Cross-gauge cross-manufacturer train wake-up process train-ground communication interruption hierarchical fault-tolerant processing method and system
By dividing the train wake-up process into low-sensitivity, medium-sensitivity, and high-sensitivity stages and dynamically matching communication interruption strategies, the problem of wake-up compatibility between different manufacturers in cross-line operation is solved, and seamless wake-up and fault analysis support for trains in different manufacturers' systems are achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA RAILWAY CHONGQING SURVEYING DESIGN RES INST CO LTD
- Filing Date
- 2026-04-13
- Publication Date
- 2026-06-05
AI Technical Summary
Different signaling system manufacturers have conflicting strategies for handling train-to-ground communication interruptions during train wake-up, leading to compatibility issues during cross-line operation. Existing technologies have failed to effectively address how to ensure compatibility between the extreme strategies of different manufacturers within the same system, especially achieving a smooth transition of the wake-up process while ensuring safety.
The train wake-up process is divided into three safety-sensitive stages: low sensitivity, medium sensitivity, and high sensitivity. Different communication interruption tolerance strategies are dynamically matched according to the safety sensitivity of each stage. The communication link status is monitored in real time through the RSSP-II safety communication protocol, and corresponding processing strategies are executed when an interruption is detected. Fault analysis logs are recorded and reported.
It enables seamless train wake-up across different vendors' FAO systems, improving wake-up success rate and operational efficiency, and providing traceable fault analysis data support, balancing safety and availability.
Smart Images
Figure CN122143980A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of rail transit signal control technology, and relates to a hierarchical fault-tolerant processing method and system for train-to-ground communication interruption during cross-system and cross-vendor train wake-up process. Background Technology
[0002] In a fully automated operation (FAO) system, train wake-up is a core scenario for achieving driverless operation. This process involves a series of rigorous steps: powering on the onboard controller, static testing, establishing communication with the area controller, and obtaining operational authorization.
[0003] However, industry research and engineering practice show that different signal system manufacturers often have conflicting definitions of the safety boundaries for this process, especially in handling vehicle-to-ground communication interruptions, resulting in two extreme strategies:
[0004] One approach allows communication interruptions during non-core phases such as static testing and power-on self-testing during wake-up. The train can continue with subsequent testing procedures, and the connection can be re-established once communication is restored. This strategy prioritizes a high wake-up success rate but has lower requirements for communication quality.
[0005] The other approach is extremely stringent, requiring uninterrupted communication during the wake-up process. Any interruption is considered a serious fault, immediately halting the wake-up process and necessitating manual intervention. This strategy prioritizes absolute process control but places extremely stringent demands on the communication environment.
[0006] When trains using the second strategy (such as those on the Bi-Tong Line) are woken up on lines using the first strategy (such as Line 27), this difference can lead to serious compatibility issues: trains may be incorrectly aborted from waking up due to brief communication fluctuations on the line, resulting in a significant decrease in operational efficiency. This is especially true in cross-line operation scenarios, where different lines may be built by different signaling vendors, and the same train faces different communication interruption handling logic when waking up on different lines, exacerbating compatibility risks.
[0007] While existing technologies disclose general communication timeout reconnection mechanisms, none of them have solved how to simultaneously ensure compatibility between the two vendor logics mentioned above in the same system, especially how to achieve a smooth transition of the wake-up process while ensuring security.
[0008] For example, Chinese patent application CN111003023A discloses a "Dual-system, dual-redundancy train-specific automatic wake-up and automatic sleep device." This solution uses redundant AAM devices at both ends to achieve dual-system cross-execution of wake-up / sleep commands, thereby improving equipment availability. However, this solution only focuses on the redundant execution mechanism of wake-up / sleep commands, without addressing the safety sensitivity of each stage of the wake-up process, and fails to resolve the cross-line wake-up compatibility issue caused by conflicting communication interruption handling strategies between different manufacturers' FAO systems. Summary of the Invention
[0009] The purpose of this invention is to address the aforementioned problems in existing technologies by proposing a hierarchical fault-tolerant processing method and system for train-to-ground communication interruptions during cross-system and cross-vendor train wake-up processes.
[0010] To achieve the above objectives, the basic solution of this invention is a graded fault-tolerant processing method for train-to-ground communication interruption during cross-system and cross-vendor train wake-up process, used to realize cross-line wake-up compatibility of trains in fully automated operation (FAO) systems of different vendors, including the following steps:
[0011] S1. Based on the degree of impact of each operation in the train wake-up process on train operation safety, classify the safety criticality level of the operation in advance, and then divide the entire train wake-up process into at least two safety-sensitive stages according to the safety criticality level, and establish a stage-safety mapping relationship for the wake-up process.
[0012] S2. Pre-generate a stage-tolerance mapping table bound to the stage-security mapping relationship. The mapping table stores the tolerance time parameters and communication interruption handling strategy codes corresponding to each security sensitive stage. The security sensitivity level is negatively correlated with the tolerance time parameter: the lower the security sensitivity level, the longer the tolerance time; the higher the security sensitivity level, the shorter the tolerance time.
