the first interface, while the second and third interfaces enable the backup system to monitor and control the trackside equipment, thus completing the switch of control from the primary system to the backup system. This design allows for rapid switching to the backup system to continue operation after a primary system failure during operation, achieving seamless failover and rapid operational recovery of the heterogeneous primary and backup systems, reducing the operational impact of signaling system failures.

[0037] In one embodiment, the first train control subsystem further includes a first onboard device and a zone controller; the second train control subsystem further includes a second onboard device. The signaling system is configured by default to use the first train control subsystem as the primary system and the second train control subsystem as the backup system. In primary system mode, the train is operated by the first onboard equipment according to the movement authorization of the area controller, and the trackside equipment is controlled by the interlocking equipment. In this mode, the interlocking equipment obtains the latest status of all trackside equipment in real time and transparently from the object controller through the second interface, and executes safe interlocking logic and route control.

[0038] After switching to the standby system mode, the train operates under the control of the second onboard equipment based on its own sensing and the resources requested from the resource controller. The trackside equipment is controlled by the resource controller through the object controller. In this mode, the resource controller sends control commands to the object controller through the third interface and receives status feedback, thereby realizing dynamic resource management and control of the trackside equipment.

[0039] In the primary system mode, the signaling system of this invention operates the train based on the movement authorization provided by the area controller. The area controller can comprehensively analyze information such as track conditions and the position of the train ahead to accurately calculate the safe operating range and speed limits of the train, and send this information as movement authorization to the primary onboard equipment. The primary onboard equipment operates strictly according to this authorization, effectively avoiding safety accidents such as train speeding and rear-end collisions, providing a solid safety foundation for train operation. When switching to the backup system mode, the secondary onboard equipment not only relies on its own sensing capabilities to acquire information about the surrounding environment, but also requests resources from the resource controller. Its own sensing can monitor obstacles and track conditions around the train in real time, while the resource controller can rationally allocate resources and plan a safe operating path based on the train's operating needs and track resource conditions. This dual safety guarantee mechanism ensures the safety of train operation in the backup system mode, enabling safe operation even in complex environments.

[0040] In the primary system, the area controller provides precise movement authorization to trains based on real-time track conditions, enabling trains to operate at optimal speeds and intervals, reducing unnecessary stops and waiting times, and improving the line's transport capacity. Simultaneously, the interlocking equipment's efficient control of trackside equipment ensures smooth train operations such as entering and leaving stations and passing through switches, further enhancing operational efficiency. When the primary system fails, the signaling system can quickly switch to backup mode. The secondary onboard equipment utilizes its own sensing capabilities and resource allocation from the resource controller to rapidly adjust the train's operating status, allowing the train to resume normal operation as quickly as possible. This rapid switching and recovery capability minimizes operational interruptions caused by system failures, ensuring continuous operation of urban rail transit and improving overall operational efficiency.

[0041] This invention's signaling system employs two heterogeneous subsystems: a primary train control subsystem and a secondary train control subsystem, one as the primary and one as a backup. This heterogeneous redundancy design avoids the risk of system paralysis due to a single technology or equipment failure. When the primary system fails, the backup system can immediately take over, ensuring the safe continued operation of the train and improving system reliability. The secondary onboard equipment in the backup system possesses autonomous sensing capabilities, enabling real-time acquisition of information about the train's surrounding environment and reducing reliance on external equipment. Simultaneously, the resource controller controls trackside equipment through the object controller, achieving flexible resource allocation and management. This autonomous sensing and resource management mechanism allows the system to quickly adjust its operating strategy in the face of emergencies or complex environments, enhancing its resilience and adaptability. Compared to configuring a backup subsystem of the same standard for a CBTC system, this signaling system uses heterogeneous subsystems as backups, eliminating the need for a large number of additional identical devices, thus significantly reducing construction costs. Furthermore, the simplified system architecture also reduces subsequent maintenance and management costs. Through the resource management function of the resource controller, the system can rationally allocate and utilize resources according to train operation needs and track resource conditions, avoiding resource waste. For example, on lines with short train intervals, resource controllers can optimize the use of trackside equipment, improve equipment utilization, and further reduce operating costs.

[0042] Reference Figure 1 As shown, the equipment and logical functions of the signaling system can be divided into a control center layer, a centralized station layer, and a trackside layer according to typical deployment locations and control levels. The control center layer includes shared ATS equipment. In this invention, the control center layer is the core of operation command. Operators here monitor the train operation status and equipment status of the entire line through a unified human-machine interface, and can issue global or local manual switching commands when necessary. As the highest command level, the control center layer communicates with the equipment in the lower centralized station layer. The equipment in the centralized station layer includes the ground core equipment of the first train control subsystem (CBTC), namely the aforementioned interlocking equipment and area controllers. It also includes the ground core equipment of the second train control subsystem (PB-TACS), namely the aforementioned resource controllers and object controllers. It also includes a fusion interface unit to realize data interaction between the interlocking equipment and the resource controller, and between the interlocking equipment and the object controller. The trackside layer includes trackside equipment such as signals, switches, track circuits or axle counters, platform screen doors, emergency stop buttons, etc.

