DE102024203589A1 - Procedure for securing the functionalities of a passenger car - Google Patents

Abstract

The invention relates to a method for safeguarding functionalities (6, 7, 8) of a passenger car (PW1) in rail transport. The functionalities (6, 7, 8) of the passenger car (PW1) are controlled by a primary vehicle control (1) in the passenger car (PW1), wherein the primary vehicle control (1) sends respective control commands to the functionalities (6, 7, 8). During normal operation, the primary vehicle control (1) transmits status information to a communication link (9) of the passenger car (PW1). The status information transmits functional information that signals a technical status of the functionalities and the primary vehicle control (1). The communication link (9) examines the status information. If a fault in the primary vehicle control (1) is detected, the communication link (9) requests redundant control commands for the functionalities (6, 7, 8) from a stationary control point (LS). The redundant control commands are transmitted from this to the communication link (9). The redundant control commands are transmitted to the functionalities (6, 7, 8) via the communication link (9) when the primary vehicle control (1) is deactivated and executed by them.
The communication link (9) monitors the communication between the communication link (9) and the stationary control point (LS). If a communication fault is detected, a failure function (11) stored in the passenger car (PW1) is executed via the communication link (9), which sets the functionalities (6, 7, 8) to be controlled to a predefined state.

Description

The invention relates to a method for securing the functionalities of a passenger car in rail transport.

Introduction and state of the art

In railway technology, passenger cars must have a particularly high level of technical availability in order to ensure essential functions during operation of the passenger car.

These include, in particular, controls that influence the well-being and safety of passengers, namely the control of lighting, power supply and air conditioning in the passenger car.

A primary vehicle control system is provided in the passenger car, which takes over the control of the essential functions of the passenger car during normal operation.

A secondary vehicle control system is provided in the passenger car for emergency operation. This system takes over control of the car's essential functions if the primary vehicle control system malfunctions or fails completely.

The secondary vehicle control system enables at least a limited technical operation of the passenger car within the framework of a “redundancy control system, RSG”, for example by taking over a simplified control of the lighting, the power supply and a simplified control of a consumer circuit of the passenger car.

3 shows a schematic representation of a passenger car PW constructed and secured in this way according to the known state of the art.

1. 1 - eine primäre Fahrzeugsteuerung,
2. 2 - eine Redundanzsteuerung als sekundäre Fahrzeugsteuerung,
3. 3 - Bedienelemente,
4. 4 - ein erstes I/O-System („Input/Output-System“),
5. 5 - ein zweites I/O-System („Input/Output-System“),
6. 6 - eine Energieversorgung,
7. 7 - (zumindest) ein Verbraucherkreis und
8. 8 - eine Beleuchtung.

The following functionalities are provided in the passenger car PW:

1. 1 - a primary vehicle control,
2. 2 - a redundancy control as secondary vehicle control,
3. 3 - Control elements,
4. 4 - a first I/O system (“input/output system”),
5. 5 - a second I/O system (“Input/Output system”),
6. 6 - an energy supply,
7. 7 - (at least) one consumer group and
8. 8 - a lighting.

The connections between the functionalities shown here are logical connections realized through data traffic. Associated data is transmitted via a common vehicle bus (e.g., Ethernet, MVB, CAN, etc.).

During normal operation, the primary vehicle control 1 continuously controls all necessary functions of the passenger car PW.

The vehicle control system 1 uses the first I/O system 4 to send respective control commands to assigned functionalities, namely in particular to the power supply 6, to the consumer circuit 7 and to the lighting 8.

Accordingly, the primary vehicle control 1 receives the respective signals of the aforementioned functionalities with the aid of the first I/O system 4.

The first I/O system 4 also receives control commands from the control elements 3, with which train personnel can perform operating actions (e.g. switching lights on or off or dimming, etc.).

Redundancy control 2 is activated in the described normal operation, but does not itself control the functionalities via control commands.

The redundancy control 2 continuously monitors the function of the primary vehicle control 1 or the function of the first I/O system 4 with the help of appropriate sensors.

If the redundancy control 2 detects a fault, it takes over control of the functionalities considered important in fault mode.

