Train control system

Abstract

The application relates to the technical field of rail transit train control, and relates to a train control system which comprises a communication module, a central control module and an autonomous running module. The communication module receives safe driving information from a signal subsystem and vehicle state information from a vehicle subsystem, and respectively sends the safe driving information and the vehicle state information to the autonomous running module and the central control module; the central control module generates vehicle state integrated information after analyzing the vehicle state information, and sends the vehicle state integrated information to the autonomous running module; the autonomous running module generates a control instruction for train running according to the received information, and feeds back the control instruction to the central control module; and the central control module generates vehicle control information according to the control instruction, and sends the vehicle control information to a corresponding vehicle subsystem through the communication module. The application solves the problem of low data interaction efficiency between a train automatic running system and a central control unit by fusing the core functions of the train automatic running system and the central control unit, realizes real-time data interaction, and improves the collaboration and reliability of train control.

Description

Technical Field

[0001] This application relates to the field of rail transit train control technology, and in particular to a train control system. Background Technology

[0002] In train operation control, the two core systems relied upon are the Automatic Train Control System (ATS) and the Train Control and Management System (TCS). The ATS is responsible for achieving advanced driving functions such as automatic driving and precise stopping, while the TCS's central control unit is responsible for core vehicle management tasks such as overall vehicle logic control, traction and braking coordination, and fault diagnosis.

[0003] Because the train automatic control system and the train control and management system are relatively independent, the train automatic operation system and the central control unit communicate through external buses such as Ethernet bus and multi-function vehicle bus. However, this communication method suffers from low data exchange efficiency, making it difficult to meet the high-precision train control requirements such as precise stopping and real-time speed adjustment. Summary of the Invention

[0004] This application provides a train control system that at least solves the problems of low data interaction efficiency, insufficient system reliability, and slow redundancy switching between the automatic train operation system and the central control unit in related technologies, and realizes integrated train control, high real-time interaction, and high-safety redundancy operation.

[0005] In a first aspect, embodiments of this application provide a train control system, including: a communication module, an autonomous operation module, and a central control module; The communication module is configured to establish communication with the signal subsystem and the vehicle subsystem respectively, receive safe driving information from the signal subsystem and vehicle status from the vehicle subsystem, send the safe driving information to the autonomous operation module, and send the vehicle status information to the central control module. The central control module establishes communication with the autonomous operation module and the communication module respectively, and is configured to parse the vehicle status information and generate integrated vehicle status information, and send the integrated vehicle status information to the autonomous operation module; receive control commands from the autonomous control operation module, generate control information for controlling the operation of the vehicle subsystem according to the control commands, and send the control information to the corresponding vehicle subsystem through the communication module; The autonomous operation module establishes communication with the communication module and the central control module respectively, and is configured to receive the safe driving information and the vehicle status integration information; generate the control command for train operation based on the safe driving information and the vehicle status integration information, and send the control command to the central control module.

[0006] In some embodiments, the communication module is further configured to: Receive Ethernet messages sent by the signal subsystem and the vehicle subsystem; According to the train real-time data protocol, the Ethernet packets are parsed to obtain the safe driving information and the vehicle status information.

[0007] In some embodiments, the system further includes: The system security module establishes communication with the autonomous operation module, the central control module, and the communication module, and is configured to receive the working status from the autonomous operation module, the central control module, and the communication module respectively; based on the working status, it determines whether there is any abnormality in the autonomous operation module, the central control module, and the communication module; if an abnormality is determined, the module with the abnormality performs a restart operation.

[0008] In some embodiments, the system further includes: The real-time running module is configured to construct a shared memory with multiple independent partitions for data exchange between the communication module, the autonomous running module, and the central control module. The communication module, the autonomous running module, and the central control module perform write and read operations through the shared memory.

[0009] In some embodiments, the shared memory includes a first shared memory used for interaction between the autonomous operation module and the communication module; During the interaction between the autonomous operation module and the communication module, after receiving the safe driving information, the communication module writes the safe driving information into the first shared memory. The autonomous operation module reads the safe driving information from the first shared memory and writes autonomous driving output information into the first shared memory. The communication module reads and encapsulates the autonomous driving output information from the first shared memory and sends the encapsulated autonomous driving output information to the corresponding signal subsystem.

[0010] In some embodiments, the shared memory includes a second shared memory for the central control module to interact with the communication module; During the interaction between the central control module and the communication module, the communication module writes the vehicle status information into the second shared memory, the central control module reads the vehicle status information from the second shared memory and writes the control information into the second shared memory, the communication module reads the control information from the second shared memory and encapsulates it, and sends the encapsulated control information to the corresponding vehicle subsystem.

[0011] In some embodiments, the shared memory includes a third shared memory used for the autonomous operating module to interact with the central control module; During the interaction between the autonomous operation module and the central control module, the autonomous operation module writes the control instructions to the third shared memory, the central control module reads the control instructions from the third shared memory and writes vehicle status integration information to the third shared memory, and after reading the vehicle status integration information, the autonomous operation module adjusts the issued control instructions according to the vehicle status integration information.

[0012] In some embodiments, before performing a write or read operation on the shared memory, the communication module, the autonomous operation module, and the central control module all request a mutex lock from the shared memory; after obtaining the mutex lock, the communication module, the autonomous operation module, or the central control module performs a write or read operation on the shared memory, and releases the mutex lock after the operation is completed.

[0013] In some embodiments, the system includes a primary control device and a backup control device, both of which include the communication module, the autonomous operation module, and the central control module. The primary control device is configured to receive the safe driving information, the vehicle status information, and its own status information fed back by the backup control device, and to send the control information to the corresponding vehicle subsystem. The backup control device is configured to receive the safe driving information and the vehicle status information, to feed back its own status information to the primary control device, and not to actively issue control commands.

[0014] In some embodiments, when the primary control device fails, the backup control device verifies the fault of the primary control device. If the fault verification passes, the primary control device and the backup control device perform a primary / backup switchover.

[0015] Compared to related technologies, the train control system provided in this application integrates the automatic train operation system and the central control unit, which solves the problem of low data interaction efficiency between the two, improves train control efficiency, enhances the smoothness and accuracy of train operation control, and meets the high-precision train control requirements such as precise stopping and real-time speed adjustment.

[0016] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a structural block diagram of a train control system according to an embodiment of this application; Figure 2 This is another structural block diagram of a train control system according to an embodiment of this application; Figure 3 This is another structural block diagram of a train control system according to an embodiment of this application; Figure 4 This is a structural block diagram of a main control device and a backup control device in a train control system according to an embodiment of this application; Figure 5 This is a flowchart illustrating the operation of a train control system according to an embodiment of this application; Figure 6 This is a structural diagram of multiple processes in a train control system according to an embodiment of this application; Figure 7 This is a flowchart illustrating the operation of a primary control device and a backup control device in a train control system according to an embodiment of this application. Figure 8 This is a schematic diagram of the operation of a system safety module in a train control system according to an embodiment of this application; Figure 9 This is a structural block diagram of a signal subsystem in a train control system according to an embodiment of this application.

[0018] In the diagram: 101. Communication module; 102. Autonomous operation module; 103. Central control module; 104. Vehicle subsystem; 105. System security module; 106. Real-time operation module; 107. First shared memory; 108. Second shared memory; 109. Third shared memory; 110. Fourth shared memory; 111. Main control board; 112. Communication board; 113. Power board; 114. Backplane; 115. Train automatic protection system; 116. Onboard data recording unit; 117. Software watchdog component; 118. Hardware watchdog component; 119. Signal subsystem; 120. Train automatic monitoring system Detailed Implementation To make the objectives, technical solutions, and advantages of this application clearer, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0019] Obviously, the accompanying drawings described below are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar scenarios based on these drawings without any inventive effort. Furthermore, it is understood that although the efforts made in this development process may be complex and lengthy, for those skilled in the art related to the content disclosed in this application, any changes to design, manufacturing, or production based on the technical content disclosed in this application are merely conventional technical means and should not be construed as insufficient disclosure of the content of this application.

