基于车车通信的列控系统在传统车地通信的基础上，引入了车车通信技术，后车与前车实时通信，极大 地简化了地面设备，提高了列车运行效率。使用 STPA 法对该系统的关键设备(资源管理单元)的安全性进行研究。 以资源管理单元下发临时限速命令的过程为例，识别出过程中的危险行为，找出系统的不安全因素，规划安全性 设计需求。通过安全性设计需求条件搭建该场景的时间自动机网络模型，使用 UPPAAL 对模型进行验证。验证表 明 STPA 方法能够找到列控系统中的控制缺陷，并采用相应的策略，提高系统的安全性，在列控系统的安全性分 析中具有较好的适用性。

Based on traditional train ground communications, the train control system introduces train ground communications technology to realize real-time communications between the rear and front trains, which significantly simplifies the ground equipment and improves the train operation efficiency. This study used the STPA (system theoretic process analysis) method to analyze the security of the resource management unit, which is the key equipment of the system. The process of temporary speed restriction sent by the RMU (resource management unit) is studied as typical of the control scenario. The unsafe behaviors in the process and the unsafe factors of the system are identified, and the SDR (security design requirements) is formulated in the scenario. The timed automata network model of the TSR (temporary speed restriction) sending scenario was built using the SDR condition, and UPPAAL was used to verify the model. The verification shows that the STPA method can find the control defects in the train control system and adopt corresponding strategies to improve the security of the system, which has good applicability in the security analysis of the train control system.

U231