Risk assessment of high-speed railway CTC system based on improved game theory and cloud model

Purpose – In order to solve the problem of inaccurate calculation of index weights, subjectivity and uncertainty of index assessment in the risk assessment process, this study aims to propose a scientific and reasonable centralized traffic control (CTC) system risk assessment method. Design/methodology/approach – First, system-theoretic process analysis (STPA) is used to conduct risk analysis on the CTC system and constructs risk assessment indexes based on this analysis. Then, to enhance the accuracy of weight calculation, the fuzzy analytical hierarchy process (FAHP), fuzzy decision-making trial and evaluation laboratory (FDEMATEL) and entropy weight method are employed to calculate the subjective weight, relative weight and objective weight of each index. These three types of weights are combined using game theory to obtain the combined weight for each index. To reduce subjectivity and uncertainty in the assessment process, the backward cloud generator method is utilized to obtain the numerical character (NC) of thecloudmodelforeachindex.TheNCsoftheindexesarethenweightedtoderivethecomprehensivecloudforriskassessmentoftheCTCsystem.ThiscloudmodelisusedtoobtaintheCTCsystem ’ s comprehensive risk assessment.The model ’ s similarity measurement method gauges the likeness between the comprehensive risk assessment cloud and the risk standard cloud. Finally, this process yields the risk assessment results for the CTC system. Findings – Thecloudmodelcanhandlethesubjectivityandfuzzinessintheriskassessmentprocesswell.The cloud model-based risk assessment methodwas appliedto the CTC systemrisk assessment ofa railwaygroup and achieved good results. Originality/value – This study provides a cloud model-based method for risk assessment of CTC systems, which accurately calculates


