A method and system for dynamic matching of urban rail transit capacity and train control

Abstract

The present application belongs to the field of urban rail transit train operation control technology, and discloses a kind of urban rail transit dynamic transport capacity matching and train control method and system.Based on historical uncongested condition training self-encoder and constructing graph definite operation domain;Combined with train, brake and rail passenger flow state to determine passenger flow safety recovery time and safe arrival time, build ATP physical safety feasible set and safety mapping domain, and according to operation deviation, position relationship and remaining safety margin to divide control area. Through ATS or ATO candidate control strategy and ATP braking protection target and ATP physical safety feasible set iteration to obtain executable self-consistent transport capacity control solution;When ATP limit approximation or transport capacity recovery fails, start ATP safety recovery control, iterate the candidate strategy covering the ATP allowed control range, and trigger interlocking degradation when neither can form a safety recovery trajectory, achieving step-by-step safety recovery.

Description

Technical Field

[0001] This invention belongs to the field of urban rail transit train operation control technology, and in particular relates to a method and system for dynamic capacity matching and train operation control of urban rail transit. Background Technology

[0002] Urban rail transit train operation control is typically accomplished collaboratively by ATS, ATO, ATP, and interlocking systems. ATP monitors speed and provides braking protection based on factors such as movement authorization, line speed limits, and train braking performance. ATS and ATO primarily handle operation plan adjustments, arrival and departure time control, and automatic train operation. Under sudden surges in passenger flow, passenger density, distribution, and evacuation speed in the platform's trackside area change rapidly. Existing train control systems often determine braking protection boundaries based on predetermined train operation permits and parameters, making it difficult to directly translate the platform passenger flow recovery process into ATP braking protection conditions. This can easily lead to a disconnect between changes in passenger flow risk and train arrival control.

[0003] Existing capacity adjustment methods mostly alleviate passenger flow pressure by adjusting arrival times, dwell times, or operating speeds. However, there is a lack of continuous linkage between capacity recovery control and ATP physical safety constraints. Changes in train operation and passenger flow caused by control strategies are difficult to be fed back to subsequent safety boundaries in a timely manner, making it difficult to balance the effectiveness of capacity recovery with overall train operation safety. In addition, when ATS or ATO control cannot continue to recover, existing systems usually rely on ATP braking or interlocking restrictions to ensure safety, lacking sufficient assessment of the remaining autonomous recovery capacity of ATP. This may lead to problems such as premature entry into interlocking degradation or excessively rapid restoration of control authority.

[0004] Therefore, there is an urgent need for an urban rail transit train control method that can dynamically link passenger flow safety status with ATP braking protection and realize hierarchical control and safe recovery between ATS or ATO, ATP and interlocking. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention discloses a method for dynamic capacity matching and train operation control in urban rail transit, comprising:

[0006] The autoencoder is trained based on the joint state parameters of vehicles and passengers under historical congestion-free conditions, and the encoder in the autoencoder is used to construct a graph-defined operating domain.

[0007] The safe recovery time and safe arrival time of passenger flow are determined based on the real-time train operation status, braking system status and passenger flow status near the track.

[0008] If the safe arrival time is less than the sum of the passenger flow safe recovery time and the preset time margin, the virtual protection point is inverted through the ATP braking model;

[0009] Based on the time comparison results and virtual protection point inversion results, the ATP braking protection target is determined. Using the ATP braking protection target as the braking stopping boundary, the ATP physical safety feasible set is determined. The state vector corresponding to the ATP physical safety feasible set is mapped by the encoder to form the ATP safety mapping domain. Real-time train-passenger joint state parameters are mapped to real-time state points by the encoder. Based on the train's remaining safety margin relative to the ATP braking protection target, the operational deviation of the real-time state point relative to the scheduled operating domain, and the positional relationship of the real-time state point relative to the ATP safety mapping domain, the scheduled operating area, the ATS or ATO capacity recovery area, or the ATP clearance approach area are determined. The operational deviation is determined based on the spatial distance relationship between the real-time state point and the scheduled operating domain. The train's remaining safety margin relative to the ATP braking protection target is determined through the real-time train operating status and braking system status.

[0010] Within the ATS or ATO capacity recovery zone, candidate control strategies are generated while keeping their control objectives unchanged. Control sequences are obtained under the constraints of the ATP physical safety feasible set. Based on the control sequences, train operation and passenger flow changes are predicted to update the passenger flow safety recovery time, ATP braking protection objectives, and ATP physical safety feasible set. The control sequences are iteratively re-obtained to obtain an executable self-consistent capacity control solution.

[0011] When the ATP limit is approaching the limit or there is no executable self-consistent capacity control solution in the ATS or ATO capacity recovery region, it switches to ATP safe recovery control.

[0012] For each ATP candidate control strategy covering the ATP allowable control range, a safety recovery determination is made. When none of the ATP candidate control strategies can form a recovery trajectory that satisfies the corresponding ATP physical safety feasible set constraints and reaches the target safety margin within the preset recovery time domain, interlocking degradation control is triggered.

[0013] According to a preferred embodiment, the training and real-time state mapping of the autoencoder includes:

[0014] The vehicle-passenger joint state parameters under historical congestion-free conditions are used to form a training input vector according to a preset feature dimension, arrangement order and normalization rule. The training input vector is used to train an autoencoder, and the graphical operating domain is determined in the low-dimensional state space based on the distribution range of historical state points output by the encoder.

[0015] The combined vehicle and passenger status parameters include train operation status parameters and platform passenger flow status parameters; the train operation status parameters include at least train position and train speed, and at least one of station dwell time and interval travel time; the platform passenger flow status parameters include at least one or more of the following: platform rail area passenger flow density, passenger flow inflow rate, and passenger spatial distribution.

[0016] The real-time train and passenger joint state parameters, which consist of real-time train operation status parameters and real-time platform passenger flow status parameters, are used to form a real-time input vector according to the same feature dimensions, arrangement order and normalization rules as the training input vector, and then mapped to the real-time state point through the same encoder.

[0017] According to a preferred embodiment, the specific process for determining the safe arrival time includes:

[0018] The air spring pressure of each vehicle is acquired in real time. The real-time load of each vehicle is determined based on the preset calibration relationship between the air spring pressure and the vehicle load. The real-time equivalent mass of the train is determined by combining the self-weight of each vehicle, the formation relationship and the preset slewing mass conversion factor.

[0019] The available braking units and their braking force are determined based on the status of the braking system, and the effective braking deceleration is determined in combination with the real-time equivalent mass of the train.

[0020] The real-time physical state of the train is formed by the train position, train speed, real-time equivalent mass of the train and effective braking deceleration. The shortest running time from the current control time to the platform entry protection boundary under the ATP braking constraint is determined by the ATP operation constraint and is used as the safe arrival time.

[0021] According to a preferred embodiment, the specific process of determining the passenger flow safety recovery time and retrieving virtual protection points includes:

[0022] Based on the passenger flow density in the platform's adjacent area, the distance distribution of passengers relative to the platform edge, the passenger flow inflow rate, and the passenger flow evacuation rate to the preset safe area, the time required for the platform's adjacent area to first meet the preset passenger flow safety conditions from the current control time is predicted and used as the passenger flow safety recovery time.

[0023] When the safe arrival time is less than the sum of the passenger flow safe recovery time and the preset time margin, multiple candidate stopping positions are determined within the braking stopping range based on the real-time physical state of the train.

[0024] For each candidate stopping position, under the condition that the train stops completely at the candidate stopping position and restarts without setting an additional stopping time, the ATP braking model is used to determine the expected arrival time of the train from the current control time to the platform entry protection boundary.

[0025] From the candidate parking locations whose estimated arrival time is not less than the sum of the passenger flow safe recovery time and the preset time margin, select the candidate parking location with the smallest estimated arrival time as the virtual protection point;

[0026] When the safe arrival time is less than the sum of the passenger flow safe recovery time and the preset time margin, and a feasible virtual protection point exists, the virtual protection point is used as the ATP braking protection target; when the safe arrival time is not less than the sum of the passenger flow safe recovery time and the preset time margin, or when no feasible virtual protection point exists, the braking protection target determined by the ATP system based on the current mobility authorization, line operation constraints, and ATP braking constraints is used as the basic braking protection target, and the basic braking protection target is used as the ATP braking protection target.

[0027] According to a preferred embodiment, the specific steps for determining the ATP physically safe feasible set, the ATP safety mapping domain, the operational deviation, the remaining safety margin, and the control region include:

[0028] Using the ATP braking protection target as the braking and stopping boundary, and under the conditions of the train's real-time equivalent mass and effective braking deceleration, with the train position and train speed as state variables, the ATP braking model determines the set of train physical states that can complete braking and stopping without exceeding the ATP braking protection target, which is then used as the ATP physical safety feasible set.

[0029] The critical train physical states located on the boundary of the ATP physically feasible set and the sampled train physical states located inside the ATP physically feasible set are extracted. The train position and train speed in the current real-time input vector are replaced with the train position and train speed in the critical train physical states and the sampled train physical states, respectively, while keeping the other feature dimensions in the real-time input vector unchanged, forming a corresponding state vector, which is then mapped by the same encoder. An ATP safety bounding function is established based on the critical mapping point corresponding to the critical train physical state, and the region defined by the ATP safety bounding function and containing the internal mapping point corresponding to the sampled train physical state is determined as the ATP safety mapping domain.

[0030] When the real-time status point is within the designated operating range, the operating deviation is zero. When it is outside the designated operating range, the operating deviation is determined based on the minimum distance from the real-time status point to the boundary of the designated operating range. The farthest expected stopping position of the train along the operating direction is determined based on the real-time train physical state and ATP braking constraints, and the longitudinal position difference between the ATP braking protection target and the farthest expected stopping position along the train operating direction is determined as the remaining safety margin.

[0031] When the deviation from the operation is not greater than the preset deviation threshold, the real-time status point is located within the ATP safety mapping domain, and the remaining safety margin is not less than the preset safety margin, the initial control area is determined to be the map-based operation area.

[0032] When the conditions for determining the operating zone according to the diagram are not met, the real-time status point is located inside the ATP safety mapping domain, and the remaining safety margin is higher than the preset limit threshold, the initial control zone is determined to be the ATS or ATO capacity recovery zone.

[0033] When the real-time state point is located at or outside the boundary of the ATP safety mapping domain, or when the remaining safety margin is not higher than the preset limit threshold, the initial control area is determined as the ATP limit approximation area; wherein, the preset safety margin is higher than the preset limit threshold; the ATP physical safety feasible set is used to constrain the train's physical state and control sequence, and the ATP safety mapping domain is used to determine the control area in the low-dimensional state space.

[0034] According to a preferred embodiment, the specific process of obtaining the control sequence and iteratively re-obtaining the control sequence within the ATS or ATO capacity recovery region includes:

[0035] Multiple candidate control strategies are generated, and at least one of the following control objectives is set for each candidate control strategy: arrival time adjustment objective, dwell time adjustment objective, and ATO operation control objective.

