A loop packet processing method, system, device and storage medium

Abstract

The application provides a loop message processing method, system, device and storage medium, and relates to the field of train operation control.The method comprises the following steps: processing the loop message; extracting a key field characteristic value; if the key field characteristic value is different from a current effective value, loading the key field characteristic value into a candidate area and starting a consistency window count; if the same value message is continuously received for a set number of frames, submitting the same value message as a second effective value; if a message received is the same as the current effective value and different from the candidate area, clearing the candidate; monitoring the survival time of the effective value; if the survival time exceeds a safe effective period and the characteristic value does not change, triggering protection; calculating the channel health degree according to the message flow; adaptively adjusting the window frame number and the effective period; and finally outputting the message with trusted access.The application can filter out message jitter, identify hidden faults with CRC passing but expired content, and ensure that the output message has time effectiveness, content correctness and channel adaptability.

Description

Technical Field

[0001] This application relates to the field of train operation control, and in particular to a method, system, device and storage medium for processing loop messages. Background Technology

[0002] In ETCS Level 1, Euroloop achieves semi-continuous data transmission via the loop and onboard antenna. The existing ATP host parses the loop messages sent by LTM frame by frame: after a CRC check passes, it compares the version number; if updated, it is directly used for braking curve calculation. However, three potential problems exist: First, when the LOOMO malfunctions or loses power, residual energy continues to broadcast old messages. Although the CRC, identifier, and version are valid, services such as speed limits and authorizations are invalid. Existing timers only monitor identifier similarity and cannot identify content-stationary faults. Second, LOOMO data switching generates jitter between old and new messages, lacking a filtering mechanism, causing the vehicle control core to frequently recalculate curves, leading to speed fluctuations. Third, the channel quality information reported by LTM is not utilized, and the arbitration mechanism for continuous loop broadcasting under the dual-system LTM redundancy architecture is still lacking. A comprehensive solution is needed to address content validity judgment, jitter suppression, channel information mining, and redundancy arbitration.

[0003] Therefore, how to construct a trusted access mechanism for loop messages that can identify static, hidden faults, suppress jitter between new and old versions, adaptively adjust security parameters using channel traffic characteristics, and support dual-system arbitration is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this application is to provide a method, system, computer-readable storage medium, and electronic device for processing loop messages, which solves the problem of how to perform trusted access processing on loop messages to identify hidden faults in which the content of key service fields remains unchanged and to adapt to changes in channel state.

[0005] To address the aforementioned technical problems, this application provides a method for processing loop messages, comprising the following steps: Obtain the loop message and extract the key field feature values ​​of the loop message; If the key field feature value is different from the currently effective reference feature value, the loop message is loaded into the candidate data area and consistency window counting is started; Within the consistency window, when a loop message with the same key field feature value as the candidate data area is received, the count is incremented; when the count reaches a set number of frames, the candidate data area is submitted as the second effective reference feature value; when a loop message with the same key field feature value as the current effective reference feature value but different from the candidate data area is received, the candidate data area and the count are cleared. Monitor the lifespan of the currently effective reference feature value. When the lifespan exceeds the preset security validity period and the key field feature value has not changed, trigger a security protection action. The packet traffic characteristics are obtained based on the ring packet statistics, the channel health is calculated based on the packet traffic characteristics, and at least one of the set frame number of the consistency window and the preset security validity period is adaptively adjusted based on the channel health. The loop message submitted through trusted access will be output as the currently valid loop data.

[0006] Optionally, before extracting the key field feature values ​​of the loop message, the method further includes: predicting the set of loop identifiers that should be received based on the current position of the train and the loop end marker prediction information; comparing the loop identifiers in the received loop message with the predicted set of loop identifiers; and when the loop identifier is not in the predicted set of loop identifiers, determining it as misaligned reception or crosstalk between adjacent loops, and discarding the loop message.

[0007] Optionally, after extracting the key field feature values ​​of the loop message, the method further includes: predicting the reasonable evolution direction of the key business content in the loop message based on the current position of the train, and obtaining the expected evolution of train positioning; monitoring the evolution rules of the sequence number and version number within the loop message, and obtaining the expected evolution of the sequence number; when the expected evolution of the sequence number does not match the expected evolution of train positioning, determining it as a trackside logic anomaly, and triggering the safety protection action.

[0008] Optionally, monitoring the evolution patterns of sequence numbers and version numbers within the loop message to obtain the expected sequence number evolution includes: determining whether the sequence number remains monotonically increasing; if the sequence number is not monotonically increasing, exhibits abnormal looping, or the evolution of the sequence number does not match the evolution of the train position, determining that the expected sequence number evolution does not conform to the expected pattern; and triggering the safety protection action based on the determination result that the sequence number evolution does not conform to the expected pattern.

[0009] Optionally, within the consistency window, when a loop message with the same key field feature value as the candidate data area is received, the count is incremented; when the count reaches a set number of frames, the candidate data area is submitted as the second effective reference feature value; when a loop message with the same key field feature value as the current effective reference feature value but different from the candidate data area is received, the candidate data area is cleared and the count is reset, including: matching the key field feature value of the loop message with the candidate data area and the current effective reference feature value respectively; when the key field feature value is the same as the candidate data area, the count is incremented; when the count reaches the set number of frames, the candidate data area is submitted as the second effective reference feature value; when the key field feature value is the same as the current effective reference feature value, the candidate data area is cleared and the count is reset.