[0013] S3. During the wake-up process, the communication link status between the vehicle controller and the area controller is monitored in real time; the monitoring is based on the RSSP-II secure communication protocol between the vehicle controller and the area controller, and is achieved through periodic message exchange, timeout judgment, serial number verification and CRC integrity verification.
[0014] S4. When a vehicle-to-ground communication interruption is detected, identify the current wake-up phase; the detection of a vehicle-to-ground communication interruption means that no valid message is received within a preset communication timeout period, or the sequence numbers of the continuously received messages are not consecutive, or the CRC check of the message fails.
[0015] S5. Based on the current security sensitivity level, query the stage-tolerance mapping table to obtain the corresponding tolerance time parameter and communication interruption handling strategy code, and execute the corresponding communication interruption handling strategy.
[0016] The working principle and beneficial effects of this basic solution are as follows: This technical solution provides a unified, safe and adaptive processing method, enabling trains to be woken up seamlessly in FAO systems from different manufacturers.
[0017] The system dynamically matches different communication interruption tolerance strategies based on the security sensitivity of the wake-up phase, integrating the processing logic of different vendors in a mechanism-wise, rather than simply compromising.
[0018] This method divides the wake-up process into stages closely related to the security level and dynamically matches different fault tolerance strategies to each stage, fundamentally ensuring compatibility with the logic of different vendors.
[0019] The communication interruption events, occurrence stages, handling strategies, and final results throughout the entire wake-up process are uniformly recorded and reported to the dispatch center to form a traceable vendor compatibility log, providing data support for fault analysis and system optimization in cross-line operations.
[0020] The information to be recorded for each interrupt event includes: interrupt time (accurate to milliseconds), interrupt duration, interrupt type, state snapshot of the vehicle controller at the time of interruption, name of the processing strategy matched by the system for the event, tolerance timer setting and final processing result, the identification of the line where the interrupt occurred, and the identification of the manufacturer of the current vehicle device.
[0021] It provides full-process traceability, which facilitates post-event fault analysis and system optimization, and also provides a data foundation for optimizing tolerance timer parameters under different lines and communication quality from different manufacturers.
[0022] The security-sensitive phase is divided into a low-sensitivity phase and a high-sensitivity phase according to time sequence, specifically as follows:
[0023] The low-sensitivity phase is the initial phase of the wake-up process, which includes power-on self-test and communication request steps. This phase does not involve driving safety-related operations and allows communication disturbances within a preset range.
[0024] The highly sensitive phase is the final stage of the wake-up process, which includes obtaining operating authorization and wake-up completion steps. This stage involves the calculation and confirmation of driving authorization and is most sensitive to communication interruptions.
[0025] Clearly defining the phase division between the two extreme security levels provides a clear boundary for differentiated fault-tolerance strategies. The low-sensitivity phase allows for communication disturbances to improve wake-up success rate; the high-sensitivity phase is strictly controlled to ensure the bottom line of driving safety.
[0026] The security-sensitive phase also includes the medium-sensitive phase:
[0027] The intermediate sensitive stage is the transitional stage of the wake-up process, which includes waiting for connection and establishing a secure communication link. During this stage, the vehicle-to-ground security control link is being established, and the sensitivity to communication interruption is between that of the low-sensitivity stage and the high-sensitivity stage.
[0028] Introducing an intermediate transition phase allows for a more refined classification of security sensitivity.
[0029] The tolerance time parameters corresponding to each security-sensitive stage are implemented through timers. Specifically, the low-sensitivity stage corresponds to a long timer T1, the medium-sensitivity stage corresponds to a short timer T2, and the high-sensitivity stage corresponds to a zero-tolerance timer T3. The durations of the three timers satisfy T1 > T2 > T3, and the duration of T3 is 0.
[0030] The core design principle of clearly defining the inverse relationship between tolerance and security sensitivity is used to achieve dynamic security boundaries, enabling the system to automatically switch behavior modes at different stages, thus balancing security and availability.
[0031] The communication interruption handling strategy includes a low-sensitivity phase handling strategy and a high-sensitivity phase handling strategy, specifically:
[0032] The low-sensitivity phase handling strategy is as follows: If the communication interruption occurs during the power-on self-test or communication request phase, the system starts a long timer T1, opens a communication recovery tolerance window, and the wake-up process is suspended and maintains the current state; if communication is restored before the T1 timer ends, the wake-up process resumes from the suspended state and continues to execute; if communication is still not restored after the T1 timer ends, it is determined to be a minor fault and enters the preset fault recovery process.
[0033] The high-sensitivity phase handling strategy is as follows: If the communication interruption occurs during the acquisition of operation authorization or wake-up completion phase, the system starts the zero-tolerance timer T3 and immediately executes the zero-tolerance strategy: abort the wake-up process, control the train to apply emergency braking, output an emergency braking command to the train through the on-board controller, send the highest level alarm to the dispatch center, and the train enters a safety lock state, which can only be unlocked by manual intervention or local physical reset.
[0034] The low-sensitivity phase uses a long timer to simulate relaxed logic, maximizing tolerance for short-term communication fluctuations and avoiding unnecessary wake-up failures. The high-sensitivity phase uses a zero-tolerance strategy to simulate stringent logic, ensuring the safety and absolute controllability of the vehicle authorization process.
