Train operation control method for enhancing CBTC system train-ground communication resilience

Abstract

This invention discloses a train operation control method to enhance the resilience of CBTC system train-to-ground communication, comprising: establishing a two-way confirmation process for movement authorization information between ZC and VOBC to ensure consistency of movement authorization information between ZC and VOBC; when communication with VOBC is interrupted but movement authorization has been confirmed, ZC creates a non-communication train protection zone based on the last reported position of the train and the endpoint of the movement authorization, and locks the movement authorization status within the zone; when communication with ZC is interrupted but movement authorization has been confirmed, VOBC maintains the train in controlled mode operation according to the confirmed movement authorization, while monitoring the communication status and attempting to rebuild communication; ZC dynamically maintains and updates the non-communication train protection zone according to changes in track section occupancy status or communication recovery status. This invention controls the train to leave the communication interruption zone as quickly and efficiently as possible in a controlled mode, restoring train-to-ground communication while avoiding operational impacts caused by train speed reduction or operation mode degradation due to communication interruption.

Description

Technical Field

[0001] This invention belongs to the field of rail transit signal control technology, specifically a train operation control method to enhance the resilience of CBTC system vehicle-to-ground communication. Background Technology

[0002] Communication-based train control (CBTC) has become the mainstream train control technology for urban rail transit. Continuous and stable vehicle-to-ground communication is fundamental to ensuring the normal operation of urban rail transit. Once vehicle-to-ground communication is established, the train can operate in controlled mode. In controlled mode, the trackside control system continuously sends movement authorizations to the train and monitors the train's position, speed, and intervals in real time, automatically ensuring driving safety. This is the highest level, most automated, and safest operating mode. If vehicle-to-ground wireless communication is interrupted, the information exchange channel between the train and the trackside system is interrupted. To ensure operational safety, after communication interruption, the train needs to automatically exit controlled mode, trigger emergency braking, and stop. After the train stops, the train operation mode is downgraded to restricted manual driving mode (RM mode), requiring the driver to manually drive at low speed until vehicle-to-ground communication is restored, at which point the train operation mode can return to controlled mode. Therefore, once vehicle-to-ground communication is interrupted, it will affect the operation of urban rail transit. At best, it will cause train speed reduction and decreased operating efficiency; at worst, it will lead to a downgrade of the operating mode, i.e., from controlled mode to manual driving mode, causing train delays. Especially on driverless urban rail transit lines, the process of downgrading from driverless mode (which is a controlled mode) to RM mode and then back to driverless mode is more complex, takes longer, and has a more serious impact on operations.

[0003] In the current CBTC system, vehicle-to-ground communication primarily achieves continuous, bidirectional data transmission between the vehicle and ground systems via wireless communication. Although vehicle-to-ground wireless communication generally utilizes a dedicated network architecture, employing dedicated frequency bands and measures such as enhanced signal strength to improve anti-interference capabilities, the complexity of the wireless environment still makes it difficult to completely avoid interference from other wireless signals on the vehicle-to-ground wireless communication link. In actual operation, interruptions in vehicle-to-ground communication due to signal interference and other factors frequently lead to train delays and other disruptions, significantly impacting the normal operation of rail transit.

[0004] Since factors such as wireless signal interference cannot be completely avoided, how to ensure that trains do not degrade their operation after the train-to-ground communication is interrupted, and how to ensure that the normal operation of rail transit is not affected, has become an urgent problem to be solved.

[0005] Therefore, a train operation control method is provided to enhance the resilience of CBTC system vehicle-to-ground communication. Summary of the Invention

[0006] To address the aforementioned problems in the existing technology, this invention provides a train operation control method to enhance the resilience of CBTC system vehicle-to-ground communication. By controlling the train to leave the communication interruption area as quickly and efficiently as possible in a controlled mode, the method restores vehicle-to-ground communication while avoiding the impact on operations caused by train speed reduction or downgrade of operation mode due to vehicle-to-ground communication interruption.

[0007] The technical solution to achieve the above objectives is: A train operation control method for enhancing the resilience of CBTC system vehicle-to-ground communication includes: Step S1: The ZC (Region Controller) and VOBC (Vehicle Controller) establish a two-way confirmation process for mobility authorization information to ensure consistency of mobility authorization information between the ZC and VOBC. Step S2: When communication with VOBC is interrupted and the movement authorization has been confirmed, ZC creates a non-communication train protection zone based on the last reported position of the train and the endpoint of the movement authorization, and locks the movement authorization status within the zone. In step S3, when communication with ZC is interrupted but the movement authorization has been confirmed, VOBC maintains the train in controlled mode according to the confirmed movement authorization, while monitoring the communication status and attempting to rebuild the communication. When the preset conditions are met, the train is safely downgraded to manual driving. Step S4: ZC dynamically maintains and updates the non-communication train protection area based on changes in track section occupancy status or communication recovery status, and supports manual deletion operations in abnormal situations. Step S5: The ATS (Automatic Train Monitoring System) monitors the vehicle-to-ground communication status on axle-counting sections of the track, accumulates the number of communication interruptions, marks potential fault sections, generates alarms, and sends fault information to ZC. In step S6, ZC determines the endpoint of the movement authorization when calculating the movement authorization for the train based on the communication fault status of the track axle counting section sent by ATS.