[0043] In one embodiment, the signaling system further includes an Automatic Train Supervision (ATS) device, which is shared by the first train control subsystem and the second train control subsystem. The ATS device serves as the front-end interface for issuing route processing instructions. The ATS device establishes a bidirectional data connection with both the first and second train control subsystems via a high-speed and stable communication network, such as industrial Ethernet or a dedicated data transmission channel. This connection ensures that the ATS device can acquire operational data from both subsystems in real time and accurately, while also promptly transmitting monitoring instructions to the corresponding subsystems.

[0044] When the primary system (first train control subsystem) fails or needs to be switched to the backup system (second train control subsystem), the Automatic Train Monitoring (ATM) system detects this first. It immediately sends a switchover notification signal to both subsystems and displays the switchover information on the monitoring interface to alert operators. During the switchover, the ATM ensures data synchronization and status handover between the two subsystems. It transmits the last valid operating data of the primary system before the failure (such as train position, speed, and operating plan) to the backup system, enabling the backup system to seamlessly take over train operation. Simultaneously, the ATM coordinates the handover of control over trackside equipment between the two subsystems, ensuring no control conflicts or loss of control occur during the switchover. For example, at the moment of switchover, the ATM transmits the control status information of the primary system over the interlocking equipment to the resource controller of the backup system through the first interface of the fusion interface unit, enabling the resource controller to smoothly take over control of the trackside equipment. After the switchover is complete, the ATM continues to monitor the operation of the backup system in real time. It adjusts monitoring parameters and strategies promptly based on the actual operating conditions of the backup system. If an anomaly or performance degradation is detected in the backup system during operation, the train automatic monitoring equipment will issue another alarm and provide corresponding optimization suggestions, such as adjusting resource allocation and optimizing the operation plan, to ensure that the train can operate safely and efficiently.

[0045] This invention utilizes an automatic train monitoring system (ATS) to monitor the real-time operating status of both the primary and secondary train control subsystems, promptly identifying potential faults. Upon detecting a fault, it quickly issues an alarm and provides operators with accurate fault location and handling suggestions, significantly reducing troubleshooting and repair time. For example, when a sensor malfunctions in the primary onboard equipment, the ATS can detect the anomaly and display the location and type of the faulty sensor on the monitoring interface, guiding maintenance personnel to quickly replace the faulty component and minimizing the impact on train operation. When the primary system fails, the ATS can coordinate a seamless switch between the two subsystems, ensuring continued safe train operation. Through data synchronization and status handover functions, the backup system can quickly take over the primary system's operation, avoiding train stops or operational interruptions caused by the switch. This seamless switchover capability improves system availability and reduces operational losses due to system failures. For instance, during peak hours in urban rail transit, if the primary system suddenly fails, the ATS can quickly switch control to the backup system without affecting normal train operation, ensuring smooth passenger travel. Furthermore, since the automatic train monitoring equipment is shared by both the first and second train control subsystems, it avoids configuring separate monitoring equipment for each subsystem, reducing equipment redundancy and investment costs. At the same time, unified monitoring equipment also reduces subsequent maintenance and management costs and improves resource utilization efficiency.

[0046] In one embodiment, the situations in which the primary system needs to be switched include: the signal system detecting a malfunction in the on-board equipment or interlocking equipment of the primary system (referred to as situation one), or receiving a manual switching instruction (referred to as situation two).

[0047] Scenario 1 is an automated triggering mechanism. The signaling system uses a built-in, continuous health diagnosis and status monitoring module to monitor the operational status of key equipment in the first train control subsystem in real time. Fault events specifically include failures in the first onboard equipment and interlocking equipment. When a serious fault occurs in the first onboard equipment, such as main processor failure, continuous communication interruption with the ground area controller exceeding a safety threshold, or a critical sensor failure preventing the generation of a valid positioning report, the signaling system determines that the train has lost its ability to operate safely in CBTC mode. When a fault occurs in the interlocking equipment, which is the core of ground safety, such as failure of both the main and backup systems, abnormal logic operation units, or complete interruption of communication with the second interface of the object controller, resulting in the inability to properly process routes, control switches and signals, the signaling system determines that the ground CBTC control function has failed. When the monitoring module identifies any of the above fault events and meets the preset severity level criteria, it will automatically generate a high-priority switching request and submit it to the signaling system's switching management logic as a trigger condition.