Introduction
With the continuous development of China's economy, High-speed railway (HSR) has become the main body of inter-regional rapid transportation in the comprehensive transportation system (Song, Gao, Li, Liu, & Dong, 2023).The HSR dispatching system is the brain and nerve center of the HSR transportation system and plays a huge role in ensuring the safety, punctuality, and efficient operation of HSR trains (Sun, Zhang, Yuan, Gao, & Ding, 2020).With the continuous advancement of science and technology, China HSR dispatching system is based on the Centralized Traffic Control (CTC), realizing the automation and remote control of dispatching and command centered on train operation plan control.The CTC system is mainly composed of three parts: the railway administration central subsystem, the station subsystem, and the network subsystem (Ding, Zhang, Sheng, Chen, & Yuan, 2023), which are highly coupled.If the risks between these subsystems are not handled properly, it may cause CTC system disorder and affect train operating efficiency.In severe cases, it may even lead to major accidents (Zhang et al., 2022).For example, the 2008 Chatsworth train collision in the United States, the 2012 Buenos Aires rail disaster in Argentina, and the 2020 Livraga derailment in Italy indicate potential risk issues with the CTC systems (Xu et al., 2023).Therefore, it becomes an important issue for CTC system developers to focus on improving the safety of the CTC systems.Risk assessment has a strong guiding role in identifying the risks of the CTC systems and reducing accidents.Therefore, it is necessary to study the risk assessment of the CTC systems.
Safety is the eternal theme and the lifeline of railway transportation (Zhang, Li, Yuan, & Yu, 2018).Therefore, many experts and scholars have conducted risk assessments on the development of railway systems and have achieved certain research results.By collecting various accident reports and holding workshops with railway safety experts, Leitner (2017) identified various hazardous events that may directly lead to casualties.And a risk assessment was conducted on the Slovakian railway system by using safety technologies such as Fault Tree Analysis (FTA) technology and Event Tree Analysis (ETA) technology.Alawad, Kaewunruen, and An (2020) proposed a novel framework that uses computer vision and pattern recognition to perform risk management in railway systems (Hwang & Jo, 2013).first used the Preliminary Hazard Analysis (PHA) method to draw the initial hazard sources at the most fundamental stage, and then used Hazard and Operability Study (HAZOP) to evaluate the risks of the railway signaling system.Szaciłło, Krze sniak, Jasi nski, and Valis (2022) used the traditional risk matrix assessment method to assess rail freight transport risks.In order to apply it, the causes and consequences of undesirable events during the implementation of rail freight transport were specified.(Zhang, Xu, & Su, 2013) combined Failure Mode, Effects and Criticality Analysis (FMECA) and Fuzzy Analytical Hierarchy Process (FAHP) to construct a new risk assessment method.Finally, a case study on risk assessment of the interval signal control function for the train control center (TCC) is used to illustrate the application of the proposed risk assessment method.Ilczuk and Kycko (2023) used the Failure Mode and Effect Analysis (FMEA) method and the fuzzy set method, as well as various methods of fuzzification and defuzzification.In order to overcome the inherent imprecision and uncertainty of the available data, Jafarian and Rezvani (2012) improved FTA using fuzzy sets and extended the minimal cut-set and the Fussell-Vesely importance measures of the conventional approach into the fuzzy environment.Considering both existing expertise and uncertainties, such as fuzziness and randomness of the evaluation, Wu, Zhen, and Zhang (2020) evaluated urban rail transit operation safety through the Criterion Relevance (CRITIC) method based on the cloud model and improved criterion importance.Cases were used to prove that the modified method can indeed conduct a scientific, systematic, and objective evaluation of the index system.
The above experts and scholars have provided significant insights into risk assessment.For example, how to deal with fuzziness in risk assessment, calculate the weight of risk factors, etc.For the fuzziness of risk assessment, some experts used fuzzy sets to deal with it, and some experts use cloud models to deal with it.Compared with fuzzy sets, cloud models can better handle the conversion of qualitative data into quantitative concepts.Therefore, using cloud models for risk assessment has become a trend (Zhang, Wu, Chen, Skibniewski, & Zhong, 2015).Another issue in risk assessment is obtaining the weights of risk factors or risk indexes.In the aforementioned research regarding the acquisition of weights, some use the FAHP, while others use the CRITIC.However, these two methods can only obtain subjective weights or objective weights separately.There is relatively few research on combining these two types of weights.Even in cases where studies do combine them, it is often a simple linear combination.As belongs to the operation research theory, game theory can better coordinate the conflicts between different weighting methods, maximizes the mutual benefits of various weighting methods, and obtains the most satisfying combined weight (Wu, Lee, Guizani, & Wang, 2014).Therefore, this paper aims to propose a risk assessment model for the HSR CTC systems, which is based on cloud model theory and uses game theory to obtain the combined weight of risk indexes.
The remainder of this paper is displayed as follows.Section 2 briefly introduces the CTC system and conducts risk analysis on the CTC system using System-Theoretic Process Analysis (STPA), laying the foundation for subsequent CTC system risk assessment.Section 3 introduces three methods of calculating weights and a weight combination calculation method based on game theory.In addition, a brief introduction to the cloud model theory was given, and the risk assessment steps based on the cloud model were given.Section 4 is an example of verifying the method in this article and conducts a risk assessment on the CTC system of a railway administration.Section 5 summarizes this paper and points out the direction for next research.