In this case, the redundancy controller 2 deactivates the primary vehicle controller 1 and transmits control commands to the functionalities considered essential using the second I/O system 5.

In this example, the redundancy control 2 ensures the correct function of the power supply 6, the consumer circuit 7 and the lighting 8.

The disadvantage here is that the required software, the secondary redundancy control and the second I/O system as well as the data bus required for the connection are kept in reserve for a fault that rarely or never occurs during the life cycle of a passenger car.

This results in correspondingly high costs for the operation and maintenance of the aforementioned functionalities in each individual passenger car.

Task

It is therefore the object of the invention described below to provide a method for a cost-effective and simply constructed safeguarding of functionalities of a passenger car in rail transport.

This problem is solved by the features of patent claim 1. Advantageous further developments are specified in the dependent patent claims.

Description of the invention

The invention relates to a method for safeguarding the functionalities of a passenger car in rail transport. The functionalities of the passenger car are controlled by a primary vehicle control system in the passenger car, with the primary vehicle control system sending respective control commands to the functionalities.

During normal operation, the primary vehicle control system transmits status information to a communication link in the passenger car. This status information transmits functional information that signals the technical status of the functionalities and the primary vehicle control system.

The communication link examines the status information. If a fault in the primary vehicle control system is detected, the communication link requests redundant control commands for the functionalities from a fixed control point. The redundant control commands are transmitted from the fixed control point to the communication link.

The redundant control commands are transmitted to the functionalities via the communication connection when the primary vehicle control is deactivated and are executed by them.

The communication link monitors communication between the communication link and the stationary control point. If a communication failure is detected, a failover function stored in the passenger car is executed via the communication link (9), which sets the functionalities to be controlled to a predefined state or default state.

In a beneficial further training, the functionalities influence the well-being and safety of passengers in passenger cars.

In an advantageous further development, the functionalities are used to control a power supply and/or a controlled consumer circuit and/or a control of lighting in the passenger car.

In an advantageous further development, the communication connection uses the status information transmitted by the vehicle control system to continuously and cyclically create a process image that contains the functional information on the functionalities.

In an advantageous further development, the process image is transferred to the control point and evaluated there in order to create the redundant control commands.

Advantages:

The present invention saves hardware and software costs per passenger car.

Changes to the redundancy control software are made centrally via the landside and transmitted to assigned passenger cars via remote data transmission (e.g., via mobile phone).

The present invention allows changes to the redundancy control software to be transferred to all passenger cars in a vehicle fleet or to address only a single car or a group of passenger cars.

The present invention enables changes to the redundancy control software to be made easily and cost-effectively.

The present invention eliminates the need for maintenance personnel to perform manual work on passenger cars.

The present invention makes it possible to make functional adaptations of the control software to different vehicle types or types of passenger cars via the land side.

Character description:

• 1 in einer prinzipiellen Darstellung einen Personenwagen mit einer erfindungsgemäßen Absicherung,
• 2 in einer Übersicht und bezogen auf 1 landseitige Software-Elemente, und
• 3 den in der Einleitung beschriebenen Personenwagen als Beispiel zum bekannten Stand der Technik.

The invention is explained in more detail below with the aid of a drawing. It shows:

• 1 in a schematic representation of a passenger car with a protection device according to the invention,
• 2 in an overview and related to 1 land-based software elements, and
• 3 the passenger car described in the introduction as an example of the known state of the art.

1 shows a basic representation of a passenger car PW1 with a protection device according to the invention.

1

eine primäre Fahrzeugsteuerung,

3

Bedienelemente,

4

ein erstes I/O-System („Input/Output-System“),

5

ein zweites I/O-System („Input/Output-System“),

6

eine Energieversorgung,

7

einen oder mehrere Verbraucherkreise,

8

eine Beleuchtung,

9

eine Kommunikationsanbindung,

10

ein Prozessabbild PROAB,

11

eine Ausfallfunktion, und

13

ein GPS-Empfänger.