[0048] Scenario two involves manual intervention and emergency dispatch mechanisms. Although the signaling system has automatic fault detection capabilities, in certain specific scenarios, such as planned maintenance, drills, or when there is doubt about the automatic criteria requiring manual confirmation, authorized operators can manually initiate a switching command for a specific train, a specific area, or the entire line through the shared human-machine interface of the Automatic Train Monitoring (ATM) equipment. This command has the highest priority; once confirmed and issued, the signaling system will unconditionally initiate the switching process, regardless of the automatic fault detection results.

[0049] Upon receiving an automatic fault switching request from scenario one or a manual switching command from scenario two, the switching management logic of the signaling system formally determines that the primary system needs to be switched and immediately initiates the subsequent switching process. The core of this switching process is to first transfer control of the trackside equipment between the interlocking equipment and the resource controller via a first interface. After the control transfer, the resource controller controls the object controller through a third interface to manage the trackside equipment. The train then operates under the control of the second onboard equipment based on its own perception and the resources requested from the resource controller, thereby achieving a complete and safe switch of control from the first train control subsystem to the second train control subsystem.

[0050] The signaling system of this invention can quickly detect faults and automatically trigger a switching process when the on-board equipment or interlocking equipment of the primary system fails. This rapid response mechanism can prevent the fault from escalating further, reduce the impact on train operation, and ensure that the train continues to operate safely. The introduction of manual switching commands provides the system with a flexible emergency handling method. In case of potential misjudgments by the automatic detection mechanism or special circumstances, operators can intervene in the system's operation in a timely manner through manual switching commands to ensure train safety. Whether the fault is detected automatically or a manual switching command is received, the signaling system can flexibly switch between the primary and backup systems. This flexibility allows operators to adjust the system's operating mode at any time according to actual needs and operating conditions, improving operational flexibility. Through the primary / backup system switching mechanism, the signaling system can quickly switch to the backup system when the primary system fails, ensuring uninterrupted train operation. This greatly improves the operational continuity of urban rail transit, reduces train delays and cancellations caused by system failures, and improves passenger travel satisfaction. When the primary system fails, the signaling system can quickly and accurately locate the faulty equipment and isolate the fault within the primary system. This allows maintenance personnel to conduct targeted inspections and maintenance on faulty equipment, avoiding wider equipment damage and increased repair workload caused by the spread of the fault.

[0051] In one embodiment, the control handover includes the coordination of train control handover and trackside equipment control handover; wherein, trackside equipment control is transferred through the first interface, and after the handover is completed, train control is switched to onboard equipment corresponding to the subsystem currently controlling the trackside equipment.

[0052] The CBTC system is the primary system, and the PB-TACS system is the backup system. The following example, assuming a failure of the first onboard equipment, details the specific process of control handover: The signaling system continuously monitors the operational status of the first onboard equipment through the train's own health management unit or the train-to-ground communication status. When a serious fault is detected in the first onboard equipment, such as a communication interruption or main controller failure, preventing it from safely executing CBTC system control functions, the signaling system determines that a handover procedure needs to be initiated. The handover can also be triggered manually by an operator through the train's automatic monitoring equipment. The signaling system then automatically triggers the handover procedure. After the handover procedure is initiated, the signaling system performs a control transfer operation through the first interface. Specifically, the interlocking equipment sends a handover command containing the current control status information of all trackside equipment to the resource controller through the first interface; after receiving the command and performing a self-check, the resource controller replies with confirmation through the first interface, completing the logical transfer of control status.

[0053] Simultaneously or shortly after the transfer of control of the trackside equipment, the signaling system isolates or de-controlled the first onboard equipment of the faulty train and activates the second onboard equipment. After powering on and initializing, the second onboard equipment immediately requests the necessary track resources from the resource controller via wireless communication. Upon confirming control, the resource controller establishes a complete control and status reporting link with the object controller via a third interface. After receiving resource authorization, the second onboard equipment, combined with the track information acquired by the onboard sensing unit, begins controlling the train to continue operation in PB-TACS mode. During the handover process, the signaling system compares the last trackside equipment status acquired via the second interface with the status acquired by the resource controller via the third interface, performing a consistency check to ensure continuous and seamless status changes before and after the handover. At this point, the control handover for the faulty train is complete, and the train continues to operate safely under the control of the PB-TACS system.

[0054] Similarly, when the signaling system detects a malfunction in the interlocking equipment, the core of its switching method lies in directly transferring control of the trackside equipment from the interlocking equipment to the resource controller via the first interface. Subsequently, the signaling system guides the switching of control of all affected trains to the second onboard equipment, where the PB-TACS subsystem fully takes over train operation and trackside equipment control, thus completing the system-level ground equipment switching.