[0008] Preferably, step S1 includes: After receiving the route request from the ATS, ZC calculates the train movement authorization, generates a corresponding identifier based on the destination of the movement authorization, and sends the movement authorization information containing the identifier to VOBC. VOBC receives movement authorization information and uses it for train operation control, and then replies to ZC with a movement authorization confirmation message containing the identifier; Once the identifier in the ZC confirmation message matches the identifier sent, it marks that the mobile authorization has been confirmed by VOBC and sends a mobile authorization confirmation acceptance message to VOBC. After VOBC receives the confirmation message, it marks that the currently used mobile authorization has been confirmed by ZC. If the VOBC needs to actively disconnect communication due to train position loss, it sends a movement authorization confirmation cancellation request to the ZC; after receiving the request, the ZC clears the confirmation flag and replies with a cancellation message, and the VOBC stops sending messages to the ZC. When ZC receives a new route request, if the previously sent mobility grant has been confirmed by VOBC, it sends a cancellation of mobility grant confirmation message to VOBC; after receiving the message, VOBC resets the mobility grant and replies with a message. After receiving the reply, ZC clears the original mobility grant, recalculates and sends a new mobility grant. Among them, ZC and VOBC adopt an "instant trigger + periodic recovery" communication mechanism: when sending a mobile authorization, confirmation message or confirmation of acceptance message, a message is sent immediately, and periodic communication is resumed after the mobile authorization confirmation process is completed.

[0009] Preferably, step S2 includes: ZC monitors the communication status with VOBC through periodic communication messages. If no VOBC message is received within a predetermined time, the communication is considered interrupted. If communication is determined to be interrupted and the previously sent mobility authorization has been confirmed by VOBC, ZC creates a non-communication train protection zone from the last reported rear position of the train to the end of the mobility authorization. Within this protected area, ZC locks the movement authorization, turnout and signal light status, and rejects any movement authorization change requests; ZC uses train markings as protection zone markings, thus associating each protection zone with a train. When ZC calculates movement authorization for other trains, the movement authorization of other trains must not intrude into the non-communication train protection zone based on movement authorization; ZC sends the identified protected area information to ATS; If the previously sent mobile authorization is not confirmed by VOBC, ZC will process it according to the existing procedures.

[0010] Preferably, step S3 includes: VOBC monitors the communication status with ZC and ATS through periodic communication messages. If the corresponding message is not received within a predetermined time, the communication is considered to be interrupted. When VOBC determines that communication with ZC has been interrupted, if the current mobility authorization has been confirmed by ZC and is in controlled mode, it will maintain controlled mode operation according to the mobility authorization. When VOBC maintains controlled mode operation: If communication with ATS is not interrupted, start the ATS communication status monitoring timer. If communication with ZC is not restored after the timeout, clear the mobility authorization and exit the controlled mode. If communication with ATS is interrupted before the timeout, continue to maintain the controlled mode operation. If the train's direction of travel is found to be inconsistent with the direction of movement authorization, it will actively exit the controlled mode, or if it fails to restore communication with ZC after reaching the end of the movement authorization, the movement authorization will be cleared and the controlled mode will be exited. Continuously attempt to rebuild communication with ZC and ATS. If only communication with ATS is restored, start the ZC communication status monitoring timer. If communication with ZC is not restored after the timer expires, clear the mobility authorization and exit the controlled mode. VOBC starts a timer to monitor the train's motion status. The duration is the smaller of the estimated time to reach the end of the movement authorization and the system's preset movement authorization retention time. After the timer expires, the movement authorization is cleared and the train exits the controlled mode. If communication with ZC is restored or the end of the movement authorization is reached, the timer is canceled. If the current mobile authorization has not been confirmed by ZC or is in uncontrolled mode, exit controlled mode directly.

[0011] Preferably, in step S4, the method by which ZC updates the protected area includes: Dynamically maintain the protected area: ZC starts detecting from the beginning of the protected area. If the status of the track axle counting section changes from occupied to free, the section is deleted from the protected area and the movement authorization area. Automatic deletion based on communication status: When ZC determines that communication with VOBC has been restored and the train identification matches, if the train's location is within the protected area, the protected area is deleted and the normal process is restored. If the train is not located within the protected area, an invalid movement authorization value is sent to VOBC; when an uncontrolled operation mode is reported by VOBC, the protected area is automatically deleted. Automatic deletion based on track idle status: If ZC determines that communication with VOBC has not been restored, but all track axle counting sections within the protected area become idle, the protected area is deleted; Information synchronization and manual deletion: ZC sends the protection zone update information to ATS; ATS supports manual deletion operations. After the operator confirms the train has left on the interface, the operator initiates a deletion request. ATS sends the deletion command and area identifier to ZC. Upon receiving the information, ZC deletes the corresponding protected area.

[0012] Preferably, in step S5, the specific method by which the ATS monitors the communication status is as follows: VOBC uses ATS time as its time source for synchronization. When it detects that communication with both ZC and ATS is interrupted, it records the position and time of the train interruption. After communication is restored, it sends this information to ATS and resets the system. When ATS receives a VOBC message, if it contains information on the location and time of the communication interruption, it determines whether the latest train-to-ground communication time of the track axle counting section corresponding to that location is earlier than the interruption time. If so, it accumulates the number of communication interruptions for that section; and resets the potential fault flags and interruption counts for the track axle counting section corresponding to the current position of the train, and updates the message receipt time to the latest train-to-ground communication time for that section. Before ATS sends a message to ZC, it checks all track axle counting sections: if the number of communication interruptions in a certain section exceeds the threshold, it sets a potential communication fault mark, generates an interface color prompt alarm, and sends the information of that section to ZC. ATS operators manually clear potential fault markers and communication interruption counts for designated track axle counting sections.

[0013] Preferably, in step S6, after ZC receives the information on track axle counting sections with potential vehicle-to-ground communication failures sent by ATS, it first resets the communication failure status of all track axle counting sections, and then sets the corresponding track axle counting sections as communication failure sections according to the track axle counting section information sent by ATS. When ZC calculates movement authorization for a train, the endpoint of the movement authorization is not located in a section where there is a potential train-to-ground communication failure.