[0010] Optionally, the packet traffic characteristics include at least: the proportion of duplicate packets within a unit time period, the burst characteristics of cyclic redundancy check (CRC) error frames, and the frequency of switching between old and new versions within a unit time period; correspondingly, calculating the channel health based on the packet traffic characteristics includes: calculating a channel health index based on the proportion of duplicate packets, the burst characteristics of CRC error frames, and the frequency of switching between old and new versions; the channel health index is within a set range; at least one of the set frame number of the consistency window and the preset security validity period is adaptively adjusted based on the channel health index; wherein, when the channel health index is in a set high range, the set frame number of the consistency window is reduced and the preset security validity period is extended; when the channel health index is in a set low range, the set frame number of the consistency window is increased and the preset security validity period is shortened; when the channel health index is in a set high range and the key field feature value is static, the security protection action is triggered in advance.

[0011] Optionally, under the redundant architecture of the dual-system ring transmission module, the method further includes: extracting the content fingerprints of the ring messages reported by the dual-system ring transmission modules respectively; when the content fingerprints of the two systems are the same, the dual systems are deemed to be from the same source and valid, and the dual system data is submitted as the second effective reference feature value after voting; when the content fingerprints of the two systems are different, the dual system messages are subjected to joint verification of the key field feature value, ring identification number and sequence number evolution expectation, and the system message that passes the joint verification is selected as the primary data, and the system message that fails the joint verification is given a fault diagnosis alarm; when both system messages fail the joint verification, the security protection action is triggered.

[0012] This application also provides a system for processing loop messages, including: The message acquisition module is used to acquire loop messages; The feature extraction module is used to extract the key field feature values ​​of the loop message; The candidate loading and counting start module is used to load the loop message into the candidate data area and start consistency window counting when the key field feature value is different from the currently effective reference feature value; The consistency window processing module is used to perform the following processing within the consistency window: when a loop message with the same key field feature value as the candidate data area is received, the count is incremented; when the count reaches a set number of frames, the candidate data area is submitted as the second effective reference feature value; when a loop message with the same key field feature value as the current effective reference feature value but different from the candidate data area is received, the candidate data area and the count are cleared. The survival time monitoring module is used to monitor the survival time of the currently effective reference feature value. When the survival time exceeds the preset security validity period and the key field feature value has not changed, a security protection action is triggered. The channel health assessment and adaptive adjustment module is used to obtain packet traffic characteristics based on the ring packet statistics, calculate channel health based on the packet traffic characteristics, and adaptively adjust at least one of the set frame number of the consistency window and the preset security validity period based on the channel health. The trusted access output module is used to output the loop message submitted through trusted access as the currently valid loop data.

[0013] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described above.

[0014] This application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor, when calling the computer program in the memory, implements the steps of the method described above.

[0015] This application provides a method for processing loop messages, including: acquiring a loop message; extracting key field feature values ​​from the loop message; if the key field feature values ​​differ from the currently effective reference feature value, loading the loop message into a candidate data area and starting a consistency window count; within the consistency window, when a loop message with the same key field feature value as the candidate data area is received, accumulating the count; when the count reaches a set number of frames, submitting the candidate data area as a second effective reference feature value; when a loop message with the same key field feature value as the currently effective reference feature value and differs from the candidate data area, the method continues to process the loop message. When selecting ring packets with different data areas, the candidate data areas and the count are cleared; the lifespan of the currently effective reference feature value is monitored, and when the lifespan exceeds the preset security validity period and the key field feature value has not changed, a security protection action is triggered; the packet traffic characteristics are obtained based on the ring packets, the channel health is calculated based on the packet traffic characteristics, and at least one of the set frame number of the consistency window and the preset security validity period is adaptively adjusted based on the channel health; the ring packets submitted through trusted access are output as the currently effective ring data.

[0016] This application extracts key field feature values ​​from loop messages and compares them with currently effective reference feature values. When they differ, a consistency window accumulation count is initiated, and the message is only submitted for effectiveness after a set number of consecutive identical messages are received. This effectively filters out message jitter caused by trackside equipment switching or transient channel interference. By monitoring the lifespan of the currently effective reference feature values, security protection actions are proactively triggered when key field feature values ​​remain unchanged for an extended period, enabling the identification of hidden faults where CRC checks pass but content has expired. By calculating channel health based on message traffic characteristics and adaptively adjusting the set number of frames and security validity period of the consistency window, security confirmation parameters can be dynamically optimized according to the actual channel status, improving operational efficiency when the channel is good and enhancing security confirmation strength when the channel is poor. Through the combined effect of the above mechanisms, loop messages that have passed trusted access are ultimately output as currently valid data, ensuring that loop messages participating in the vehicle control logic calculation have time validity, content correctness, and channel adaptability.

[0017] This application also provides a loop message processing system, a computer-readable storage medium, and an electronic device, which have the above-mentioned beneficial effects, and will not be elaborated here. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 A flowchart illustrating a method for processing loop messages provided in an embodiment of this application; Figure 2 This is a message processing timing diagram provided in the embodiments of this application; Figure 3 A schematic diagram of the structure of a loop message processing system provided in an embodiment of this application; Figure 4 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] In this application, ETCS stands for European Train Control System; Euroloop is a semi-continuous, intermittent transmission system; LOOP stands for loop; LOOMO stands for loop modem unit, a trackside device; EOLM stands for End of Loop Marker, typically a transponder; LTM stands for Loop Transmission Module, an onboard equipment functional unit; BTM stands for Balise Transmission Module, an onboard device; ATP stands for Automatic Train Protection; TSR stands for Temporary Speed ​​Restriction; MA stands for Movement Authority; SIL4 stands for Safety Integrity Level 4; and CRC stands for Cyclic Redundancy Check. Check); SUBSET-044 is the Euroloop interface specification; SUBSET-026 is the ETCS message format specification; NID_LOOP is the Euroloop identifier; M_VERSION is the system version number; Q_SSCODE is the spread spectrum code qualifier; Key_Hash is the key field hash, which refers to the short identifier obtained by operating on the key service fields in the message; Channel health index is a quantification index of loop channel quality calculated based on the traffic characteristics of the reported message; Reverse reset refers to the mechanism that clears the entire candidate state to zero when old data is received during the consistency window accumulation period; Static failure refers to the security risk that the key field characteristic value does not change for a long time.