[0020] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0021] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms “a,” “an,” “an,” “the,” and similar words used in this application do not indicate quantity limitation and may indicate singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units not listed, or may include other steps or units inherent to these processes, methods, products, or devices. The terms “connected,” “linked,” “coupled,” and similar words used in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following objects are in an "or" relationship. The terms "first," "second," and "third" used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects.

[0022] The core of train operation control relies on two major systems: the Automatic Train Control System (ATC) and the Train Control and Management System (TCMS).

[0023] The Automatic Train Control (ATC) system comprises the Automatic Train Protection System (ATP), the Automatic Train Operation System (ATO), and the Automatic Train Supervision System (ATS). The ATP system is responsible for core safety functions such as safe speed monitoring and train operation permission verification. The ATO system enables automatic train start-stop, acceleration / deceleration, precise stopping, and door control linkage, serving as the core of automatic train operation. The ATS system performs overall management functions, including train operation planning and real-time status monitoring.

[0024] The core subsystems of TCMS include: the Central Control Unit (CCU), the Remote Input / Output Module (RIOM), and the Human-Machine Interface Unit (HMI). The CCU receives and processes commands and data from the TCMS, enabling overall vehicle logic control, fault diagnosis, and subsystem scheduling. The RIOM collects input signals from various relays and switches on the train and uploads them to the CCU. It also receives control commands from the CCU and drives actuators to complete output control. The HMI provides the driver with an interface to interact with the TCMS, displaying train operating status and fault information.

[0025] Currently, ATO and CCU are independent hardware units, and cross-system data interaction is achieved through external buses such as Ethernet and MVB, which presents the following problems.

[0026] (1) Low data interaction efficiency: The external bus transmission path is complex and easily interfered with, and the communication delay is up to 100ms, which makes it difficult to meet the high-precision vehicle control requirements such as precise parking and real-time speed adjustment.

[0027] (2) High system maintenance costs: The independent architecture of ATO and CCU requires separate testing, and the hardware and software need to be debugged separately, which prolongs the vehicle debugging cycle and increases the workload and cost of operation and maintenance.

[0028] (3) Insufficient reliability and availability: It relies on external bus communication, and bus failures can easily cause delays in vehicle control commands. Furthermore, it lacks a unified safety guarantee mechanism, which limits the stability of system operation.

[0029] (4) Low utilization of multi-core resources: Traditional control units are not optimized for multi-core processor task scheduling. The mixed operation of multiple tasks leads to frequent switching, resulting in low utilization of multi-core resources and weakening the system's real-time response capability.

[0030] (5) Limited reliability of redundancy switching: When a single control unit fails, it relies on an external redundancy mechanism for switching. It lacks a unified fault verification and data synchronization mechanism, which can easily lead to short-term train loss of control and make it difficult to meet the high safety operation requirements of rail transit.

[0031] Furthermore, existing solutions for the integration of signal and network systems only achieve simple functional overlay and fail to address key issues such as redundant architecture, security isolation, multi-core scheduling, master-slave switching, and hierarchical reset, making it difficult to support stable operation in flexible grouping scenarios.

[0032] To address the aforementioned issues, this application provides a train control system that breaks away from the traditional independent architecture of ATO and CCU, adopting an integrated design that achieves efficient internal communication and information exchange while constructing a robust safety mechanism to ensure the stable operation of the integrated architecture. The core of the train control system includes a communication module, an autonomous operation module, and a central control module, with additional system safety and real-time operation modules. A primary / backup redundant hardware architecture is employed, with a complete control system deployed in each of the head and tail cars to achieve highly reliable and stable operation.

[0033] like Figure 1 As shown in the figure, this application provides a train control system, including: a communication module 101, an autonomous operation module 102, and a central control module 103.

[0034] The communication module 101 is configured to establish communication with the signal subsystem 119 and the vehicle subsystem 104, receive safe driving information from the signal subsystem 119 and vehicle status information from the vehicle subsystem 104, send the safe driving information to the autonomous operation module 102, and send the vehicle status information to the central control module 103. The central control module 103 establishes communication with the autonomous operation module 102 and the communication module 101 respectively. It is configured to parse vehicle status information and generate integrated vehicle status information, and send the integrated vehicle status information to the autonomous operation module 102. It also receives control commands from the autonomous control operation module, generates control information for controlling the operation of the vehicle subsystem 104 according to the control commands, and sends the control information to the corresponding vehicle subsystem 104 through the communication module 101. The autonomous operation module 102 establishes communication with the communication module 101 and the central control module 103 respectively, and is configured to receive safe driving information and vehicle status integration information; based on the safe driving information and vehicle status integration information, it generates control commands for train operation and sends the control commands to the central control module 103.

[0035] By dividing the system into three functional units—communication module 101, autonomous operation module 102, and central control module 103—each module can operate independently and establish communication links with each other. Communication module 101 connects to signal subsystem 119 and vehicle subsystem 104, and uploads safety driving information and vehicle status information separately. Safety driving information is sent to autonomous operation module 102, and vehicle status information is sent to central control module 103. Central control module 103 parses vehicle status information and forwards it to autonomous operation module 102. Autonomous operation module 102 integrates safety driving information and vehicle status information to generate control commands. Central control module 103 then converts the control commands into control information adapted to vehicle subsystem 104 and sends them out through communication module 101. Ultimately, this achieves hierarchical transmission and collaborative processing of train operation data and vehicle status, enabling autonomous decision-making and hierarchical control of train operation, and achieving integrated and logical automatic operation and control of the control system.

[0036] Specifically, the autonomous operation module 102 is used to realize automatic train start-stop control, precise parking control, door control linkage control and energy-saving optimization functions. It is also used to interact with the central control module 103 to obtain the vehicle status and issue corresponding control commands.

[0037] Safe driving information includes train speed, train location information, track parameters, track speed limits, and safe speed curves.

[0038] like Figure 9 As shown, the signal subsystem 104 includes an automatic train protection system 115, an automatic train monitoring system 120, and an onboard data recording unit 116.

[0039] The autonomous operation module 102 establishes communication with the automatic train protection system 115 to obtain train speed and position information sent by the automatic train protection system 115 and upload its own status and fault data. It also obtains the dispatching instructions of the automatic train monitoring system 120 forwarded by the automatic train protection system 115 and sends the operating status and control instructions to the on-board data recording unit 116 in real time.

[0040] Specifically, the central control module 103 is used to realize train operation logic control, traction and braking control, vehicle monitoring and diagnostic functions, and also to interact with the autonomous operation module 102 to receive control commands issued by the autonomous operation module 102, and to feed back real-time vehicle status information to the autonomous operation module 102, and to interact with the vehicle subsystem 104 to issue control information and collect status and fault data of the vehicle subsystem 104.

[0041] Furthermore, a redundant architecture is adopted for the train control system. Hardware devices integrating a central control module 103, an autonomous operation module 102, and a communication module 101 are installed at the front and rear of the train, respectively. One hardware device serves as the primary control device, and the other serves as the backup control device. For any given hardware device, the modules on its own device serve as its local modules, and the modules on the other hardware device serve as its peer modules.

[0042] Specifically, the communication module 101 is used to transmit, receive, parse, and process Ethernet data. It also encapsulates and verifies data sent by the local autonomous operation module 102 before forwarding it to the train automatic protection system 115, the on-board data recording unit 116, and the remote autonomous operation module 102. The communication module 101 also verifies and parses data from the train automatic protection system 115 and the remote autonomous operation module 102 before distributing it to its own autonomous operation module 102. Furthermore, the communication module 101 encapsulates and verifies data sent by the local central control module 103 before forwarding it to various vehicle subsystems, and verifies and parses data sent by the vehicle subsystem 104 before distributing it to its own central control module 103.

[0043] In some embodiments, the autonomous operation module 102 controls the train to operate autonomously. During automatic train operation, the autonomous operation module 102 is divided into functions such as adjusting operating speed, automatic precise stopping, automatic departure from stations, temporary stopping within sections, and temporary speed limits within sections.