[0014] Compared with the prior art, the beneficial effects of the present invention are: In this invention, after the train-to-ground communication is interrupted, the train does not need to reduce speed or exit the controlled mode. Instead, it continues to operate in the controlled mode based on the movement authorization mutually confirmed by ZC and VOBC before the communication interruption, until it reaches the end of the movement authorization. This avoids the train speed reduction and operation mode downgrade (such as downgrading from automatic mode to manual driving mode) caused by the communication interruption. It can control the train to leave the communication interruption area as quickly and as possible in the controlled mode, reduce the time for the train-to-ground communication to be restored, and avoid the impact on operation. This invention is based on the movement authorization mutually confirmed by ZC and VOBC before the communication interruption. By creating a non-communication train protection zone based on movement authorization, ZC locks the movement authorization state, and VOBC uses the movement authorization confirmed before the communication interruption, it supports the train to continue operating in a controlled mode after the communication interruption. By identifying and isolating the faulty section of the train-to-ground communication and attempting to rebuild the train-to-ground communication, the normal process is quickly restored after the communication is restored. This realizes the automated handling of train-to-ground communication interruption faults, avoids manual intervention, and reduces the recovery time of train-to-ground communication interruption faults. Attached Figure Description

[0015] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1This is a flowchart of a train operation control method for enhancing the resilience of CBTC system vehicle-to-ground communication according to the present invention; Figure 2 This is a flowchart of the ZC and VOBC mobile authorization confirmation process in an embodiment of the present invention; Figure 3 This is a schematic diagram of the non-communication train protection area based on mobile authorization in an embodiment of the present invention; Figure 4 This is a schematic diagram of the VOBC processing status and status monitoring when VOBC and ZC communication is interrupted in an embodiment of the present invention; Figure 5 This is a schematic diagram of VOBC predicting train travel time in an embodiment of the present invention; Figure 6 This is a schematic diagram of updating the protection zone of non-communication trains based on track occupancy status in an embodiment of the present invention; Figure 7 This is a schematic diagram of vehicle-to-ground communication status monitoring information based on the track axle counting section in an embodiment of the present invention; Figure 8 This is a schematic diagram of the communication status of the train automatic monitoring system monitoring the track axle counting section in an embodiment of the present invention; Figure 9 This is a schematic diagram of the movement authorization range of the track axle counting section based on potential vehicle-to-ground communication failure in an embodiment of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] like Figure 1 As shown, a train operation control method for enhancing the resilience of CBTC system vehicle-to-ground communication includes: Step S1: ZC and VOBC establish a two-way confirmation process for mobile authorization information to ensure consistency of mobile authorization information between ZC and VOBC.

[0018] In this embodiment, step S1 includes: After receiving the route request from the ATS, ZC calculates the train movement authorization, generates a corresponding identifier based on the destination of the movement authorization, and sends the movement authorization information containing the identifier to VOBC. VOBC receives movement authorization information and uses it for train operation control, and then replies to ZC with a movement authorization confirmation message containing the identifier; Once the identifier in the ZC confirmation message matches the identifier sent, it marks that the mobile authorization has been confirmed by VOBC and sends a mobile authorization confirmation acceptance message to VOBC. After VOBC receives the confirmation message, it marks that the currently used mobile authorization has been confirmed by ZC. If the VOBC needs to actively disconnect communication due to train position loss, it sends a movement authorization confirmation cancellation request to the ZC; after receiving the request, the ZC clears the confirmation flag and replies with a cancellation message, and the VOBC stops sending messages to the ZC. When ZC receives a new route request, if the previously sent mobility grant has been confirmed by VOBC, it sends a cancellation of mobility grant confirmation message to VOBC; after receiving the message, VOBC resets the mobility grant and replies with a message. After receiving the reply, ZC clears the original mobility grant, recalculates and sends a new mobility grant. Among them, ZC and VOBC adopt an "instant trigger + periodic recovery" communication mechanism: when sending a mobile authorization, confirmation message or confirmation of acceptance message, a message is sent immediately, and periodic communication is resumed after the mobile authorization confirmation process is completed.

[0019] In step S2, when communication with VOBC is interrupted and the movement authorization has been confirmed, ZC creates a non-communication train protection zone based on the last reported position of the train and the endpoint of the movement authorization, and locks the movement authorization status within the zone.

[0020] In this embodiment, step S2 includes: ZC monitors the communication status with VOBC through periodic communication messages. If no VOBC message is received within a predetermined time, the communication is considered interrupted. If communication is determined to be interrupted and the previously sent mobility authorization has been confirmed by VOBC, ZC creates a non-communication train protection zone from the last reported rear position of the train to the end of the mobility authorization. Within this protected area, ZC locks the movement authorization, turnout and signal light status, and rejects any movement authorization change requests; ZC uses train markings as protection zone markings, thus associating each protection zone with a train. When ZC calculates movement authorization for other trains, the movement authorization of other trains must not intrude into the non-communication train protection zone based on movement authorization; ZC sends the identified protected area information to ATS; If the previously sent mobile authorization is not confirmed by VOBC, ZC will process it according to the existing procedures.

[0021] In step S3, when communication with ZC is interrupted but the movement authorization has been confirmed, VOBC maintains the train in controlled mode according to the confirmed movement authorization, while monitoring the communication status and attempting to rebuild communication. When the preset conditions are met, the train is safely downgraded to manual driving.