[0022] like Figure 1 As shown, Figure 1 This is a flowchart illustrating a method for processing loop messages according to an embodiment of this application. The method includes the following steps: S101: Obtain the loop message and extract the key field feature values ​​of the loop message.

[0023] In this step, the input interface layer of the ATP host receives loop messages reported by the LTM or BTM modules. The LTM or BTM modules perform transparent transmission of the loop messages; that is, they do not perform deduplication on the received loop messages, but instead sequentially send each demodulated loop message frame to the ATP host. The broadcast period of the loop messages can be determined by the system configuration; for example, in the ETCS Level 1 system, the loop broadcast period is 50ms, and the ATP master control period is 100ms. The received loop messages can be temporarily stored in the input FIFO queue, awaiting subsequent processing. The transparent transmission mode allows the ATP host to obtain the complete loop message stream, including duplicate messages, CRC error messages, and transitional messages during version switching, which provides a data foundation for subsequent channel health assessment.

[0024] In this step, key business fields are extracted from the acquired loop message, and their feature values ​​are calculated. Key business fields may include Temporary Speed ​​Limit (TSR) values ​​and Movement Authorization (MA) endpoints, as well as core parameters affecting train operation control such as gradient. Feature values ​​can be calculated using a Cyclic Redundancy Check (CRC) algorithm on the selected key business fields. For example, a short identifier, Key_Hash, can be calculated by using the CRC-16 algorithm (polynomial 0x8005) on both the TSR and MA endpoint fields. Using CRC-16 to calculate feature values ​​ensures good distinguishability between different content and is computationally efficient, making it suitable for real-time execution in a SIL4 safety computer.

[0025] Building upon this, a spatial dimension verification of the loop identifier can be added before extracting key field feature values. Specifically, based on the train's current location and the loop end marker (EOLM) advance warning information, the set of loop identifiers (NID_LOOP) that the train should receive is predicted. When the train passes an EOLM transponder near the beginning of a loop section, the EOLM sends a Q_SSCODE to inform the onboard equipment to prepare to receive loop messages. The ATP host predicts the NID_LOOP value that should be received based on the train's location and the line database. The NID_LOOP in the received loop message is compared with the predicted set. If the NID_LOOP is not in the predicted set, even if the CRC check of the message is correct, it is determined to be a misaligned reception or crosstalk between adjacent loops, and the message is directly discarded without proceeding to the subsequent processing flow. For example, when the train is traveling in the overlapping coverage area of ​​two loops, it may receive an old message from an adjacent loop with an NID_LOOP of 102, while the currently predicted NID_LOOP set is {101}. In this case, the message is discarded due to the mismatch. The tolerance for spatial dimension verification can be set by those skilled in the art based on engineering experience to ±1 adjacent ring markers.

[0026] Furthermore, after extracting key field feature values, joint verification of the time and content dimensions can be added. Specifically, based on the train's current position, the reasonable evolution direction of key business content in the loop message is predicted to obtain the expected train positioning evolution. For example, when the train enters the loop section, the expected TSR should be the same as the line parameters and temporary speed limit announcements for that section. Simultaneously, the evolution patterns of sequence numbers and version numbers within the loop message are monitored to obtain the expected sequence number evolution. The expected sequence number evolution can include: determining whether the sequence number remains monotonically increasing, i.e., whether the sequence number of each frame increases by a predetermined step size based on the sequence number of the previous frame; when the sequence number is not monotonically increasing (e.g., backwards), abnormally loops (e.g., jumping from the maximum value to the minimum value), or the evolution of the sequence number does not match the evolution of the train position, it is determined that the sequence number evolution does not conform to the expected pattern. When the expected sequence number evolution or version number evolution does not match the expected train positioning evolution, it is determined to be a trackside logic anomaly (e.g., a LOOMO internal state machine failure), and safety protection actions are triggered. This three-dimensional joint verification mechanism constructs a trust model from three dimensions: space (loop identification), time (train positioning evolution), and content (serial number evolution), which significantly improves message credibility.

[0027] S102: If the key field feature value is different from the currently effective reference feature value, load the loop message into the candidate data area and start consistency window counting.

[0028] In this step, the ATP host maintains two data storage areas: the currently effective data area (Buffer_A) and the candidate data area (Buffer_B). The currently effective data area stores the currently effective reference characteristic value and its corresponding complete message data. This reference characteristic value is the key field characteristic value of the loop message submitted after trusted access and currently used by the controlled vehicle core. The candidate data area is used to temporarily store new messages that have not yet been confirmed through the consistency window.

[0029] After extracting the key field feature values ​​of the current loop message, they are first compared with the currently effective reference feature value. If they are the same, it means that the current message and the effective data content are the same, which is a duplicate frame. The message can be discarded directly, and only the last received timestamp of the currently effective reference feature value is refreshed. The subsequent candidate accumulation process is not triggered.

[0030] If the two differ, it indicates that the current message carries updated service content. In this case, the loop message is loaded into the candidate data area, and a consistency window count is started, with the initial count value set to 1. This count is used to record the number of frames that are consecutively received within the consistency window and have the same key field feature value as the candidate data area.