[0036] For each candidate control strategy, a control sequence is obtained under the current ATP physical safety feasible set constraints. Based on the control sequence, the train prediction state at each prediction time within the preset prediction time domain is generated. The train prediction state includes the train prediction running state and the train prediction physical state. The train prediction physical state includes at least the train position, train speed, train equivalent mass, and effective braking deceleration at each prediction time. Combining the current platform passenger flow state and the train arrival, train stop, and door opening processes corresponding to the train prediction running state, the platform passenger flow state at each prediction time is predicted.

[0037] For each predicted time before the train arrives at the platform and enters the station protection boundary within the preset prediction time domain, the safe arrival time is re-determined based on the corresponding predicted physical state of the train, and the safe passenger flow recovery time is re-determined based on the corresponding platform passenger flow state; when the safe arrival time is less than the sum of the safe passenger flow recovery time and the preset time margin and there is a feasible virtual protection point, the corresponding virtual protection point is used as the ATP braking protection target.

[0038] Otherwise, the basic braking protection target is re-determined based on the movement authorization, line operation constraints, and ATP braking constraints at the predicted time, and the basic braking protection target is used as the ATP braking protection target. Based on the ATP braking protection target determined at each predicted time and the equivalent mass and effective braking deceleration of the train in the corresponding predicted physical state, the corresponding ATP physical safety feasible set is formed by using the train position and train speed as state variables through the ATP braking model, and arranged according to the predicted time to form an ATP physical safety feasible set sequence. The farthest expected stopping position of the train along the running direction is determined according to the predicted physical state of the train at each predicted time and the ATP braking constraints. The longitudinal position difference between the corresponding ATP braking protection target and the farthest expected stopping position along the train running direction is determined as the remaining safety margin at the corresponding predicted time.

[0039] Keeping the control objective set by the corresponding candidate control strategy unchanged, the control sequence is re-obtained under the hourly constraints of the ATP physical safety feasible set sequence, and the train prediction state and platform passenger flow state are updated according to the re-obtained control sequence. Then, the ATP braking protection objective, ATP physical safety feasible set sequence and remaining safety margin at each prediction time are re-determined for iterative cycle.

[0040] According to a preferred embodiment, obtaining an executable self-consistent energy control solution and transitioning to ATP safe recovery control includes:

[0041] The train arrival time is determined based on the predicted train running status obtained from two adjacent rounds of iterative cycles. When the difference in train arrival time between two adjacent rounds of iterative cycles does not exceed the preset time convergence threshold and the maximum value of the longitudinal position difference of the ATP braking protection target along the train running direction at each corresponding predicted moment in two adjacent rounds of iterative cycles does not exceed the preset position convergence threshold, the corresponding candidate control strategy is determined to meet the convergence condition.

[0042] If, under the time-by-time constraints of the updated ATP physically safe feasible set sequence, it is impossible to re-obtain the control sequence that achieves the control objective set by the corresponding candidate control strategy, or if the convergence condition is not met even after reaching the preset maximum number of iterations, the corresponding candidate control strategy is eliminated.

[0043] For a candidate control strategy that satisfies the convergence condition, when the predicted physical state of the train at each predicted time before the train arrives at the platform entry protection boundary in the final round of iteration is located within the ATP physical safety feasible set at the corresponding predicted time, and the minimum value of the remaining safety margin at each predicted time is not lower than the preset safety threshold, the control sequence obtained when the convergence condition is satisfied, along with the corresponding train predicted state, platform passenger flow state, and ATP physical safety feasible set sequence, are jointly determined as the self-consistent capacity control solution.

[0044] The predicted time-domain end-train operation status and platform passenger flow status corresponding to the self-consistent capacity control solution are mapped to predicted status points by the encoder according to the same input and mapping rules as the real-time status points, and the predicted operation deviation is determined according to the position of the predicted status points relative to the fixed operation domain.

[0045] If the current operational deviation is greater than the preset deviation threshold, then the predicted operational deviation should be less than the current operational deviation; if the current remaining safety margin is lower than the preset safety margin, then the remaining safety margin at least one predicted moment before the train arrives at the station entry protection boundary should be greater than the current remaining safety margin; the self-consistent capacity control solution that satisfies the aforementioned operational deviation or remaining safety margin conditions is determined as an executable self-consistent capacity control solution.

[0046] When at least one executable self-consistent capacity control solution exists, a target candidate control strategy is determined based on the predicted operational deviation and the remaining safety margin at each prediction time corresponding to each executable self-consistent capacity control solution, and the control sequence in the executable self-consistent capacity control solution corresponding to the target candidate control strategy is executed; when no executable self-consistent capacity control solution exists, the control authority is transferred from ATS or ATO capacity recovery control to ATP safety recovery control.

[0047] According to a preferred embodiment, the ATP safe recovery control includes:

[0048] After entering ATP safety recovery control, freeze ATS or ATO capacity recovery control, and according to the preset control discrete precision, perform discrete value combination of the braking level and rate limit value allowed by ATP to generate multiple ATP candidate control strategies covering all combinations of braking level and rate limit value under the preset control discrete precision.

[0049] For each ATP candidate control strategy, the braking level and speed limit value corresponding to the ATP candidate control strategy are used as control constraints. Under the current ATP physical safety feasible set constraints, the ATP control sequence is obtained. Based on the ATP control sequence, the train prediction state at each prediction time in the preset recovery time domain is generated. Combined with the current platform passenger flow state and the train arrival, train stop and door opening process corresponding to the train prediction operation state, the platform passenger flow state at each prediction time is predicted.

[0050] For each predicted time before the train arrives at the platform's entry protection boundary, the safe arrival time is re-determined based on the corresponding predicted physical state of the train, and the safe passenger flow recovery time is re-determined based on the corresponding platform passenger flow state. When the safe arrival time is less than the sum of the safe passenger flow recovery time and the preset time margin, and a feasible virtual protection point exists, the corresponding virtual protection point is used as the ATP braking protection target. Otherwise, the basic braking protection target is re-determined based on the movement authorization, line operation constraints, and ATP braking constraints at the predicted time, and the basic braking protection target is used as the ATP braking protection target.

[0051] Based on the ATP braking protection target at each predicted time and the equivalent mass and effective braking deceleration of the train in the corresponding predicted physical state, the corresponding ATP physical safety feasible set is determined by the ATP braking model with the train position and train speed as state variables, and arranged according to the predicted time to form an ATP physical safety feasible set sequence; the farthest expected stopping position of the train along the running direction is determined according to the predicted physical state of the train at each predicted time and the ATP braking constraints, and the longitudinal position difference between the corresponding ATP braking protection target and the farthest expected stopping position along the train running direction is determined as the remaining safety margin at that predicted time;

[0052] Keeping the braking level and speed limit value defined by the corresponding ATP candidate control strategy unchanged, the ATP control sequence that meets the corresponding braking level and speed limit value is re-obtained under the hourly constraints of the ATP physical safety feasible set sequence; the train prediction status and platform passenger flow status at each prediction time are updated according to the re-obtained ATP control sequence, and the corresponding safe arrival time and passenger flow safe recovery time are re-determined, thereby updating the ATP braking protection target, the ATP physical safety feasible set sequence and the remaining safety margin, and the ATP control sequence is re-obtained under the hourly constraints of the updated ATP physical safety feasible set sequence for iterative iteration.

[0053] When the maximum value of the longitudinal position difference of the ATP braking protection target along the train running direction at the same prediction time in two adjacent rounds of iteration does not exceed the preset position convergence threshold, the corresponding ATP candidate control strategy is determined to meet the convergence condition; when it is impossible to re-obtain the ATP control sequence that meets the corresponding braking level and speed limit value under the time-by-time constraints of the updated ATP physical safety feasible set sequence, or when the convergence condition is not met even after reaching the preset maximum number of iterations, the corresponding ATP candidate control strategy is eliminated.

[0054] For an ATP candidate control strategy that satisfies the convergence condition, when prediction is performed based on the ATP control sequence obtained when the convergence condition is satisfied, if the remaining safety margin is not lower than the target safety margin for the first time within the preset recovery time domain and before the train reaches the station entry protection boundary, and the predicted physical state of the train is located within the corresponding ATP physical safety feasible set at each prediction time from the current control time to the prediction time, then the corresponding ATP candidate control strategy is determined to have autonomous safety recovery capability.

[0055] When at least one ATP candidate control strategy has autonomous safety recovery capability, one ATP candidate control strategy with autonomous safety recovery capability is selected, and the ATP control sequence obtained when the ATP candidate control strategy satisfies the convergence condition is executed; when the aforementioned safety recovery determination is completed for the multiple ATP candidate control strategies, and there is no ATP candidate control strategy with autonomous safety recovery capability, interlocking degradation control is triggered; wherein, the preset safety margin is higher than the preset safety threshold, the preset safety threshold is higher than the preset limit threshold, and the target safety margin is not lower than the preset safety threshold.

[0056] According to a preferred embodiment, the restoration of control authority after interlocking degradation control includes:

[0057] During the interlocking degradation control, the updated real-time train operation status, real-time train physical status, and real-time platform passenger flow status are obtained in each control cycle. Multiple ATP candidate control strategies are regenerated according to the preset control discrete accuracy. Based on the updated real-time train operation status, real-time train physical status, and real-time platform passenger flow status, the ATP control sequence is re-obtained for each ATP candidate control strategy and iterated in a loop to re-determine whether each ATP candidate control strategy has autonomous safety recovery capability.

[0058] When the number of control cycles with at least one ATP candidate control strategy having autonomous safety recovery capability reaches a preset number, one ATP candidate control strategy with autonomous safety recovery capability is selected from the current control cycle. Under the condition that the route protection constraint of the interlocking degradation control remains effective, the first control action in the ATP control sequence obtained when the selected ATP candidate control strategy meets the convergence condition is executed. In the next control cycle, based on the updated real-time train operation status, real-time train physical status, and real-time platform passenger flow status after the execution of the first control action, the ATP braking protection target and ATP physical safety feasible set are re-determined, and ATP candidate control strategies are regenerated and it is determined whether each ATP candidate control strategy has autonomous safety recovery capability. When the updated real-time train physical status is within the re-determined ATP physical safety feasible set, and at least one ATP candidate control strategy with autonomous safety recovery capability still exists in the next control cycle, the control authority is restored from interlocking degradation control to ATP safety recovery control.

[0059] During ATP safety recovery control, ATS or ATO candidate control strategies are regenerated and self-consistent capacity control solutions are obtained; when an executable self-consistent capacity control solution exists, control authority is restored from ATP safety recovery control to ATS or ATO capacity recovery control.

[0060] During ATS or ATO capacity recovery control, when the operational deviation is not greater than the preset deviation threshold, the real-time status point is within the ATP safety mapping domain, and the remaining safety margin is not less than the preset safety margin, the scheduled operation is resumed.

[0061] This invention provides a dynamic capacity matching and train operation control system for urban rail transit, comprising:

[0062] The fixed-running-domain construction module is used to train an autoencoder based on the joint state parameters of vehicles and passengers under historical congestion-free conditions, and to construct the fixed-running-domain using the encoder in the autoencoder.

[0063] The time safety determination module is used to determine the safe recovery time and safe arrival time of passenger flow based on the real-time train operation status, braking system status and passenger flow status near the track; if the safe arrival time is less than the sum of the safe recovery time of passenger flow and the preset time margin, the virtual protection point is inverted through the ATP braking model.