CTC system risk analysis
The CTC system is a telecontrol system divided into two levels: the central system and the station system.Dispatchers located in the railway administration's dispatch center complete operations such as plan adjustments, route control, and issuance of dispatch orders through various terminal devices in the CTC center system.The operation instruction information is sent to the train service terminal or station autonomous machine of the corresponding station through the communication machine.The station attendant operates the train service terminal to accept the plan issued by the CTC center and sign for the dispatch order.The station autonomous machine generates instructions according to the adjustment plan and sends them to the computer-based interlocking (CBI) system for execution.The station receipt information for the plan and dispatching commands is back to the dispatch center through the communication machine program.The station operation terminal can also directly send instructions to the station autonomous machine.In addition to the internal information exchange of the CTC system, the CTC system also communicates with external systems such as radio block center (RBC), temporary speed restriction server (TSRS), CBI, and TCC through system interfaces for information transmission and feedback.Obviously, the CTC system is a typical control-feedback system.
Regarding risk analysis of complex systems, the most classic and commonly used models are the system-theoretic accident model and process (STAMP) and the STPA based on STAMP (Leveson, 2004).Different from commonly used linear chain-of-events models, such as hazard and operability analysis, FMEA and FTA, etc. STPA considers the interaction between components or the hazards involving non-failure of components (Sulaman, Beer, Felderer, & H€ ost, 2019).STPA starts with identifying types of potential losses of the target High-speed railway CTC system risk assessment system, hazards for those losses, and constraints for the hazards.Then, create a STAMP model for the system, that is, a control structure composed of control actions and feedback between the controller and the controlled process.Next, identify the potential unsafe control actions (UCA) for each control action in the control structure that could result in system hazards and losses.Finally, determine how each UCA occurs and how it propagates to system losses (loss scenario).The analysis process of STPA is shown in Figure 1.
The steps for conducting risk analysis on the CTC system using STPA are as follows.
Step1: Define possible losses and hazards in the CTC system.The following three losses and eight hazards are defined according to the functions of the CTC system, as shown in Table 1 and Table 2, respectively.
Step 2: Define the CTC system control structure.Based on the functions of the CTC system and the information flow of its interaction with other systems, the control structure of the CTC system is established.The control structure of the CTC system is shown in Figure 2.
Step 3: Identify the UCA of the CTC system.Considering the constraints of space, this paper takes the interaction between the dispatcher and the CTC system as an example for illustration, as shown in Table 3.
Step 4: Determine how each UCA occurs.The possible causes of UCA and the loss scenario caused by UCA are shown in Table 4.

Combined weight calculation method based on game theory
The acquisition of index weights is crucial for risk assessment, and its accuracy directly impacts the risk evaluation results.The consideration of weights is mostly focused on subjective or

STAMP/STPA
Why would a UCA occurs Why would control action be improperly executed or not executed The analysis process of STPA Table 1.Losses of the CTC system objective weights.However, there is relatively less emphasis on correlation weights.From the perspective of information theory, if one index significantly influences another, indicating that the former provides more information than the latter, and it should be assigned a higher weight.Therefore, calculating correlation weights for indexes is also reasonable.

Source(s): Authors' own work
3.1.1Calculation of subjective weights.Analytical Hierarchy Process (AHP) is a classical method for calculating subjective weights, but in constructing the judgment matrix, it is challenging for experts or decision-makers to make precise pairwise comparisons among indexes.In order to overcome this problem, this paper uses triangular fuzzy numbers (TFN) to improve AHP.
The definition of the TNF is as follows.
Definition 1.If Q is a TNF, then it can be represented as: where X represents the range of values for the input variable x, and μ(x) is the membership degree of x, with its membership function as: As shown in Figure 3, a, b, and c are the lower, median, and upper bounds of the TNF, respectively.
, and it can be also expressed as: Hazard-ID Description

H-1
The train departing without proper handling or incorrect handling of blocking procedures resulted in the occurrence of L-1 H-2 Receiving or departing without preparing the receiving or departing route resulted in the occurrence of L-1 H-3 Incorrectly handling the train departure voucher before departure or delaying the train resulted in the occurrence of L-1 H-4 Shunting conflict resulted in the occurrence of L-2 H-5 Shunting derailment resulted in the occurrence of L-2 H-6 Switch misalignment resulted in the occurrence of L-2 H-7 Locomotives and Vehicles slip into the section or station resulted in the occurrence of L-2 H-8 Train colliding with pedestrians resulted in the occurrence of L-3 Source(s): Authors' own work

RS
The simple steps are as follows.
Step 1: According to Table 5, use the TNF to compare n indexes pairwise and construct a fuzzy judgment matrix Q.
Step 2: Calculate the fuzzy relative weights of the j-th index with respect to other indexes.(5) Step 3: According to the calculation degree of possibility in Equation ( 3), the possibility of the j-th index compared to other indexes is calculated: High-speed railway CTC system risk assessment Step 4: Normalize dðQ i Þ to obtain the subjective weights of the indexes.
UCA Possible cause