[0022] In this embodiment, step S3 includes: VOBC monitors the communication status with ZC and ATS through periodic communication messages. If the corresponding message is not received within a predetermined time, the communication is considered to be interrupted. When VOBC determines that communication with ZC has been interrupted, if the current mobility authorization has been confirmed by ZC and is in controlled mode, it will maintain controlled mode operation according to the mobility authorization. When VOBC maintains controlled mode operation: If communication with ATS is not interrupted, start the ATS communication status monitoring timer. If communication with ZC is not restored after the timeout, clear the mobility authorization and exit the controlled mode. If communication with ATS is interrupted before the timeout, continue to maintain the controlled mode operation. If the train's direction of travel is found to be inconsistent with the direction of movement authorization, it will actively exit the controlled mode, or if it fails to restore communication with ZC after reaching the end of the movement authorization, the movement authorization will be cleared and the controlled mode will be exited. Continuously attempt to rebuild communication with ZC and ATS. If only communication with ATS is restored, start the ZC communication status monitoring timer. If communication with ZC is not restored after the timer expires, clear the mobility authorization and exit the controlled mode. VOBC starts a timer to monitor the train's motion status. The duration is the smaller of the estimated time to reach the end of the movement authorization and the system's preset movement authorization retention time. After the timer expires, the movement authorization is cleared and the train exits the controlled mode. If communication with ZC is restored or the end of the movement authorization is reached, the timer is canceled. If the current mobile authorization has not been confirmed by ZC or is in uncontrolled mode, exit controlled mode directly.

[0023] In step S4, ZC dynamically maintains and updates the non-communication train protection area based on changes in track section occupancy status or communication recovery status, and supports manual deletion operations in abnormal situations.

[0024] In this embodiment, in step S4, the method by which ZC updates the protected area includes: Dynamically maintain the protected area: ZC starts detecting from the beginning of the protected area. If the status of the track axle counting section changes from occupied to free, the section is deleted from the protected area and the movement authorization area. Automatic deletion based on communication status: When ZC determines that communication with VOBC has been restored and the train identification matches, if the train's location is within the protected area, the protected area is deleted and the normal process is restored. If the train is not located within the protected area, an invalid movement authorization value is sent to VOBC; when an uncontrolled operation mode is reported by VOBC, the protected area is automatically deleted. Automatic deletion based on track idle status: If ZC determines that communication with VOBC has not been restored, but all track axle counting sections within the protected area become idle, the protected area is deleted; Information synchronization and manual deletion: ZC sends the protection zone update information to ATS; ATS supports manual deletion operations. After the operator confirms the train has left on the interface, the operator initiates a deletion request. ATS sends the deletion command and area identifier to ZC. Upon receiving the information, ZC deletes the corresponding protected area.

[0025] In step S5, the ATS monitors the vehicle-to-ground communication status on a track axle section basis, accumulates the number of communication interruptions, marks potential fault sections, generates alarms, and sends fault information to the ZC.

[0026] In this embodiment, the specific method by which the ATS monitors the communication status in step S5 is as follows: VOBC uses ATS time as its time source for synchronization. When it detects that communication with both ZC and ATS is interrupted, it records the position and time of the train interruption. After communication is restored, it sends this information to ATS and resets the system. When ATS receives a VOBC message, if it contains information on the location and time of the communication interruption, it determines whether the latest train-to-ground communication time of the track axle counting section corresponding to that location is earlier than the interruption time. If so, it accumulates the number of communication interruptions for that section; and resets the potential fault flags and interruption counts for the track axle counting section corresponding to the current position of the train, and updates the message receipt time to the latest train-to-ground communication time for that section. Before ATS sends a message to ZC, it checks all track axle counting sections: if the number of communication interruptions in a certain section exceeds the threshold, it sets a potential communication fault mark, generates an interface color prompt alarm, and sends the information of that section to ZC. ATS operators manually clear potential fault markers and communication interruption counts for designated track axle counting sections.

[0027] In step S6, ZC determines the endpoint of the movement authorization when calculating the movement authorization for the train based on the communication fault status of the track axle counting section sent by ATS.

[0028] In the embodiment, in step S6, after ZC receives the information on the track axle counting section with potential vehicle-to-ground communication failure sent by ATS, it first resets the communication failure status of all track axle counting sections, and then sets the corresponding track axle counting section as a communication failure section according to the track axle counting section information sent by ATS. When ZC calculates movement authorization for a train, the endpoint of the movement authorization is not located in a section where there is a potential train-to-ground communication failure.

[0029] This invention provides a train operation control method to enhance the resilience of CBTC system vehicle-to-ground communication. After vehicle-to-ground communication is interrupted, the train does not need to reduce speed or exit the controlled mode. Instead, it continues to operate in the controlled mode based on the movement authorization mutually confirmed by ZC and VOBC before the communication interruption, until it reaches the movement authorization endpoint. This avoids train speed reduction and operation mode downgrade (such as downgrading from automatic mode to manual driving mode) caused by communication interruption. It can control the train to leave the communication interruption area as quickly and as possible in the controlled mode, reduce the time for vehicle-to-ground communication to be restored, and avoid the impact on operation.

[0030] CBTC systems generally use wireless communication for train-to-ground communication. Due to the complexity of the wireless environment, interference from other wireless signals on the train-to-ground wireless communication link cannot be avoided. Wireless communication failures are characterized by being sporadic and self-healing (i.e., the failure automatically recovers after the interference disappears). The method provided by this invention controls the train to maintain normal operation in a controlled mode when a train-to-ground wireless communication failure occurs, thereby enhancing the resilience and fault tolerance of the CBTC system's train-to-ground communication system. It greatly reduces the probability of operational impact caused by train-to-ground communication interruptions due to sporadic wireless signal interference and other factors, alleviates the impact of train-to-ground communication interruptions on operations, and improves the stability and availability of the CBTC system.

[0031] The method provided by this invention identifies and isolates faulty sections of the train-to-ground communication system. Based on these faulty sections, the ZC (Train Control Center) adjusts the endpoint of the movement authorization in advance to ensure that the train safely passes through the faulty sections in a controlled mode, thereby reducing the cascading impact of the train-to-ground communication failure on the overall operation.