[0055] The following describes the signal system control switching method provided by the present invention. The signal system control switching method described below can be referred to in correspondence with the signal system described above.

[0056] The present invention also provides a method for switching control of a signal system, applied to the signal system described above, the method comprising: S110. Monitor and determine whether the primary system needs to be switched.

[0057] The signaling system continuously monitors the operating status of the core equipment of the main system (first train control subsystem) through its built-in monitoring module.

[0058] S120. When it is determined that a switch is required, the switchover process is triggered.

[0059] Once the signaling system determines that a handover is necessary, it immediately triggers the handover procedure. The central handover management unit of the signaling system begins its work: determining the target area for the handover based on the source of the handover trigger. If the handover is triggered by specific onboard equipment, the target is that specific train; if it is triggered by interlocking equipment, the target is the area under the jurisdiction of that interlocking equipment; if it is a manual command, the target is determined according to the area specified in the command. The handover management unit quickly assesses the resource status of the current standby system (second train control subsystem), including the processing capacity of the resource controller, the load status of the object controller, and the current status of relevant trackside equipment, ensuring that the standby system has the capability to take over. It initializes the handover procedure, establishes the handover task sequence, and sends handover preparation notifications to relevant subsystems (including the first and second train control subsystems).

[0060] S130. In response to the switching process, a switching command is sent to the resource controller through the first interface in the fusion interface unit, and the control status of the trackside equipment is transferred between the interlocking equipment and the resource controller.

[0061] After the handover process is triggered, the signaling system executes the control transfer operation through the fusion interface unit. Specifically, the signaling system's handover management unit generates a structured handover instruction. This instruction includes key information such as the handover reason, handover scope, handover timestamp, and expected handover completion time. The signaling system sends this handover instruction to the resource controller through the first interface. Simultaneously or subsequently, the signaling system coordinates the interlocking equipment and the resource controller to synchronize their control status. The interlocking equipment transmits complete control status information of all relevant trackside equipment to the resource controller through the first interface. After receiving the handover instruction and control status information, the resource controller performs an internal status check. Confirming that it is operating normally and has takeover capability, the resource controller sends a confirmation message to the interlocking equipment through the first interface, indicating that it is ready to take over control.

[0062] S140. After the transfer of control, the resource controller and object controller in the second train control subsystem take over the monitoring and control of the trackside equipment through the second interface and the third interface, thus completing the switch of control from the primary system to the backup system.

[0063] After the handover of control status is completed, the signaling system guides the actual transfer of control, which includes the switching of monitoring paths, the establishment of control paths, the switching of train control, and the confirmation of the completion of the switching.

[0064] The monitoring path switching process refers to the signaling system switching the monitoring information path for trackside equipment from the second interface. Before this, the interlocking equipment obtains the trackside equipment status from the object controller through the second interface; afterwards, the resource controller obtains the trackside equipment status from the object controller through the third interface. The signaling system ensures that monitoring information is not interrupted or lost during the switching process. Control path establishment refers to the resource controller, after confirming control, immediately establishing a complete control path with the object controller through the third interface. The resource controller begins sending control commands to the object controller through the third interface, and the object controller executes these commands and provides feedback on the execution results, thereby achieving actual control of the trackside equipment. Train control switching refers to the signaling system performing a switch of train control for trains requiring switching. If the switch is triggered by onboard equipment, the signaling system sets the onboard equipment of the faulty train to a non-control state and activates the standby onboard equipment. After the standby onboard equipment is activated, it immediately requests the necessary line resources from the resource controller and begins controlling train operation in standby system mode. The handover completion confirmation refers to the signaling system confirming the handover completion when the resource controller stably receives the trackside equipment status through the third interface and successfully sends control commands, and the relevant train has successfully switched to the backup onboard equipment control. The signaling system records key information such as the handover completion time and handover result, and updates the system status display on the shared automatic train monitoring equipment.

[0065] This invention continuously monitors and determines whether a switchover is needed for the primary system. Once a fault or anomaly is detected in the primary system, a switchover process can be quickly triggered. For example, when the onboard equipment of the primary system experiences a communication failure, resulting in the inability to accurately obtain train location information, the system can immediately react and switch control to the backup system. The backup system can seamlessly take over the operation of the primary system, ensuring the continued normal operation of the signaling system, significantly reducing the time of service interruption due to faults and improving the reliability of the entire signaling system. This method is based on a signaling system architecture with primary and backup systems, where the primary and backup systems are independent yet collaborative. Under normal circumstances, the primary system is responsible for the control of the signaling system, while the backup system is in standby mode, synchronizing key data and status information from the primary system in real time. When the primary system experiences an irreparable fault or requires maintenance, the backup system can quickly take over control, ensuring the continuous operation of the signaling system. This redundancy design effectively avoids the risk of the entire signaling system being paralyzed due to a single system failure, significantly improving the system's reliability and stability.