[0064] The safety domain construction and state mapping module is used to determine the ATP braking protection target based on the time comparison result and the virtual protection point inversion result, determine the ATP physical safety feasible set with the ATP braking protection target as the braking stopping boundary, and map the state vector corresponding to the ATP physical safety feasible set through the encoder to form the ATP safety mapping domain; and map the real-time vehicle and passenger joint state parameters into real-time state points through the encoder.

[0065] The control zone determination module is used to determine the planned operating zone, ATS or ATO capacity recovery zone, or ATP clearance approach zone based on the train's remaining safety margin relative to the ATP braking protection target, the operating deviation of the real-time status point relative to the scheduled operating domain, and the positional relationship of the real-time status point relative to the ATP safety mapping domain. The operating deviation is determined based on the spatial distance relationship between the real-time status point and the scheduled operating domain. The train's remaining safety margin relative to the ATP braking protection target is determined through the real-time train operating status and braking system status.

[0066] The ATS or ATO capacity recovery control module is used to generate candidate control strategies within the ATS or ATO capacity recovery zone while keeping their control objectives unchanged. It obtains the control sequence under the constraints of the ATP physical safety feasible set, and updates the passenger flow safety recovery time, ATP braking protection objectives, and ATP physical safety feasible set based on the control sequence to predict train operation and passenger flow changes. It iteratively re-obtains the control sequence to obtain an executable self-consistent capacity control solution.

[0067] The ATP safety recovery control module is used to switch to ATP safety recovery control when there is no executable self-consistent capacity control solution in the ATP limit approach region or the ATS or ATO capacity recovery region. It performs safety recovery judgment on each ATP candidate control strategy covering the ATP allowable control range. When none of the ATP candidate control strategies can form a recovery trajectory that satisfies the corresponding ATP physical safety feasible set constraints and reaches the target safety margin in the preset recovery time domain, it triggers interlocking degradation control.

[0068] The present invention has the following beneficial effects:

[0069] 1. This invention links the safe recovery state of platform passenger flow with the train's ATP braking protection process, enabling the train operation protection boundary to be dynamically adjusted according to changes in passenger flow risk, thereby improving the safety adaptability of train entry control under sudden passenger flow conditions.

[0070] 2. This invention determines the control area by coordinating the fixed operating domain, ATP safety mapping domain, and remaining safety margin, and the ATS or ATO performs self-consistent capacity recovery under the physical safety constraints of ATP, thereby improving the coordination between capacity adjustment and train safety control.

[0071] 3. When the ATS or ATO capacity recovery control cannot form an executable self-consistent capacity control solution, this invention gradually switches to ATP safety recovery control and interlocking degradation control. It avoids premature triggering of interlocking degradation by determining the coverage of candidate control strategies within the ATP's allowable control range. During the recovery process after interlocking degradation, the control authority is restored step by step through continuous control cycle confirmation, execution of the first control action of ATP under interlocking route protection constraints, and re-verification based on the updated real state. This reduces the safety risk of directly restoring control authority due to a single prediction result, which is beneficial to improving the safety redundancy capability and operational continuity of the train control system. Attached Figure Description

[0072] Figure 1 A structural block diagram of a dynamic capacity matching and train operation control system for urban rail transit is provided as an exemplary embodiment.

[0073] Figure 2 A flowchart of a dynamic capacity matching and train control method for urban rail transit is provided as an exemplary embodiment. Detailed Implementation

[0074] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention.

[0075] The terminology used in this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention.

[0076] It should be understood that although the terms first, second, third, etc., may be used in this invention to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first information may also be referred to as second information without departing from the scope of this invention, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0077] In one embodiment, the present invention is applied to urban rail transit lines equipped with an Automatic Train Monitoring System (ATS), an Automatic Train Operation System (ATO), an Automatic Train Protection System (ATP), and an interlocking system.

[0078] The ATS is used for operation plan adjustment and capacity recovery control; the ATO is used to execute corresponding train operation control; the ATP is used to implement speed monitoring and braking protection based on train operation status, movement authorization, line operation constraints and train braking capacity; and the interlocking system is used to execute route establishment, route locking, hostile route protection and corresponding route-level safety control.

[0079] For ease of explanation, in this application, the passenger flow status near the rail refers to the passenger flow status corresponding to the area near the rail on the platform, including the passenger flow density, passenger flow inflow rate, passenger spatial distribution, and relevant passenger flow status parameters used for predicting the safe recovery of passenger flow.

[0080] The platform entry protection boundary refers to the longitudinal boundary located on the entry side of the target platform along the train's direction of travel, used to determine the safe arrival status of the train before entering the target platform area. Its specific location is determined based on the signaling system and platform protection configuration of the target line.

[0081] ATP operational constraints include current movement authorization, route operational constraints, and ATP braking constraints.

[0082] Freezing ATS or ATO capacity recovery control means suspending the ATS or ATO from continuing to generate or execute adjustment control commands for capacity recovery, and does not mean stopping the ATS or ATO's status monitoring, information interaction and other non-capacity recovery functions.

[0083] Interlocking downgrade control refers to the process where, when the ATP (Automatic Train Protection) system is unable to establish an autonomous and safe recovery trajectory, the train operation is switched to a downgraded operating state with route locking, hostile route protection, and corresponding downgraded train operation permits provided by the interlocking system as the main safety constraints. It does not mean that the interlocking system directly generates continuous traction or continuous braking control commands for the train.

[0084] Covering the ATP's permissible control range means, under a preset control discrete precision, fully enumerating all braking levels and all discrete velocity limit combinations that the current ATP is allowed to use, without requiring the generation of candidate control strategies for each real velocity limit value within the continuous velocity limit range.

[0085] The ATP braking protection target refers to the protection position used to form the ATP physical safety feasible set at the current moment.

[0086] The basic braking protection target refers to the original ATP protection target determined by the current movement authorization, line operation constraints, and ATP braking constraints.

[0087] Virtual protection points refer to the virtual spatial locations used to delay the arrival of trains at the platform and serve as protection boundaries, obtained by inverting candidate parking locations under time conflict conditions.

[0088] The ATP physical safety feasible set refers to the set of train physical states that can safely stop, defined by the ATP braking model and with the current ATP braking protection target as the boundary.

[0089] The ATP safety mapping domain refers to the safe region formed in the low-dimensional state space after the ATP physically safe feasible set is mapped by the same encoder and used for control region determination.

[0090] Operational deviation refers to the degree of deviation of a real-time state point from the low-dimensional space of the defined operational domain boundary.

[0091] The remaining safety margin refers to the directional longitudinal position difference between the ATP braking protection target and the farthest expected stopping position, defined along the direction of train operation.

[0092] The ATS or ATO capacity recovery zone indicates a control area where capacity recovery control is permitted, but the region has not yet entered the ATP limit approach state.

[0093] ATP safe recovery control refers to the control process of autonomous safe recovery based on candidate control strategies within the ATP-permissible control range.

[0094] See Figure 1 The urban rail transit dynamic capacity matching and train operation control system of the present invention may include:

[0095] The fixed-route construction module is used to train an autoencoder based on the joint state parameters of vehicles and passengers under historical congestion-free conditions, and to construct the fixed-route.

[0096] The time safety determination module is used to determine the safe recovery time and safe arrival time of passenger flow based on the real-time train operation status, braking system status and passenger flow status near the track; if the safe arrival time is less than the sum of the safe recovery time of passenger flow and the preset time margin, the virtual protection point is inverted through the ATP braking model.

[0097] The safety domain construction and state mapping module is used to determine the ATP braking protection target based on the time comparison results, thereby determining the ATP physical safety feasible set and mapping it to form the ATP safety mapping domain; and to map the real-time vehicle and passenger joint state parameters into real-time state points through the encoder.

[0098] The control zone determination module is used to determine the map-based operating zone, ATS or ATO capacity recovery zone or ATP limit approach zone based on the operating deviation of the real-time status point relative to the map-defined operating zone, the positional relationship relative to the ATP safety mapping zone, and the remaining safety margin.

[0099] The ATS or ATO capacity recovery control module is used to generate candidate control strategies within the ATS or ATO capacity recovery zone while keeping their control objectives unchanged. It obtains the control sequence under the constraints of the ATP physical safety feasible set, and updates the passenger flow safety recovery time, ATP braking protection objectives, and ATP physical safety feasible set based on the control sequence to predict train operation and passenger flow changes. It iteratively re-obtains the control sequence to obtain an executable self-consistent capacity control solution.

[0100] The ATP safety recovery control module is used to switch to ATP safety recovery control when there is no executable self-consistent capacity control solution in the ATP limit approach region or the ATS or ATO capacity recovery region. It performs safety recovery judgment on each ATP candidate control strategy covering the ATP allowable control range. When none of the ATP candidate control strategies can form a recovery trajectory that satisfies the corresponding ATP physical safety feasible set constraints and reaches the target safety margin in the preset recovery time domain, it triggers interlocking degradation control.

[0101] See Figure 2 The urban rail transit dynamic capacity matching and train operation control method of the present invention may include:

[0102] S1. Train an autoencoder based on the joint state parameters of vehicles and passengers under historical congestion-free conditions, and use the encoder in the autoencoder to construct a graphical operating domain in a low-dimensional state space.

[0103] Specifically, the vehicle and passenger joint status parameters under historical congestion-free conditions are obtained. The historical congestion-free conditions can be selected from the historical operating cycles in which the target line is in a normal transportation organization state, there is no obvious passenger flow gathering at the platform, and no abnormal temporary speed limit or emergency train control is triggered due to sudden events.

[0104] Combined train and passenger status parameters include train operation status parameters and platform passenger flow status parameters.

[0105] Train operation status parameters can be obtained from ATS historical operation records, ATO operation logs, train positioning equipment, and speed measuring equipment. These parameters include at least train position and train speed, and at least one of the following: station dwell time and interval travel time.

[0106] Platform passenger flow status parameters can be obtained by platform video analysis equipment, passenger flow detection equipment or other platform passenger flow sensing devices, including at least one or more of the following: platform rail area passenger flow density, passenger flow inflow rate and passenger spatial distribution.

[0107] The train operation status parameters and platform passenger flow status parameters under historical congestion-free conditions are used to construct the training input vector according to preset feature dimensions, fixed arrangement order, and preset normalization rules. When different data sources have different sampling periods, time alignment can be performed according to a unified control period. For data with a sampling period shorter than the control period, the average value, final value, or filtered representative value within the corresponding control period can be used; for data with a sampling period longer than the control period, data at the corresponding control time can be obtained by holding or interpolation.

[0108] In one implementation, the autoencoder includes an input layer, at least one encoding hidden layer, a low-dimensional encoding layer, at least one decoding hidden layer, and an output layer. The number of nodes in the input layer is the same as the dimension of the training input vector, and the number of nodes in the low-dimensional encoding layer is less than the dimension of the training input vector. The decoder is used to reconstruct the training input vector based on the output of the low-dimensional encoding layer. Historical uncongested samples are divided into a training set and a validation set. The reconstruction error between the training input vector and the decoder's reconstructed vector is used as the training loss, and the network parameters of the encoder and decoder are updated through backpropagation. Training stops when the reconstruction error corresponding to the validation set is lower than a preset reconstruction error threshold, or when the decrease in the validation set reconstruction error within a preset number of consecutive training rounds does not exceed a preset training convergence threshold, and the corresponding encoder is retained.