[0035] This system achieves compatibility with logic from two extreme vendors within the same system, solving the core compatibility challenge of cross-line operations.
[0036] The communication interruption handling strategy also includes a medium-sensitive phase handling strategy, specifically:
[0037] If the communication interruption occurs during the waiting for connection or the establishment of a secure communication link, the system starts a short timer T2, immediately suspends the wake-up process, caches the current wake-up state, and opens a secure reconnection window.
[0038] If communication is successfully reconnected before the T2 timeout ends, the wake-up process resumes execution from the breakpoint based on the cache state.
[0039] If the reconnection fails after the T2 timeout, it is determined to be a moderate fault. The train is then guided to the preset safe waiting state for recovery, and an alarm message is sent to the dispatch center.
[0040] It combines the recovery mechanism of a relaxed strategy with the alertness of a strict strategy: it has both a tolerance window and a strict time limit. State caching and breakpoint recovery mechanisms prevent repeated execution of the process and improve wake-up efficiency.
[0041] The tolerance time parameter in the stage-tolerance mapping table is a configurable parameter, and its configuration methods include: dynamically loading the corresponding tolerance time parameter set according to the preset configuration information of the line in response to the train entering the jurisdiction of the new line; or adjusting the tolerance time parameter online according to the configuration instructions issued by the dispatch center.
[0042] It is simple to operate and easy to use.
[0043] This invention also provides a graded fault-tolerant processing system for train-to-ground communication interruption during cross-system and cross-vendor train wake-up process, comprising:
[0044] The phase division module is used to pre-classify the safety criticality level of each operation in the train wake-up process based on the degree of impact on train operation safety, and then divide the entire train wake-up process into at least two safety-sensitive phases based on the safety criticality level, establishing a "phase-safety" mapping relationship for the wake-up process.
[0045] The mapping table storage module is used to store the "stage-tolerance mapping table" which is bound to the "stage-security degree" mapping relationship. The stage-tolerance mapping table stores the tolerance time parameters and communication interruption handling strategy code corresponding to each security sensitive stage.
[0046] The communication monitoring module is used to monitor the communication link status between the on-board controller and the area controller in real time during the train wake-up process.
[0047] The interruption identification module is used to identify the security-sensitive stage of the current wake-up process when an interruption in vehicle-to-ground communication is detected.
[0048] The fault-tolerant execution module is used to query the "stage-tolerance mapping table" based on the identified security sensitivity level of the current stage, obtain the corresponding tolerance time parameter and communication interruption handling strategy code, and execute the corresponding communication interruption handling strategy.
[0049] The processing system executes the cross-system and cross-vendor train wake-up process vehicle-to-ground communication interruption graded fault tolerance processing method of the present invention to complete the cross-system and cross-vendor train wake-up process vehicle-to-ground communication interruption graded fault tolerance processing.
[0050] This system implements the complete implementation of the method and embodiment, and is deployable in actual engineering projects. Attached Figure Description
[0051] Figure 1 This is a flowchart illustrating the graded fault-tolerant processing method for train-to-ground communication interruption during the cross-system and cross-vendor train wake-up process of the present invention.
[0052] Figure 2 This is a schematic diagram illustrating the mapping relationship between the wake-up stage and security sensitivity in the cross-system and cross-vendor train wake-up process train communication interruption hierarchical fault tolerance processing method of the present invention. Detailed Implementation
[0053] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.
[0054] In the description of this invention, it should be understood that the terms "longitudinal", "lateral", "up", "down", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.
[0055] In the description of this invention, unless otherwise specified and limited, it should be noted that the terms "installation", "connection" and "linking" should be interpreted broadly. For example, they can refer to mechanical or electrical connections, or internal connections between two components. They can be direct connections or indirect connections through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms according to the specific circumstances.
[0056] This invention discloses a graded fault-tolerant processing method for train-to-ground communication interruption during cross-system and cross-vendor train wake-up process. It solves the problem of cross-line train wake-up failure caused by extreme contradictions in the communication interruption handling strategies of different vendors during the wake-up process. The wake-up process is divided into stages closely related to the safety level, and different fault-tolerant strategies are dynamically matched for each stage. This fundamentally supports the logic of two extreme vendors, enabling trains to seamlessly complete wake-up in FAO systems of different vendors.
[0057] like Figure 1 As shown, the graded fault-tolerant handling method for train-to-ground communication interruption during cross-system and cross-vendor train wake-up process includes the following steps:
[0058] S1. Based on the impact of each operation in the train wake-up process on train operation safety, pre-classify the safety criticality level of each operation. Then, based on the safety criticality level, divide the entire train wake-up process into at least two safety-sensitive stages, establishing a "stage-safety" mapping relationship for the wake-up process, such as... Figure 2 As shown, the horizontal axis represents the timing stages of the wake-up process, and the vertical axis represents the security sensitivity level, clearly defining the correspondence between each stage and the security level and tolerance time. This mapping relationship is pre-installed in the system in the form of a stage-tolerance mapping table, which defines the security sensitivity level, tolerance timer type, and specific tolerance time value corresponding to each wake-up stage.