[0044] Taking speed adjustment as an example, the control process includes: the autonomous operation module 102 receives information such as line parameters, train speed, train position information and line speed limit collected by the on-board equipment of the automatic train protection system 115, combines the operation plan instructions sent by the automatic train monitoring system 120, outputs the target speed curve of the train, and calculates and generates control instructions by obtaining the real-time status of the traction and braking system from the central control module 103, controls the train to perform traction, coasting, braking and other operations, and completes the speed adjustment of the train.

[0045] When the train is in an unmanned automatic turnaround situation, after the train arrives at the turnaround station and comes to a complete stop, the autonomous operation module 102 receives the automatic turnaround command. Using the onboard track database and real-time train position information, combined with the safe speed curve provided by the automatic train protection system 115, it calculates the optimal turnaround path and speed curve. During the turnaround process, the autonomous operation module 102 controls the train's traction, braking, and coasting in real time according to the calculated speed curve. The central control module 103, following the control commands of the autonomous operation module 102, controls the train to automatically move to the turnaround line and complete the turnaround operation, finally stopping at the designated position on the departure platform.

[0046] During the automatic door opening and closing process, after the train arrives at the station, the Autonomous Operation Module 102 receives the door opening authorization from the Automatic Train Protection System 115 and, after confirming its correct position, sends an opening command to the Central Control Module 103. The Central Control Module 103 then controls the door control unit to complete the door opening operation. When the stop time ends, the ATO receives the closing command and sends a closing command to the Central Control Module 103, which then controls the door control unit to complete the closing operation.

[0047] In some embodiments, the central control module 103 performs traction / braking control, system monitoring and diagnostics, and primary / backup switching decisions.

[0048] Specifically, during traction / braking control, the central control module 103 receives traction / braking commands from the autonomous operation module 102, comprehensively judges and calculates the traction force distribution value of the vehicle based on the traction command, vehicle load information, and traction level information, and sends the traction command and traction force distribution value to the traction system. Based on the braking command, braking level information, and load information, the braking force demand value is calculated, and the electric braking control command is sent to the traction system, while the air braking command is sent to the braking system, realizing hybrid electric-air braking operation.

[0049] During system monitoring and diagnosis, the central control module 103 collects the status data and fault information of the vehicle subsystem 104 in real time and sends them to the display screen.

[0050] When making a primary / standby switchover decision, the central control module 103 exchanges status data with the central control module 103 at the other end every 20ms. When it detects a fault in the primary control device it is in, it triggers the primary / standby switchover.

[0051] The central control module 103 has pre-set control logic for controlling the train. This control logic is developed using the CODESYS IDE, strictly adhering to the IEC 61131-3 standard. Core logic such as traction and braking control is designed and implemented through graphical or text-based modeling. After development, compilation and configuration are performed in the CODESYS IDE to verify the syntax and security rules of the control logic. Upon successful verification, the compilation process is triggered, ultimately generating the application.app file, which encapsulates the complete control logic, parameter configuration, and interface definitions. This file can be directly adapted for loading and scheduling execution by the real-time running module 106.

[0052] In some embodiments, the communication module 101 is further configured to: Receive Ethernet messages sent by signal subsystem 119 and vehicle subsystem 104; According to the Train Real-time Data Protocol (TRDP), Ethernet packets are parsed to obtain safe driving information and vehicle status information.

[0053] After receiving Ethernet messages from the signaling subsystem 119 and the vehicle subsystem 104, the communication module 101 parses the Ethernet messages according to the train real-time data protocol, extracting standard-format train operation information and status data from the original messages. This standardized parsing method based on the train-specific real-time data protocol enables unified decoding and effective data stripping of network messages from the signaling subsystem 119 and the vehicle subsystem 104, ensuring the standardization, accuracy, and real-time nature of the uplink train operation information and vehicle status data, and providing reliable data source support for the calculation and decision-making of the backend modules.

[0054] Specifically, a communication module 101 is set up based on the train real-time data protocol stack. During the data transmission and processing, the communication module 101 receives Ethernet messages from the signal subsystem 119, vehicle subsystem 104, etc., unpacks the train real-time data protocol, extracts the valid data, and sends it to the central control module 103 and autonomous operation module 102 as needed, writing it into the corresponding shared memory. On the other hand, it reads the data sent out by the central control module 103 and autonomous operation module 102 from each shared memory, encapsulates it into train real-time data protocol messages, including fields such as message ID, timestamp, and data length, and sends it to the corresponding on-board equipment or subsystem.

[0055] According to safety levels, vehicle subsystem 104 is divided into a first safety subsystem and a first non-safety subsystem. The first safety subsystem includes the traction system, braking system, etc., while the first non-safety subsystem includes the air conditioning system, door system, etc. Signal subsystem 119 is divided into a second safety subsystem and a second non-safety subsystem. The second safety subsystem includes the train automatic protection system 115, the train automatic monitoring system 120, etc., while the second non-safety subsystem includes the onboard data recording unit 116, etc.

[0056] During the data verification and filtering process, the communication module 101 performs hierarchical verification on the received data. Data from the first and second security subsystems are verified using SDT, while data from the first and second non-security subsystems are verified using CRC32.

[0057] Furthermore, the communication module 101 directly discards the data that fails verification and records it in the log.

[0058] The communication module 101 uses a circular queue and read / write flags to achieve data synchronization. Each communication ID corresponds to 10 data packets in the cache. When the communication module 101 writes data to the shared memory, the flag is set to 1. After the autonomous operation module 102 or the central control module 103 reads the data, the flag is set to 0 to avoid data overwriting.

[0059] In some embodiments, the system further includes: The system security module 105 establishes communication with the autonomous operation module 102, the central control module 103, and the communication module 101, and is configured to receive the working status from the autonomous operation module 102, the central control module 103, and the communication module 101 respectively; based on the working status, it determines whether the autonomous operation module 102, the central control module 103, and the communication module 101 are abnormal; if an abnormality is determined, the abnormal module performs a restart operation.

[0060] The train control system is equipped with a system safety module 105. This module establishes communication with the autonomous operation module 102, the central control module 103, and the communication module 101. It collects parameters that characterize the working status of each core module in real time. By continuously comparing the parameters with normal thresholds, it determines whether each module is abnormal. If an abnormality is detected, it immediately triggers the abnormal module to automatically restart and repair. This realizes real-time monitoring of the working status of each core module and automatic identification of abnormalities. The abnormal self-healing mechanism quickly eliminates faults and avoids the paralysis of the entire control system due to a single module abnormality. This greatly improves the stability, reliability, and fault self-healing capability of the system operation.

[0061] Furthermore, the system safety module 105 is equipped with a software watchdog component 117 and a hardware watchdog component 118 to achieve system security protection through a dual protection mechanism. The software watchdog component 117 is used to monitor the real-time operating status of the autonomous operation module 102, the central control module 103, and the communication module 101, setting normal operating cycle thresholds for each module. If any module is detected to have a timeout, no response, or abnormal freeze, the corresponding reset and restart process is triggered, and the abnormal information is recorded. The hardware watchdog component 118 is used to monitor the overall operating status of the system. If the software watchdog itself malfunctions or detects an unrecoverable operational anomaly in the entire system, a hardware-level system reset is directly triggered to ensure that the train control function quickly returns to normal.

[0062] Specifically, such as Figure 8 As shown, the system security module 105 adopts a distributed dual-process deployment architecture. The software watchdog component 117 is deployed as an independent process on the main processor of the main control board 111, and the hardware watchdog component 118 is integrated as an independent process in the microcontroller unit of the main control board 111. The two establish linkage through a dedicated communication interface.

[0063] The software watchdog component 117 presets the normal operating cycle threshold for each module, for example, 200ms. Based on this preset threshold, it inspects the operating status of each module stored in the fourth shared memory 110, monitoring the task execution flags, data interaction status, and process survival of each module in real time. If a module is detected to have timed out, become unresponsive, or abnormally frozen, it immediately triggers the module's targeted reset and restart process, sending a reset signal to the module. Simultaneously, a reset status recording area is designated in the shared memory to store information such as the trigger cause, the time of the exception, the module identifier, and the fault type in a local cache.