[0032] The method provided by this invention, based on the movement authorization mutually confirmed by ZC and VOBC before the communication interruption, creates a non-communication train protection zone based on movement authorization. ZC locks the movement authorization state, and VOBC uses the movement authorization confirmed before the communication interruption. This supports the train to continue operating in a controlled mode after the communication interruption. By identifying and isolating the faulty section of the train-to-ground communication and attempting to rebuild the communication, the normal process is quickly restored after communication is restored. This achieves automated handling of train-to-ground communication interruption faults, avoids manual intervention, and reduces the recovery time. Since fully automated driverless lines mainly rely on movement authorization to control the automatic operation of trains, this method is particularly suitable for fully automated driverless lines, reducing the need for manual intervention and improving the adaptability of the train-to-ground communication system in fully automated driverless lines.

[0033] The following is based on the appendix Figure 1 The implementation case shown is executed through the following steps: Step S1: ZC and VOBC establish a two-way confirmation process for mobile authorization information to ensure consistency of mobile authorization information between ZC and VOBC.

[0034] After ZC establishes communication with VOBC, they establish periodic communication, meaning that ZC and VOBC send messages to each other according to their respective communication cycles. To enable rapid sending and confirmation of mobility authorization information between ZC and VOBC, this embodiment adds a mechanism for instant message sending. The message sending and confirmation process is as follows: Figure 2 As shown, the entire processing flow is as follows: After receiving the route request from the ATS, the ZC calculates the train's movement authorization in real time and generates a corresponding movement authorization identifier based on the different destinations of the movement authorization. When the calculated destination of the movement authorization changes, the ZC determines to generate a new movement authorization. The ZC does not need to wait for a communication cycle and immediately sends a message containing the movement authorization information of the identifier to the VOBC. After receiving the mobility authorization information, VOBC uses the received mobility authorization information to control the train operation. Then it determines whether the newly received mobility authorization identifier has changed. If it has changed, it immediately replies to ZC with a message containing the mobility authorization identifier. If it has not changed, VOBC waits for the communication cycle to expire before replying to ZC. After ZC receives the message sent by VOBC, if the mobile authorization identifier in the message is the same as the mobile authorization identifier sent to VOBC, it confirms that VOBC has received the mobile authorization information. If the mobile authorization identifier is not marked as being confirmed by VOBC, it marks that the mobile authorization has been confirmed by VOBC and immediately sends a mobile authorization confirmation acceptance message to VOBC. After receiving the mobile authorization confirmation message, the VOBC marks that the currently used mobile authorization has been confirmed by the ZC. The mobile authorization information confirmation is complete. The VOBC waits for the communication cycle to expire before replying to the ZC with a message. If the VOBC needs to actively disconnect from the ZC due to reasons such as loss of train position, the VOBC does not need to wait for the communication cycle and immediately sends a Mobility Authorization Confirmation Cancellation Request message to the ZC; upon receiving the message, the ZC clears the Mobility Authorization Confirmation flag and immediately replies with the Mobility Authorization Confirmation Cancellation information to the VOBC; upon receiving the message, the VOBC stops sending messages to the ZC. When ZC needs to calculate a new mobility authorization based on a new route request, to avoid inconsistencies between the mobility authorization used by ZC and VOBC, after ZC receives a new route request, if the mobility authorization previously sent to VOBC has been confirmed by VOBC, ZC immediately sends a cancellation of mobility authorization confirmation message to VOBC. Upon receiving the message, VOBC resets the mobility authorization and immediately replies to ZC. Only after ZC receives the reply message from VOBC can ZC clear the mobility authorization previously confirmed by VOBC, recalculate the new mobility authorization based on the route request, and send it to VOBC.

[0035] In step S2, when communication with VOBC is interrupted and the movement authorization has been confirmed, ZC creates a non-communication train protection zone based on the last reported position of the train and the endpoint of the movement authorization, and locks the movement authorization status within the zone.

[0036] ZC monitors the communication status with VOBC through periodic communication messages. If ZC does not receive a message from VOBC within a predetermined time, it determines that the communication with VOBC is interrupted. If ZC determines that the previously sent mobility grant has been confirmed by VOBC, then ZC establishes a non-communication train protection zone within the area between the last reported rear position of the train by VOBC and the endpoint of the mobility grant. That is, a train protection zone is established from the last reported rear position of the train by VOBC to the endpoint of the mobility grant. The non-communication train protection zone established by ZC based on mobility grant is as follows: Figure 3 As shown; Within the non-communication train protection zone based on movement authorization, ZC locks the movement authorization status, that is, keeps the movement authorization area, turnouts, signal lights, etc., consistent with the status of the movement authorization previously sent to VOBC, and ZC will refuse any request to change the movement authorization. ZC uses the train identifier as the identifier for the non-communication train protection zone created based on mobility authorization. That is, the non-communication train protection zone based on mobility authorization is associated with the train identifier, and there will only be one train in a non-communication train protection zone based on mobility authorization. When ZC assigns routes to other trains and calculates movement authorization, the movement authorization of other trains must not intrude into the protection zone of non-communication trains based on movement authorization, thereby protecting non-communication trains. ZC sends the information (including identification information) of the non-communication train protection zone based on mobile authorization to ATS, and ATS displays the information of the zone on the ATS interface; If ZC determines that the previously sent mobile authorization has not been confirmed by VOBC, ZC will process it according to the existing system procedures.

[0037] In step S3, when communication with ZC is interrupted but the movement authorization has been confirmed, VOBC maintains the train in controlled mode according to the confirmed movement authorization, while monitoring the communication status and attempting to rebuild communication. When the preset conditions are met, the train is safely downgraded to manual driving.