[0059] The specific criteria for classifying safety criticality levels are as follows:
[0060] The initial phase (power-on self-test, request for communication) is a low-sensitivity phase. This phase involves the onboard controller's internal hardware self-test, the initial handshake with the vehicle interface, and the initiation of a connection request to the area controller. It is a "preparatory" phase and does not involve train operation authorization calculation or movement authorization generation. Communication interruption will not cause the train to lose control.
[0061] The intermediate stage (waiting for connection, establishment of secure communication link) is a medium-sensitive stage. During this stage, the establishment of secure communication link between the vehicle controller and the area controller and the exchange of key data are underway. A complete mobility authorization has not yet been formed. Communication interruption can be recovered through state caching and reconnection mechanisms.
[0062] The final stage (obtaining operational authorization and confirming wake-up completion) is a highly sensitive stage. This stage involves the area controller sending movement authorization to the onboard controller, which includes critical train safety data such as train direction, speed limits, information on obstacles ahead, and switch positions. Communication interruption could very likely cause the train to start without authorization or with incorrect authorization, resulting in a serious safety accident.
[0063] S2. Pre-generate a stage-tolerance mapping table bound to the stage-security mapping relationship. The mapping table stores the tolerance time parameters and communication interruption handling strategy codes corresponding to each security sensitive stage. The security sensitivity level is negatively correlated with the tolerance time parameter: the lower the security sensitivity level, the longer the tolerance time; the higher the security sensitivity level, the shorter the tolerance time.
[0064] Communication interruption handling strategy codes are predefined instruction identifiers that can be recognized and executed by the system, including at least the following examples:
[0065] The low-sensitivity phase tolerance recovery strategy is used during the power-on self-test or communication request phase. The actions include starting a long timer, monitoring communication recovery, and entering the fault recovery process after the timeout.
[0066] During the sensitive phase, the reconnection is paused and the train waits for a connection or secure communication link to be established. Actions include pausing the wake-up process, caching the current state, starting a short timer to attempt reconnection, and guiding the train into a safe waiting state after the timeout.
[0067] During the highly sensitive phase, a zero-tolerance termination is implemented. The process involves obtaining operational authorization or confirming the completion of the wake-up process, including immediately suspending the wake-up procedure, applying emergency braking, putting the train into a safety lockout state, and sending the highest-level alarm to the dispatch center.
[0068] S3. During the wake-up process, based on the RSSP-II secure communication protocol between the vehicle controller and the area controller, the communication link status between the vehicle controller and the area controller is monitored in real time through periodic message exchange, timeout judgment, serial number verification and CRC integrity verification.
[0069] The vehicle controller and the area controller exchange security application messages at a fixed period T. The messages follow the data structure of the RSSP-II protocol and include at least the message sequence number, message CRC check code, timestamp information, and message type identifier. After receiving each message frame, the receiving end performs sequence number verification, CRC integrity verification, and timeout judgment: the sequence number verification is to determine whether the current message sequence number is equal to the sequence number of the previous valid message frame plus 1. If it does not meet the condition, it is determined that the message is lost or out of order.
[0070] CRC integrity check involves recalculating the checksum of the received message using a preset CRC-32 algorithm and comparing it with the checksum carried in the message. If they do not match, the message is considered corrupted. Timeout check involves the receiving end maintaining a receive timer. If no valid message is received within the preset communication timeout period, the communication is considered interrupted. If any of the above checks fails, the system determines that the vehicle-to-ground communication has been interrupted. If all checks pass, the communication link is considered normal, and the system continues to wait for the next cycle of messages and resets the timer.
[0071] S4. When a vehicle-to-ground communication interruption is detected, identify the current wake-up phase. A vehicle-to-ground communication interruption is detected when no valid message is received within the preset communication timeout period, or when the sequence numbers of consecutively received messages are not consecutive, or when the CRC check of the message fails.
[0072] Identifying the current wake-up stage is achieved in the following way: The vehicle controller maintains a state machine variable, which is updated at the beginning and end of each step of the wake-up process to record the specific step of the current wake-up process; when the communication monitoring module detects a message abnormality, the system immediately reads and records the current wake-up stage from the state machine variable before starting the tolerance timer.
[0073] For example:
[0074] Suppose a train is being woken up on line A of manufacturer A, currently in the secure communication link establishment phase, which is a medium-sensitive phase. The onboard controller (VOBC) internally maintains a state machine variable, WakeUpStage, which is updated at the beginning of each step of the wake-up process.
[0075] Read the current stage from the VOBC state machine variable. At this time, the value of WakeUpStage is STAGE_ESTABLISH_SECURE_LINK_STEP3.
[0076] The value of this stage is recorded in memory as the stage at which this communication interruption event occurred;
[0077] According to STAGE_ESTABLISH_SECURE_LINK_STEP3 (which belongs to the medium sensitive stage), the "stage-tolerance mapping table" is queried to obtain the corresponding short timer T2=3000ms and the processing strategy code POLICY_MID_TOLERANCE_002;
[0078] The system starts timer T2 and enters the communication recovery waiting window.