[0064] Specifically, the software watchdog component 117 monitors the core processes in each module. Taking the handling of communication process anomalies as an example, the software watchdog component 117 reads the status flag bits of the communication process in shared memory every 40ms. If the cycle completion signal of the process is not detected five times consecutively, the communication process is determined to be abnormal. The software watchdog component 117 sends a reset signal to the communication process through the inter-process communication interface.

[0065] After receiving the reset signal, the communication process starts the process restart process, reinitializes the TRDP receive class thread, TRDP send class thread, and TRDP protocol stack class thread, and restores the normal operating sequence.

[0066] The software watchdog synchronously writes exception information to the log file. The exception information includes a process-level reset type, a communication process timeout triggering the error, and records the occurrence time.

[0067] In addition, the software watchdog component 117 sends a periodic life signal to the hardware watchdog component 118 every 20ms to provide feedback on the overall operational effectiveness of each module in the system.

[0068] The hardware watchdog component 118 has a preset life signal reception timeout threshold, which can be set to 100ms. If no life signal is continuously received from the software watchdog component 117 within the life signal reception timeout threshold, the system is judged to be abnormal or the software watchdog component 117 has failed. This immediately triggers a hardware-level system reset, controlling the main control board 111 to restart, initialize core configuration parameters, and reload all modules and control logic to ensure rapid recovery of train control functions. During the reset process, the hardware watchdog component 118 records the fault identifier, which is fed back to the system after the system restarts, providing a basis for fault diagnosis.

[0069] Specifically, the hardware watchdog component 118 verifies the received life signal at 20ms intervals. If no valid life signal is received for five consecutive cycles, and the five cycles accumulate to 100ms, reaching the preset timeout threshold, the system is determined to have failed. The hardware watchdog component 118 outputs a reset control signal to the reset pin of the processor chip in the main control board 111, forcibly triggering a system-level reset.

[0070] After the system restarts, the hardware watchdog component 118 sends an initialization completion signal to the processor chip in the main control board 111. The software watchdog component 117 completes initialization and then immediately resumes sending a life signal to the hardware watchdog component 118. After the hardware watchdog component 118 detects a normal life signal, it deactivates the redundant protection alarm state.

[0071] like Figure 2 As shown, in some embodiments, the system further includes a real-time running module 106, configured to construct a shared memory with multiple independent partitions for data interaction between the communication module 101, the autonomous running module 102, and the central control module 103. The communication module 101, the autonomous running module 102, and the central control module 103 perform write and read operations through the shared memory.

[0072] The train control system adds a real-time operation module 106, which constructs multiple shared memory modules as data interaction carriers between the communication module 101, the autonomous operation module 102, and the central control module 103. This allows each module to perform independent write and read operations on the shared memory, replacing the traditional serial port or network interaction method. This not only simplifies the interface logic for data transmission between modules but also reduces the latency loss of data interaction, improving the real-time performance and transmission efficiency of data interaction between modules. It can well meet the high real-time operation requirements of train control.

[0073] The real-time execution module 106 is deployed as a CODESYS Runtime and is used to create and manage shared memory. It combines memory mapping technology to map physical memory to the virtual address spaces of various module processes, enabling multiple modules to directly access the same memory region and reducing data interaction latency. The real-time execution module 106 also schedules and executes the control logic within the central control module 103, coordinating efficient data interaction between the central control module 103, the autonomous execution module 102, and the communication module 101. The shared memory is divided into four independent data interaction spaces: the data interaction space between the autonomous execution module 102 and the communication module 101, the data interaction space between the central control module 103 and the communication module 101, the data interaction space between the autonomous execution module 102 and the central control module 103, and the module status interaction space.

[0074] To avoid resource contention and data conflicts caused by concurrent access from multiple modules, the real-time execution module 106 employs a combination of mutexes and semaphores to handle shared memory security and inter-module timing synchronization, respectively. The mutex provides exclusive protection for read and write operations on shared memory, allowing only one module to access any given shared memory location at a time. The writing module acquires the mutex, writes data, and sends a ready notification via a semaphore after completion. The reading module receives the synchronization semaphore, acquires the mutex, and completes the data reading.

[0075] Mutexes ensure exclusive access to shared memory, preventing data conflicts caused by concurrent read / write operations from multiple modules. Semaphores synchronize read / write timing, ensuring that the write end completes data writing before notifying the read end to perform the read operation. Together, they prevent data corruption and ensure orderly operations, achieving safe and reliable data interaction within shared memory.

[0076] In addition, the real-time running module 106 is based on CODESYS Runtime, which uses a real-time scheduling kernel to build a priority-based and periodically triggered scheduling system, enabling refined management of the control logic in the central control module 103.

[0077] Based on the security level and real-time requirements of the control logic in the central control module 103, a three-level scheduling priority is defined: security critical level > core control level > auxiliary monitoring level. Differentiated scheduling cycles and triggering methods are configured to ensure that critical logic is executed first.

[0078] The scheduling period can be set between 10ms and 100ms.

[0079] Triggering methods include event-triggered and periodic-triggered.

[0080] The control logic within the central control module 103 includes traction control, braking control, door control, and fault diagnosis. Safety-critical tasks, including traction and braking control, are of the highest priority, with a scheduling cycle set to 10ms. Core control-level tasks, including speed calculation and air compressor control, are of medium priority, with a scheduling cycle that can be set between 20ms and 50ms. Auxiliary monitoring-level tasks, including status and fault monitoring, are of low priority, with a scheduling cycle that can be set to 100ms.

[0081] The scheduling system is responsible for controlling the execution order and priority of logical tasks. Tasks with higher priority are executed first, ensuring that tasks are executed in an orderly manner.

[0082] In addition, the real-time execution module 106 is also responsible for loading the APP file compiled by the central control module 103, parsing the control logic encapsulated therein, and allocating hardware resources such as CPU and memory according to the scheduling strategy to drive the logic to execute precisely.

[0083] In some embodiments, the shared memory includes a first shared memory 107, which is used for interaction between the autonomous operation module 102 and the communication module 101. During the interaction between the autonomous operation module 102 and the communication module 101, after the communication module 101 receives driving information, it writes the driving information into the first shared memory 107. The autonomous operation module 102 reads the driving information from the first shared memory 107 and writes autonomous driving output information into the first shared memory 107. The communication module 101 reads and encapsulates the autonomous driving output information from the first shared memory 107 and sends the encapsulated autonomous driving output information to the corresponding signal subsystem 119.

[0084] The shared memory of the train control system includes a first shared memory 107 for interaction between the autonomous operation module 102 and the communication module 101. After receiving the train operation information, the communication module 101 writes it into the shared memory for buffering and relaying. The autonomous operation module 102 reads the train operation information from the first shared memory 107 for calculation and decision-making, and writes the automatic driving output information back to the memory. The communication module 101 then reads the automatic driving output information in the memory, encapsulates it into a message, and then sends it to the corresponding signal subsystem 119. This dedicated memory interaction method realizes asynchronous buffering and decoupling of data between the two modules, avoids timing conflicts caused by direct coupling communication, ensures the orderliness and efficiency of data interaction between the two modules, and improves the timing stability of data transmission.

[0085] Specifically, the autonomous operation module 102 writes data that needs to be sent out every 20ms, such as the main / standby status, control commands, and fault information of the autonomous operation module 102. The communication module 101 reads this data, encapsulates it into a train real-time data protocol message, and sends it to the train automatic protection system 115, the on-board data recording unit 116, and the autonomous operation module 102 at the other end. Every 20ms, the communication module 101 receives speed limits, driving permits, and speed and acceleration data sent by the train automatic protection system 115 and the autonomous operation module 102 at the other end. After verification, it writes the data to the first shared memory 107. The autonomous operation module 102 reads the data and clears it to avoid residual data.