[0031] S103: Within the consistency window, when a loop message with the same key field feature value as the candidate data area is received, the count is incremented; when the count reaches a set number of frames, the candidate data area is submitted as the second effective reference feature value; when a loop message with the same key field feature value as the current effective reference feature value but different from the candidate data area is received, the candidate data area and the count are cleared.

[0032] In this step, during the consistency window, the ATP host performs a matching check on each subsequently received loop message frame. Specifically, the key field feature values ​​of the newly received loop message are matched with the feature values ​​in the candidate data area and the currently effective reference feature value, respectively: If the key field feature value of the current message is the same as the feature value in the candidate data area, the candidate count is incremented (count incremented by 1). When the candidate count reaches a preset number of frames N, it is considered that the messages in the candidate data area have passed the continuous sameness verification for a sufficient duration and a sufficient number of frames. At this time, the candidate data area is submitted as the new currently effective data area, that is, the reference feature value in the candidate data area is set as the second effective reference feature value, replacing the original currently effective reference feature value. After the submission is completed, the candidate data area can be cleared and the count reset, ready for the next update.

[0033] If the key field feature value of the current message is the same as the currently effective reference feature value (i.e., the old version message has been received), and is different from the feature value of the candidate data area, then a reverse reset operation is performed: all temporarily stored data in the candidate data area is cleared, and the candidate count is reset to zero. This reverse reset mechanism is fundamentally different from the behavior of a conventional sliding window: a conventional sliding window usually ignores or continues to slide when old data is received within the window, while this application adopts a strategy of clearing the entire candidate state to zero. This is a special response to the jitter that may occur when railway trackside equipment switches between old and new versions during data update, preventing erroneous submissions due to interference from briefly appearing old version messages.

[0034] If the key field feature value of the current message differs from both the currently effective reference feature value and the candidate data area feature value (i.e., a third type of content appears), the current candidate data area and count can be cleared, and the new message can be used as a new candidate to start accumulating again.

[0035] The value of the frame number N can be set by those skilled in the art based on a comprehensive consideration of system response speed requirements and jitter resistance needs; for example, it can be set to 3 frames. This value can also be adaptively adjusted in subsequent steps based on channel health.

[0036] S104: Monitor the lifespan of the currently effective reference feature value. When the lifespan exceeds the preset security validity period and the key field feature value has not changed, trigger a security protection action.

[0037] In this step, the ATP host independently monitors the lifetime of the currently effective reference feature value. The lifetime refers to the elapsed time since the currently effective reference feature value was first submitted as effective data until the current moment. This monitoring is independent of whether loop messages are continuously received. Even if the loop transmission module continuously sends messages with correct CRC checks, as long as the key field feature value in the message has not changed and the lifetime exceeds the preset security validity period T_valid, it is determined to be a "content-static hidden fault".

[0038] Upon determining that a hidden fault is of the static type, a safety protection action is triggered. This safety protection action may include, but is not limited to, at least one of the following: outputting a common braking command to slow the train to a stop, limiting the train's maximum speed to a preset safe speed (e.g., 45 km / h), or triggering a downgrade mode switch to a backup protection level. For example, if the LOOMO logic crashes and continuously broadcasts cached old messages, and the LTM continuously sends CRC-correct v2 messages, and the ATP detects that the currently effective reference characteristic value has not changed for 5.1 seconds, exceeding the preset safety validity period (e.g., 5 seconds), then a safety downgrade is triggered.

[0039] The preset security validity period T_valid can be set by those skilled in the art based on a comprehensive consideration of system security requirements and operational efficiency; for example, it can be set to 5 seconds. This value can also be adaptively adjusted in subsequent steps based on channel health.

[0040] S105: Obtain message traffic characteristics based on the ring message statistics, calculate channel health based on the message traffic characteristics, and adaptively adjust at least one of the set frame number of the consistency window and the preset security validity period based on the channel health.

[0041] In this step, because the LTM / BTM module transmits loop messages transparently without deduplication, the message stream received by the ATP host contains rich information about channel quality. The ATP host performs traffic statistics on the received loop messages per unit time to obtain message traffic characteristics.

[0042] Message traffic characteristics can include at least the following three items: the proportion of repeated messages within a unit of time (R_repeat), the burst characteristic of CRC error frames (CRC_error_burst), and the frequency of switching between old and new versions within a unit of time (F_switch). The proportion of repeated messages reflects the percentage of messages with the same content being repeatedly transmitted on the channel; a higher proportion generally indicates a more stable channel. The burst characteristic of CRC error frames is used to distinguish between random interference (isolated errors) and persistent channel degradation (continuous errors); for example, the number of consecutive occurrences of CRC error frames and their distribution within a unit of time can be statistically analyzed. The switching frequency between old and new versions reflects the activity level of state switching in LOOMO devices; an abnormally high switching frequency may indicate hardware switching jitter or software state machine failure in the LOOMO.

[0043] The channel health index H_channel is calculated based on the aforementioned message traffic characteristics. The channel health index can take values ​​within a set range, such as [0,1]. A smaller value indicates a worse channel, while a larger value indicates a better channel. An exemplary calculation method is: H_channel = 0.4 × (1 - R_repeat) + 0.4 × (1 - CRC_error_rate) + 0.2 × (1 - F_switch_normalized), where CRC_error_rate is the CRC error rate calculated per unit time based on the burst characteristic CRC_error_burst, and F_switch_normalized is the normalized switching frequency. The weighting coefficients can be determined by those skilled in the art based on actual line test data.