The following functionalities are provided in the PW1 passenger car:

1

a primary vehicle control,

3

Controls,

4

a first I/O system (“input/output system”),

5

a second I/O system (“input/output system”),

6

an energy supply,

7

one or more consumer groups,

8

lighting,

9

a communication connection,

10

a process image PROAB,

11

a failure function, and

13

a GPS receiver.

• ITSYS - ein IT-System und
• 15 - eine Redundanzsteuerung.

The following functionalities are provided in a fixed control point known as landside LS:

• ITSYS - an IT system and
• 15 - a redundancy control.

The landside LS and the passenger car PW1 are connected to each other via the respective “remote communication with antennas” functionalities 12 and 14, which are preferably part of a mobile radio system.

The connections between the functionalities shown here are logical connections realized through data traffic. Associated data is transmitted via a common vehicle bus (e.g., Ethernet, MVB, CAN, etc.).

During normal operation, the primary vehicle control 1 continuously controls all necessary functions of the passenger car PW1.

• - die Energieversorgung 6,
• - an den Verbraucherkreis 7 und an
• - die Beleuchtung 8.

The vehicle control system 1 uses the first I/O system 4 to send respective control commands to assigned functionalities, namely in particular to:

• - the energy supply 6,
• - to consumer group 7 and to
• - the lighting 8.

Accordingly, the primary vehicle control 1 receives the respective signals and information of the aforementioned functionalities with the aid of the first I/O system 4.

The first I/O system 4 also receives control commands from the control elements 3 at the primary vehicle control 1, with which a train crew can perform an operating action (e.g. switching lights on or off or dimming, etc.).

During normal operation, the primary vehicle control unit 1 cyclically and continuously sends status information to the communication connection 9.

• - zur Energieversorgung 6,
• - zum Verbraucherkreis 7,
• - zur Beleuchtungssteuerung 8,
• - zu den Bedienelementen 3,

sowie

• - zur primäre Fahrzeugsteuerung 1 und
• - zum ersten I/O-System 4.

This status information contains functional information on the functionalities controlled by the primary vehicle control 1, namely

• - for energy supply 6,
• - to consumer group 7,
• - for lighting control 8,
• - to the controls 3,

as well as

• - to primary vehicle control 1 and
• - to the first I/O system 4.

The functional information of functionalities 3, 6, 7, 8 allows a statement to be made about the (technical) status of the respective functionality, for example in the form of diagnostic information.

The functional information of functionalities 1 and 4 allows a statement to be made as to whether these two functionalities are operating smoothly or whether there is a malfunction.

The status information also contains a so-called “live byte” with which communication failures between sending and receiving functionalities, i.e. failures in data traffic or in the vehicle bus, can be detected.

• - Energieversorgung 6,
• - Verbraucherkreis 7,
• - Beleuchtungssteuerung 8,
• - Bedienelementen 3,
• - primären Fahrzeugsteuerung 1,
• - ersten I/O-System 4.

The communication connection 9 generates using the information provided by the vehicle control 1 transmitted status information in a unit 10 continuously and cyclically a so-called process image PROAB, which contains the functional information on the following functionalities:

• - Energy supply 6,
• - Consumer group 7,
• - Lighting control 8,
• - Control elements 3,
• - primary vehicle control 1,
• - first I/O system 4.

The process image PROAB is provided with time information, location information and a suitable checksum in order to detect data corruption.

The location information preferably comes from the GPS receiver 13, which can also be used to determine the time information.

The process image PROAB is transferred to the IT system ITSYS of the landside LS using a secure data transmission method (e.g. using VPN tunnel technology) and remote communication 12 and 14.

The IT system ITSYS receives and evaluates the process image PROAB based on the transmitted checksum and based on the transmitted time information.

If the process image PROAB is deemed valid, it is forwarded to further processing onshore. Using the IT system ITSYS, a functional evaluation of the vehicle control system 1 and the first I/O system 4 is performed using the respective functional information transmitted in the process image PROAB.

If it is determined onshore that the vehicle control system 1 or the first I/O system 4 is malfunctioning, the redundancy control system 15 is activated. Based on the process image PROAB, this system generates suitable control commands with the aim of replacing the malfunctioning primary vehicle control system 1.