[0109] In one implementation, the training input vector may include state features such as train position, train speed, station dwell time, interval travel time, passenger flow density in the platform rail area, passenger flow inflow rate, and passenger spatial distribution. For a training input vector containing the above state features, an input layer of corresponding dimensions can be set according to the actual number of features, and at least one encoding hidden layer and a low-dimensional encoding layer can be set to map the joint state formed by the train operation state and the platform passenger flow state to a low-dimensional state space.

[0110] The specific number, combination, and low-dimensional coding layer dimensions of the aforementioned state features do not constitute a limitation of this invention. The feature dimensions of the training input vector should correspond to the actual train operation state parameters and platform passenger flow state parameters used, and maintain the same feature dimensions, arrangement order, and normalization rules during historical training, real-time state mapping, and ATP safety state mapping.

[0111] The structure described is only one implementation method. The dimensions of the low-dimensional encoding layer and the number of hidden layer nodes can be set according to the actual number of input parameters, the size of historical samples, and the reconstruction error requirements. The purpose of using an autoencoder in this application is to learn the joint state representation between train operation parameters and platform passenger flow parameters under normal operating conditions, rather than directly generating train control commands using the autoencoder. After training, the training input vector corresponding to historical congestion-free operating conditions is input into the encoder to obtain multiple historical low-dimensional state points.

[0112] In one implementation, kernel density estimation is performed on historical low-dimensional state points, a closed region is formed according to a preset historical normal state coverage ratio, and the closed region that can cover the historical low-dimensional state points of the preset ratio is determined as the map-defined operating domain.

[0113] In other implementations, a graphical operating domain can be formed using statistical envelopes, preset quantile boundaries, or other methods capable of characterizing the distribution range of historical normal operating states. During real-time operation, the real-time vehicle-passenger joint state parameters are used to construct a real-time input vector according to the same feature dimensions, arrangement order, and normalization rules as the training input vector, and then mapped to real-time state points using the same encoder. This allows historical normal operating states, real-time operating states, and subsequent ATP safety states to be characterized in a unified low-dimensional state space. The real-time vehicle-passenger joint state parameters include real-time train operating state parameters and real-time platform passenger flow state parameters.

[0114] S2. Determine the safe recovery time of passenger flow and the safe arrival time to the platform entrance protection boundary based on the real-time train operation status, braking system status and passenger flow status near the track; when the safe arrival time is less than the sum of the safe recovery time of passenger flow and the preset time margin, the virtual protection point is inverted through the ATP braking model.

[0115] Specifically, the real-time physical state of the train and its safe arrival time are first determined. The air spring pressure of each vehicle is acquired in real time, and the real-time load of each vehicle is determined based on a preset calibration relationship between the air spring pressure and the vehicle load. This preset calibration relationship can be established in advance through air spring pressure calibration tests under different vehicle load conditions and stored in the train control equipment or corresponding data processing device. The real-time equivalent mass of the train is determined based on the real-time load of each vehicle, the self-weight of each vehicle, the vehicle formation relationship, and a preset slewing mass conversion factor.

[0116] Further, based on the status of the braking system, determine the currently available braking units and the braking force they can provide, and combine this with the real-time equivalent mass of the train to determine the effective braking deceleration.

[0117] In one implementation, the effective braking deceleration can be further modified by incorporating track gradient, current adhesion conditions, and braking setup time. The real-time train physical state is formed by train position, train speed, real-time equivalent mass, and effective braking deceleration. The shortest travel time from the current control moment to the platform entry protection boundary under ATP operating constraints is determined using the ATP braking model and is taken as the safe arrival time. This safe arrival time differs from the planned arrival time specified in the timetable; it represents the shortest physically achievable time for the train to reach the platform entry protection boundary under the current train physical state and ATP operating constraints.

[0118] Furthermore, determine the safe recovery time of passenger flow. Obtain passenger density in the platform's track-adjacent area, the distance distribution of passengers relative to the platform edge, passenger inflow rate, and passenger evacuation rate to the preset safe area.

[0119] In one implementation, the platform's track-adjacent area is divided into multiple passenger flow space units.

[0120] For any passenger flow space unit, the number of passengers at the next predicted time is determined based on the number of passengers in that passenger flow space unit at the current predicted time, the number of passengers entering that passenger flow space unit within the predicted time interval, and the number of passengers leaving that passenger flow space unit within the predicted time interval. The number of passengers entering is determined based on the passenger flow inflow rate combined with the predicted time interval, and the number of passengers leaving is determined based on the passenger flow transfer rate to adjacent space units and the passenger flow evacuation rate to the preset safe area combined with the predicted time interval. The passenger flow status of each passenger flow space unit is updated hourly accordingly.

[0121] When the forecasting process involves train arrivals, stops, or door openings, the inflow and outflow volumes of the corresponding passenger flow units are adjusted based on the door location, the predicted number of passengers boarding and alighting, and the door throughput capacity per unit time. This determines the future passenger flow density, inflow rate, and spatial distribution in the platform's track-adjacent area hourly. Preset passenger flow safety conditions include at least a passenger flow density in the platform's track-adjacent area that is lower than a preset safety density; further, it may also include a passenger number or proportion within a preset distance from the platform edge that is lower than a preset safety level.

[0122] The passenger flow evolution is predicted from the current control time, and the time required for the platform's adjacent track area to first meet the preset passenger flow safety conditions is determined as the passenger flow safety recovery time. When the safe arrival time is not less than the sum of the passenger flow safety recovery time and the preset time margin, it indicates that, according to the current ATP operation constraints, the platform's adjacent track area can complete passenger flow safety recovery before the train reaches the platform's entry protection boundary.

[0123] At this point, the braking protection target determined by the ATP system based on the current movement authorization, line operation constraints, and ATP braking constraints is taken as the basic braking protection target, and the basic braking protection target is taken as the ATP braking protection target.

[0124] When the safe arrival time is less than the sum of the passenger flow safe recovery time and the preset time margin, multiple candidate stopping positions are determined within the braking range determined based on the real-time physical state of the train, and the estimated arrival time of the train after braking and stopping at the corresponding candidate stopping position and restarting to the platform entry protection boundary is determined.

[0125] Under normal circumstances, at least one candidate parking location can be identified from the candidate parking locations whose estimated arrival time is not less than the sum of the passenger flow safety recovery time and the preset time margin. The candidate parking location with the shortest estimated arrival time is then selected as the virtual protection point. This virtual protection point is used to transform the time constraint required for passenger flow safety recovery into an ATP braking protection location constraint, and serves as the target for subsequent ATP braking protection.

[0126] It should be noted that under certain abnormal operating conditions, the range of possible braking stops, jointly limited by the current train position, train speed, effective braking deceleration, line operation constraints, and current movement authorization, may not exist for candidate stopping positions whose expected arrival time meets the above time conditions. In this case, the range of candidate stopping positions will not be expanded, nor will virtual protection points be constructed by artificially increasing the stopping time. Instead, it will be determined that no feasible virtual protection point exists under the current condition.

[0127] When no feasible virtual protection point exists, the current time conflict cannot be eliminated by setting a virtual protection point within the current braking range. Therefore, the ATP braking protection target corresponding to the current state is maintained as the basic braking protection target determined based on the current movement authorization, line operation constraints, and ATP braking constraints, and the process directly enters the ATP safety constraint processing. At this time, the ATP physical safety feasible set is still constructed using the basic braking protection target as the braking and stopping boundary, and the safety domain construction and control area determination in S3 continue to be executed. Based on the control area determination result, the corresponding control process is entered.

[0128] The above-mentioned abnormal branches are only used to handle the case where there is no feasible virtual protection point under the current braking capacity and operating constraints. They do not change the normal processing flow of inverting the virtual protection point through the ATP braking model when there are feasible candidate parking positions.

[0129] Therefore, the virtual protection point inversion process has clear normal and abnormal exits: when there is a candidate parking position that meets the time conditions, a virtual protection point is generated and used as the ATP braking protection target; when there is no candidate parking position that meets the conditions, the invalid search is not continued, and the process switches to ATP safety processing based on the basic braking protection target, thereby avoiding the interruption of the control flow due to the inability to generate a virtual protection point.

[0130] S3. Based on the time comparison results and the virtual protection point inversion results, determine the ATP braking protection target. Using the ATP braking protection target as the braking stopping boundary, determine the ATP physical safety feasible set. Map the state vector corresponding to the ATP physical safety feasible set through the encoder to form the ATP safety mapping domain. Map the real-time vehicle and passenger joint state parameters through the encoder to real-time state points. Determine the scheduled operating area, ATS or ATO capacity recovery area, or ATP clearance approach area based on the train's remaining safety margin relative to the ATP braking protection target, the operating deviation of the real-time state point relative to the scheduled operating area, and the positional relationship of the real-time state point relative to the ATP safety mapping domain. The operating deviation is determined based on the spatial distance relationship between the real-time state point and the scheduled operating area. The train's remaining safety margin relative to the ATP braking protection target is determined through the real-time train operating status and braking system status.

[0131] Specifically, when the safe arrival time is less than the sum of the passenger flow safe recovery time and the preset time margin, and there is a feasible virtual protection point, the virtual protection point determined by S2 is used as the ATP braking protection target; when the safe arrival time is not less than the sum of the passenger flow safe recovery time and the preset time margin, or there is no feasible virtual protection point, the basic braking protection target is used as the ATP braking protection target.

[0132] The ATP braking protection target is used as the braking and stopping boundary. Under the conditions of real-time equivalent mass and effective braking deceleration of the train, with the train position and speed as state variables, the ATP braking model is used to determine whether the train can stop without exceeding the ATP braking protection target after braking in physical states corresponding to different position and speed combinations. The train physical states that meet the above conditions form the ATP physically safe feasible set. The train physical states located on the boundary of the ATP physically safe feasible set are designated as critical train physical states; the train physical states located inside the ATP physically safe feasible set indicate that they have a larger physical braking safety margin relative to the current ATP braking protection target.

[0133] Furthermore, multiple critical train physical states are extracted from the boundary of the ATP physically safe feasible set, and multiple sampled train physical states are extracted from inside the ATP physically safe feasible set.

[0134] For each critical train physical state, the corresponding train position and speed in the current real-time input vector are replaced with the train position and speed in the corresponding state, while keeping the other feature dimensions in the real-time input vector unchanged, thus forming a critical state vector. The same method is used to form internally sampled train physical states. These state vectors are then processed according to the same normalization rule as the S1 training input vector and input into the same encoder to form critical mapping points and internal mapping points, respectively.