[0086] The size of the first shared memory 107 can be set to 256KB, which can be set according to the needs of actual applications. It stores the speed / position information of the train automatic protection system 115, the synchronization data of the autonomous operation module 102 at the other end, and the status data of the autonomous operation module 102 at the local end. The memory access permissions are set so that the autonomous operation module 102 can perform read and write operations, and the communication module 101 can perform read and write operations.

[0087] In some embodiments, the shared memory includes a second shared memory 108, which is used for interaction between the central control module 103 and the communication module 101. During the interaction between the central control module 103 and the communication module 101, the communication module 101 receives the vehicle status from the vehicle subsystem 104 every 50ms, unpacks and verifies it. If the verification is successful, the vehicle status is written to the second shared memory 108. The central control module 103 reads the vehicle status from the second shared memory 108, performs logic processing, and writes control information to the second shared memory 108 every 50ms. The communication module 101 reads the control information from the second shared memory 108, encapsulates it, and sends the encapsulated control information to the corresponding vehicle subsystem 104.

[0088] In the train control system, the communication module 101 writes the received vehicle status into the second shared memory 108 for caching. The central control module 103 reads the vehicle status from the second shared memory 108 and completes the parsing process. Then, it writes the generated control information back to the memory. The communication module 101 reads the control information, encapsulates it, and sends it to the vehicle subsystem 104. This avoids the interference of different business data and ensures the independence and accuracy of vehicle status transmission and control information transmission.

[0089] The size of the second shared memory 108 can be set according to actual needs. The second shared memory 108 stores the status data of the vehicle subsystem 104 and the control information of the central control module 103. The memory access permissions are set so that the central control module 103 can perform read and write operations, and the communication module 101 can perform read and write operations.

[0090] In some embodiments, the shared memory includes a third shared memory 109, which is used for interaction between the autonomous operation module 102 and the central control module 103. During the interaction between the autonomous operation module 102 and the central control module 103, the autonomous operation module 102 writes control commands to the third shared memory 109, the central control module 103 reads the control commands from the third shared memory 109 and writes vehicle status integration information to the third shared memory 109, and after reading the vehicle status integration information, the autonomous operation module 102 adjusts the issued control commands according to the vehicle status integration information.

[0091] The third shared memory 109 is used for interaction between the autonomous operation module 102 and the central control module 103. The autonomous operation module 102 writes the generated control commands into the third shared memory 109 every 10ms. The central control module 103 reads the control commands and converts them into control information every 10ms. At the same time, it writes vehicle status integration information into the third shared memory 109. After reading the vehicle status integration information, the autonomous operation module 102 iteratively adjusts the subsequent control commands. Meanwhile, the autonomous operation module 102 determines whether the communication is interrupted by monitoring the life signals sent by the central control module 103. If the communication is interrupted, an alarm is triggered.

[0092] During the writing and reading process, further verification steps are set, including: verifying the legality and validity of vehicle control commands through SDT verification, and verifying the integrity of data transmission in shared memory through CRC32 verification to prevent data errors due to interference or abnormal writing.

[0093] This interaction method realizes the instruction interaction and feedback loop between the two modules. Through the logic of decision-execution-feedback-optimization, it effectively improves the adaptability, accuracy and dynamic adjustment capability of train control instructions.

[0094] The size of the third shared memory 109 can be set according to actual needs. The third shared memory 109 stores the control commands of the autonomous operation module 102 and the vehicle status fed back by the central control module 103. The memory access permissions are set so that the autonomous operation module 102 can perform read and write operations, and the central control module 103 can perform read and write operations.

[0095] In some embodiments, the shared memory includes a fourth shared memory 110, which is used for the system security module 105 to interact with the autonomous operation module 102, the central control module 103, and the communication module 101, respectively.

[0096] During the interaction between the system security module 105 and various modules, the autonomous operation module 102, the central control module 103, and the communication module 101 write their respective working statuses into the fourth shared memory 110. The system security module 105 reads the working statuses of each module from the fourth shared memory 110 and completes the monitoring and judgment of module anomalies.

[0097] The size of the fourth shared memory 110 can be set according to actual needs. The fourth shared memory 110 stores the working status of the autonomous operation module 102, the central control module 103, and the communication module 101. The memory access permissions are set so that the autonomous operation module 102, the central control module 103, and the communication module 101 can perform write operations, and the system security module 105 can perform read operations.

[0098] In some embodiments, before performing write or read operations on the shared memory, the communication module 101, the autonomous operation module 102, and the central control module 103 must apply for a mutex lock on the shared memory; after obtaining the mutex lock, the communication module 101, the autonomous operation module 102, or the central control module 103 performs a write or read operation on the shared memory, and releases the mutex lock after the operation is completed.

[0099] Before performing read and write operations on shared memory, the communication module 101, the autonomous operation module 102, and the central control module 103 must first apply for a mutex lock. Only the module that obtains the mutex lock can perform read and write operations. After the operation is completed, the module actively releases the mutex lock for other modules to use. This mutex lock mechanism realizes mutual exclusion and exclusive access to shared memory read and write, effectively avoiding data corruption, overwriting, loss, and process deadlock caused by multiple modules reading and writing at the same time, and ensuring the integrity, consistency, and security of interactive data in shared memory and read and write operations.

[0100] Specifically, when the autonomous operation module 102 and the central control module 103 interact through shared memory, a security mechanism combining CRC check, process lock and life signal monitoring is adopted. The central control module 103 determines whether the communication is interrupted by monitoring the life signal of the autonomous operation module 102. The autonomous operation module 102 avoids data residue by reading and clearing the memory data, and at the same time, it ensures the orderly access by managing the interactive data in a tabular manner.

[0101] The communication module 101 performs secure data transmission verification on data from the security subsystem and cyclic redundancy verification on data from the non-security subsystem. Data that fails the verification is discarded and logged.

[0102] In practical applications, such as Figure 5 As shown, the specific steps for autonomous operation module 102, central control module 103, communication module 101, and real-time operation module 106 to achieve data interaction through shared memory include: The system first enters the shared memory creation and management phase. During system initialization, the real-time execution module 106 creates and configures four shared memory blocks. Each of the four shared memory blocks has its data structure and access permissions defined according to a preset communication protocol, and concurrent access protection is achieved through mutexes and semaphores. The preset communication protocol specifies the data frame format, verification rules, and timeout mechanism.

[0103] Next, in the data reception and preprocessing stage, the signal subsystem 119 and vehicle subsystem 104 send real-time operating data to the communication module 101 via the Ethernet interface of the main control board 111. The communication module 101 first performs data verification, performing SDT verification on data from the safety subsystem and CRC32 verification on data from non-safety subsystems. Then, it performs data parsing, parsing the category identifier, source device address, and destination device address of the data packet based on the train real-time data protocol header information, thus completing the data routing preprocessing.

[0104] Next, the data is categorized and stored. After the communication module 101 completes data verification and confirms its accuracy, it performs precise data splitting based on the parsing results. Data from the autonomous operating module 102 is categorized by data type and written to the corresponding partition of the first shared memory 107. Data from the central control module 103 is categorized by subsystem type and written to the corresponding partition of the second shared memory 108. A semaphore-based mutex access mechanism is used during the storage process to ensure data consistency during concurrent read / write operations by multiple modules.

[0105] Next, in the data processing and interaction stage, the autonomous operation module 102 extracts the safety constraint information sent by the train automatic protection system 115 and the collaborative control parameters of the autonomous operation module 102 at the other end from the first shared memory 107. The central control module 103 obtains the vehicle status from the second shared memory 108 and writes the key data into the third shared memory 109.

[0106] Next, in the control command generation stage, the autonomous operation module 102 integrates the data from the third shared memory 109, the constraints of the train automatic protection system 115 in the first shared memory 107, and the information from the autonomous operation module 102 at the other end to generate control commands that meet safety constraints and comfort requirements. The control commands are then written back to the third shared memory 109 for use by the central control module 103. Simultaneously, the autonomous operation module 102 updates its own status information to the first shared memory 107 for the communication module 101 to upload to external devices. The central control module 103 reads the control commands from the autonomous operation module 102 from the third shared memory 109, processes them logically to generate control information, and writes it to the second shared memory 108.