The control commands are generated cyclically and continuously by the redundancy controller 15.

When generating the control commands, the redundancy controller 15 may also use the location information of the GPS receiver 13 contained in the process image PROAB in order to take local conditions (e.g. upcoming tunnel passages) into account when controlling the functionalities.

• - Energieversorgung 6,
• - Verbraucherkreis 7, und
• - Beleuchtung 8.

The control commands of the redundancy controller 15 are addressed to the following functionalities:

• - Energy supply 6,
• - Consumer group 7, and
• - Lighting 8.

If a fault in the vehicle control system 1 or the first I/O system 4 is detected onshore, the onshore IT system ITSYS sends corresponding information together with the control commands of the redundancy control system 15 to the communication connection 9.

The communication connection 9 distributes the control commands of the redundancy control 15 to the aforementioned functionalities via the second I/O system 5. This ensures at least limited operation of the passenger car PW1.

The control commands of the redundancy control 15 are again securely transmitted to the passenger car PW1 and checked for their validity via the communication connection 9.

A special case of the described procedure is the situation when a total failure of the primary vehicle control 1 occurs on the vehicle side. This total failure is directly detected by the communication connection 9 because the status information and "live bytes" normally sent by the primary vehicle control 1 are simply missing in this case.

In this case, the communication connection 9 requests the creation and retransmission of the control commands of the redundancy control 15 from the land-based IT system ITSYS via the remote communication 12 and 14.

• - Sowohl für den Übertragungsweg vom Personenwagen PW1 zur Landseite als auch für den Übertragungsweg zurück gilt, dass die empfangende Einheit empfangene Signalinhalte ignoriert bzw. verwirft, wenn bei der Übertragung ein Fehler oder eine Verfälschung erkannt wird.
• - In diesem Fall bleiben die jeweils zuletzt empfangenen und als gültig erachteten Signalinhalte so lange aktiv, bis eine fehlerfreie Übertragung vorliegt.
• - Sowohl die Landseite LS als auch die Kommunikationsanbindung 9 senden beim Empfang eines gültigen Signalinhalts eine Empfangsbestätigung zurück. Somit kann die jeweils sendende Einheit erkennen, dass neue Befehle bzw. Informationen angekommen sind und zur Verarbeitung anstehen.
• - Sollte die Kommunikation zwischen dem Personenwagen PW1 und der Landseite LS dauerhaft gestört sein, wird auf dem Personenwagen PW1 ein entsprechender Diagnosevermerk sowie eine Warnung an einen Triebfahrzeugführer bzw. an ein Zugpersonal ausgegeben. Entsprechend wird auf der Landseite ein entsprechender Diagnosevermerk vorgenommen und landseitiges Personal informiert.
• - Der Personenwagen PW1 ist derart konstruiert, dass bei Software- oder Übertragungsfehlern zur Landseite LS kein gefährlicher Zustand entstehend kann und eine entsprechende Eigensicherung des Fahrzeugs vorhanden ist.
• - Optional kann die Kommunikationsanbindung 9 direkt auf das erste I/O-System 4 zugreifen. Dies ermöglicht es, ggf. auf das zweite I/O-System 5 zu verzichten.

Further details of the invention are briefly described below:

• - For both the transmission path from the passenger car PW1 to the landside and the transmission path back, the receiving unit ignores or discards received signal content if an error or corruption is detected during transmission.
• - In this case, the last signal contents received and considered valid remain active until an error-free transmission is achieved.
• - Both the landside LS and the communication link 9 send when receiving of a valid signal content. This allows the sending unit to recognize that new commands or information have arrived and are waiting to be processed.
• - If communication between passenger car PW1 and the landside LS is permanently disrupted, a corresponding diagnostic note will be displayed on passenger car PW1 and a warning will be sent to the driver or train crew. A corresponding diagnostic note will be made on the landside, and landside personnel will be informed.
• - The passenger car PW1 is designed in such a way that in the event of software or transmission errors on the land side LS no dangerous situation can arise and the vehicle has appropriate internal safety features.
• - Optionally, the communication connection 9 can directly access the first I/O system 4. This makes it possible to dispense with the second I/O system 5 if necessary.