[0044] The consistency window is adaptively adjusted based on at least one of the set frame number N and the preset security validity period T_valid, according to the channel health index. The adjustment strategy can be: When the channel health index is in the set high range (e.g., H_channel>0.8, indicating that the channel is good), the set number of frames of the consistency window can be reduced (e.g., from 5 frames to 3 frames) to speed up the response to new messages, while the preset security validity period can be extended (e.g., from 5 seconds to 8 seconds) to reduce false triggering caused by short-term channel fluctuations.

[0045] When the channel health index is in the set low range (e.g., H_channel<0.4, indicating poor channel conditions), the set number of frames of the consistency window can be increased (e.g., from 3 frames to 7 frames) to enhance anti-interference capability and security confirmation strength, while the preset security validity period can be shortened (e.g., from 5 seconds to 3 seconds) to improve the monitoring sensitivity of potential hidden faults.

[0046] When the channel health index is in the set high range and the key field characteristic value is static, it indicates that the channel conditions are good but the content remains unchanged for a long time. At this time, security protection actions can be triggered in advance, that is, security degradation is triggered before the survival time reaches the conventional preset security validity period, so as to respond more quickly to possible equipment failures.

[0047] The calculation and adaptive adjustment of the channel health index can be performed periodically. For example, the statistics can be updated once every ATP master control cycle (100ms), and H_channel can be recalculated every 1 second to adjust N and T_valid accordingly.

[0048] S106: Output the loop message submitted through trusted access as the currently valid loop data.

[0049] In this step, after a series of trusted access processes, including loop identifier verification, three-dimensional joint verification, consistency window accumulation, reverse reset filtering, content static monitoring, and adaptive adjustment of channel health, the loop message corresponding to the currently effective reference feature value is recognized as trusted currently valid loop data. This currently valid loop data is output to the ATP host's vehicle control core task for calculating braking curves and updating vehicle control logic. Differential resolution can be used during output, meaning that the vehicle control core is only triggered to recalculate when the content of the output loop message has substantially changed compared to the previous output, avoiding invalid computational load caused by duplicate data.

[0050] Based on the above embodiments, in one feasible implementation, the spatial dimension verification of the loop identifier can be performed independently. After acquiring the loop message, the ATP host first parses the NID_LOOP field in the message and predicts the set of NID_LOOPs that should be received based on the train's current position and EOLM advance warning information. When the train passes the EOLM transponder, the ATP host obtains the identifier of the upcoming loop segment based on Q_SSCODE, and determines the currently valid set of NID_LOOPs (which may contain two adjacent loop identifiers in the overlapping coverage area) by combining the train's running direction and the line database. If the NID_LOOP value of the received message does not fall into the predicted set, the message is discarded and a loop identifier misalignment event is recorded for subsequent diagnosis and maintenance analysis. The tolerance for spatial dimension verification can be set by those skilled in the art to ±1 adjacent loop identifiers based on the loop layout spacing and train positioning accuracy.

[0051] Based on the above embodiments, in one feasible implementation, the content dimension verification of sequence number evolution can be performed after S101 and before S102, or it can be performed in parallel with S102. The ATP host maintains a sequence number status record, storing the sequence number value and reception time of the most recently received valid loop message. When a new message arrives, the sequence number field (e.g., M_VERSION or a custom sequence number counter) in the message is extracted to determine whether the sequence number remains monotonically increasing. The criteria for determining monotonically increasing can be: the current sequence number is greater than the previous sequence number and the difference does not exceed a predetermined maximum step size (e.g., a difference between 1 and 10 is considered normal, and a difference exceeding 10 is considered an abnormal jump). If the sequence number is not monotonically increasing (the current sequence number is less than or equal to the previous sequence number), abnormally loops (jumps from near the upper limit value to near the lower limit value), or the rate of increase of the sequence number does not match the evolution of the train position (e.g., the train passes through the loop section at high speed but the sequence number does not increase for a long time), then it is determined that the sequence number evolution does not conform to the expected pattern, triggering a safety protection action. Content dimension verification can be linked with the static failure judgment in S105. If the serial number continues to increase but the key field feature value remains static, it may also indicate that there is a logical anomaly in LOOMO, which can also trigger security protection.

[0052] Based on the above embodiments, in one feasible implementation, during the consistency window processing in S103, after receiving each frame of the loop message, the ATP host compares its key field feature values ​​with the candidate data area feature values ​​and the currently effective reference feature values, respectively. The matching order can be flexibly set, for example, comparing with the candidate data area first, then with the currently effective reference feature value, or vice versa. A preferred matching order is: first compare with the currently effective reference feature value; if they are the same and the candidate data area is not empty, then perform a reverse reset; if they are different, then compare with the candidate data area; if they are the same, then increment the count. When the candidate count reaches a set number of frames N, the candidate data area is submitted. After submission, the original currently effective reference feature value can be archived for fault tracing. When a reverse reset occurs, the zeroing operation includes clearing the data content of the candidate data area and setting the candidate count value to zero.

[0053] Based on the above embodiments, in a feasible implementation, the packet traffic characteristic statistics for channel health calculation can be performed as follows: Within each statistical period (e.g., 1 second), the ATP host classifies and statistically analyzes all received loop packets: total number of received frames, number of frames passing CRC checksums, number of frames with CRC checksum errors, number of duplicate packets (the number of frames with the same key field characteristic value as the previous frame), and number of version switching times (the number of times the key field characteristic value changes). The duplicate packet ratio R_repeat = number of duplicate packets / total number of received frames. The CRC error rate CRC_error_rate = number of CRC checksum error frames / total number of received frames. The burstiness characteristic of CRC error frames can be quantified by statistically analyzing the maximum length of consecutive CRC error frames or the degree of clustering of CRC error frames on the time axis. For example, the average interval between CRC error frames can be calculated; if the average interval is less than a set threshold, it is determined to be highly bursty. The old and new version switching frequency F_switch = number of version switching times / statistical period duration. After the above traffic characteristic statistics are completed, they are substituted into the channel health index calculation formula to obtain H_channel. The weighting coefficients (e.g., 0.4, 0.4, 0.2) in the channel health index calculation can be determined by those skilled in the art through parameter calibration based on actual line test data. The thresholds for setting the high-order interval and the low-order interval can also be adjusted according to the actual operating scenario. For example, [0.7, 1.0] can be set as the high-order interval, and [0, 0.4] as the low-order interval.