[0079] Within 3000ms of the T2 timer running, VOBC attempts to re-establish the secure communication link. If communication is successfully restored at 1800ms, execution continues from the breakpoint after the third handshake, based on the previously recorded stage information STAGE_ESTABLISH_SECURE_LINK_STEP3, without having to start the handshake process from the beginning.
[0080] Phase identification occurs before the tolerance timer starts and relies on the state machine variables maintained by VOBC itself, rather than the communication link state after the interruption. Even if the communication message is corrupted, the VOBC state machine variables still accurately record the wake-up progress when the interruption occurs, thus ensuring that the hierarchical fault tolerance strategy can be executed correctly.
[0081] S5. Based on the current security sensitivity level, query the stage-tolerance mapping table to obtain the corresponding tolerance time parameters and communication interruption handling strategy code, and execute the corresponding communication interruption handling strategy.
[0082] The communication interruption events, occurrence stages, handling strategies, and final results throughout the entire wake-up process are uniformly recorded and reported to the dispatch center to form a traceable vendor compatibility log, providing data support for fault analysis and system optimization in cross-line operations.
[0083] The communication interruption event is a structured data object, which contains at least the following fields:
[0084] Interrupt occurrence time (accurate to milliseconds), interrupt duration, interrupt type, state snapshot of the vehicle controller at the time of interruption, name of the processing strategy matched by the system for this event, tolerance timer setting and final processing result, originating line identifier, and the identifier of the manufacturer of the current vehicle device.
[0085] Specific examples are as follows:
[0086] Example 1 (Low Sensitivity Phase Timeout Interruption): The interrupt occurred at XXXX-XX-XX XX:XX:XX.XXX, lasting 8500ms (timeout interrupt). At that time, the status was "Power-on self-test, progress 65%, ZC disconnected". A low sensitivity phase tolerance recovery strategy was used, with the tolerance timer set to 10000ms. Finally, communication was restored and the device was woken up again.
[0087] Example 2 (CRC failure in the medium-sensitive phase): The interruption occurred at XXXX-XX-XX XX:XX:XX.XXX, lasting 2800ms (CRC check failure). At that time, the status was "Secure communication link establishment phase, RSSP-II handshake step 2, cache sequence number 15432". The medium-sensitive phase pause reconnection strategy was used, and the tolerance timer was set to 3000ms. Finally, the communication reconnection was successful, and execution resumed from the breakpoint.
[0088] Example 3 (Sequence number disorder during high-sensitivity phase): Interruption occurred at XXXX-XX-XX XX:XX:XX.XXX, lasting 0ms (sequence number disorder). At that time, the status was "acquiring operation authorization phase, partial movement authorization received, valid sequence number 17892". The zero-tolerance termination strategy for high-sensitivity phase was used, with the tolerance timer set to 0ms. Finally, the wake-up was aborted, emergency braking was applied, and the train entered the safety lock state.
[0089] This approach dynamically matches different communication interruption tolerance strategies based on the security sensitivity of the wake-up phase, creatively integrating relaxation strategies and stringent logic in its mechanism. Unlike traditional static timeout reconnection methods, it establishes a dynamically changing security boundary deeply bound to the wake-up process, greatly improving the robustness of the wake-up process without sacrificing core security.
[0090] Specifically, addressing the conflict between the two solutions, Zhonghe and Zhikong, in the "sleep wake-up" scenario recorded in the "Chongqing UTO Interoperability Function Difference Table"—the former allowing communication interruptions during non-core stages such as static testing and power-on self-test, while the latter requiring absolute communication continuity—this invention divides the wake-up process into low-sensitivity stages (such as static testing and power-on self-test) and high-sensitivity stages (such as obtaining operating authorization). It configures a long-tolerance timer for the low-sensitivity stage (simulating Zhonghe logic) and a zero-tolerance strategy for the high-sensitivity stage (simulating Zhikong logic). This achieves compatibility between two extreme vendor logics within the same system, enabling trains using different strategies to seamlessly complete wake-up within the system, effectively solving the core compatibility problem of cross-line operation.
[0091] In a preferred embodiment of the present invention, the security-sensitive stage is divided into a low-sensitivity stage, a medium-sensitivity stage, and a high-sensitivity stage according to time sequence, specifically as follows:
[0092] The low-sensitivity phase is the initial phase of the wake-up process, which includes power-on self-test and communication request steps. This phase does not involve driving safety-related operations and allows communication disturbances within a preset range.
[0093] The medium-sensitive phase is the intermediate transition phase of the wake-up process, which includes waiting for connection and establishing a secure communication link. During this phase, the vehicle-to-ground safety control link is being established, and the sensitivity to communication interruption is between that of the low-sensitive phase and the high-sensitive phase.
[0094] The highly sensitive phase is the final stage of the wake-up process, which includes obtaining operating authorization and wake-up completion steps. This stage involves the calculation and confirmation of driving authorization and is most sensitive to communication interruptions.
[0095] The tolerance timers at each stage can be flexibly configured according to the actual communication quality of different lines and manufacturers, and the accompanying compatibility logs provide a data foundation for continuous cross-line operation optimization.
