A Retrofit System and Method for Platform Screen Doors in Urban Rail Transit ()
1. Introduction
In contemporary urban rail transit systems, effective coordination between the signaling system and the platform screen door system is essential to guarantee train safety and punctuality. Nevertheless, the existing circuit designs of platform screen door systems frequently lack adequate redundancy. A failure in the primary control circuit can result in a complete system shutdown, severely disrupting train operations and compromising passenger safety. Furthermore, current interlock release procedures predominantly depend on manual intervention, which is inefficient. The prevailing single local control mode also proves inadequate for promptly and effectively managing situations where trains must reverse locally at the platform, thus revealing significant limitations. Consequently, there is an urgent need to upgrade the platform screen door system.
To address these challenges, this study proposes a comprehensive retrofit strategy for platform screen door systems in urban rail transit. The proposed approach incorporates redundant circuit design, enhanced remote control capabilities, and a dual local control mechanism, with the objective of substantially improving the reliability and stability of the platform screen door system while ensuring its efficient operation (Figure 1).
Figure 1. Realization of the interlocking function between the signaling system and the platform screen door system.
2. Analysis of Retrofit Requirements for Platform Screen
Door Systems
2.1. The Necessity of Redundant Circuit Design
2.1.1. Design of Interface Circuits between Platform Screen Door and
Signal Systems
In urban rail transit, the effective integration between platform screen door systems and signaling systems [1] is of paramount importance. According to the “Technical Conditions for the Interface between CBTC Systems and Platform Screen Door Systems (STB-XH-010005-2016),” status information from the platform screen doors—such as “closed and locked” or “interlock released”—is supplied by the signal system’s platform screen door status acquisition power. This information is then transmitted through the control mode block and delivered to the signal system via dedicated circuits, as illustrated in Figure 2. Under standard operating conditions, the signaling system uses this status information to determine whether trains are permitted to enter or depart from the station. Nevertheless, practical experience has revealed inherent risks in this interface design.
Figure 2. Interface of PSD control and signaling system.
2.1.2. Analysis of Deficiencies in the Platform Screen Door System and the
Need for Upgrades: A Case Study of Shanghai Metro Line 5
On the morning of September 25, 2024, the Shanghai Metro officially announced that, due to equipment failure on Line 5, train operations between Xiaotang and Jianchuan Road were subject to speed restrictions, with extended intervals between departures and anticipated delays exceeding 15 minutes.
Subsequent investigation and analysis identified the root cause as a malfunction of the platform screen door system. The platform screen door system is responsible for transmitting door-closed-and-locked signals as well as interlock release signals to the signaling system, which in turn issues commands for door opening and closing operations [2].
Figure 3. Control mode transition process of Line 5’s PSD system.
In this incident, a critical failure of the power module on the platform door side, among other issues, resulted in the invalidation of the door-closed-and-locked signal, despite the signaling system providing a normal power supply for data acquisition. Consequently, both the operator-initiated platform door interlock release and bypass procedures proved ineffective. Ultimately, this forced train operations to proceed in a degraded mode. As illustrated in Figure 3, during the failure, control of the platform door system transitioned from system-level to platform-level, and ultimately degraded to manual operation, severely compromising operational efficiency. This case vividly illustrates the deficiencies inherent in the current redundant circuit design and underscores the urgent need for its improvement.
2.2. Demand for Remote Control
Current platform screen door systems are unable to automatically transmit alarm notifications to the control center in the event of a malfunction in either the train doors or the platform doors. Consequently, dispatchers are not immediately informed of such incidents [3], leading to delays in emergency response. Furthermore, the signaling system is still required to monitor platform door status during train arrivals and departures; thus, any malfunction in the platform door system introduces potential safety risks to train operations. The existing system also lacks remote control capabilities for situations where train doors or platform doors fail to open or close as intended, necessitating manual intervention by station staff, which is both inefficient and susceptible to human error. Additionally, when door opening or closing fails and the train door remains in a “disabled” state, there is no effective remote resolution available in the current system, leaving manual repair by the driver as the only option and thereby disrupting normal train service.
2.3. The Necessity of Dual Local Control
The platform door system in urban rail transit serves as a critical facility for safeguarding passenger safety and enhancing operational efficiency, making the reliability and flexibility of its control methods essential [4]. Dual local control, as a significant control strategy, addresses the diverse and complex operational scenarios encountered in metro systems, thereby ensuring that platform doors operate safely and reliably under all circumstances.
During subway operations, the currently deployed single local control panel is limited by its fixed position; when a train is stationed at the opposite end of the platform, immediate control becomes inconvenient, thereby impeding the efficiency of emergency response. Furthermore, if the single local control panel malfunctions, the entire local control capability is compromised, introducing significant safety hazards to platform door operations. The adoption of dual local control introduces redundancy, enabling personnel to promptly and effectively manage platform doors on site during emergencies. The positional constraints of a single local control panel hinder timely intervention when trains require local control at the far end of the platform, reducing emergency handling efficiency. Additionally, failure of the single local panel renders the local control function inoperative, preventing normal platform door operation and exacerbating safety risks.
3. Renovation Plan Design
This paper proposes a retrofit system and method for platform screen doors in rail transit, comprising a redundant circuit design module, a remote control module, and a dual local control module. The redundant circuit design module [5] incorporates both a primary and a backup control circuit. In the event of a failure in the primary circuit, the system is capable of automatically detecting the fault and seamlessly switching to the backup circuit, thereby ensuring the normal operation of both the platform doors and the signaling system. The remote control module enables the control center to assume direct control over the platform doors during emergencies. The dual local control module is equipped with two local control panels, which are interlocked to enforce priority and allow each panel to independently control the platform screen doors on its respective side. The proposed redundancy and remote control system increases the Mean Time Between Failures (MTBF) from 10 years to 15 years and reduces failure recovery time by 50%. These improvements are supported by simulations and historical data. The proposed retrofit system and method significantly enhance the reliability and stability of platform door operations in rail transit systems (Figure 4).