[0038] VOBC monitors the communication status with ZC and ATS through periodic communication messages. If VOBC does not receive a message from ZC within a predetermined time, it determines that the communication with ZC is interrupted; if VOBC does not receive a message from ATS within a predetermined time, it determines that the communication with ATS is interrupted. Figure 4 This is a diagram illustrating the VOBC processing status and status monitoring when VOBC and ZC communication is interrupted. Figure 4The states and state transition conditions shown are processed as follows: When VOBC determines that communication with ZC is interrupted, if VOBC determines that the current mobility authorization has been confirmed by ZC and the current operating mode is controlled mode, then it will maintain the controlled mode operation according to the current mobility authorization. When the train is running in controlled mode according to the current movement authorization, if the VOBC determines that the communication with the ATS is not interrupted, it starts a timer to monitor the communication status with the ATS. If the ATS communication status monitoring timer expires, the VOBC and ATS are communicating normally, but the VOBC and ZC are interrupted, the VOBC clears the current movement authorization, exits the controlled mode, and the driver takes over manual driving. If the VOBC does not receive an ATS message before the ATS communication status monitoring timer expires, the VOBC determines that the communication with the ATS is interrupted, and maintains the controlled mode operation according to the current movement authorization. The VOBC ensures that the communication status interruption with the ZC is caused by the interruption of the train-to-ground communication by simultaneously monitoring the communication status of the ATS. When the train is running in controlled mode according to the current movement authorization, if the VOBC detects that the train's running direction is inconsistent with the movement authorization direction or the train exits the controlled mode, the VOBC will clear the currently saved movement authorization, exit the controlled mode, and the driver will take over manual driving. In order to ensure that the train can run to the end of the movement authorization if the train communication between the train and the ground is interrupted, this embodiment adds system operation restrictions. Before the train communication between the train and the ground is restored, the train is not allowed to switch ends until the train reaches the end of the movement authorization. While the train is operating in controlled mode according to the current movement authorization, the VOBC continues to periodically send communication messages to the ZC and ATS to attempt to rebuild communication with them. If communication between the VOBC and the ZC is restored, the VOBC resumes the existing system process. If communication between the VOBC and the ATS is restored, but communication between the VOBC and the ZC is interrupted, a timer for monitoring the communication status with the ZC is started. If communication between the VOBC and the ZC is restored within the time of the ZC communication status monitoring timer, the VOBC resumes the existing system process. If the timer expires and communication between the VOBC and the ZC is not restored, the VOBC clears the current movement authorization, exits the controlled mode, and the driver takes over manual driving. When the train reaches the end of the current movement authorization while maintaining controlled mode operation, and communication between VOBC and ZC has not yet been established, VOBC clears the current movement authorization, exits the controlled mode, and the driver takes over manual driving. When VOBC determines that communication with ZC is interrupted, the current movement authorization has been confirmed by ZC, and the current operating mode is controlled mode, VOBC estimates the time from the current position of the train to the end of the movement authorization based on the current speed of the train and the track speed limit information (target speed) between the current position of the train and the end of the movement authorization. Figure 5This is a schematic diagram of the time estimation used in this embodiment. The time estimation is based on kinematic formulas. The acceleration and deceleration phases use the maximum acceleration and deceleration of the train. The train motion phase is divided into three phases: acceleration, coasting (cruising) and deceleration. The time for the train to reach the authorized endpoint is calculated under the constraint of the track speed limit. The specific calculation process will not be described in detail. Then, VOBC starts the train motion status monitoring timer with the smaller of the estimated time and the motion authorization retention time when the vehicle-to-ground communication is interrupted. The motion authorization retention time when the vehicle-to-ground communication is interrupted is a system parameter, and in this embodiment, it is set to 120 seconds. If the train motion status monitoring timer expires, the movement authorization is cleared, the controlled mode is exited, and the driver takes over manual driving; if the communication between VOBC and ZC is restored to normal or the end of the movement authorization is reached, the train motion status monitoring timer is canceled. If the current mobility authorization is not confirmed by ZC or the current mode is uncontrolled, exit controlled mode and switch to manual driving by the driver.

[0039] In step S4, ZC dynamically maintains and updates the non-communication train protection area based on changes in track section occupancy status or communication recovery status, and supports manual deletion operations in abnormal situations.

[0040] ZC updates the non-communication train protection zone based on mobility authorization in the following manner: ZC dynamically maintains the non-communication train protection zone based on movement authorization according to track occupancy status, such as Figure 6 As shown, starting from the beginning of the protected area, if the status of a track axle counting section changes from occupied to idle, then the track axle counting section is deleted from the protected area and the movement authorization area. ZC automatically deletes the protection zone of non-communication trains based on movement authorization based on communication status: If ZC determines that communication with VOBC has been restored and the train identifier reported by VOBC matches the identifier of the non-communication train protection zone based on movement authorization, and if the train position reported by VOBC is within the non-communication train protection zone based on movement authorization, ZC automatically deletes the protection zone of the non-communication train based on movement authorization, calculates a new movement authorization for the train, and restores the normal processing flow of the system; if the train position reported by VOBC is not within the non-communication train protection zone based on movement authorization, the movement authorization is set to an invalid value and sent to VOBC. Upon receiving this, VOBC clears the current movement authorization, exits the controlled mode, and switches to manual driving by the driver; when ZC receives a report from VOBC that the operating mode is uncontrolled, ZC automatically deletes the protection zone of the non-communication train based on movement authorization. If ZC determines that communication with VOBC has not been restored and all track sections in the protection zone of non-communication trains based on mobility authorization have become idle, that is, the train has left the protection zone, then ZC deletes the protection zone of non-communication trains based on mobility authorization. ZC sends the updated information (including identification information) of non-communication train protection zones based on mobility authorization to ATS. ATS then displays this information on its interface. To avoid situations where ZC cannot automatically delete protection zones of non-communication trains based on mobility authorization due to axle counting failures or other reasons, ATS provides a method for manually confirming and deleting such protection zones: If the operator confirms that a train has left a protection zone displayed on the ATS interface, the operator can delete the protection zone on the ATS interface. Upon receiving the deletion request, ATS sends the deletion command and the corresponding area's identifier to ZC. ZC then deletes the corresponding non-communication train's protection zone.