[0054] Based on the above embodiments, in one feasible implementation, the ATP host can simultaneously connect to two independent LTM modules (LTM_A and LTM_B), forming a dual-system hot standby redundancy. Since the loop operates in a continuous broadcast mode, slight differences in antenna installation positions between the two LTM systems may cause demodulation timing offsets, rendering the traditional arbitration strategy based on taking the maximum timestamp unusable in this scenario. This application employs content fingerprint comparison for same-source arbitration: Extract the content fingerprints of the ring packets reported by the dual-system ring transmission modules. The content fingerprint can be the same CRC-16 calculation result as the key field feature value, or it can be a hash value calculated from the complete packet content. When the content fingerprint reported by LTM_A is the same as that reported by LTM_B, the dual-system is considered to be from the same source, meaning that both received and demodulated the same ring packet content. In this case, the dual-system data is voted on and submitted as the second effective reference feature value. The voting method can adopt a simple majority principle where the two systems' data are the same, and the pass is granted.

[0055] When the content fingerprints of the two systems differ, joint verification is performed on the key field feature values, loop identification number, and sequence number evolution of the messages from both systems. If only the message reported by LTM_A passes the joint verification, the data of LTM_A is selected as the primary data, and a fault diagnosis alarm is triggered for LTM_B, indicating that LTM_B may have demodulation anomalies or antenna faults. If only LTM_B passes the verification, LTM_B is selected as the primary data. If neither system message passes the joint verification, a safety protection action is triggered directly. If both system messages pass the joint verification but their content fingerprints differ, the sequence number evolution logic of the two systems is further compared, and the system message whose sequence number update logic is more in line with the expected pattern (e.g., the sequence number monotonically increases with a normal step size and has a higher degree of matching with the train position evolution) is selected as the primary data. Verification shows that the dual-system arbitration process provided in this embodiment can still achieve correct arbitration even in extreme scenarios where the demodulation timing offset of the dual-system LTM reaches 200ms.

[0056] See Figure 2 , Figure 2 The following is a message processing timing diagram provided in the embodiments of this application, and the application will be further described in conjunction with specific application scenarios: In the ETCS Level 1 system, the loop broadcast period is 50ms, and the ATP master control period is 100ms. Assuming that initially, the trackside LOOMO broadcasts a v1 message carrying a TSR of 80km / h and an MA endpoint of K10+200, and after LTM demodulation, continuously sends v1 messages to the ATP master. The ATP master executes S101 to acquire each frame of the message and extracts the Key_Hash1 of the v1 message. Assuming that the currently effective reference feature value is also Key_Hash1, S102 determines that they are the same, directly discarding the duplicate frame, only refreshing the last received timestamp, without triggering train control recalculation, thus achieving deduplication and reducing the load of invalid parsing.

[0057] When LOOMO switches to a new configuration, the broadcast sequence may exhibit alternating old and new v1, v2, v1, v2, v2, v2. When the ATP host first receives v2, S102 determines that Key_Hash2 is different from the currently effective reference feature value Key_Hash1, loads v2 into the candidate data area, and starts the count as 1. When v1 is subsequently received, S103 determines that it is the same as the currently effective reference feature value but different from the candidate data area, and performs a reverse reset to clear the candidate data area and the count. When v2 is received again, accumulation starts again. After receiving 3 consecutive frames of v2, the candidate count reaches the set frame number N=3, v2 is submitted as the second effective reference feature value, triggering one recalculation of the vehicle control core. The reverse reset mechanism effectively suppresses the frequent recalculation caused by LOOMO update jitter.

[0058] When the LOOMO logic malfunctions and continuously broadcasts buffered v2 messages, the LTM continuously sends v2 messages with correct CRC. The S104 monitors that the currently effective reference characteristic value Key_Hash2 has not changed for 5.1 seconds, exceeding the preset safety validity period T_valid=5 seconds, triggering a safety protection action, outputting service braking and limiting the train's maximum speed to 45km / h. This mechanism fills the technical gap in existing solutions that cannot identify received but statically displayed, hidden faults.

[0059] When the loop leaky cable is subjected to external electromagnetic interference, the LTM upload sequence contains a large number of CRC error frames. S105 statistics show that the duplicate message ratio is 100% and the CRC error rate is 66%. The calculated channel health index decreases, and the consistency window N is adaptively adjusted from 3 to 5, and T_valid is shortened from 5 seconds to 3 seconds, thereby improving the sensitivity of security monitoring.