Loss scenario
The dispatcher did not modify the instructions The shunting work order issued to the locomotive did not receive a receipt in time H-1 or H-2 The wireless shunting route arrangement application information sent by the driver to the autonomous machine was not received The train operation adjustment plan is being implemented, but the adjustment time calculated by the autonomous calculation has not yet started The dispatcher modified the instructions Received wrong receipt information H-3 The wireless shunting route arrangement application information received from the driver to the autonomous machine is incorrect Dispatchers modify instructions when they make mistakes The shunting work order sent to the locomotive has not received a receipt H-1 or H-2 or H-3 The wireless shunting application information sent by the driver to the autonomous machine was not received in time During the execution of the train operation adjustment plan, the shunting time calculated by the autonomous machine was wrong The successive route resulted in the operating time of various trains not being implemented according to the standard time . . . . . . . . .Note(s): "..." indicates that the table is not fully displayed.Due to the space limit of the paper, only a part of the table has been intercepted Source(s): Authors' own work   The interrelationship between indexes has a significant impact on the weights of the indexes.Therefore, for risk assessment, relative weights also need to be calculated.Decision-making Trial and Evaluation Laboratory (DEMATEL) is a comprehensive method for building and analyzing a structural model involving causal relationships between complex factors.However, it is also subjective.Similar to AHP, DEMATEL can be enhanced by using TNF to calculate the relative weights of indexes.The steps of the Fuzzy Decision-making Trial and Evaluation Laboratory (FDEMATEL) are as follows: Step 1: According to Table 5, a fuzzy initial direct-relation matrix B is constructed using TNF to represent the degree of mutual influence among n indexes.
Step 2: The Converting Fuzzy data into Crisp Scores (CFCS) method is used to defuzzify P to obtain the direct-relation matrix D (Zhang et al., 2015).Then, calculate the standard direct influence matrix, standardize the direct influence matrix D according to Equation ( 9), and obtain the standardized direct-relation matrix G.
Step 3: Calculate the total relation matrix T. The calculation equation is as follows.
where E represents the identity matrix.
Step 4: Calculate the relevance of indexes r j .
The greater the relevance of an index, the greater its impact on other indexes.In the context of risk assessment, higher relevance indicates greater risk, and consequently, the weight assigned to it is also higher.Normalize the relevance to obtain the correlation weight of the index.
Importance Influence TNF(a, b, c)
Step 1: Establish risk assessment matrix Y composed of m evaluation experts and n evaluation indexes.
Step 2: If the indexes have the benefit index or the cost index, then the benefit index is normalized according to Equation ( 14), and the cost-type index is normalized according to Equation ( 15): Step 3: According to the definition of entropy in the information theory, the information entropy of the j-th evaluation index is: where Step 4: Calculate the weight of the index based on information entropy.
3.1.4Combined weights based on game theory.Compared with the general linear combined method, the combined weight method based on game theory can better balance the differences between different weight calculation methods, making the acquisition of combined weight more reasonable and accurate (Xie et al., 2022).
Assuming that the index weights W k ; ðk ¼ 1; 2; :::; LÞ are obtained through L methods, these weights are then subject to arbitrary linear combinations.

RS
where α k is the coefficient for the linear combination, and α k > 0.
Based on game theory, seek the most satisfied W * in the possible vector sets and the most satisfied weight coefficient α k to minimize the deviation between W * and W k .min According to the differential properties of the matrix, the first derivative of Equation ( 20) is transformed into a system of linear equations.

Cloud model theory
In 1995, Academician Li Deyi proposed the cloud model theory based on probability theory and fuzzy set theory.This model can implement the uncertain transformation between a qualitative concept and its quantitative instantiations quantitative aspects, effectively overcoming uncertainty issues in conventional risk assessments (He & Liu, 2020).