[0041] In step S5, the ATS (Automatic Train Monitoring System) monitors the vehicle-to-ground communication status on axle-counting sections of the track, accumulates the number of communication interruptions, marks potential fault sections, generates alarms, and sends fault information to ZC.

[0042] ATS monitors the vehicle-to-ground communication status on a track axle counting section basis. The relevant information regarding the vehicle-to-ground communication status monitored by ATS includes... Figure 7 As shown, it contains the following information: [Latest vehicle-to-ground communication time for this section, number of vehicle-to-ground communication interruptions for this section, and whether there are potential vehicle-to-ground communication fault markers for this section]; When the ATS system is started, the communication status information of each track axle counting section is set to the initial values: latest vehicle-to-ground communication time = 0, number of vehicle-to-ground communication interruptions = 0, potential vehicle-to-ground communication fault flag = False; The ATS process for monitoring vehicle-to-ground communication status is as follows: Figure 8 As shown, the specific method is as follows: VOBC uses ATS time as the time source for time synchronization. If VOBC detects that communication with both ZC and ATS is interrupted, it records the train position and time at the time of the communication interruption. When VOBC resumes communication with ATS, VOBC sends this information to ATS and then resets the information. When the ATS receives a VOBC message, if the message contains the train position and time information of the communication interruption, the ATS determines whether the latest train-to-ground communication time of the track axle counting section corresponding to the train position at the time of the communication interruption is earlier than the communication interruption time. If the latest train-to-ground communication time of the track axle counting section is earlier than the communication interruption time, the ATS accumulates the number of communication interruptions of the track axle counting section. When the ATS receives a VOBC message, it resets the potential vehicle-to-ground communication fault flags and communication interruption counts for the track axle counter section where the train's position is located, updates the latest vehicle-to-ground communication time for the track axle counter section where the train's position is located, and saves the time of receiving the VOBC message as the latest vehicle-to-ground communication time for the current track axle counter section where the train's position is located. When sending messages to ZC, ATS performs the following checks on all track axle counting sections: If the number of communication interruptions in a track axle counting section exceeds a predefined threshold, ATS determines that there is a potential vehicle-to-ground communication fault in that section, sets a potential communication fault flag, generates an alarm on ATS, and displays a color-coded indicator for that section on the interface, indicating a potential vehicle-to-ground communication fault. ATS then sends the information on track axle counting sections with potential communication faults to ZC. For track axle counting sections with potential vehicle-to-ground communication faults, ATS operators can confirm the elimination of vehicle-to-ground communication faults through the ATS system interface, that is, manually clear the potential vehicle-to-ground communication fault markers and communication interruption counts for the specified track axle counting sections.

[0043] In step S6, ZC determines the endpoint of the movement authorization when calculating the movement authorization for the train based on the communication fault status of the track axle counting section sent by ATS.

[0044] After receiving information from ATS about a track axle counting section with potential vehicle-to-ground communication failure, ZC first resets the communication failure status of all track axle counting sections, and then sets the corresponding track axle counting section as a communication failure section according to the track axle counting section information sent by ATS. When calculating movement authorization for trains, ZC ensures that the endpoint of the movement authorization is not located in a section with potential train-to-ground communication failures, so as to guarantee that the train can safely pass through sections with potential train-to-ground communication failures using the methods described above. Figure 9 As shown, when there is a potential train-to-ground communication failure in the section ahead of the train, the movement authorization range calculated by ZC for the train needs to be less than the maximum range of not crossing the faulty section or greater than the minimum range of crossing the faulty section.

[0045] Finally, it should be noted that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A train operation control method for enhancing the resilience of vehicle-to-ground communication in a CBTC system, characterized in that, include: Step S1: ZC and VOBC establish a two-way confirmation process for mobile authorization information to ensure consistency of mobile authorization information between ZC and VOBC. Step S2: When communication with VOBC is interrupted and the movement authorization has been confirmed, ZC creates a non-communication train protection zone based on the last reported position of the train and the endpoint of the movement authorization, and locks the movement authorization status within the zone. In step S3, when communication with ZC is interrupted but the movement authorization has been confirmed, VOBC maintains the train in controlled mode according to the confirmed movement authorization, while monitoring the communication status and attempting to rebuild the communication. When the preset conditions are met, the train is safely downgraded to manual driving. Step S4: ZC dynamically maintains and updates the non-communication train protection area based on changes in track section occupancy status or communication recovery status, and supports manual deletion operations in abnormal situations. Step S5: The ATS monitors the vehicle-to-ground communication status by track axle counting section, accumulates the number of communication interruptions and marks potential fault sections, generates alarms and sends fault information to ZC. In step S6, ZC determines the endpoint of the movement authorization when calculating the movement authorization for the train based on the communication fault status of the track axle counting section sent by ATS.

2. The train operation control method for enhancing the resilience of CBTC system vehicle-to-ground communication according to claim 1, characterized in that, Step S1 includes: After receiving the route request from the ATS, ZC calculates the train movement authorization, generates a corresponding identifier based on the destination of the movement authorization, and sends the movement authorization information containing the identifier to VOBC. VOBC receives movement authorization information and uses it for train operation control, and then replies to ZC with a movement authorization confirmation message containing the identifier; Once the identifier in the ZC confirmation message matches the identifier sent, it marks that the mobile authorization has been confirmed by VOBC and sends a mobile authorization confirmation acceptance message to VOBC. After VOBC receives the confirmation message, it marks that the currently used mobile authorization has been confirmed by ZC. If the VOBC needs to actively disconnect communication due to train position loss, it sends a movement authorization confirmation cancellation request to the ZC; after receiving the request, the ZC clears the confirmation flag and replies with a cancellation message, and the VOBC stops sending messages to the ZC. When ZC receives a new route request, if the previously sent mobility grant has been confirmed by VOBC, it sends a cancellation of mobility grant confirmation message to VOBC; after receiving the message, VOBC resets the mobility grant and replies with a message. After receiving the reply, ZC clears the original mobility grant, recalculates and sends a new mobility grant. Among them, ZC and VOBC adopt an "instant trigger + periodic recovery" communication mechanism: when sending a mobile authorization, confirmation message or confirmation of acceptance message, a message is sent immediately, and periodic communication is resumed after the mobile authorization confirmation process is completed.