[0135] It should be noted that different features in the real-time input vector play different roles in the ATP safety mapping construction process. Features such as station dwell time, interval travel time, and platform passenger flow status characterize the current train's operating and passenger flow context. Train position and speed characterize the core physical state of the train under the current operating context and serve as the main variables for state changes when constructing the ATP physical safety boundary mapping samples. Simultaneously, the train's real-time equivalent mass and effective braking deceleration used to construct the current ATP physical safety feasible set characterize the current train's actual load and braking capacity conditions, and their values ​​remain unchanged during this ATP physical safety boundary construction and mapping process, corresponding to the current real-time state. Therefore, while maintaining consistency with the current operating context and braking capacity conditions, only the train position and speed are changed to encode and map the critical train physical states and internally sampled train physical states in the ATP physical safety feasible set, so that the resulting ATP safety mapping domain reflects the ATP physical safety boundary relationships corresponding to different train positions and speeds under the current operating context and braking capacity conditions.

[0136] By adopting the above method, when the ATP physical safety state enters the low-dimensional state space, only the train position and train speed directly related to the ATP physical safety feasible set are changed, while the current passenger flow state and other train operation characteristics remain unchanged.

[0137] In one implementation, a radial basis function is used to establish an implicit ATP safety bound function.

[0138] Each critical mapping point is used as a boundary constraint sample, and the internal mapping points corresponding to the sampled states within the ATP physical safety feasible set are used as safety-side constraint samples. Based on the coordinates of the critical and internal mapping points in the low-dimensional state space, the parameters and weights of the radial basis functions are solved, making the function values ​​corresponding to the critical mapping points approach the preset boundary values ​​and ensuring that the internal mapping points are located on the same safety side. The boundary contour lines or contour surfaces corresponding to the implicit ATP safety bounding function are determined as the ATP safety bounds, and the connected region defined by the ATP safety bounds and containing the internal mapping points is determined as the ATP safety mapping domain.

[0139] When multiple mutually separate closed regions are formed, the closed region containing the corresponding internal mapping point is determined as the effective ATP safety mapping region; when multiple connected regions each containing internal mapping points exist, they can collectively serve as components of the current ATP safety mapping domain. Therefore, the ATP physical safety feasible set and the ATP safety mapping domain have different technical functions.

[0140] The ATP (Action-Proof) physical feasible set is used to constrain the actual or predicted physical state and control sequence of the train; the ATP safe mapping domain is used to determine the control zone in the low-dimensional state space. Further, the operational deviation is determined. When the real-time state point is located inside the designated operational domain, the operational deviation is zero; when the real-time state point is located outside the designated operational domain, the operational deviation is determined based on the minimum distance from the real-time state point to the boundary of the designated operational domain.

[0141] The remaining safety margin is used to characterize the longitudinal safety margin of the current train's physical state relative to the ATP braking protection target under the current ATP braking constraints. It is a directional longitudinal position difference defined along the train's running direction, rather than an absolute distance that does not distinguish between directions.

[0142] Specifically, taking the train's direction of travel as the positive longitudinal direction, the farthest expected stopping position of the train along the direction of travel and the ATP braking protection target are projected onto the same longitudinal position coordinate system of the line, and the remaining safety margin is determined based on their positional relationship in this coordinate system. When the ATP braking protection target is ahead of the farthest expected stopping position, the remaining safety margin is positive, indicating that the train is expected to stop before reaching the ATP braking protection target according to the current braking constraints; when the farthest expected stopping position coincides with the ATP braking protection target, the remaining safety margin is zero; when the farthest expected stopping position exceeds the ATP braking protection target, the remaining safety margin is negative, indicating that the train cannot stop before reaching the ATP braking protection target according to the current braking constraints.

[0143] Therefore, the magnitude and direction of the remaining safety margin simultaneously reflect the physical safety status of the train relative to the ATP braking protection target. In subsequent control zone determination, ATS or ATO capacity recovery control, and ATP safety recovery control processes, the aforementioned directional longitudinal position difference is used as the remaining safety margin, instead of employing the low-dimensional spatial distance between the real-time state point and the ATP safety mapping domain boundary.

[0144] The remaining safety margin is maintained as the longitudinal position difference in physical space, and is not replaced by the low-dimensional distance from the real-time state point to the boundary of the ATP safety mapping domain. When the operational deviation is not greater than the preset map deviation threshold, the real-time state point is located inside the ATP safety mapping domain, and the remaining safety margin is not less than the preset map safety margin, the initial control area is determined as the map-based operation area.

[0145] When the conditions for determining the operating zone according to the diagram are not met, the real-time status point is located inside the ATP safety mapping domain, and the remaining safety margin is higher than the preset limit threshold, the initial control zone is determined to be the ATS or ATO capacity recovery zone.

[0146] When the real-time state point is located at or outside the boundary of the ATP safety mapping domain, or when the remaining safety margin is not higher than the preset limit threshold, the initial control region is determined as the ATP limit approximation region. The preset safety margin is higher than the preset limit threshold.

[0147] Therefore, the degree of deviation from the normal scheduled operation, the current low-dimensional ATP safety position relationship, and the actual physical braking safety margin are all used to determine the current control zone of the train.

[0148] S4. Generate candidate control strategies within the ATS or ATO capacity recovery zone and keep the control objectives of each candidate control strategy unchanged. Obtain the control sequence under the constraints of the ATP physical safety feasible set. Predict train operation and passenger flow changes based on the control sequence. Update the passenger flow safety recovery time, ATP braking protection objective and ATP physical safety feasible set. Iterate and re-obtain the control sequence to obtain an executable self-consistent capacity control solution.

[0149] Specifically, multiple candidate control strategies are generated, and at least one control objective is set for each candidate control strategy, including arrival time adjustment objective, dwell time adjustment objective, and ATO operation control objective.

[0150] For the same candidate control strategy, the control objective set by the candidate control strategy remains unchanged in subsequent iterations. For each candidate control strategy, the control sequence is obtained under the constraints of the current ATP physically safe feasible set.

[0151] In one implementation, the control sequence is obtained using a finite predictive time-domain model predictive control method. Train position, train speed, and train operating state related to the candidate control strategy are used as predicted states, and one or more of traction, coasting, braking, or target speed commands are used as control variables.

[0152] Based on the longitudinal dynamics of the train, the train position and speed are recursively calculated at each predicted time point within the predicted time domain. The equivalent mass and effective braking deceleration of the train at the corresponding predicted time point are determined by combining the predicted load changes and the braking system status.

[0153] The current ATP physically safe and feasible set or the subsequently formed ATP physically safe and feasible set sequence is used as a safety constraint in the process of solving the control sequence.

[0154] Based on the arrival time adjustment target, stop time adjustment target, or ATO operation control target set by the candidate control strategy, establish the control objective function, and obtain the control sequence in the prediction time domain under the conditions of satisfying ATP physical safety constraints, line operation constraints, and train traction and braking capacity constraints.

[0155] The model predictive control method described above is only one implementation method for obtaining the control sequence. Other train operation optimization methods with the same state recursion and constraint optimization functions can also be used.

[0156] The train prediction state is generated at each prediction time within the preset prediction time domain based on the obtained control sequence. The train prediction state includes the train prediction operation state and the train prediction physical state. The train prediction physical state includes at least the train position, train speed, train equivalent mass, and effective braking deceleration at each prediction time. Combining the current platform passenger flow state with the train arrival, train stop, and door opening processes corresponding to the train prediction operation state, the platform passenger flow state at each prediction time is predicted.

[0157] Therefore, different candidate control strategies will not only change the future train trajectory, but also alter the future passenger flow evolution through the arrival, stopping, and door opening processes.

[0158] For each predicted time before the train arrives at the platform and enters the station protection boundary within the preset prediction time domain, the safe arrival time is re-determined based on the corresponding predicted physical state of the train, and the safe passenger flow recovery time is re-determined based on the corresponding platform passenger flow status.

[0159] When the safe arrival time at the corresponding predicted time is less than the sum of the safe passenger flow recovery time and the preset time margin, and there is a feasible virtual protection point, the corresponding virtual protection point will be used as the ATP braking protection target.

[0160] Otherwise, the basic braking protection target is redefined based on the movement authorization, line operation constraints, and ATP braking constraints at the predicted time, and the basic braking protection target is used as the ATP braking protection target.

[0161] Based on the ATP braking protection targets determined at each prediction time, and the equivalent mass and effective braking deceleration of the train in the corresponding predicted physical state, the ATP physical safety feasible sets for each prediction time are formed using the train position and speed as state variables through the ATP braking model. The ATP physical safety feasible sets corresponding to each prediction time are then arranged in chronological order to form an ATP physical safety feasible set sequence.

[0162] Furthermore, the farthest predicted stopping position of the train along the direction of travel is determined based on the predicted physical state of the train at the corresponding predicted time and the ATP braking constraints. The ATP braking protection target and the farthest predicted stopping position at the corresponding predicted time are respectively transformed to a unified longitudinal position coordinate system of the line, and the directional longitudinal position difference between the two is determined according to the direction of train travel. This longitudinal position difference is determined as the remaining safety margin at the corresponding predicted time.

[0163] The remaining safety margin is positive when the ATP braking protection target at the predicted time is ahead of the farthest predicted stopping position in the direction of travel; it is zero when the two positions coincide; and it is negative when the farthest predicted stopping position exceeds the ATP braking protection target. Therefore, the remaining safety margin directly characterizes the remaining physical safety space relative to the ATP braking protection target when the train brakes according to the corresponding ATP braking constraints at the predicted time.

[0164] In subsequent iterative cycles, for different prediction times, the remaining safety margin is re-determined according to the ATP braking protection target and the farthest expected stopping position re-determined at the corresponding prediction time, so that the remaining safety margin is updated synchronously with the changes in the predicted train operating status, train braking capacity and ATP braking protection target.

[0165] It should be noted that the ATP physically safe feasible set sequence is not a safety constraint that is given in advance and remains unchanged before the ATS or ATO candidate control strategies are generated.

[0166] The candidate control strategy first alters the future train operation state, further changing the train's arrival, stopping, and door opening processes. This train operation process alters the future platform passenger flow state; the future platform passenger flow state changes the passenger flow safety recovery time; and the passenger flow safety recovery time further affects the virtual protection point and the ATP braking protection target, thereby changing the future ATP physical safety feasible set. Therefore, the candidate control strategy itself, in turn, changes the ATP safety boundary that constrains its future execution process.

[0167] After the first round of ATP physically safe feasible set sequence is formed, the control objective set by the corresponding candidate control strategy remains unchanged. Only the updated ATP physically safe feasible set sequence is used to replace the safety constraints of the previous round, and a new control sequence is obtained again.

[0168] Based on the newly obtained control sequence, the train status and platform passenger flow status are predicted again, and the ATP braking protection target, ATP physical safety feasible set sequence, and remaining safety margin are redefined for each prediction time. This process is repeated cyclically. Therefore, what remains constant during the cyclic process is the upper-level control target of the candidate control strategy, rather than the lower-level control sequence obtained in the previous round.

[0169] Further determine whether each candidate control strategy has converged. Determine the train arrival time based on the predicted train running status obtained from two adjacent iterations. When the difference in train arrival time between two adjacent iterations does not exceed a preset time convergence threshold, and the maximum value of the longitudinal position difference of the ATP braking protection target along the train running direction at each corresponding predicted time in two adjacent iterations does not exceed a preset position convergence threshold, the corresponding candidate control strategy is determined to meet the convergence condition.