3.2.1
Basic concepts of cloud model.Let U be a domain of discourse represented by quantitative values and C be the qualitative concept on U. If the qualitative value is x ∈ U and x is a random implementation of the qualitative concept C, the certainty degree U ðxÞ ∈ ½0; 1 of x with regard to C is the random number with a steady tendency (Wu et al., 2014), that is, Then, the distribution of x on the domain U is called a cloud, and each ðx; μðxÞÞ is called a cloud droplet.Cloud models can be divided into triangular clouds, rectangular clouds, trapezoidal clouds, and normal clouds, according to the different shapes of clouds.In the real High-speed railway CTC system risk assessment world, since a large number of random phenomena generally obey normal distribution, this paper adopts the normal cloud distribution model as the modeling object.In this paper, the term "cloud model" specifically refers to the normal cloud model.

3.2.2
The numerical character of cloud model.The numerical character (NC) of the cloud is represented by three values: expectation Ex, entropy En, and hyper entropy He, which are recorded as C(Ex, En, He).The expectation Ex represents the distribution expectation of cloud droplets in the domain space, reflecting the points in the domain space that can best represent qualitative concepts.The entropy En represents the degree of determinism of qualitative concepts, reflecting the size of the range of values that the domain space can be accepted by qualitative concepts.The hyper entropy He represents the determinism measure of entropy, reflecting the degree of dispersion of cloud droplets (Wang, Wang, Wang, Au-Yong, & Ali, 2021).Figure 4 is an example of a cloud model with Ex 5 0.5, En 5 0.2, He 5 0.015, and cloud drop number N is set as 4000.
There are two methods for determining the NC of cloud mode: one is the backward cloud generator method, which is mainly used to generate NC for index evaluation.This method is based on statistical principles, transforming data into NC C(Ex, En, He) representing qualitative concepts of clouds, and then forming a normal cloud.The algorithm steps are as follows.
Input: M experts' assessment of risk indexes x i ði ¼ 1; 2; :::; M Þ. Output: Cloud model NC C(Ex, En, He) of evaluation indexes.Firstly, Calculate the sample mean, which is the expectation Ex.
Next, calculate the sample variance.
Finally, calculate the entropy En and hyper entropy He.
Another NC generation method is mainly used to generate the NC of the assessment standard cloud, that is, the NC that determines the assessment level.Suppose the left boundary of each level scoring interval of the assessment index is C min and the right boundary is C max .Then, the cloud model NC is determined using Equation (28).8 < : where η is a constant that can be adjusted according to the fuzzy threshold of the variable.Its value is generally determined by experience and can be adjusted according to the actual situation.
3.2.3Cloud model similarity measurement.Similarity measurement can be performed between two different cloud models.The traditional method is to use the expectation Ex as the benchmark.Although this method is simple, it does not take into account the two NC of En and He, so the results of the similarity measurement are rough.
In order to calculate the similarity measure of cloud models more accurately, the paper proposes a cloud model similarity measurement method based on the improved expectation curve and Kullback-Leibler (KL) divergence.
KL divergence is an asymmetry measure of the difference between two probability density functions (PDF).It is often used to measure the difference between two PDFs.The greater the KL divergence, the greater the difference between the two PDFs (Budka, Gabrys, & Musial, 2011).
This paper uses KL divergence to measure the difference in the modified expectation curves of two cloud models, thereby measuring the similarity of the two cloud models.For continuous random variables P and Q, their PDFs are p(x) and q(x), respectively, and the KL divergence is defined as follows.
According to the difference ðC 1 ; C 2 Þ , the similarity measurement formula for cloud models is defined as.
3.3 Risk assessment method based on improved game theory and cloud model 3.3.1 Building the risk assessment indexes for the CTC system.The STPA method was utilized to conduct a risk analysis of the CTC system and establish risk assessment indexes for it.These indexes are divided into two levels: the first level comprises three indexes, while the second level consists of 12 indexes, as illustrated in Figure 5.