[0060] like Figure 3 As shown, the message processing sequence is divided into four stages in chronological order: Phase 1 is normal operation. The trackside LOOP continuously broadcasts version v1 messages. The onboard LTM transmits v1 messages transparently frame by frame. The ATP host extracts the key field feature values ​​and compares them with the effective buffer. If they match, they are determined to be duplicate frames and are directly discarded and the last received time is refreshed. The train control core is not triggered to recalculate. Phase 2 is the LOOMO update jitter. During the configuration switching process, the trackside LOOP will have a message sequence of alternating v1 and v2 jitter. The onboard LTM will transmit the above sequence. When the ATP host receives v2 for the first time, it will load it into the candidate buffer and start counting. When it receives an old message that is consistent with the effective data, it will perform a reverse reset to clear the candidate. After accumulating to the set number of frames, the candidate will be submitted as effective data, triggering the train control core to recalculate once. Phase 3 is a hidden LOOMO fault. After the trackside LOOP logic crashes, it continues to broadcast the buffered v2 messages. The message cyclic redundancy check is correct, but the key field characteristic values ​​remain static for a long time. The ATP host detects that the survival time exceeds the preset safety validity period and triggers a safety downgrade. Phase four is characterized by channel degradation. The loop leaky cable is affected by external electromagnetic interference, resulting in a high error rate in the transmitted messages. After statistically analyzing the message traffic characteristics, the ATP host estimates that the channel health has declined. It then adaptively increases the consistency window setting frame number and shortens the preset security validity period to improve the sensitivity of security monitoring.

[0061] The specific values ​​of the above parameters (such as N=3, T_valid=5s, polynomial 0x8005, weighting coefficients 0.4 and 0.2, speed limit 45km / h, time offset 200ms, etc.) are all exemplary reference values ​​given in the embodiments of this application. In practical applications, those skilled in the art can make adaptive adjustments and settings to these parameters according to specific system configurations and operational needs.

[0062] See Figure 3 , Figure 3 This is a schematic diagram of a loop message processing system provided in an embodiment of this application. The following provides a loop message processing system for performing the steps in the above method embodiments. The system includes: The message acquisition module is used to acquire loop messages. This module may include the input interface unit of the ATP host and the FIFO queue management unit.

[0063] The feature extraction module is used to extract key field feature values ​​from the loop message. This module may include a field parsing unit and a CRC operation unit. The field parsing unit is used to extract the TSR field and MA endpoint field from the loop message, and the CRC operation unit is used to perform a CRC-16 operation on the extracted fields to obtain the Key_Hash.

[0064] The candidate loading and counting startup module is used to load the loop message into the candidate data area and start consistency window counting when the key field feature value differs from the currently effective reference feature value. This module may include a comparison decision unit, a candidate data area management unit, and a counter management unit.

[0065] A consistency window processing module is used to perform the following processes within a consistency window: when a loop message with the same key field feature value as the candidate data area is received, the count is incremented; when the count reaches a set number of frames, the candidate data area is submitted as the second effective reference feature value; when a loop message with the same key field feature value as the currently effective reference feature value but different from the candidate data area is received, the candidate data area and the count are cleared. This module may include a multiplexing unit, an increment control unit, a submission execution unit, and a reverse reset unit.

[0066] The survival time monitoring module is used to monitor the survival time of the currently effective reference feature value. When the survival time exceeds the preset security validity period and the key field feature value has not changed, a security protection action is triggered. This module may include a timer management unit, a threshold comparison unit, and a security action triggering unit.

[0067] The channel health assessment and adaptive adjustment module is used to obtain packet traffic characteristics based on the ring packet statistics, calculate channel health based on the packet traffic characteristics, and adaptively adjust at least one of the set frame number of the consistency window and the preset security validity period based on the channel health. This module may include a traffic statistics unit (for statistics of R_repeat, CRC_error_rate, and F_switch), a health calculation unit (for calculating H_channel), and a parameter adaptive adjustment unit (for adjusting N and T_valid based on H_channel).

[0068] The trusted access output module is used to output the loop message submitted through trusted access as the currently valid loop data. This module may include a differential resolution unit and a data output interface unit.

[0069] In the above system embodiments, the names of each module are based on the technical features in the method steps they execute. The specific working methods of each module can be found in the corresponding descriptions in the method embodiments, and will not be repeated here.

[0070] This application also provides an embodiment of a computer-readable storage medium and a computer program product. Both the computer-readable storage medium and the computer program product may store a computer program that, when executed by a processor, implements the steps of the method described in the above method embodiments.

[0071] It is understood that if the methods in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0072] The computer-readable storage medium provided in this embodiment includes computer programs that implement the corresponding embodiments of the above methods, and the effects are the same as above.

[0073] This application also provides an electronic device, see [link to document]. Figure 4 The present application provides a structural diagram of an electronic device, such as... Figure 4 As shown, it may include a processor 1410 and a memory 1420.

[0074] The processor 1410 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 1410 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 1410 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 1410 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 1410 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0075] The memory 1420 may include one or more computer-readable storage media, which may be non-transitory. The memory 1420 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In this embodiment, the memory 1420 is used to store at least the following computer program 1421, which, after being loaded and executed by the processor 1410, is capable of implementing the relevant steps in the methods executed by the electronic device side as disclosed in any of the foregoing embodiments. In addition, the resources stored in the memory 1420 may also include an operating system 1422 and data 1423, etc., and the storage method may be temporary storage or permanent storage. The operating system 1422 may include Windows, Linux, Android, etc.

[0076] In some embodiments, the electronic device may further include a display screen 1430, an input / output interface 1440, a communication interface 1450, a sensor 1460, a power supply 1470, and a communication bus 1480.

[0077] certainly, Figure 4 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of this application. In practical applications, the electronic device may include more than [other components]. Figure 4More or fewer components as shown, or combinations of certain components.

[0078] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. As the system provided in the embodiments corresponds to the method provided in the embodiments, the description is relatively simple; relevant parts can be found in the method section.

[0079] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of this application.