[0170] If the control sequence that achieves the control objective set by the corresponding candidate control strategy cannot be obtained again under the time-by-time constraints of the updated ATP physically safe feasible set sequence, or if the convergence condition is not met even after reaching the preset maximum number of iterations, the corresponding candidate control strategy is eliminated.

[0171] For a candidate control strategy that meets the convergence condition, when the predicted physical state of the train at each predicted time before the train arrives at the platform entry protection boundary in the final round of iteration is located within the ATP physical safety feasible set at the corresponding predicted time, and the minimum value of the remaining safety margin at each predicted time is not lower than the preset safety threshold, the control sequence obtained when the convergence condition is met, along with its corresponding predicted train state, platform passenger flow state, and ATP physical safety feasible set sequence, are jointly determined as the self-consistent capacity control solution.

[0172] The predicted train operation status and platform passenger flow status corresponding to the self-consistent capacity control solution in the predicted time domain are generated by an encoder according to the same input and mapping rules as the real-time status points, and the predicted operation deviation is determined according to the position of the predicted status points relative to the fixed operation domain.

[0173] If the current operational deviation exceeds the preset deviation threshold, the predicted operational deviation must be less than the current operational deviation. If the current remaining safety margin is lower than the preset safety margin, the remaining safety margin at least one predicted moment before the train reaches the station's entry protection boundary must be greater than the current remaining safety margin. If both excessive operational deviation and insufficient remaining safety margin exist simultaneously, both conditions must be met. A self-consistent capacity control solution that meets these conditions is determined as an executable self-consistent capacity control solution.

[0174] When there is at least one executable self-consistent capacity control solution, the target candidate control strategy is determined based on the predicted operating deviation and the remaining safety margin at each prediction time corresponding to each executable self-consistent capacity control solution.

[0175] In one implementation, candidate solutions with larger minimum remaining safety margins during the prediction process can be prioritized, and then solutions with smaller deviations from the predicted operation can be selected from candidate solutions with similar safety margins. If no executable self-consistent capacity control solution exists, control authority is transferred from ATS or ATO capacity recovery control to ATP safety recovery control.

[0176] S5. When the train is in the ATP limit approach zone, or when there is no executable self-consistent capacity control solution in the ATS or ATO capacity recovery zone, freeze the ATS or ATO capacity recovery control and start the ATP safety recovery control; generate multiple ATP candidate control strategies covering the ATP allowable control range, and keep the control conditions defined by each ATP candidate control strategy unchanged; obtain the ATP control sequence for each ATP candidate control strategy, and predict train operation and passenger flow changes based on the ATP control sequence; update the passenger flow safety recovery time, ATP braking protection target, and ATP physical safety feasible set, and iteratively re-obtain the ATP control sequence; when all ATP candidate control strategies cannot form a recovery trajectory that satisfies the corresponding ATP physical safety feasible set constraints and reaches the target safety margin within the preset recovery time domain, trigger the interlocking degradation control.

[0177] Specifically, after entering ATP safety recovery control, freeze ATS or ATO capacity recovery control.

[0178] The allowed rate limits for ATP are discretized according to a preset control discretization precision. Each discrete rate limit is then combined with the currently allowed braking levels of ATP to generate multiple ATP candidate control strategies. These multiple ATP candidate control strategies collectively cover the control range currently allowed for ATP under the preset control discretization precision.

[0179] For each ATP candidate control strategy, the braking level and rate limit value corresponding to the ATP candidate control strategy are used as control constraints to obtain the ATP control sequence under the constraints of the current ATP physically safe feasible set.

[0180] The ATP control sequence can be obtained using the same predictive state recursion and constraint optimization framework as S4, but its control objective changes from energy recovery to safety recovery, and the braking level and rate limit value defined by the corresponding ATP candidate control strategy remain unchanged during the cyclic iteration of the candidate strategy.

[0181] The ATP control sequence generates the predicted train status for each predicted moment within the preset recovery time domain. This is combined with the current platform passenger flow status and the predicted train operation status, including train arrival, stopping, and door opening processes, to predict the platform passenger flow status for each predicted moment. For each predicted moment before the train reaches the platform's entry protection boundary, the corresponding safe arrival time and passenger flow safe recovery time are redefined. If the safe arrival time is less than the sum of the passenger flow safe recovery time and the preset time margin, and a feasible virtual protection point exists, the corresponding virtual protection point is used as the ATP braking protection target; otherwise, the basic braking protection target is redefined.

[0182] Based on the ATP braking protection target at each predicted time, the equivalent mass of the train in the predicted physical state of the corresponding train, and the effective braking deceleration, an ATP physically safe feasible set is formed, and an ATP physically safe feasible set sequence is formed according to the predicted time.

[0183] Simultaneously, the remaining safety margin corresponding to each predicted time is determined. Keeping the braking level and speed limit values ​​defined by the corresponding ATP candidate control strategy unchanged, the ATP control sequence that meets the control conditions is re-obtained under the hourly constraints of the updated ATP physical safety feasible set sequence. Based on the re-obtained ATP control sequence, the train prediction status and platform passenger flow status at each predicted time are updated, and the safe arrival time, passenger flow safe recovery time, ATP braking protection target, ATP physical safety feasible set sequence, and remaining safety margin are re-determined. The ATP control sequence is then re-obtained, thus forming a cyclical iteration.

[0184] When the maximum longitudinal position difference of the ATP braking protection target along the train running direction at the same prediction time in two adjacent cycle iterations does not exceed the preset position convergence threshold, the corresponding ATP candidate control strategy is determined to meet the convergence condition.

[0185] If an ATP control sequence that meets the corresponding braking level and rate limit value cannot be obtained again under the time-by-time constraints of the updated ATP physically safe feasible set sequence, or if the convergence condition is not met even after reaching the preset maximum number of iterations, the corresponding ATP candidate control strategy is eliminated.

[0186] For ATP candidate control strategies that meet the convergence criteria, predictions are made based on the ATP control sequences obtained when the convergence criteria are met.

[0187] Within the preset recovery time domain and before the train reaches the platform entry protection boundary, when the predicted time when the remaining safety margin is not lower than the target safety margin for the first time occurs, and the predicted physical state of the train is within the corresponding ATP physical safety feasible set in each predicted time from the current control time to the predicted time, the corresponding ATP candidate control strategy is determined to have autonomous safety recovery capability.

[0188] Therefore, ATP candidate control strategies must have autonomous and safe recovery capabilities, which requires simultaneously satisfying both the safe recovery outcome and the safe recovery process.

[0189] On the one hand, the remaining safety margin needs to be restored to the target safety margin within the preset recovery time domain and before the train reaches the station entry protection boundary. On the other hand, throughout the entire prediction process from the current state to reaching the target safety margin, the predicted physical state of the train must not exceed the corresponding dynamic ATP physical safety feasible set. As long as at least one ATP candidate control strategy has autonomous safety recovery capability, it is considered that the ATP currently still has autonomous safety recovery capability, and one ATP candidate control strategy that meets the conditions is selected and the corresponding ATP control sequence is executed.

[0190] If, after completing the above solution and judgment for all ATP candidate control strategies covering the ATP's allowable control range under the preset control discrete precision, there is still no ATP candidate control strategy with autonomous safety recovery capability, it is determined that the ATP's current autonomous safety recovery capability has been exhausted, and interlocking degradation control is triggered.

[0191] Among these, the preset safety margin is higher than the preset safety threshold, the preset safety threshold is higher than the preset limit threshold, and the target safety margin is not lower than the preset safety threshold. Therefore, the trigger for interlocking degradation is not the failure of a particular ATP candidate control strategy, but rather the inability of the ATP's current permissible control capability, after coverage verification, to form an autonomous safety recovery trajectory.

[0192] S6. After the interlocking degradation control is triggered, the control permissions are restored step by step.

[0193] It should be noted that S6 is a further implementation method after interlocking degradation is triggered, and is used to specifically explain how to restore control authority after interlocking degradation control.

[0194] In one implementation, during interlocking downgrade control, updated real-time train operation status, real-time train physical status, and real-time platform passenger flow status are acquired in each control cycle.

[0195] Multiple ATP candidate control strategies are regenerated according to the preset control discrete accuracy. Based on the updated real train operation status, real train physical status and real platform passenger flow status, the ATP control sequence is re-obtained for each ATP candidate control strategy and iterated in a loop to re-determine whether each ATP candidate control strategy has autonomous and safe recovery capability.

[0196] Set a preset number of consecutive control cycles. When the number of control cycles in which at least one ATP candidate control strategy with autonomous and safe recovery capability exists continuously reaches the preset number, select one from the ATP candidate control strategies with autonomous and safe recovery capability in the current control cycle.

[0197] At this point, the interlocking degradation control is not directly released. While the path protection constraints of the interlocking degradation control remain in effect, only the first control action in the ATP control sequence obtained when the selected ATP candidate control strategy meets the convergence condition is executed. The fact that the path protection constraints remain in effect means that the path blocking, hostile path prohibition, and other path-level security protection conditions currently established by the interlocking system remain valid.

[0198] The first ATP control action can only be implemented within the currently permitted driving range of the interlocking system. It is not used to expand the current movement authorization range, nor to remove existing interlocking route safety protections. The first control action can be a braking level activation, speed limit activation, or other ATP restrictive control action that conforms to the current interlocking route protection constraints within a control cycle.

[0199] After executing the first control action, the actual train operating status, actual train physical status, and actual platform passenger flow status are reacquired in the next control cycle, instead of directly replacing the actual status with the train status predicted in the previous cycle. Based on the updated real status after executing the first control action, the ATP braking protection target and the ATP physical safety feasible set are redefined. At the same time, ATP candidate control strategies are regenerated, and it is reassessed whether each ATP candidate control strategy has autonomous safety recovery capability.

[0200] When the updated real-time train physical state is within the redefined ATP physical safety feasible set, and there is still at least one ATP candidate control strategy with autonomous safety recovery capability in the next control cycle, it indicates that the ATP recovery capability obtained from continuous prediction still holds after experiencing a real train physical control action.

[0201] At this point, control authority is restored from interlocked degraded control to ATP safety recovery control. During ATP safety recovery control, ATS or ATO candidate control strategies are regenerated, and a self-consistent capacity control solution is obtained according to the process described in S4. When an executable self-consistent capacity control solution exists, control authority is restored from ATP safety recovery control to ATS or ATO capacity recovery control.

[0202] During ATS or ATO capacity recovery control, the real-time status point, operational deviation, ATP safety mapping domain, and remaining safety margin are continuously updated. When the operational deviation is not greater than the preset deviation threshold, the real-time status point is within the ATP safety mapping domain, and the remaining safety margin is not less than the preset safety margin, the conditions for operation according to the map are met again, and operation according to the map is resumed.

[0203] This results in a process of hierarchical control authority recovery: from interlocking downgrade control to ATP safety recovery control; from ATP safety recovery control to ATS or ATO capacity recovery control; and from ATS or ATO capacity recovery control to chart-based operation recovery.

[0204] Unlike the migration of control authority to a more stringent security level when risks increase, the recovery from interlock downgrade to normal operation requires continuous prediction and confirmation, the first actual ATP control action, and re-verification of the real state, thus forming an asymmetric control authority migration mechanism. Specific Implementation Example 1

[0206] The following example, taking the passenger flow gathering in the track area of ​​a certain urban rail transit train as it approaches the target platform, illustrates the above S1 to S6.