3. The train operation control method for enhancing the resilience of CBTC system vehicle-to-ground communication according to claim 1, characterized in that, Step S2 includes: ZC monitors the communication status with VOBC through periodic communication messages. If no VOBC message is received within a predetermined time, the communication is considered interrupted. If communication is determined to be interrupted and the previously sent mobility authorization has been confirmed by VOBC, ZC creates a non-communication train protection zone from the last reported rear position of the train to the end of the mobility authorization. Within this protected area, ZC locks the movement authorization, turnout and signal light status, and rejects any movement authorization change requests; ZC uses train markings as protection zone markings, thus associating each protection zone with a train. When ZC calculates movement authorization for other trains, the movement authorization of other trains must not intrude into the non-communication train protection zone based on movement authorization; ZC sends the identified protected area information to ATS; If the previously sent mobile authorization is not confirmed by VOBC, ZC will process it according to the existing procedures.

4. The train operation control method for enhancing the resilience of CBTC system vehicle-to-ground communication according to claim 1, characterized in that, Step S3 includes: VOBC monitors the communication status with ZC and ATS through periodic communication messages. If the corresponding message is not received within a predetermined time, the communication is considered to be interrupted. When VOBC determines that communication with ZC has been interrupted, if the current mobility authorization has been confirmed by ZC and is in controlled mode, it will maintain controlled mode operation according to the mobility authorization. When VOBC maintains controlled mode operation: If communication with ATS is not interrupted, start the ATS communication status monitoring timer. If communication with ZC is not restored after the timeout, clear the mobility authorization and exit the controlled mode. If communication with ATS is interrupted before the timeout, continue to maintain the controlled mode operation. If the train's direction of travel is found to be inconsistent with the direction of movement authorization, it will actively exit the controlled mode, or if it fails to restore communication with ZC after reaching the end of the movement authorization, the movement authorization will be cleared and the controlled mode will be exited. Continuously attempt to rebuild communication with ZC and ATS. If only communication with ATS is restored, start the ZC communication status monitoring timer. If communication with ZC is not restored after the timer expires, clear the mobility authorization and exit the controlled mode. VOBC starts a timer to monitor the train's motion status. The duration is the smaller of the estimated time to reach the end of the movement authorization and the system's preset movement authorization retention time. After the timer expires, the movement authorization is cleared and the train exits the controlled mode. If communication with ZC is restored or the end of the movement authorization is reached, the timer is canceled. If the current mobile authorization has not been confirmed by ZC or is in uncontrolled mode, exit controlled mode directly.

5. The train operation control method for enhancing the resilience of CBTC system vehicle-to-ground communication according to claim 1, characterized in that, In step S4, the ZC updates the protection area in the following ways: Dynamically maintain the protected area: ZC starts detecting from the beginning of the protected area. If the status of the track axle counting section changes from occupied to free, the section is deleted from the protected area and the movement authorization area. Automatic deletion based on communication status: When ZC determines that communication with VOBC has been restored and the train identification matches, if the train's location is within the protected area, the protected area is deleted and the normal process is restored. If the train is not located within the protected area, an invalid movement authorization value is sent to VOBC; when an uncontrolled operation mode is reported by VOBC, the protected area is automatically deleted. Automatic deletion based on track idle status: If ZC determines that communication with VOBC has not been restored, but all track axle counting sections within the protected area become idle, the protected area is deleted; Information synchronization and manual deletion: ZC sends the protection zone update information to ATS; ATS supports manual deletion operations. After the operator confirms the train has left on the interface, the operator initiates a deletion request. ATS sends the deletion command and area identifier to ZC. ZC then deletes the corresponding protected area.

6. The train operation control method for enhancing the resilience of CBTC system vehicle-to-ground communication according to claim 1, characterized in that, In step S5, the specific method by which the ATS monitors the communication status is as follows: VOBC uses ATS time as its time source for synchronization. When it detects that communication with both ZC and ATS is interrupted, it records the position and time of the train interruption. After communication is restored, it sends this information to ATS and resets the time. When ATS receives a VOBC message, if it contains information on the location and time of the communication interruption, it determines whether the latest train-to-ground communication time of the track axle counting section corresponding to that location is earlier than the interruption time. If so, it accumulates the number of communication interruptions for that section; and resets the potential fault flags and interruption counts for the track axle counting section corresponding to the current position of the train, and updates the message receipt time to the latest train-to-ground communication time for that section. Before ATS sends a message to ZC, it checks all track axle counting sections: if the number of communication interruptions in a certain section exceeds the threshold, it sets a potential communication fault mark, generates an interface color prompt alarm, and sends the information of that section to ZC. ATS operators manually clear potential fault markers and communication interruption counts for designated track axle counting sections.

7. The train operation control method for enhancing the resilience of CBTC system vehicle-to-ground communication according to claim 1, characterized in that, In step S6, after ZC receives the information on the track axle counting section with potential vehicle-to-ground communication failure sent by ATS, it first resets the communication failure status of all track axle counting sections, and then sets the corresponding track axle counting section as a communication failure section according to the track axle counting section information sent by ATS. When ZC calculates movement authorization for a train, the endpoint of the movement authorization is not located in a section where there is a potential train-to-ground communication failure.

Images