[0066] In this invention, during the switching process, a switching command is sent to the resource controller via the first interface in the fusion interface unit, and the control status of the trackside equipment is transferred between the interlocking equipment and the resource controller. This process is strictly carried out according to preset protocols and rules to ensure the accuracy and security of the control transfer. For example, during the transfer of control status, the current status of the trackside equipment is recorded and verified in detail to prevent malfunctions caused by incorrect control transfer, thereby ensuring the safety of train operation. After the control status is transferred, the resource controller and object controller in the second train control subsystem take over the monitoring and control of the trackside equipment through the second and third interfaces. The resource controller and object controller can obtain the status information of the trackside equipment in real time and perform precise control of the trackside equipment according to the train's operation plan and safety rules.

[0067] This method is not only applicable to situations where the primary system needs to be switched over due to a failure, but can also be applied to various scenarios such as manual intervention and system upgrades and maintenance. For example, when upgrading the software of a signal system, control can be switched to the backup system first, and then the software upgrade and testing can be performed on the backup system. After the upgrade is completed and verified to be error-free, control can then be switched back to the primary system. This flexible switching method can meet the system operation requirements in different scenarios, improving the system's adaptability and flexibility.

[0068] In one embodiment, the monitoring and determination of whether the primary system needs to be switched over in S110 above includes: S1101. Monitor the operating status of the vehicle-mounted equipment or interlocking equipment in the main system.

[0069] The signaling system continuously monitors the operational status of core equipment in the primary system, namely the first train control subsystem, through its built-in monitoring modules. These monitoring modules specifically include an onboard equipment operational status monitoring unit and an interlocking equipment operational status monitoring unit. The onboard equipment operational status monitoring unit monitors the wireless communication link status between the onboard equipment and the ground area controller in real time and periodically receives self-test reports from the onboard equipment to assess the health status of its processors, sensors, and other critical units. The interlocking equipment operational status monitoring unit focuses on monitoring the hardware operational status of the interlocking equipment, including its primary / backup system switching records, processor load, and the communication status of its second interface with the target controller.

[0070] S1102. When a malfunction is detected in the vehicle-mounted equipment or the interlocking equipment, or when a manual switching command is received, it is determined that a switch is required.

[0071] The monitoring module compares and analyzes the real-time collected status information with preset safety thresholds. If the on-board equipment operation status monitoring unit detects that the communication interruption between the on-board equipment and the area controller lasts for more than a safe time threshold (e.g., three seconds), or detects that the on-board equipment reports a serious hardware error code, the unit will generate an on-board equipment fault event. Similarly, if the interlocking equipment operation status monitoring unit detects an abnormality in the interlocking equipment's own logic unit or a complete interruption of communication between it and the object controller's second interface, the unit will generate an interlocking equipment fault event. These fault events are classified and marked with severity levels before being uniformly reported to the central decision-making unit of the signaling system.

[0072] Meanwhile, the signaling system maintains a high-priority command reception channel, continuously monitoring for manual operation commands from the shared train automatic monitoring equipment interface. When an authorized operator issues a clear manual switching command through the human-machine interface based on operational needs, such as planned maintenance or emergency drills, the command will be immediately captured and transmitted to the central decision-making unit.

[0073] Upon receiving a fault event report from the monitoring module or a manual switching command from the operating interface, the central decision-making unit of the signaling system initiates its judgment logic. For fault events, the decision-making unit verifies whether their severity level reaches a preset threshold requiring switching. When a fault requiring system response has occurred in the onboard equipment or interlocking equipment, or when a valid manual switching command is received, the central decision-making unit integrates all input information and ultimately generates a judgment indicating that switching is necessary. This judgment result is then used as the core decision-making basis and output to the signaling system's switching management unit, thereby triggering the subsequent complete control handover process. This judgment result is also updated and displayed on the shared Automatic Train Monitoring (ATM) interface to ensure that operators have a clear understanding of the system's decisions.

[0074] In one embodiment, the control status information transferred through the first interface includes at least: the locked status of the turnout, the open status of the signal, and the occupied and idle status of the track section.

[0075] The locking status information of turnouts is crucial to ensuring the safe passage of trains through them. Accurately transferring the lockout status during control switching allows the taking-over system to clearly know whether the turnout is currently locked and in the correct position. For example, if the primary system controls the turnout to the straight track position and locks it, when switching to the backup system, the backup system obtains this locking status information through the first interface. This prevents accidental turnout operation when a train approaches, avoiding derailment due to sudden turnout switching and greatly ensuring the safe operation of trains in the turnout area.