[0107] Finally, the data aggregation and uploading stage begins. The communication module 101 performs data aggregation, reads the control data processed by the central control module 103 from the second shared memory 108, obtains the latest status information of the autonomous operation module 102 from the first shared memory 107, and packages the above data into a train real-time data protocol message according to the interface specifications between the central control module 103 or the autonomous operation module 102 and other devices, and sends it through the Ethernet interface to realize the real-time uploading of the entire train's control data.

[0108] In some embodiments, the system provides a primary control device and a backup control device, both of which include a communication module 101, an autonomous operation module 102, and a central control module 103. The primary control device is configured to receive driving information, vehicle status, and its own status information fed back by the backup control device, and to send control information to the corresponding vehicle subsystem 104. The backup control device is configured to receive driving information and vehicle status, and to feed back its own status information to the primary control device.

[0109] The train control system is equipped with primary and backup control devices, both of which are fully equipped with a communication module 101, an autonomous operation module 102, and a central control module 103, forming a completely redundant hardware architecture. Under normal operating conditions, the primary control device receives all train operation information, vehicle status, and feedback from the backup device's own status, and is responsible for distributing control information across the entire network. The backup device receives all data synchronously and only reports its own status to the primary device, without participating in active control. This primary-backup hot backup mode achieves hardware-level redundancy in the control system, ensuring that the backup device and the primary device share the same data source and are synchronized in status, laying a solid data and architectural foundation for subsequent primary-backup switching.

[0110] The autonomous operation module 102 synchronizes data with the peer autonomous operation module 102, exchanging key operational data such as speed and acceleration.

[0111] The central control module 103 establishes communication with the peer central control module 103 to obtain each other's communication status in real time.

[0112] In some embodiments, when the primary control device fails, the backup control device verifies the fault of the primary control device. If the fault verification passes, the primary control device and the backup control device switch over.

[0113] When the primary control equipment fails, the backup control equipment initiates a fault verification process to perform a secondary verification of the fault status of the primary equipment. Once the fault verification is successful, the control of the primary and backup control equipment is immediately switched. The fault verification process effectively avoids unnecessary switching caused by momentary interference and misjudgment, improving the accuracy of fault diagnosis. The fast and seamless primary / backup switching ensures that the control system does not stop operating when the primary equipment fails, achieving seamless fault switching and greatly improving the fault tolerance and continuous operation reliability of the train control system.

[0114] In practical applications, a closed-loop process of secondary fault verification, status identification, communication takeover, data verification, function switching, and full train coordination is used to achieve master-slave switching, ensuring that the train control function is not interrupted.

[0115] like Figure 7As shown, the train first undergoes power-on initialization. Hardware devices located at the front and rear of the train read the primary / standby flags from their respective local configuration files. One hardware device's flag is set to 1, and the other's to 2. Both hardware devices perform initialization self-tests. If the device with flag 1 passes the self-test, it is designated as the primary control device, responsible for external data transmission and control decision-making. If the device with flag 2 passes the self-test, it is designated as the standby control device, only receiving data and synchronizing status, without actively issuing commands. If the hardware device with flag 1 fails initialization, the hardware device with flag 2 automatically updates its primary / standby flag to 1, becoming the primary control device. If both hardware devices fail initialization, both become standby devices, triggering the train's emergency braking.

[0116] Secondly, the primary and backup control devices synchronize their states. The central control module 103 of the primary and backup control devices exchange status data every 20ms via the primary-backup synchronization link, monitoring the processor core operating status, the train real-time data protocol communication interface status, shared memory response time, safety board self-test results, and the operating status of autonomous, real-time, and communication processes. The backup control device performs fault detection, continuously monitoring the operating status of the primary control device through the primary-backup synchronization link. When an anomaly is detected in the primary control device for the first time, a secondary verification of the fault is completed through repeated testing, avoiding invalid switching due to a single misjudgment.

[0117] Secondly, after the standby control device confirms the primary control device's failure through secondary verification, it performs a primary / standby switchover, setting its own primary / standby flag to 1 to indicate that it has switched to the primary state. If the primary control device detects its own abnormality, it actively sets its primary / standby flag to 2 to indicate that it has switched to the standby state, ensuring that the primary / standby status identifiers are unique and consistent.

[0118] After the original primary control equipment completes the standby status check, it automatically disables the transmission enable of all external communication interfaces, retaining only the data reception and primary / standby synchronization functions to avoid data transmission conflicts with the new primary control equipment. After the new primary control equipment completes the primary status check, it completes the takeover of external communication permissions and immediately enables the transmission enable of all external communication interfaces, taking full control of the data transmission tasks of the entire train.

[0119] Next, the new primary control device performs a data consistency check, loads the last full-scale synchronization data transmitted via the primary / backup synchronization link, performs a rationality check on key parameters, and determines whether the key parameters are normal. If the check passes and the data is normal, the full-scale synchronization data is used to ensure the continuity of control logic before and after the switchover. If the check fails and the data is abnormal, the latest value cached locally is used to ensure control security.

[0120] Furthermore, functional takeover and mode switching are performed. The central control module 103 and the autonomous operation module 102 periodically read the primary / standby flags to detect changes in the primary / standby status in real time and automatically switch from the standby working mode to the primary working mode. Specifically, the central control module 103 initiates core processes such as traction control and braking control, taking over the overall vehicle logic control; the autonomous operation module 102 loads cached speed curves, precise parking parameters, and other core data, connects to the automatic driving control logic, outputs control commands, and interacts with external systems such as the signal subsystem 119 and the vehicle subsystem 104 to ensure a smooth transition in train operation status.

[0121] Finally, after the new primary control device completes the function switchover, it sends a switchover completion notification, sending a primary / backup switchover completion message to the signaling subsystem 119 and the vehicle subsystem 104. This message carries the physical identifier of the new primary control device and the switchover completion timestamp. Upon receiving the message, the signaling subsystem 119 and the vehicle subsystem 104 synchronously update their communication objects to ensure communication is established with the new primary control device, achieving coordinated and consistent control across the entire train.

[0122] When the original primary control device is repaired, it automatically enters slave mode, sends a local recovery ready message to the new primary control device, requests to join the redundant system, receives three consecutive full data synchronizations from the new primary control device to ensure that the local data is consistent with the new primary control device, starts its own monitoring logic, exchanges status data with the new primary control device every 20ms, enters standby mode, and waits for the next switchover trigger.

[0123] Through the collaborative architecture design of master and slave dual units, millisecond-level automatic switching can be achieved when the master control equipment fails, ensuring uninterrupted connection of key functions such as traction and braking control and automatic driving, avoiding train operation stoppage caused by a single equipment failure, and maximizing the protection of driving safety and operational continuity.

[0124] like Figure 4 As shown, within a single hardware device, interaction rules are set for each module within the system. These interaction rules include: The autonomous operation module 102 communicates with the central control module 103 to obtain key vehicle status information and transmits control commands to the central control module 103. The central control module 103 communicates with the autonomous operation module 102 to obtain control commands from the autonomous operation module 102 and feeds back vehicle status information to the autonomous operation module 102. The communication module 101 communicates with the autonomous operation module 102, processes the data sent out by the autonomous operation module 102, and sends it to the train automatic protection system 115, the autonomous operation module 102 at the other end, and the on-board data recording unit 116. The communication module 101 verifies the data from the train automatic protection system 115 and the autonomous operation module 102 at the other end and sends it to the autonomous operation module 102 at its own end.

[0125] The communication module 101 communicates with the central control module 103, processes the data sent by the central control module 103, and sends it to each vehicle subsystem 104. The data from each vehicle subsystem 104 is verified and then sent to the autonomous operation module 102.

[0126] like Figure 4 As shown, when the system is configured in a redundant manner, each of the head and tail cars of the train has one hardware device, serving as the primary control device and the backup control device, respectively. During operation, only the primary control device undertakes the task of sending external data. The primary / backup status of the hardware device is determined by its internal decision-making, while the primary / backup status of the central control module 103 and the autonomous operation module 102 switches synchronously with the primary / backup status of their respective hardware devices.