[0207] To facilitate the explanation of the virtual protection point inversion process, this embodiment uses uniform speed operation, constant deceleration braking, and constant acceleration restart as examples in local numerical calculations. In actual engineering operation, the corresponding calculations are completed by the ATP braking model based on factors such as track gradient, braking establishment time, actual train braking performance, track speed limit, and movement authorization.

[0208] S1, Graphical Operating Domain and Real-time Status Points

[0209] Historical data on normal, congestion-free operation of the target line are selected as training samples. Each historical sample includes state features such as train position, train speed, station dwell time, section travel time, passenger flow density in the platform rail area, passenger inflow rate, and passenger spatial distribution. In this embodiment, the above state features are selected and arranged in a preset order to form a training input vector, and then processed according to a preset normalization rule.

[0210] This embodiment sets up an input layer of corresponding dimensions based on the number of features selected in the training input vector, and sets the low-dimensional encoding layer to two dimensions, so that the joint state formed by the train operation state and the platform passenger flow state is mapped to a two-dimensional low-dimensional state space. The two-dimensional low-dimensional encoding layer is only a specific setting in this embodiment and does not limit the low-dimensional encoding dimension of the present invention.

[0211] After training is complete, a graphical operating domain is established using low-dimensional state points corresponding to historical congestion-free states. The current train is 500 meters from the target platform's entry protection boundary, and its speed is 20 meters per second.

[0212] The current train operation status and platform passenger flow status are mapped by the encoder according to the same input rules as in the training phase to obtain the real-time status point. The current operation deviation is 0.41, which is greater than the preset deviation threshold of 0.25.

[0213] S2, Virtual Protection Point Inversion

[0214] The current train consists of six cars. Based on the air spring pressure of each car, the preset load calibration relationship, the car's own weight, the formation relationship, and the slewing mass conversion factor, the real-time equivalent mass of the train is 200,000 kilograms.

[0215] Based on the current braking system status, and using simplified conditions to illustrate the calculation process, the effective braking deceleration is taken as one meter per second squared. The current train is 500 meters from the platform's entry protection boundary, traveling at 20 meters per second, corresponding to a safe arrival time of approximately 25 seconds.

[0216] The area adjacent to the tracks on the platform is 60 square meters. Currently, there are 252 passengers in this area, corresponding to an average passenger density of 4.2 people per square meter. The preset safe passenger density is 2.8 people per square meter, corresponding to a safe number of 168 people in the area adjacent to the tracks.

[0217] The current passenger inflow rate is 1.05 people per second, and the effective evacuation rate to the preset safe area is 3.2 people per second. Therefore, the net reduction rate in the adjacent area is approximately 2.15 people per second. To reduce the number of passengers from 252 to 168, a reduction of 84 people is required, corresponding to a safe passenger flow recovery time of approximately 39.1 seconds. The preset time margin is 5 seconds, therefore the required safe time is approximately 44.1 seconds.

[0218] The current safe arrival time is approximately 25 seconds, which is less than 44.1 seconds. Therefore, a virtual protection point inversion is performed. Within the current braking range, candidate parking positions are set at distances of 80 meters, 100 meters, 120 meters, 150 meters, and 200 meters from the platform entrance protection boundary.

[0219] Under the simplified motion conditions of this embodiment, the estimated arrival times for each candidate parking position are approximately 43.6 seconds, 44.1 seconds, 44.5 seconds, 44.8 seconds, and 45 seconds, respectively.

[0220] Therefore, a virtual protection point was selected at a location 100 meters away from the platform entrance protection boundary that meets the passenger flow safety time requirements and has the shortest expected arrival time.

[0221] S3, ATP safety region and control region determination

[0222] Taking the current train position as the starting point of the local longitudinal coordinate system, the platform entrance protection boundary is located 500 meters ahead, and the virtual protection point is located 400 meters ahead. Based on the current effective braking capacity, an ATP physical safety feasible set is established using the train position and speed as state variables.

[0223] Under the simplified constant deceleration condition in this embodiment, the critical speed corresponding to the current position is approximately 28.3 meters per second; the critical speed after the train has moved 100 meters is approximately 24.5 meters per second; after moving 200 meters is approximately 20 meters per second; and after moving 300 meters is approximately 14.1 meters per second.

[0224] Critical states and internal sampled states on the boundary of the ATP physically safe feasible set are selected, and the position and velocity features in the current real-time input vector are replaced according to the S3 method. Critical mapping points and internal mapping points are formed through the same encoder, and the ATP safe mapping domain is formed by using the radial basis implicit ATP safe bound function.

[0225] The current real-time status point is located within the ATP safety mapping domain. The farthest expected stopping position of the current train is approximately 200 meters ahead of the current train, while the ATP braking protection target is located 400 meters ahead of the current train. Therefore, the remaining safety margin is approximately 200 meters.

[0226] Based on the train's current position, speed, real-time equivalent mass, and effective braking deceleration at the predicted moment, the farthest expected stopping position along the direction of travel is determined using the ATP braking model. Using the longitudinal position of the platform approach protection boundary as a position reference, the ATP braking protection target and the farthest expected stopping position are converted to the same longitudinal coordinate system along the track.

[0227] When the ATP braking protection target is located ahead of the farthest predicted stopping position, the longitudinal positional difference between the two is positive and serves as the remaining safety margin at that predicted moment; when the farthest predicted stopping position exceeds the ATP braking protection target, the positional difference is negative. Therefore, in this embodiment, the sign of the remaining safety margin not only indicates its numerical value but also its directional relationship with the farthest predicted stopping position of the train relative to the ATP braking protection target.

[0228] The preset safety margin is set to 260 meters, the preset safety threshold is set to 220 meters, the preset clearance threshold is set to 150 meters, and the target safety margin is set to 230 meters.

[0229] Since the current operational deviation is higher than the deviation threshold shown in the diagram, the real-time status point is located within the ATP safety mapping domain, and the remaining safety margin is lower than the preset safety margin shown in the diagram but higher than the preset limit threshold, the current control area is determined as the ATS or ATO capacity recovery area.

[0230] S4, ATS, or ATO self-consistent operational capacity recovery failure

[0231] Three candidate ATS or ATO control strategies are generated. The first candidate control strategy requires the train to arrive at the platform entry protection boundary approximately 44.2 seconds after the current control time. The corresponding control sequence can be obtained in the first round. After re-predicting train operation and passenger flow changes based on the control sequence, the passenger flow safety recovery time increases to approximately 39.8 seconds. After adding a 5-second preset time margin, the new safety time requirement becomes approximately 44.8 seconds. The candidate stopping positions of this embodiment are reused for virtual protection point inversion.

[0232] The candidate parking position 120 meters from the entrance protection boundary corresponds to an estimated arrival time of approximately 44.5 seconds, which does not meet the new safety time requirement; the position 150 meters from the entrance protection boundary corresponds to an estimated arrival time of approximately 44.8 seconds. Therefore, the new virtual protection point is determined to be the position 150 meters from the entrance protection boundary.

[0233] The original candidate control strategy still requires an arrival time of approximately 44.2 seconds. Under the updated ATP physically safe feasible set sequence constraints, it is no longer possible to find a control sequence that satisfies both the new safety boundary and achieves the original control objective; therefore, the first candidate control strategy is eliminated.

[0234] After different cycles, the virtual protection points of the second candidate control strategy were located at distances of 120 meters, 150 meters, 120 meters, and 150 meters from the ingress protection boundary, respectively. After reaching the preset maximum number of cycles, the change in the position of the ATP braking protection target in adjacent cycles still significantly exceeded the preset position convergence threshold of three meters, therefore the second candidate control strategy was eliminated.

[0235] The third candidate control strategy ultimately met the convergence conditions of arrival time and ATP braking protection target position, but the minimum remaining safety margin in the final prediction process was only 205 meters, which is lower than the preset safety threshold of 220 meters.

[0236] The third candidate control strategy cannot form a self-consistent capacity control solution. Ultimately, there is no executable self-consistent capacity control solution, and the control authority is transferred from ATS or ATO capacity recovery control to ATP safety recovery control.

[0237] S5, ATP autonomous recovery and interlocking downgrade

[0238] The ATP is currently allowed to use three braking levels, and the allowable speed limits are determined according to the preset discrete precision as 16 meters per second, 14 meters per second, and 12 meters per second, forming a total of nine ATP candidate control strategies.

[0239] In the first operating scenario, passenger flow on the platform did not worsen further, and no new malfunctions occurred in the train braking system. The ATP candidate control strategies corresponding to the second braking level and the speed limit of 14 meters per second converged after a loop. The maximum position change of the target under the last two rounds of ATP braking was approximately 2.1 meters, less than the preset position convergence threshold of 3 meters.

[0240] Within the 30-second recovery time domain, the remaining safety margin reaches the target safety margin of 230 meters for the first time at the 16th second, while the predicted train physical state throughout the entire process is within the corresponding ATP physical safety feasible set. Therefore, this ATP candidate control strategy has autonomous safety recovery capability and does not trigger interlocking degradation.

[0241] In another operating scenario, a new surge in passenger flow occurs on the platform, restricting some evacuation routes and rendering some braking units unavailable. Based on the updated passenger flow and actual train braking status, nine ATP candidate control strategies are re-formulated.

[0242] Some of the candidate strategies could not re-obtain the ATP control sequence under the updated ATP physical safety feasible set sequence constraints. Although the remaining candidate strategies could converge, none of them could make the remaining safety margin reach the target safety margin of 230 meters within the preset recovery time domain and before the train arrives at the platform entry protection boundary.

[0243] After completing the comprehensive solution of the nine ATP candidate control strategies, no ATP candidate control strategy with autonomous safety recovery capability was found, thus triggering the interlocking degradation control.

[0244] S6. Step-by-step recovery after interlock downgrade

[0245] After entering the interlocking downgrade control phase, the station implements passenger flow restrictions and evacuation measures, and continuously updates the train braking system status. This embodiment sets the control cycle to two seconds, and requires that an ATP candidate control strategy with autonomous safety recovery capability exist for three consecutive control cycles before proceeding to the actual action verification phase.

[0246] After the above conditions are met for three consecutive control cycles, one ATP candidate control strategy with autonomous and safe recovery capability is selected from the current cycle.

[0247] The interlocking system maintains the established conditions of route blocking, hostile route prohibition, and other route protection, and only executes the first two-second control action in the corresponding ATP control sequence.

[0248] Assuming the train's actual speed before the action is 15 meters per second, the actual deceleration corresponding to the ATP restrictive control action is approximately 0.8 meters per second squared.

[0249] Two seconds after execution, the train's actual speed dropped to approximately 13.4 meters per second.

[0250] After entering the next control cycle, the actual train position, train speed, braking status, and platform passenger flow status are collected again.

[0251] Based on the above actual conditions, the ATP braking protection target and the feasible set of ATP physical safety are redefined.

[0252] If the updated physical state of the train is still within the newly determined ATP physical safety feasible set, and there is still at least one ATP candidate control strategy with autonomous safety recovery capability after resolving based on the latest real state, then the control authority will be restored from interlocking downgrade control to ATP safety recovery control.