[0076] The open status of a signal directly controls the movement and stopping of a train. Handing over signal open status information allows the backup system to accurately continue the signal indications of the primary system. For example, if the primary system controls a signal to display a green light, allowing a train to pass, the backup system, upon receiving this status information during the handover, can continue to maintain the green light display. This prevents trains from accidentally running a red light or attempting to pass when conditions are not suitable due to incorrect signal display, thus avoiding safety accidents such as train collisions.

[0077] Track occupancy and availability information is crucial for train operation scheduling. The backup system obtains this information through the primary interface, enabling it to monitor the real-time distribution of trains on the track. For example, when a track section is shown as occupied, the backup system will not schedule other trains to enter that section to avoid rear-end collisions or conflicts; when a section is shown as available, train routes can be rationally planned to ensure safe and orderly train operation.

[0078] This invention includes the transfer of various control status information, ensuring that the standby system can obtain comprehensive and accurate operational data from the primary system when taking over control. This data is the foundation for the standby system to continue effectively controlling the signaling system, preventing control interruptions or chaos during the handover process due to missing or incorrect data. For example, if turnout locking status information is missing, the standby system may be unable to determine the current position of the turnout, thus hesitant to direct trains through, affecting the smoothness of the handover; while a complete transfer of status information allows the standby system to quickly and accurately take over control, achieving a seamless handover. Accurate transfer of control status information through the first interface ensures consistency in the primary and standby systems' understanding of the trackside equipment status before and after the handover. This consistency is a prerequisite for the safe and stable operation of trains. For example, at the moment of handover, the primary and standby systems have the same understanding of the signal display status, track section occupancy, etc., allowing the standby system to continue controlling the signaling system according to the primary system's operational logic, ensuring that train operation is unaffected by the handover and maintaining operational continuity and stability. When the primary system fails and a switch to the backup system is required, accurately transferring control status information helps the backup system quickly understand the current operating status of the system, rapidly take over control and restore normal operation, reduce the impact time of the failure on the system, and improve the reliability and availability of the system.

[0079] In one embodiment, the method further includes: before transferring control status through the first interface, the signaling system performs a consistency check on the current trackside equipment status through the second interface to ensure the continuity of status before and after the switch.

[0080] Specifically, before the signaling system sends a switching command to the resource controller via the first interface and prepares to transfer control of the trackside equipment, a consistency check is performed on the current trackside equipment status. The goal of this check is to ensure that the trackside equipment status information to be transferred from the interlocking equipment to the resource controller is accurate, complete, and consistent with the actual situation on site, thus laying the foundation for a smooth and safe takeover of control. The signaling system's switching management unit initiates this process by sending a check command to the interlocking equipment. The interlocking equipment then initiates a targeted status query request to the object controller via the second interface. This request explicitly requests a complete status snapshot of all relevant trackside equipment at a specific point in time.

[0081] Upon receiving a verification request from the interlocking equipment, the object controller immediately collects the latest real-time status data from the field equipment. This data is fed back to the interlocking equipment via a second interface, forming a verification baseline status report. This report includes all key status parameters such as the exact position of the turnout at the time of verification, the signal light display status, the precise occupancy or vacancy indicators of each track section, the activation status of the emergency stop button, and the opening and closing positions of the platform screen doors.

[0082] After receiving the verification baseline status report from the object controller, the interlocking equipment does not forward it directly. Instead, it compares it item by item with its internal state image, which is maintained in real time within its own logic. This internal state image is a model of the expected state of the trackside equipment, built by the interlocking equipment based on the results of historical control command execution and previously received state feedback. The comparison process checks items one by one, such as whether the actual position of the turnout in the report matches the locking position recorded internally by the interlocking system, whether the signal status in the report matches the expected state of the last control command issued by the interlocking system, and whether the reported section occupancy status is consistent with the occupancy situation calculated by the interlocking system based on the train position.

[0083] After the comparison is complete, the interlocking equipment generates a consistency verification result. If all key status items match, the verification result is passed. At this point, the interlocking equipment will continue with the subsequent process, encapsulating and sending the control status information packet transferred through the first interface based on this verified verification baseline status report. If any key inconsistencies are found during the comparison, such as a discrepancy between the actual position of the turnout and the command, the verification result is failed. The interlocking equipment will immediately suspend the switching process and report a verification alarm to the signal system's switching management unit and the shared automatic train monitoring equipment, while providing specific details of the inconsistency, such as the turnout command DB123 indicating a fixed position, while the actual report indicates a reversed position. The operator must intervene to handle this anomaly; the switching process can only continue after the inconsistency issue is resolved and the re-verification passes.