[0096] In a preferred embodiment of the present invention, the tolerance time parameters corresponding to each security sensitive stage are implemented by timers, specifically: the low sensitivity stage corresponds to a long timer T1, the medium sensitivity stage corresponds to a short timer T2, and the high sensitivity stage corresponds to a zero tolerance timer T3. The durations of the three timers satisfy T1 > T2 > T3, and the duration of T3 is 0.
[0097] The tolerance time parameter is calculated as follows:
[0098] T = Maximum latency per interaction × Number of retries + Safety margin;
[0099] The maximum latency for a single interaction is determined based on the communication timeout specified in the RSSP-II secure communication protocol. The number of retries is set according to the tolerance for communication interruption in this stage, and the safety margin is used to cover random fluctuations in the wireless communication environment.
[0100] For low-sensitivity phases, the number of retries is set to a relatively high value (e.g., 3-5 times), and the safety margin is set to a relatively large value (e.g., 2-5 seconds); for medium-sensitivity phases, the number of retries is set to a moderate value (e.g., 1-2 times), and the safety margin is set to a moderate value (e.g., 1-2 seconds); for high-sensitivity phases, the number of retries is set to 0, and the safety margin is set to 0, to achieve zero tolerance.
[0101] In a preferred embodiment of the present invention, the communication interruption handling strategy includes a low-sensitivity phase handling strategy and a high-sensitivity phase handling strategy, specifically:
[0102] The low-sensitivity phase handling strategy is as follows: If the communication interruption occurs during the power-on self-test or communication request phase, a long timer T1 is started, the communication recovery tolerance window is opened, the wake-up process is suspended and the current state is maintained; if the communication is restored before the T1 timer ends, the wake-up process is resumed from the suspended state and continues to execute; if the communication is not restored after the T1 timer ends, it is determined to be a minor fault and enters the preset fault recovery process.
[0103] The high-sensitivity phase handling strategy is as follows: If the communication interruption occurs during the acquisition of operation authorization or wake-up completion phase, the zero-tolerance timer T3 is started, the zero-tolerance strategy is immediately executed, the wake-up process is terminated, the train is controlled to apply emergency braking, an emergency braking command is output to the train through the on-board controller, the highest level alarm is sent to the dispatch center, and the train enters a safety lock state, which can only be unlocked by manual intervention or local physical reset.
[0104] The low-sensitivity phase uses a long timer to simulate relaxed logic, maximizing tolerance for short-term communication fluctuations and avoiding unnecessary wake-up failures. The high-sensitivity phase uses a zero-tolerance strategy to simulate stringent logic, ensuring the safety and absolute controllability of the vehicle authorization process.
[0105] More preferably, the communication interruption handling strategy also includes a medium-sensitive phase handling strategy, specifically:
[0106] If the communication interruption occurs during the waiting for connection or the establishment of a secure communication link, the system starts a short timer T2, immediately suspends the wake-up process, caches the current wake-up state, and opens a secure reconnection window.
[0107] If communication is successfully reconnected before the T2 timeout ends, the wake-up process resumes execution from the breakpoint based on the cache status; if reconnection is still unsuccessful before the T2 timeout ends, it is determined to be a moderate fault, the train is guided to the preset safe waiting recovery state, and an alarm message is sent to the dispatch center.
[0108] For example, during power-on self-test, the train receives a wake-up command at the depot on line A, the VOBC powers on, and begins self-testing. At this time, due to line switching, a brief disturbance occurs in the train-to-ground wireless network, causing a communication interruption. The system determines that it is currently in a low-sensitivity phase (power-on self-test). According to the present invention, a high-tolerance strategy is matched for this phase. The system starts a 10-second tolerance timer. Within 8 seconds of the timer running, the communication link is restored. The system determines this to be a recoverable event, the VOBC continues to complete the self-test, and the wake-up is not aborted. The wake-up process enters the waiting-for-connection phase, at which point communication is unexpectedly interrupted again. The system recognizes that it has entered a medium-sensitivity phase, automatically switches to a medium-tolerance strategy, immediately pauses the wake-up process, caches the current state, and initiates a 3-second safe reconnection window. After 2 seconds, communication is successfully reconnected. The system reads the cached state, confirms the previous connection progress, and continues to send a connection request to ZC from the point of interruption, ultimately successfully establishing communication. After communication is established, the authorization acquisition phase begins. This phase is a high-sensitivity phase, matched with a zero-tolerance strategy, and the system continuously monitors the communication link. With communication remaining stable, VOBC successfully obtained runtime authorization from ZC and completed the wake-up process. No errors or interruptions occurred during the entire process.
[0109] Using this method, trains that originally followed a strict strategy successfully withstood two short-term communication interruptions on lines dominated by a relaxed strategy, achieving seamless wake-up across lines.
[0110] In a preferred embodiment of the present invention, the tolerance time parameter in the stage-tolerance mapping table is a configurable parameter, and its configuration method includes: in response to a train entering the jurisdiction of a new line, dynamically loading the corresponding tolerance time parameter set according to the preset configuration information of the line; or adjusting the tolerance time parameter online according to the configuration instruction issued by the dispatch center.