3.3.2
Obtain the cloud model NC of risk assessment index and standard.Assume that M experts evaluate the risk indexes of the CTC system, and the expert's evaluation result is x i ði ¼ 1; 2; :::; M Þ. Calculate the NC of the cloud model for the risk index based on Equations ( 24) ∼ (27).
For the assessment standard, use the natural optimal golden section model to determine the score interval and standard cloud model parameters within the scoring interval [0,1], then obtain the NC of the assessment standard cloud according to Equation ( 28), as depicted in Table 6.
Generating a standard assessment cloud map through the cloud NC of the standard assessment, as shown in Figure 6.
3.3.3Generate CTC system comprehensive assessment cloud.After obtaining the NC of the risk assessment index, and considering the different weights assigned to each index, it is necessary to perform a weighted aggregation operation on the NC of the index assessment to obtain the final comprehensive assessment cloud.

Conclusion
The HSR CTC system is crucial to ensuring the driving safety of high-speed railway trains, and risk assessment is an important means of safety management.Considering the fuzziness and difficulty of quantifying risks, this paper proposes a cloud model-based risk assessment method for CTC systems.Furthermore, this method was used to conduct a risk assessment on the CTC system of a certain railway administration, achieving good application results and providing relatively actual system risk assessment results.The main conclusions are: (1) STPA was used to conduct risk analysis on the CTC system, and a two-level risk index system was constructed for the CTC system.The proposed index system can cover the risk attributes of the CTC system effectively and lays the foundation for the risk assessment of the CTC system.
(2) The weight of the risk index is significant for the calculation of risk assessment.The combined weight calculation method based on game theory overcomes the shortcomings of the low accuracy of a single weight calculation method.
(3) The cloud model can overcome shortcomings such as fuzziness and difficulty in quantification in the risk assessment process.Compared with a single numerical assessment, the assessment results are more intuitive.The effectiveness of the method was verified by conducting a risk assessment on the CTC system of a certain railway administration, which can provide theoretical and methodological support for risk assessment of the CTC system.
(4) The backward cloud generator method in this paper exhibits some errors in hyperentropy estimation when the sample size is small.Therefore, future research will focus on enhancing the reverse cloud algorithm to improve the accuracy of the evaluation results.
Chen, Y., Li, X., Wang, J., Wang, W., & Qiu, S. (2023) The cloud map of the human-machine interface of CTC system 0.002 0.926 IV The cloud map of information exchange between CTC system and external systems 0.001 0.963 IV The cloud map of reliability of CTC system 0.001 0.997 IV The comprehensive cloud map of CTC system risk assessment 0.001 0.958 IV Source(s): Authors' own work Figure 1.The analysis process of STPA Figure 3. Schematic diagram of the TNF

Figure 4 .
Figure 4. Cloud model diagram Figure 8.The cloud map of the human-machine interface of CTC system

Figure 10 .
Figure 10.The cloud map of reliability of CTC system Figure 11.The comprehensive cloud map of CTC system risk assessment

Table 2 .
Hazards Report time point information; Dispatching order receipt Manual modification instructions; Manual triggering instructions; Manually handling train routes; Issue dispatching order ... Manual modification instructions; Manual triggering instructions; Manually handling train routes; Issue dispatching order ... Source(s): Authors' own work

Table 5 .
Calculation of objective weights.The basic steps of the entropy weight method are as follows

Table 6 .
The NC of the assessment standard cloud (0.691,0.064,0.0081)The CTC system risk has reached a critical level, and certain improvement measures must be implemented for the risk III Medium Risk [0.407,0.593](0.500,0.031,0.0050)The CTC system has the risk of reduced system performance and reduced transportation efficiency IV Slightly Low Risk [0.117,0.501](0.309,0.064,0.0081)The CTC system operates well, risks in the system can be dealt with in a timely manner, and the main functions of the system can be realized Source(s): Authors' own work . Research on risk assessment model of catenary based on causative Bayesian network.Journal of Railway Science and Engineering, 20(8), 3067-3071.

Table 11 .
The NC of the firstlevel index