[0127] Furthermore, the central control module 103 of the primary control equipment can communicate bidirectionally with the central control module 103 of the backup control equipment, the autonomous operation module 102 of the primary control equipment, and each vehicle subsystem 104.

[0128] The central control module 103 of the backup control equipment can only communicate with the central control module 103 of the primary control equipment and can receive data from the vehicle subsystem 104, but does not have the authority to send data to the vehicle subsystem 104.

[0129] The autonomous operation module 102 of the primary control equipment can communicate bidirectionally with the autonomous operation module 102 of the backup control equipment, the central control module 103 of the primary control equipment, the train automatic protection system 115, and the on-board data recording unit 116.

[0130] The autonomous operation module 102 of the backup control equipment can only communicate with the autonomous operation module 102 of the primary control equipment and can receive data from the automatic train protection system 115, but cannot send data to the automatic train protection system 115.

[0131] In practical applications, the data sent by the autonomous operation module 102 to the central control module 103 includes: the life signal of the autonomous operation module 102, the main and backup status of the autonomous operation module 102, time information, line number, train number, circuit breaker reset, traction / braking command, gate control command, wake-up from hibernation, static test, remote control command, operating condition information, station reporting command, and coupling / uncoupling command, etc.

[0132] The data sent by the central control module 103 to the autonomous operation module 102 includes: the life signal of the central control module 103, the main / standby status of the central control module 103, load, speed, IO signal, response feedback, door status, vehicle fire information, direction information, VVVF status, running mileage, self-test results, hibernation results, coupling / uncoupling information, braking capacity, actual braking force, traction capacity, actual traction force, network voltage, and network current.

[0133] The data sent by the autonomous operation module 102 to the autonomous operation module 102 at the other end includes: control status information, operation status synchronization information, equipment status information, speed and acceleration data, etc.

[0134] The data sent by the autonomous operation module 102 to the train automatic protection system 115 includes: the main and backup status of the autonomous operation module 102, the fault information of the autonomous operation module 102, the traction and braking status, the recommended speed, etc.

[0135] The data sent by the autonomous operation module 102 to the vehicle data recording unit 116 includes: operation control data, safety-related data, equipment status data, etc.

[0136] The data sent by the Automatic Train Protection System 115 to the Autonomous Operation Module 102 includes: speed limit information, target distance information, train operation permit, track parameters, temporary speed limit, etc.

[0137] The data sent by the central control module 103 to the central control module 103 at the other end includes: its own status data, life signals, master-slave status, version, configuration ID, etc.

[0138] The data sent by the central control module 103 to the vehicle subsystem 104 includes: life signals, direction information, traction commands, braking commands, driver's cab activation, time, speed, station information, wheel diameter values, etc.

[0139] The data sent by the vehicle subsystem 104 to the central control module 103 includes: life signals of each system, status information of each system, fault information of each system, etc.

[0140] like Figure 3As shown, the train control system is also equipped with multiple functional boards, including a power board 113, a main control board 111, a communication board 112, and a backplane 114.

[0141] The power supply board 113 complies with the EN50129:2003 standard and includes an independent DC110V to DC12V power supply circuit. It is equipped with two independent power supply interfaces, which can convert the DC110V voltage input from the vehicle to DC12V voltage, and then supply power to the main control board 111 and communication board 112 through the compact peripheral component interconnection connector on the back panel 114. It has functions such as input over and under voltage protection, output over and under voltage protection, output overcurrent and short circuit protection to ensure power supply stability.

[0142] Furthermore, the power board 113 supports redundant configuration, with a maximum of two power boards 113, each equipped with an independent power supply circuit and power supply interface. In the event of a failure of either power board 113, the other power board 113 can take over the power supply task without interruption, ensuring uninterrupted system power supply.

[0143] The main control board 111 can be configured as a chip integrating a quad-core processor, possessing functions such as logic operations, Ethernet communication, hardware self-testing, and watchdog timer. The main control board 111 is equipped with two Ethernet communication interfaces, through which it communicates and interacts with the vehicle subsystem 104. The main control board 111 can be configured as a safety board or a non-safety board. The safety board supports functions at the highest SIL2 safety level and is specifically used to run the core control logic of the central control module 103 and the autonomous operation module 102. The non-safety board is only used to handle non-safety auxiliary tasks such as diagnostics and logging. A physical isolation design is used between the safety board and the non-safety board to prevent interference from non-safety functional modules on the operation of safety functional modules.

[0144] Furthermore, the main control board 111 supports redundant configuration, with a maximum of two main control boards 111. Two CPU boards supporting quad-core A53 processors are selected, one as a safety board supporting SIL2 level, used to run the core vehicle control algorithm of the autonomous operation module 102 and the safety control logic of the central control module 103. The other is used as a non-safety board for auxiliary functions such as log recording and diagnostic data processing. Each board provides two 100Mbps Ethernet interfaces to support real-time train data protocol communication.

[0145] The communication board 112 can be configured as a communication expansion board. Each communication board 112 is equipped with two 100Mbps Ethernet communication interfaces, serving as the interface for external communication of the autonomous operation module 102. The communication board 112 and the main control board 111 adopt a modular design, supporting flexible switching of interface configurations. When the system architecture needs to be simplified, the external communication interfaces of the autonomous operation module 102 and the central control module 103 can be integrated into the main control board 111. When communication reliability needs to be improved, the external communication interfaces of the autonomous operation module 102 can be independently deployed on the communication board 112, forming a dual redundancy architecture with the communication interfaces of the main control board 111. The communication board 112 is connected to the main control board 111 through the backplane 114 to realize data interaction. Its interface communication latency is ≤1ms, ensuring the real-time performance of data transmission.

[0146] Backplane 114 is configured as a ten-slot standard compact peripheral component interconnection interface backplane. In terms of power supply, backplane 114 features standardized power busbars to provide stable power to various functional boards and integrates overcurrent and short-circuit protection circuits to enhance power supply safety. In terms of communication, backplane 114 supports Ethernet protocol data exchange and incorporates high-speed printed circuitry to achieve low-latency communication between the main control board 111, communication board 112, and peripheral vehicle-mounted equipment. Furthermore, backplane 114 employs a redundant communication link design; if any communication link fails, it automatically switches to a backup link, ensuring the continuity and reliability of the entire system's communication. The communication links support the Ethernet protocol, and high-speed PCB design enables low-latency data interaction between the main control board 111, communication board 112, and vehicle-mounted equipment, with a communication latency of ≤1ms.

[0147] High-speed PCB design is a circuit board design for processing signals with very fast rise / fall times.

[0148] The train control system is equipped with a fine-grained core binding strategy. Based on the operating system task affinity mechanism, the core tasks of the central control module 103, autonomous operation module 102, system safety module 105, real-time operation module 106 and communication module 101 are fixedly bound to the designated processor core of the main control board 111. This achieves precise matching between tasks and hardware resources, avoids resource contention between core tasks, and improves the real-time performance and stability of task execution.

[0149] Specifically, based on the real-time requirements, load intensity, and functional attribute types of each task, the core processes and subordinate threads running in the system are classified. The core processes include communication processes, real-time running processes, autonomous running processes, software watchdog processes, and hardware watchdog processes. The communication process is mainly run by the communication module 101, the real-time running process is mainly run by the real-time running module 106 and the central control module 103, the autonomous running process is mainly run by the autonomous running module 102, the software watchdog process is mainly run by the software watchdog component 117 of the system security module 105, and the hardware watchdog process is deployed in an independent microcontroller unit, runs as an independent process, and does not participate in the fine-grained core binding strategy.

[0150] like Figure 6 As shown, the communication process includes TRDP receive threads, TRDP send threads, and TRDP protocol stack threads. Real-time running threads include shared memory creation and management threads, IEC task execution threads, and task scheduling threads. Autonomous running threads include core control threads, communication interaction threads, and state awareness threads. The software watchdog process includes a software watchdog thread.