[0111] The tolerance time parameter can be configured in the following ways:
[0112] Cross-line adaptive configuration: When a train travels from the Bi-Tong Line to Line 15 for cross-line wake-up, the onboard controller obtains the preset configuration information of that line from the ground line database via wireless communication before entering the jurisdiction of Line 15. This configuration information includes a set of tolerance time parameters bound to the characteristics of that line. For example, it can be set as follows: low-sensitivity phase tolerance time T1 = 10000ms, medium-sensitivity phase tolerance time T2 = 3000ms, and high-sensitivity phase tolerance time T3 = 0ms. The onboard controller updates the parameters in its local "phase-tolerance mapping table" to this set, automatically adapting to the communication environment characteristics of Line 15.
[0113] The dispatch center performs online parameter adjustments. When a line's communication quality deteriorates due to seasonal changes and requires adjustment of the tolerance time, the dispatch center operator modifies the tolerance time parameters for that line on the dispatch workstation. The dispatch center then sends the configuration command to all on-board controllers within the line's jurisdiction via the dispatch communication network. Upon receiving the command, the on-board controllers update the corresponding parameters in their local "stage-tolerance mapping table" online, without requiring a restart or manual on-site intervention.
[0114] This invention also provides a graded fault-tolerant processing system for train-to-ground communication interruption during cross-system and cross-vendor train wake-up process, comprising:
[0115] The phase division module is used to pre-classify the safety criticality level of each operation in the train wake-up process based on the degree of impact on train operation safety, and then divide the entire train wake-up process into at least two safety-sensitive phases based on the safety criticality level, and establish a phase-safety mapping relationship for the wake-up process.
[0116] The mapping table storage module is used to store the stage-tolerance mapping table bound to the stage-security degree mapping relationship. The stage-tolerance mapping table stores the tolerance time parameters and communication interruption handling strategy code corresponding to each security sensitive stage.
[0117] The communication monitoring module is used to monitor the communication link status between the on-board controller and the area controller in real time during the train wake-up process.
[0118] The interruption identification module is used to identify the security-sensitive stage of the current wake-up process when an interruption in vehicle-to-ground communication is detected.
[0119] The fault-tolerant execution module is used to query the stage-tolerance mapping table based on the identified security sensitivity level of the current stage, obtain the corresponding tolerance time parameters and communication interruption handling strategy code, and execute the corresponding communication interruption handling strategy.
[0120] The processing system executes the cross-system and cross-vendor train wake-up process vehicle-to-ground communication interruption graded fault tolerance processing method described in this invention to complete the cross-system and cross-vendor train wake-up process vehicle-to-ground communication interruption graded fault tolerance processing.
[0121] The specific embodiments described herein are merely illustrative examples of the present invention. Those skilled in the art can make various modifications or additions to the described embodiments or use similar methods to substitute them, without departing from the technology of the present invention or exceeding the scope defined by the appended claims.
[0122] In the embodiments of this application, terms such as "fixed," "fixed connection," and "fixed connection" refer to common fixing methods in the prior art, such as welding, riveting, and screws. "Rotary connection" refers to common rotary connection methods in the prior art, such as hinges and bearing rotation. If electrical components are provided, the functions, control, and power supply methods of all electrical components are common technical means in the prior art. This application has not improved them and they are not within the protection scope of this application. Therefore, this application will not elaborate on them.
[0123] Furthermore, the selection of materials and strength limitations for all components in this application can be made and arranged by those skilled in the art based on the site environment and the requirements of relevant national or industry standards, and are not within the scope of protection of this application. Therefore, this application will not elaborate on these points.
Claims
1. A hierarchical fault-tolerant handling method for train-to-ground communication interruption during cross-system and cross-vendor train wake-up process, characterized in that, Includes the following steps: S1. Based on the degree of impact of each operation in the train wake-up process on train operation safety, classify the safety criticality level of the operation in advance, and then divide the entire train wake-up process into at least two safety-sensitive stages according to the safety criticality level, and establish a stage-safety mapping relationship for the wake-up process. S2. Pre-generate a stage-tolerance mapping table bound to the stage-security mapping relationship. The mapping table stores the tolerance time parameters and communication interruption handling strategy codes corresponding to each security-sensitive stage. S3. During the wake-up process, monitor the status of the communication link between the vehicle controller and the area controller in real time; S4. When a vehicle-to-ground communication interruption is detected, identify the current sensitive stage. S5. Based on the sensitive stage of the current stage, query the stage-tolerance mapping table to obtain the corresponding tolerance time parameter and communication interruption handling strategy code, and execute the corresponding communication interruption handling strategy.
2. The cross-system, cross-vendor train wake-up process train-to-ground communication interruption graded fault-tolerant processing method according to claim 1, characterized in that, The communication interruption events, occurrence stages, handling strategies, and final results throughout the entire wake-up process are uniformly recorded and reported to the dispatch center to form a traceable vendor compatibility log, providing data support for fault analysis and system optimization in cross-line operations. The communication interruption event is a structured data object, which includes at least the following fields: interruption time, interruption duration, interruption type, state snapshot of the vehicle controller at the time of interruption, name of the processing strategy matched for the event, tolerance timer setting and final processing result, occurrence line identifier, and the identifier of the manufacturer to which the current vehicle device belongs.