[0084] By implementing this state consistency verification step before the transfer of control, this invention ensures that the state baseline used by the two heterogeneous systems during the handover of control is unique, authentic, and verified. This fundamentally avoids security risks or handover failures that may result from asynchronous or inconsistent state information, such as the backup system performing train protection or route planning based on erroneous state information. This mechanism significantly improves the reliability, security, and success rate of the entire handover process, and is a crucial technical guarantee for achieving seamless and smooth handover between primary and backup systems.

[0085] In one embodiment, when a fault is detected in the on-board equipment of the primary system, the method further includes: At the same time or after the transfer of control of the trackside equipment, the train control is switched from the on-board equipment of the first train control subsystem to the on-board equipment of the second train control subsystem.

[0086] Specifically, after confirming the triggering of the switching procedure for a specific faulty train, the signal system's switching management unit will simultaneously plan and initiate the transfer of control at the onboard equipment level. This operation is coordinated with the trackside equipment control status handover process via the first interface, or executed immediately after the trackside control logic handover is completed, aiming to achieve synchronous switching between train control and ground resource control. The switching management unit first generates an onboard control switching command for the faulty train. This command is sent simultaneously to the faulty train itself and related network control nodes via an independent vehicle-to-ground wireless communication link or a dedicated onboard network management channel. Upon receiving the command, the faulty train's onboard control system will immediately execute an isolation procedure. Specifically, the train's main controller will cut off or lock the core control output of the original first train control subsystem's onboard equipment, causing it to withdraw from direct control of train traction, braking, and critical safety functions, thereby ensuring that the equipment no longer issues any control commands that may interfere with train operation. The onboard equipment switches to a monitoring mode that only reports basic status information or becomes completely silent.

[0087] At the same time, the signaling system sends activation and takeover commands to the onboard equipment of the second train control subsystem on the train via the same communication link or another independent activation channel. The onboard equipment of the second train control subsystem, which is in hot standby or dormant state, is awakened and executes a rapid initialization procedure. This initialization procedure is not a cold start, but rather loads pre-configured operating parameters and immediately sends a registration and resource request message via wireless communication to the resource controller that is ready to take over trackside control, indicating that it is ready and requesting authorization for the line resources required for current operation, such as the track sections and turnout positions required for the next route.

[0088] At this point, the train enters a brief transition period. During this time, the faulty first train control subsystem's onboard equipment has been isolated, while the second train control subsystem's onboard equipment has been activated and is requesting resources, but has not yet obtained full movement authorization. To ensure safety during this transition period, the signaling system can issue a conservative, limited movement authorization or safety shield through the resource controller based on the last known train position and speed, or rely on the second train control subsystem's onboard equipment's own sensing system for autonomous protection.

[0089] Once the resource controller confirms control of the relevant trackside equipment through the first interface and processes the resource request from the onboard equipment of the second train control subsystem, it will send formal resource authorization information to the onboard equipment via vehicle-to-ground communication. After integrating this resource authorization information with real-time environmental perception data acquired by its own sensors (such as radar and cameras), the onboard equipment of the second train control subsystem establishes a complete train control closed loop and begins to implement traction, cruise, and braking control of the train according to its system's control logic. At this point, control of the train has been completely and safely transferred from the onboard equipment of the first train control subsystem to the onboard equipment of the second train control subsystem.

[0090] After monitoring and confirming that the onboard equipment of the second train control subsystem has successfully established stable control and that the train is operating safely in the new mode, the signaling system records the completion of the onboard control handover. This entire process ensures that when the primary onboard equipment fails, train control can be quickly and orderly transferred to the backup onboard equipment, coordinating with the handover process in conjunction with the ground system. Ultimately, this achieves continuous and safe train operation under the control of the backup system, minimizing the impact of a single train failure on overall operations.

[0091] The CBTC system is the primary system, and the PB-TACS system is the backup system. Under normal circumstances, the train operates normally under the control of the CBTC system. When the primary system's onboard equipment fails, the onboard equipment switches to the backup onboard equipment. For example... Figure 3 As shown, the process of switching control of the signal system includes: Step S1: Under normal circumstances, the train operates at the primary system CBTC level; Step S2: The signaling system determines whether the on-board equipment of the main system is faulty, thereby determining the actual control of the train; Step S3: When the primary system on-board equipment fails, the signal system switches to the backup system on-board equipment; Step S4: When the primary system on-board equipment is not faulty, it can also be switched to the backup system on-board equipment through manual operation authorization; Step S5: The train is taken over by the backup system onboard equipment and switched to PB-TACS level; Step S6: The train continues to operate at PB-TACS level.