[0253] ATP continues to implement safe recovery and restarts the self-consistent solution of ATS or ATO candidate control strategies.

[0254] The predicted arrival time difference for the last two rounds of a candidate ATS or ATO control strategy is 0.3 seconds, the maximum position difference of the ATP braking protection target is 1.8 meters, and the minimum remaining safety margin during the prediction process reaches 232 meters.

[0255] The current operational deviation is 0.33, while the predicted operational deviation at the end of the time domain decreases to 0.18. Therefore, the corresponding scheme forms an executable self-consistent capacity control solution, and the control authority is restored from ATP safety recovery control to ATS or ATO capacity recovery control.

[0256] Furthermore, when the subsequent real-time operational deviation decreases to 0.19, the real-time status point is located within the ATP safety mapping domain, and the remaining safety margin reaches 268 meters, the conditions for operation according to the map are met, and operation according to the map is resumed.

[0257] The computer program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing state information from the computer-readable program instructions. This electronic circuitry can execute the computer-readable program instructions to implement various aspects of the invention.

[0258] The present invention discloses a non-transitory computer-readable storage medium storing computer instructions, which, when executed by a processor, cause the processor to perform the above-described method.

[0259] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware (e.g., processor, FPGA, ASIC, etc.), and the program can be stored in a readable storage medium, such as a read-only memory, a disk, or an optical disk. All or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module in the above embodiments can be implemented in hardware, such as by using integrated circuits to implement its corresponding function, or it can be implemented as a software functional module, such as by a processor executing a program / instruction stored in memory to implement its corresponding function. The embodiments of the present invention are not limited to any particular combination of hardware and software.

[0260] Furthermore, the functional units in the various embodiments of this document can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0261] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this article, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this article. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0262] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for dynamic capacity matching and train operation control in urban rail transit, characterized in that, include: An autoencoder is trained based on the vehicle-passenger joint state parameters under historical congestion-free conditions. The encoder in the autoencoder is used to construct a graph-defined operating domain, and the real-time vehicle-passenger joint state parameters are mapped to real-time state points through the encoder. The safe recovery time and safe arrival time of passenger flow are determined based on the real-time train operation status, braking system status and passenger flow status near the track; and the ATP braking protection target is dynamically determined based on the comparison results of the two durations and the preset time margin. Using the ATP braking protection target as the braking and stopping boundary, the ATP physical safety feasible set is determined, and the state vector corresponding to the ATP physical safety feasible set is mapped to a low-dimensional state space through the encoder to form the ATP safety mapping domain. Based on the operational deviation between the real-time status point and the fixed operating domain, the positional relationship between the real-time status point and the ATP safety mapping domain, and the remaining safety margin of the train relative to the ATP braking protection target, the current control zone is determined. Within the ATS or ATO capacity recovery region, an executable self-consistent capacity control solution is iteratively obtained under the constraints of the ATP physically safe feasible set. When the system is in the ATP limit approach region or there is no executable self-consistent energy control solution, it switches to ATP safety recovery control. Safety recovery is determined for each ATP candidate control strategy covering the ATP allowable control range. When none of the ATP candidate control strategies can form a recovery trajectory that satisfies the ATP physical safety feasible set constraints and reaches the target safety margin within the preset recovery time domain, interlocking degradation control is triggered.

2. The method according to claim 1, characterized in that, The training and real-time state mapping of the autoencoder include: The vehicle-passenger joint state parameters under historical congestion-free conditions are used to form a training input vector according to a preset feature dimension, arrangement order and normalization rule. The training input vector is used to train an autoencoder, and the graphical operating domain is determined in the low-dimensional state space based on the distribution range of historical state points output by the encoder. The combined vehicle and passenger status parameters include train operation status parameters and platform passenger flow status parameters; the train operation status parameters include at least train position and train speed, and at least one of station dwell time and interval travel time; the platform passenger flow status parameters include at least one or more of the following: platform rail area passenger flow density, passenger flow inflow rate, and passenger spatial distribution. The real-time train and passenger joint state parameters, which consist of real-time train operation status parameters and real-time platform passenger flow status parameters, are used to form a real-time input vector according to the same feature dimensions, arrangement order and normalization rules as the training input vector, and then mapped to the real-time state point through the same encoder.

3. The method according to claim 2, characterized in that, The specific process for determining the safe arrival time includes: The air spring pressure of each vehicle is acquired in real time. The real-time load of each vehicle is determined based on the preset calibration relationship between the air spring pressure and the vehicle load. The real-time equivalent mass of the train is determined by combining the self-weight of each vehicle, the formation relationship and the preset slewing mass conversion factor. The available braking units and their braking force are determined based on the status of the braking system, and the effective braking deceleration is determined in combination with the real-time equivalent mass of the train. The real-time physical state of the train is formed by the train position, train speed, real-time equivalent mass of the train and effective braking deceleration. The shortest running time from the current control time to the platform entry protection boundary under the ATP braking constraint is determined by the ATP operation constraint and is used as the safe arrival time.

4. The method according to claim 3, characterized in that, The specific process for determining the safe recovery time of passenger flow includes: Based on the passenger flow density in the platform's adjacent area, the distance distribution of passengers relative to the platform edge, the passenger flow inflow rate, and the passenger flow evacuation rate to the preset safe area, the time required for the platform's adjacent area to first meet the preset passenger flow safety conditions from the current control time is predicted and used as the passenger flow safety recovery time. When the safe arrival time is less than the sum of the passenger flow safe recovery time and the preset time margin, multiple candidate stopping positions are determined within the braking stopping range based on the real-time physical state of the train. For each candidate stopping position, under the condition that the train stops completely at the candidate stopping position and restarts without setting an additional stopping time, the ATP braking model is used to determine the expected arrival time of the train from the current control time to the platform entry protection boundary. From the candidate parking locations whose estimated arrival time is not less than the sum of the passenger flow safe recovery time and the preset time margin, select the candidate parking location with the smallest estimated arrival time as the virtual protection point; When the safe arrival time is less than the sum of the passenger flow safe recovery time and the preset time margin, and a feasible virtual protection point exists, the virtual protection point is used as the ATP braking protection target; when the safe arrival time is not less than the sum of the passenger flow safe recovery time and the preset time margin, or when no feasible virtual protection point exists, the braking protection target determined by the ATP system based on the current mobility authorization, line operation constraints, and ATP braking constraints is used as the basic braking protection target, and the basic braking protection target is used as the ATP braking protection target.

5. The method according to claim 4, characterized in that, The specific steps for determining the feasible set of ATP physical security and the ATP security mapping domain include: Using the ATP braking protection target as the braking and stopping boundary, based on the train's braking capacity, a set of train physical states that can be stopped without exceeding the ATP braking protection target is determined as the ATP physical safety feasible set. Boundary states and internal sampled states are extracted from the ATP physical safety feasible set, mapped to a low-dimensional state space by the encoder, ATP safety bound function is established, and ATP safety mapping domain is determined. Based on the operational deviation, the positional relationship between the real-time state point and the ATP safety mapping domain, and the remaining safety margin, the current control area is determined as the map-based operation area, the ATS or ATO capacity recovery area, or the ATP limit approach area.

6. The method according to claim 5, characterized in that, Within the ATS or ATO capacity recovery zone, the specific process of obtaining the control sequence and iteratively re-obtaining the control sequence includes: Multiple candidate control strategies are generated, and control sequences are obtained under the constraints of the ATP physical safety feasible set. Based on the control sequences, the train operation status and passenger flow status in the preset time domain are predicted. Based on the train status and passenger flow status at each predicted time, the ATP braking protection target, ATP physical safety feasible set and remaining safety margin at the corresponding time are dynamically updated to form the ATP physical safety feasible set sequence. Keeping the control objectives of each candidate control strategy unchanged, the control sequence is re-obtained under the time-by-time constraints of the ATP physically safe feasible set sequence, and the process is iterated until convergence.

7. The method according to claim 6, characterized in that, The process of obtaining the executable self-consistent operational control solution includes: When the cyclic iteration satisfies the convergence condition, and the predicted physical state of the train at each prediction time is within the corresponding ATP physical safe and feasible set and meets the safety margin requirement, the corresponding control sequence is determined as the self-consistent capacity control solution. From the self-consistent capacity control solutions, select the solutions that can improve the current operating state as executable self-consistent capacity control solutions, and then select one to execute. When no executable self-consistent energy control solution exists, the system switches to ATP safety recovery control.

8. The method according to claim 7, characterized in that, The ATP safe recovery control includes: Generate multiple ATP candidate control strategies covering the range of ATP-allowed control; For each ATP candidate control strategy, the ATP control sequence is iteratively obtained under the constraint of the ATP physically safe feasible set, and it is determined whether the corresponding strategy has autonomous safe recovery capability. When at least one ATP candidate control strategy with autonomous and safe recovery capability exists, the corresponding ATP control sequence is selected and executed. When no ATP candidate control strategy with autonomous and safe recovery capability exists, interlocking degradation control is triggered.

9. The method according to claim 8, characterized in that, The restoration of control authority after interlocking degradation control includes: During the interlocking degrade control period, the ability of each ATP candidate control strategy to autonomously and safely recover is continuously determined based on the real-time status. In the next control cycle, the control authority will be restored to ATP safety recovery control if the conditions are met after re-verification based on the updated real train status. When an executable self-consistent capacity control solution is obtained, the control authority is restored to ATS or ATO capacity recovery control; when the conditions for running according to the diagram are met, the operation according to the diagram is restored.

10. A dynamic capacity matching and train operation control system for urban rail transit, characterized in that, include: The fixed-running domain construction module is used to train an autoencoder based on the vehicle-passenger joint state parameters of historical congestion-free conditions, construct the fixed-running domain using the encoder in the autoencoder, and map the real-time vehicle-passenger joint state parameters into real-time state points through the encoder. The time safety determination module is used to determine the safe arrival time and the safe recovery time of passenger flow based on the real-time train operation status, braking system status and passenger flow status near the track, and dynamically determine the ATP braking protection target according to the time relationship between the two. The safety domain construction and state mapping module is used to determine the ATP physical safety feasible set with the ATP braking protection target as the braking and stopping boundary, and to map the state vector corresponding to the ATP physical safety feasible set to a low-dimensional state space through the encoder to form the ATP safety mapping domain. The control zone determination module is used to determine the current control zone based on the operational deviation between the real-time status point and the fixed operating domain, the positional relationship between the real-time status point and the ATP safety mapping domain, and the remaining safety margin of the train relative to the ATP braking protection target. The ATS or ATO capacity recovery control module is used to iteratively obtain an executable self-consistent capacity control solution within the ATS or ATO capacity recovery region under the constraints of the ATP physically safe feasible set. The ATP safety recovery control module is used to switch to ATP safety recovery control when the system is in the ATP limit approach region or when there is no executable self-consistent energy control solution. It performs safety recovery judgment on each ATP candidate control strategy covering the ATP allowable control range. When none of the ATP candidate control strategies can form a recovery trajectory that satisfies the ATP physical safety feasible set constraints and reaches the target safety margin within the preset recovery time domain, it triggers interlocking degradation control.

Images