3. The cross-system, cross-vendor train wake-up process train-to-ground communication interruption graded fault-tolerant processing method according to claim 1, characterized in that, The security-sensitive phase is divided into a low-sensitivity phase and a high-sensitivity phase according to time sequence, specifically as follows: The low-sensitivity phase is the initial phase of the wake-up process, which includes power-on self-test and communication request steps. This phase does not involve driving safety-related operations and allows communication disturbances within a preset range. The highly sensitive phase is the final stage of the wake-up process, which includes obtaining operating authorization and wake-up completion steps. This stage involves the calculation and confirmation of driving authorization and is most sensitive to communication interruptions.
4. The cross-system, cross-vendor train wake-up process train-to-ground communication interruption graded fault-tolerant processing method according to claim 3, characterized in that, The security-sensitive phase also includes the medium-sensitive phase: The intermediate sensitive stage is the transitional stage of the wake-up process, which includes waiting for connection and establishing a secure communication link. During this stage, the vehicle-to-ground security control link is being established, and the sensitivity to communication interruption is between that of the low-sensitivity stage and the high-sensitivity stage.
5. The cross-system, cross-vendor train wake-up process train-to-ground communication interruption graded fault-tolerant processing method according to claim 3, characterized in that, The tolerance time parameters for each security-sensitive stage are implemented through a timer, specifically: The low-sensitivity phase corresponds to a long timer T1, the medium-sensitivity phase corresponds to a short timer T2, and the high-sensitivity phase corresponds to a zero-tolerance timer T3. The durations of the three timers satisfy T1 > T2 > T3, and the duration of T3 is 0.
6. The cross-system, cross-vendor train wake-up process train-to-ground communication interruption graded fault-tolerant processing method according to claim 5, characterized in that, The communication interruption handling strategy includes a low-sensitivity phase handling strategy and a high-sensitivity phase handling strategy, specifically: The low-sensitivity phase handling strategy is as follows: If the communication interruption occurs during the power-on self-test or communication request phase, the system starts a long timer T1, opens a communication recovery tolerance window, and the wake-up process is suspended and maintains the current state; if the communication is restored before the T1 timer ends, the wake-up process resumes from the suspended state and continues to execute; if the communication is not restored after the T1 timer ends, it is determined to be a minor fault and enters the preset fault recovery process. The high-sensitivity phase handling strategy is as follows: If the communication interruption occurs during the acquisition of operation authorization or wake-up completion phase, the system starts the zero-tolerance timer T3 and immediately executes the zero-tolerance strategy: abort the wake-up process, control the train to apply emergency braking, output an emergency braking command to the train through the on-board controller, send the highest level alarm to the dispatch center, and the train enters a safety lock state, which can only be unlocked by manual intervention or local physical reset.
7. The cross-system, cross-vendor train wake-up process train-to-ground communication interruption graded fault-tolerant processing method according to claim 6, characterized in that, The communication interruption handling strategy also includes a medium-sensitive phase handling strategy, specifically: If the communication interruption occurs during the waiting connection or secure communication link establishment phase, start a short timer T2, immediately pause the wake-up process, cache the current wake-up state, and open a secure reconnection window. If communication is successfully reconnected before the T2 timeout ends, the wake-up process resumes execution from the breakpoint based on the cache state. If the reconnection fails after the T2 timeout, it is determined to be a moderate fault. The train is then guided to the preset safe waiting state for recovery, and an alarm message is sent to the dispatch center.
8. The cross-system, cross-vendor train wake-up process train-to-ground communication interruption graded fault-tolerant processing method according to claim 1, characterized in that, The tolerance time parameter in the "stage-tolerance mapping table" is a configurable parameter, and its configuration methods include: dynamically loading the corresponding tolerance time parameter set according to the preset configuration information of the line in response to the train entering the jurisdiction of the new line; or adjusting the tolerance time parameter online according to the configuration instructions issued by the dispatch center.
9. A hierarchical fault-tolerant processing system for train-to-ground communication interruption during cross-system and cross-vendor train wake-up process, characterized in that, include: The phase division module is used to pre-classify the safety criticality level of each operation in the train wake-up process based on the degree of impact on train operation safety, and then divide the entire train wake-up process into at least two safety-sensitive phases based on the safety criticality level, and establish a phase-safety mapping relationship for the wake-up process. The mapping table storage module is used to store the stage-tolerance mapping table bound to the stage-security degree mapping relationship. The stage-tolerance mapping table stores the tolerance time parameters and communication interruption handling strategy code corresponding to each security sensitive stage. The communication monitoring module is used to monitor the communication link status between the on-board controller and the area controller in real time during the train wake-up process. The interruption identification module is used to identify the security-sensitive stage of the current wake-up process when an interruption in vehicle-to-ground communication is detected. The fault-tolerant execution module is used to query the stage-tolerance mapping table based on the identified security sensitivity level of the current stage, obtain the corresponding tolerance time parameter and communication interruption handling strategy code, and execute the corresponding communication interruption handling strategy. The processing system executes the cross-system and cross-vendor train wake-up process vehicle-to-ground communication interruption hierarchical fault tolerance processing method as described in any one of claims 1-8, and completes the cross-system and cross-vendor train wake-up process vehicle-to-ground communication interruption hierarchical fault tolerance processing.