[0151] The quad-core A53 processor consists of CPU0, CPU1, CPU2, and CPU3.

[0152] Among them, the CPU0 core is bound to the communication process A-way communication task, which includes TRDP-A-way receive thread, TRDP-A-way send thread, and TRDP-A-way protocol stack thread.

[0153] Specifically, the TRDP-A receiving thread is configured to: receive real-time train data protocol messages from the train's A-line onboard network via the Ethernet interface, perform parsing and verification, place valid data into the receiving buffer, and write the valid data in the receiving buffer into shared memory according to data type. The TRDP-A sending thread is configured to: retrieve data from shared memory and store it in the sending buffer, read data to be transmitted from the sending buffer, encapsulate it into real-time train data protocol messages, and send them to the A-line onboard network via the Ethernet interface. The TRDP-A protocol stack thread is configured to: initialize the real-time train data protocol stack and bind the protocol stack to the Ethernet interface.

[0154] The CPU1 core is bound to the B-path communication task of the communication process, which includes the TRDP-B-path receive thread, the TRDP-B-path send thread, and the TRDP-B-path protocol stack thread.

[0155] Specifically, the TRDP-B receiving thread is configured to: receive real-time train data protocol messages from the B-line onboard network on the train via the Ethernet interface, perform parsing and verification, place valid data into the receiving buffer, and write the valid data in the receiving buffer into shared memory according to data type. The TRDP-B sending thread is configured to: retrieve data from shared memory and store it in the sending buffer, read data to be transmitted from the sending buffer, encapsulate it into real-time train data protocol messages, and send them to the B-line onboard network via the Ethernet interface. The TRDP-B protocol stack thread is configured to: initialize the real-time train data protocol stack and bind the protocol stack to the Ethernet interface.

[0156] Communication A and communication B are respectively bound to different Ethernet interfaces on the main control board 111.

[0157] CPU2 cores are bound to a real-time running process and a software watchdog process.

[0158] Specifically, the shared memory creation and management thread is configured to: during the initialization phase, complete the creation, partitioning, and virtual address mapping of shared memory; during the runtime phase, maintain the address mapping relationship of shared memory and monitor the read / write status of each partition; and simultaneously handle shared memory access requests from various modules, ensuring data read / write consistency through a mutex lock mechanism. The IEC task execution thread is configured to: load and execute the IEC 61131-3 standard control logic in the application.app file compiled by the central control module 103, and complete the input data reading and output instruction issuance of the control logic according to the instructions of the task scheduling thread. The task scheduling thread is configured to: coordinate resource allocation between threads and avoid resource contention conflicts.

[0159] Specifically, the software watchdog thread is configured to: acquire the operating status of the autonomous operation module 102, the central control module 103, and the communication module 101, and determine whether each module has issues such as timeouts, unresponsiveness, or abnormal freezing. If an abnormality is detected in a module, the directed reset and restart process for that module is immediately triggered. Additionally, it sends a life signal to the hardware watchdog process to provide feedback on the overall operational effectiveness of the main processor software system.

[0160] CPU 3 cores are bound to autonomous running processes.

[0161] Specifically, the communication interaction thread is configured to establish communication links between the autonomous running process and other processes to achieve data interaction. The state awareness thread is configured to read vehicle speed, position status information, etc., through shared memory, and upload the processed state data to the core control thread at preset intervals to provide a basis for control strategy adjustments. The core control thread is configured to load and execute the core control algorithm of the autonomous running module 102, output core control signals such as traction / braking control commands, report its own working status to the software watchdog thread, and coordinate the runtime sequence of each thread within the process to ensure functional consistency.

[0162] Furthermore, based on the real-time requirements of vehicle communication and the data processing flow, the data is divided and configured, and the priority between each thread is set.

[0163] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0164] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A train control system, characterized in that, include: Communication module, autonomous operation module, and central control module; The communication module is configured to establish communication with the signal subsystem and the vehicle subsystem respectively, receive safe driving information from the signal subsystem and vehicle status information from the vehicle subsystem, send the safe driving information to the autonomous operation module, and send the vehicle status information to the central control module. The central control module establishes communication with the autonomous operation module and the communication module respectively, and is configured to parse the vehicle status information and generate integrated vehicle status information, and send the integrated vehicle status information to the autonomous operation module; receive control commands from the autonomous control operation module, generate control information for controlling the operation of the vehicle subsystem according to the control commands, and send the control information to the corresponding vehicle subsystem through the communication module; The autonomous operation module establishes communication with the communication module and the central control module respectively, and is configured to receive the safe driving information and the vehicle status integration information; generate the control command for train operation based on the safe driving information and the vehicle status integration information, and send the control command to the central control module.

2. The train control system according to claim 1, characterized in that, The communication module is further configured to: Receive Ethernet messages sent by the signal subsystem and the vehicle subsystem; According to the train real-time data protocol, the Ethernet packets are parsed to obtain the safe driving information and the vehicle status information.

3. The train control system according to claim 1, characterized in that, Also includes: The system security module establishes communication with the autonomous operation module, the central control module, and the communication module, and is configured to receive the working status from the autonomous operation module, the central control module, and the communication module respectively; based on the working status, it determines whether there is any abnormality in the autonomous operation module, the central control module, and the communication module; if an abnormality is determined, the module with the abnormality performs a restart operation.

4. The train control system according to claim 1, characterized in that, Also includes: The real-time running module is configured to construct a shared memory with multiple independent partitions for data interaction between the communication module, the autonomous running module, and the central control module. The communication module, the autonomous running module, and the central control module perform write and read operations through the shared memory.

5. The train control system according to claim 4, characterized in that, The shared memory includes a first shared memory, which is used for interaction between the autonomous operation module and the communication module; During the interaction between the autonomous operation module and the communication module, after receiving the safe driving information, the communication module writes the safe driving information into the first shared memory. The autonomous operation module reads the safe driving information from the first shared memory and writes autonomous driving output information into the first shared memory. The communication module reads the autonomous driving output information from the first shared memory, encapsulates it, and sends the encapsulated autonomous driving output information to the corresponding signal subsystem.

6. The train control system according to claim 4, characterized in that, The shared memory includes a second shared memory, which is used for the interaction between the central control module and the communication module; During the interaction between the central control module and the communication module, the communication module writes the vehicle status information into the second shared memory, the central control module reads the vehicle status information from the second shared memory and writes the control information into the second shared memory, the communication module reads the control information from the second shared memory and encapsulates it, and sends the encapsulated control information to the corresponding vehicle subsystem.

7. The train control system according to claim 4, characterized in that, The shared memory includes a third shared memory, which is used for the interaction between the autonomous operation module and the central control module; During the interaction between the autonomous operation module and the central control module, the autonomous operation module writes the control instructions to the third shared memory, the central control module reads the control instructions from the third shared memory and writes the vehicle status integration information to the third shared memory, and after reading the vehicle status integration information, the autonomous operation module adjusts the issued control instructions according to the vehicle status integration information.

8. The train control system according to any one of claims 4-7, characterized in that, Before performing write or read operations on the shared memory, the communication module, the autonomous operation module, and the central control module all request a mutex lock from the shared memory. The communication module, the autonomous operation module, or the central control module that acquires the mutex lock performs a write operation or a read operation on the shared memory, and releases the mutex lock after the operation is completed.

9. The train control system according to claim 1, characterized in that, The system is equipped with a primary control device and a backup control device, both of which include the communication module, the autonomous operation module, and the central control module. The primary control device is configured to receive the safe driving information, the vehicle status information, and its own status information fed back by the backup control device, and to send the control information to the corresponding vehicle subsystem. The backup control device is configured to receive the safe driving information and the vehicle status information, to feed back its own status information to the primary control device, and not to actively send the control commands.

10. The train control system according to claim 9, characterized in that, When the primary control device fails, the backup control device verifies the fault of the primary control device; if the fault verification passes, the primary control device and the backup control device perform a primary / backup switchover.

Images