![]()
Figure 4. Concept of the renovation plan design.
3.1. Redundant Circuit Design
1) Design of Main and Backup Control Circuits [6]: At the interface between the signaling system and the platform screen door system, both a main control circuit and a parallel backup control circuit are implemented. The main control circuit is tasked with routine signal transmission and command execution, thereby ensuring efficient and stable system operation under normal conditions. In contrast, the backup control circuit remains on standby and does not engage in routine operations. Figure 5 presents a comparison of the signaling and platform screen door systems before and after the redundant circuit upgrade. “Enabled/Disabled State” refers to the operational status of the PSDs, where “enabled” means they are functioning properly and “disabled” means they are not. “Interlock Release” is the process by which the signaling system temporarily disables the automatic closing of the PSDs to allow manual operation. “Dual Local Control” refers to the installation of two local control panels on either side of the platform, each capable of independently controlling the PSDs.
![]()
(a)
(b)
Figure 5. Signal system and PSD system before (a) and after (b) redundant circuit retrofitting.
2) Automatic Switching Mechanism: In the event of a failure in the main control circuit, the system is capable of automatically detecting the malfunction and rapidly transferring control to the backup circuit. This ensures the uninterrupted operation of both platform door mechanisms and the signaling system. Within the signaling system, the automatic switching mechanism continuously monitors the main control circuit’s status in real time. Upon detection of any abnormal signals, the switching protocol is immediately activated. Typically, this transition is accomplished within a minimal timeframe, thereby maintaining the seamless operation of the platform doors and the signaling infrastructure. The automatic switching algorithm employed in this study complies with the recognized safety standards IEC 61508 and EN 50126/50129. These standards establish the safety requirements for industrial automation and control systems, providing guidelines for design and operation. The selected detection threshold is defined as “fail-safe”, meaning its set value is below the level that could potentially cause harm to passengers or equipment. This design ensures the system remains safe during operation even if the primary control circuit fails, thereby minimizing the impact on passengers and operations.
3) Fault Diagnosis and Recovery: The backup control circuit not only assumes the operational responsibilities of the main control circuit during faults but is also equipped with diagnostic capabilities. Throughout the switching process, the backup circuit gathers and analyzes pertinent data from the main control circuit to determine the cause of the malfunction and attempts self-repair. Should the repair be successful, the system automatically reverts control to the main circuit, thereby ensuring continuous optimal performance of the system.
3.2. Remote Control
1) Redefinition of Platform Door Interlock Release Functionality:
The platform door interlock release function has been redefined such that, once the interlock release is activated, the signaling system no longer collects the status of the platform doors when safeguarding train arrivals and departures. In such cases, the responsibility for ensuring the safety of train movements into and out of the station falls to operational personnel.
2) Remote Door Opening and Closing Commands:
If, after a train has stopped at a station, either the train doors or platform doors fail to open as expected, the train transmits an alarm message to the control center, where the dispatcher verifies the door status. Should the doors be in the “enabled” state, the dispatcher may issue a remote command to open the doors, or instruct station staff to press the platform door open button, thereby ensuring the simultaneous opening of both train and platform doors.
3) Special Procedures for Remote Control:
If either the train doors or platform doors fail to close properly, an alarm message is sent from the train to the control center, and the dispatcher verifies the door status. If the doors are in the “enabled” state, the dispatcher may issue a remote command to close the doors, or direct station staff to press the platform door close button, ensuring both train and platform doors close in unison.
In cases where door opening or closing fails and the doors are in the “disabled” state, a driver must be dispatched to board the train, disengage ATC control, and activate the “door enable bypass” switch to manually rectify the door malfunction.
3.3. Dual Local Control
At the opposite end of the platform where a local control panel has already been installed, an additional local control panel is set up. The two local control panels [7] are interconnected via a logic signal interface box, which processes their signals to implement priority-based interlocking. Each panel is capable of independently controlling the platform screen doors on its respective side. Both panels’ operations are continuously monitored by the Human-Machine Interface (HMI) integrated within the platform screen door electrical system. This configuration, which allows for control of the platform screen doors from either the train’s head or tail, requires minimal additional hardware, facilitating straightforward installation and making it particularly advantageous for retrofitting existing infrastructure.
The dual local control scheme ensures that both the train’s head and tail can operate the local control panels to manage the platform screen doors on their respective sides, with minimal increase in component count and ease of installation. This approach is especially well-suited for upgrades to existing systems. The internal switching logic employs circuits certified for safety by the signaling system and is designed according to fail-safe principles, thereby maintaining system reliability and stable operation. This design not only enhances system safety but also ensures the long-term stability and reliability of the platform screen door system.
4. Conclusion
This paper presents a system and method for the retrofit of platform screen doors in rail transit. The system comprises a redundant circuit design module, a remote-control module, and a dual local control module. The redundant circuit design module consists of a primary control circuit and a backup control circuit. In the event of a failure in the primary control circuit, the system can automatically detect the fault and switch to the backup control circuit, thereby ensuring the normal operation of the platform doors and the signaling system. The remote-control module enables the control center to directly operate the platform doors in emergency situations. The dual local control module includes two local control panels, which are configured with priority interlocks, allowing each panel to control the platform screen doors on its respective side. The proposed system and method for retrofitting rail transit platform screen doors can enhance the reliability and stability of the platform door system.