[0080] It should also be noted that, in this specification, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising a..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for processing loop messages, characterized in that, include: Obtain the loop message and extract the key field feature values ​​of the loop message; If the key field feature value is different from the currently effective reference feature value, the loop message is loaded into the candidate data area and consistency window counting is started; Within the consistency window, when a loop message with the same key field feature value as the candidate data area is received, the count is incremented; when the count reaches a set number of frames, the candidate data area is submitted as the second effective reference feature value. When a loop message that is identical to the currently effective reference feature value and different from the candidate data area is received, the candidate data area and the count are cleared. Monitor the lifespan of the currently effective reference feature value. When the lifespan exceeds the preset security validity period and the key field feature value has not changed, trigger a security protection action. The packet traffic characteristics are obtained based on the ring packet statistics, the channel health is calculated based on the packet traffic characteristics, and at least one of the set frame number of the consistency window and the preset security validity period is adaptively adjusted based on the channel health. The loop message submitted through trusted access will be output as the currently valid loop data.

2. The method for processing loop messages according to claim 1, characterized in that, Before extracting the key field feature values ​​of the loop message, the method further includes: Based on the train's current location and the loop end marker information, predict the set of loop identifiers that should be received; The loop identifier in the received loop message is compared with the predicted set of loop identifiers. When the loop identifier is not within the predicted set of loop identifiers, it is determined to be a misaligned reception or crosstalk between adjacent loops, and the loop message is discarded.

3. The method for processing loop messages according to claim 2, characterized in that, After extracting the key field feature values ​​of the loop message, the process also includes: Based on the current position of the train, predict the reasonable evolution direction of the key business content in the loop message to obtain the expected train positioning evolution. By monitoring the evolution patterns of sequence numbers and version numbers within the loop messages, the expected evolution of sequence numbers can be obtained. When the expected evolution of the sequence number does not match the expected evolution of the train positioning, it is determined to be a trackside logic anomaly, and the safety protection action is triggered.

4. The method for processing loop messages according to claim 3, characterized in that, The monitoring of the sequence number evolution pattern and version number evolution pattern within the loop message to obtain the expected sequence number evolution includes: Determine whether the serial number remains monotonically increasing; If the sequence number is not monotonically increasing, abnormally loops, or its evolution does not match the train's position evolution, the expected evolution of the sequence number is determined to be inconsistent with the expected pattern.

5. The method for processing loop messages according to claim 1, characterized in that, Within the consistency window, when a loop message with the same key field feature value as the candidate data area is received, the count is incremented; when the count reaches a set number of frames, the candidate data area is submitted as the second effective reference feature value. When a loop message with the same current effective reference feature value but a different candidate data area is received, the candidate data area is cleared and the count is reset, including: The key field feature values ​​of the loop message are matched with the candidate data area and the currently effective reference feature value, respectively. When the key field feature value is the same as the candidate data area, the count is incremented; When the count reaches the set number of frames, the candidate data area is submitted as the second effective reference feature value; When the key field feature value is the same as the currently effective reference feature value, the candidate data area is cleared and the count is reset.

6. The method for processing loop messages according to claim 1, characterized in that, The message traffic characteristics include at least: the proportion of duplicate messages within a unit of time, the burst characteristics of cyclic redundancy check error frames, and the frequency of switching between old and new versions within a unit of time; Accordingly, calculating the channel health based on the packet traffic characteristics includes: The channel health index is calculated based on the proportion of duplicate messages, the burst characteristics of the cyclic redundancy check error frames, and the frequency of the old and new version switching; the value of the channel health index is within a set range. The system adaptively adjusts at least one of the set frame number of the consistency window and the preset security validity period based on the channel health index; wherein, when the channel health index is in a set high range, the set frame number of the consistency window is reduced and the preset security validity period is extended; when the channel health index is in a set low range, the set frame number of the consistency window is increased and the preset security validity period is shortened; when the channel health index is in a set high range and the key field feature value is static, the security protection action is triggered in advance.

7. The method for processing loop messages according to claim 1, characterized in that, The dual-system loop transmission module redundancy architecture also includes: Extract the content fingerprints of the loop messages reported by the dual-system loop transmission module respectively; When the content fingerprints of the two systems are the same, the two systems are deemed to be of the same origin and valid. After voting on the data of the two systems, they are submitted as the second effective reference feature value. When the content fingerprints of the two systems are different, the key field feature values, ring identification number and sequence number evolution expectation of the two system messages are jointly verified, and the system message that passes the joint verification is selected as the main data, and the system message that fails the joint verification is given a fault diagnosis alarm. When both system messages fail the joint verification, the security protection action is triggered.

8. A system for processing loop messages, characterized in that, include: The message acquisition module is used to acquire loop messages; The feature extraction module is used to extract the key field feature values ​​of the loop message; The candidate loading and counting start module is used to load the loop message into the candidate data area and start consistency window counting when the key field feature value is different from the currently effective reference feature value; The consistency window processing module is used to perform the following processing within the consistency window: when a loop message with the same key field feature value as the candidate data area is received, the count is incremented; when the count reaches a set number of frames, the candidate data area is submitted as the second effective reference feature value. When a loop message that is identical to the currently effective reference feature value and different from the candidate data area is received, the candidate data area and the count are cleared. The survival time monitoring module is used to monitor the survival time of the currently effective reference feature value. When the survival time exceeds the preset security validity period and the key field feature value has not changed, a security protection action is triggered. The channel health assessment and adaptive adjustment module is used to obtain packet traffic characteristics based on the ring packet statistics, calculate channel health based on the packet traffic characteristics, and adaptively adjust at least one of the set frame number of the consistency window and the preset security validity period based on the channel health. The trusted access output module is used to output the loop message submitted through trusted access as the currently valid loop data.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, implements the steps of the method as described in any one of claims 1 to 7.

Images