• - Energieversorgung 6,
• - Verbraucherkreis 7, und
• - Beleuchtungssteuerung 8

bei einer Störung in einen vordefinierten Zustand bzw. Grundzustand versetzt.In addition to the above example, a failure function 11 is provided on the part of the passenger car PW1, which controls the functions of the components

• - Energy supply 6,
• - Consumer group 7, and
• - Lighting control 8

in the event of a fault, it is put into a predefined state or basic state.

The failure function 11 is used when the communication between communication connection 9 and the landside LS fails completely or the communication is disrupted.

The failure function 11 cannot be influenced by the vehicle control 1 or by the communication connection 9.

The failure function 11 can be updated or influenced by the landside (LS) as long as the associated communication is stable and available.

2 shows in an overview and related to 1 land-based software elements.

On the land side LS, a software container SW1, SW2, SW3 is stored for each vehicle or for each individual passenger car PW1, PW2, PW3,

The software container SW1 contains the control commands SB1, which are provided for the passenger car PW1 via the redundancy control 15.

The software container SW2 contains the control commands SB2, which are provided for the passenger car PW2 via the redundancy control 15.

The software container SW3 contains the control commands SB3, which are provided for the passenger car PW3 via the redundancy control 15.

The software container SW1 contains the process image PROAB of the passenger car PW1.

The software container SW2 contains the process image PROAB of the passenger car PW2.

The software container SW3 contains the process image PROAB of the passenger car PW3.

The software containers SW1 to SW3 are designed so that they cannot negatively influence each other. This ensures that in the event of a software error in a software container for a first passenger car, the control of other passenger cars is not affected.

Claims (8)

Method for safeguarding functionalities (6, 7, 8) of a passenger car (PW1) in rail transport, - in which the functionalities (6, 7, 8) of the passenger car (PW1) are controlled by a primary vehicle control (1) in the passenger car (PW1), the primary vehicle control (1) sending respective control commands to the functionalities (6, 7, 8), - in which the primary vehicle control (1) transmits status information to a communication link (9) of the passenger car (PW1) during normal operation, - in which functional information is transmitted via the status information, signaling a technical status of the functionalities and the primary vehicle control (1), - in which the communication link (9) examines the status information and, if a fault in the primary vehicle control (1) is detected: ◯ the communication link (9) requests redundant control commands for the functionalities (6, 7, 8) from a fixed control point (LS), ◯ the redundant control commands are transmitted from this to the communication connection (9), ◯ the redundant control commands are transmitted by the communication communication connection (9) when the primary vehicle control (1) is deactivated to the functionalities (6,7,8) and are executed by them, and - in which the communication connection (9) monitors the communication between the communication connection (9) and the fixed control point (LS) and, in the event of a detected disruption of the communication via the communication connection (9), executes a failure function (11) stored in the passenger car (PW1), with which the functionalities to be controlled are put into a predefined state. Procedure according to Claim 1 , in which the functionalities (6,7,8) influence the well-being and safety of passengers in the passenger car (PW1). Procedure according to Claim 1 or 2 , in which the functionalities (6, 7, 8) control a power supply (6) and/or a consumer circuit (7) and/or a lighting (8) in the passenger car (PW1). Procedure according to Claim 1 , in which the communication connection (9) uses the status information transmitted by the vehicle control (1) to continuously and cyclically form a process image (PROAB) which contains the functional information on the functionalities. Procedure according to Claim 4 , in which the process image (PROAB) is transferred to the control point (LS) and evaluated there in order to create the redundant control commands. Method according to one of the preceding claims, in which the fixed control point (LS) provides redundant control commands assigned to each of a plurality of passenger cars (PW1), which control commands are preferably provided in separate software containers and independently of one another. Procedure according to Claim 6 , in which the fixed control point (LS) carries out a fleet-wide safeguarding of functionalities (6,7,8) of the large number of passenger cars (PW1). Method according to one of the preceding claims, in which the failure function (11) is adapted to operational conditions by the fixed control point (LS) as needed, as long as communication to the communication connection (9) exists.