[0092] When the primary system interlocking equipment fails, the system switches to the backup system resource controller. For example... Figure 4 As shown, the process of switching control of the signal system includes: Step S1: Under normal circumstances, ground equipment uses the main system interlocking equipment to control trackside resources and obtain relevant resource status; Step S2: The signal system determines whether the main system interlocking equipment is faulty, thereby determining the actual control equipment of the trackside resources; Step S3: When the interlocking equipment fails, the signal system switches to the backup system resource controller to control the trackside resources, and the resource controller acquires control of the trackside equipment; Step S4: When the interlocking equipment is not faulty, the system can be switched to the standby system resource controller through manual operation authorization. Step S5: The train is taken over by the backup onboard system and switched to PB-TACS level; Step S6: The train continues to operate at PB-TACS level.

[0093] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A signal system, characterized in that, It includes a first train control subsystem, a second train control subsystem, and a fusion interface unit; The first train control subsystem includes interlocking equipment; The second train control subsystem includes a resource controller and an object controller; The fusion interface unit includes: The first interface connects the interlocking device and the resource controller, and is used to transmit the control status and switching instructions of the trackside equipment between the interlocking device and the resource controller; the switching instructions are used to instruct the resource controller to take over or relinquish control of the trackside equipment. The second interface connects the interlocking device and the object controller, and is used by the interlocking device to obtain the status of the trackside equipment through the object controller. The third interface connects the resource controller and the object controller, and is used by the resource controller to control the trackside equipment through the object controller. The signaling system is configured such that one subsystem is the primary system and the other subsystem is the backup system. When the primary system needs to be switched, the system can transfer control status through the first interface and monitor and control the trackside equipment through the second and third interfaces, thereby completing the switch of control from the primary system to the backup system.

2. The signal system according to claim 1, characterized in that, The first train control subsystem further includes a first onboard equipment and a zone controller; the second train control subsystem further includes a second onboard equipment; The signaling system is configured by default to use the first train control subsystem as the primary system and the second train control subsystem as the backup system. In the primary system mode, the train is operated by the first onboard equipment according to the movement authorization of the area controller, and the trackside equipment is controlled by the interlocking equipment; After switching to the standby system mode, the train is operated by the second onboard equipment based on its own perception and the resources requested from the resource controller, and the trackside equipment is controlled by the resource controller through the object controller.

3. The signal system according to claim 1, characterized in that, The signaling system also includes automatic train monitoring equipment, which is shared by the first train control subsystem and the second train control subsystem.

4. The signal system according to claim 1, characterized in that, The situations in which the primary system needs to be switched include: when the signal system detects a malfunction in the on-board equipment or interlocking equipment of the primary system, or when it receives a manual switching command.

5. The signal system according to claim 1, characterized in that, The control handover includes the coordination of train control handover and trackside equipment control handover; wherein, trackside equipment control is transferred through the first interface, and after the handover is completed, train control is switched to the on-board equipment corresponding to the subsystem currently controlling the trackside equipment.

6. A method for switching control of a signal system, characterized in that, Applied to the signal system as described in any one of claims 1 to 5, the method comprises: Monitor and determine whether the primary system needs to be switched over; When it is determined that a switch is needed, the switchover process is triggered; In response to the switching process, a switching command is sent to the resource controller through the first interface in the fusion interface unit, and the control status of the trackside equipment is transferred between the interlocking equipment and the resource controller; After the transfer of control, the resource controller and object controller in the second train control subsystem take over the monitoring and control of the trackside equipment through the second interface and the third interface, thus completing the switch of control from the primary system to the backup system.

7. The signal system control switching method according to claim 6, characterized in that, The monitoring and determination of whether the primary system needs to be switched over includes: Monitor the operating status of the on-board equipment or interlocking equipment in the main system; When a malfunction is detected in the vehicle-mounted equipment or the interlocking equipment, or when a manual switching command is received, it is determined that a switch is required.

8. The signal system control switching method according to claim 6, characterized in that, The control status information transferred through the first interface includes at least: the locked status of the turnout, the open status of the signal, and the occupied and idle status of the track section.

9. The signal system control switching method according to claim 6, characterized in that, The method further includes: before transferring control status through the first interface, the signaling system performs a consistency check on the current trackside equipment status through the second interface to ensure the continuity of status before and after the switch.

10. The signal system control switching method according to claim 7, characterized in that, When a fault is detected in the on-board equipment of the primary system, the method further includes: At the same time or after the transfer of control of the trackside equipment, the train control is switched from the on-board equipment of the first train control subsystem to the on-board equipment of the second train control subsystem.

Images