EP3686080B1 - Method for securely operating a railway engineering system and network node of a data network - Google Patents

Description

The invention relates to a method for the safe operation of a railway system, in which a state of at least one line element of the railway system or a value representative of the state is stored.

In a railway system that has, for example, an external signal box system, the states of elements of the external signal box system are recorded. These elements are, for example, light signals, switches, axle counters and the like. A defined status of these elements is, for example, the displayed signal aspect or the set point position. The states of the elements of the interlocking system are recorded and z. B. verified for safe operation or safe display. The states of the elements serve, for example, as a basis for safe route setting by the interlocking computers and for safe display in the interlocking computers. For safe operation and display, it must be ensured that the operator, such as a dispatcher, only sees the states that are actually set. Since erroneous information about the states could have serious consequences for the operator, a great deal of effort may have been required to date to ensure safe operation.

The use of blockchain in the railway sector is known from Feras Naser: "REVIEW: THE POTENTIAL USE OF BLOCKCHAIN TECHNOLOGY IN RAILWAY APPLICATIONS: AN INTRODUCTION OF A MOBILITY AND SPEECH RECOGNITION PROTOTYPE", 2018 IEEE International Conference on Big Data (Big Data), 12/01/2018, pages 4516-4524 .

It is therefore the object of the invention to provide a simplified method for the safe operation of a railway system of the type mentioned at the outset.

The object is achieved for the method mentioned by the subject matter of patent claim 1.

This has the advantage that the information stored in a distributed database is trustworthy and further checking of the information can be omitted. As a result, the effort required for safe operation can be reduced, so that the methods used can be simplified.

A distributed database, also known as distributed ledger technology, is a database distributed across multiple locations, regions or participants. All participants in this decentralized database can view all records. The technology provides an auditable history of all information stored in the specific records. In a distributed database, each participant processes and verifies a transaction or piece of information, thereby creating a record of that item and creating a consensus as to its veracity. A distributed database can be embodied in one of several ways, for example as a blockchain. A blockchain, i.e. a block chain, is usually understood to be a continuously expandable list of data records called blocks, which are linked together using cryptographic processes. Each block typically contains a cryptographically secure hash value of the previous block and, if necessary, a time stamp and other transaction data. The blockchain is generated by a so-called miner and distributed to all participants in the distributed database.

Due to the structurally related security of a distributed database, mistrust of the correctness of the stored states of the line elements can be eliminated. Thus Previous security procedures that were caused by distrust and simplify the railway system as a whole can also be eliminated. The state or the representative value of the state is present in essentially the same way for each participant in the distributed database.

If the status of the route element changes, this changed status or the value of the route element that is representative of the changed status is stored in the distributed database according to the invention in such a way that the change is recognizable, at least in sufficient time. Each new record of a changed state contains a current timestamp, which makes it easy to recognize a change from an earlier point in time. If a blockchain is used as a distributed database, the changed state can be appended to the existing blockchain in a new block and distributed to all participants. The old states can still be read out in the previous blocks.

In order to ensure that the states have remained the same during an operator action, according to the invention the operator is requested by at least one first input and a second input later than the first input by at least one operator and the operator is only executed if the state stored in the distributed database changes or the representative value of the state of the track element has not changed between the first input and the second input. For example, the first input is made at the beginning of an operator action and the second input concludes the operator action. This embodiment ensures that the states of the route elements have not changed during the operator action. If a change is found between the first and second input, the execution of the operator action can be blocked and a new check by the operator can be requested.

The solution according to the invention can be further developed by advantageous configurations that are described below.

In an advantageous embodiment, the status or the representative value of the status can be stored in a blockchain. Blockchain technology is a special embodiment of a distributed database in which changed states are stored and distributed in a block of the blockchain. A blockchain offers a very high level of security, since the blocks with the states cannot be changed later, and is therefore very trustworthy.

In order to keep the effort involved in storing data in the distributed database and in particular the blockchain as low as possible, the status stored in the distributed database or a representative value of the status can be checked using a proof-of-authority method, in particular using a PKI - Public Key Infrastructure , be verifiable. The PKI makes it possible to check whether the saved state or states were set by a trustworthy participant, namely the miner. For example, in a railway network, a very specific computer can be authorized to create new blocks. This computer uses its PKI so that the other computers in the data network recognize from the PKI that the authorized and trustworthy computer created the data.

The invention also relates to a network node of a data network in a railway system with at least one memory having the features of claim 4. According to the invention, to solve the task mentioned at the outset, it is provided that the network node is designed as part of a distributed database in which a status of at least a route element of the railway system or a value that is representative of the condition is stored, and the network node is designed to store a changed status or a value of the route element that is representative of the changed status in the distributed database in such a way that the change can be identified. This has the advantage already described above, that state changes in the distributed database are easily recognizable.

According to the invention, the network node is designed to operate the railway technical system by at least one first input and a second input subsequent to the first input by at least one operator, with the operation only being carried out if no change in the status and the representative value of the state of the link element was detected between the first input and the second input. This has the advantage that it can be checked immediately that the states of the route elements have not changed during an operator action by the operator, for example the dispatcher.

Finally, the invention also relates to a railway system with at least one data network, having the features of patent claim 5. According to the invention, the data network has at least one network node.

In the following, the invention will be explained with reference to the accompanying drawings.

Fig. 1

eine schematische Darstellung einer beispielhaften Ausführungsform der erfindungsgemäßen eisenbahntechnischen Anlage;

Fig. 2

eine schematische Darstellung einer beispielhaften Ausführungsform eines erfindungsgemäßen Verfahrens zur Bedienung der Anlage aus Fig. 1;

Fig. 3

eine weitere schematische Darstellung der beispielhaften Ausführungsform des erfindungsgemäßen Verfahrens aus Fig. 2.

Show it:

1

a schematic representation of an exemplary embodiment of the railway system according to the invention;

2

a schematic representation of an exemplary embodiment of a method according to the invention for operating the system 1 ;

3

a further schematic representation of the exemplary embodiment of the method according to the invention 2 .

1 shows a railway system 1, which includes a data network 2 and several track elements 3. The route elements 3 are intended to be part of an external signal box system here, for example. The route elements 3 can be, for example, light signals, points, axle counting devices, track circuits or the like.

The railway system 1 also includes various network nodes 4 which are connected to one another and form the data network 2 . The network nodes 4 in turn are formed by various computing devices, such as an operating and display computer 5, an interlocking computer 6 and several element computers 7. The operating and display computer 5 is arranged, for example, in a control center of the railway system 1 and controls the display of the railway system 1 in this control center. The signal box computer 6 is designed for the usual signal box tasks and the elements computer 7 are part of the line elements and z. B. also provided for controlling this.

The network nodes 4 together form a distributed database 8, which is a blockchain here, for example, which is distributed to each network node. The blockchain is therefore available on all network nodes 4 .

The method according to the invention for operating the system 1 is described below:
During operation of the railway system 1, the states of the track elements 3 change continuously. Each time the status of a route element 3 changes, the new, current status of the route elements 3 and in particular the element computers 7 is passed on to the interlocking computer 6 .

The interlocking computer 6 is in the exemplary embodiment in figure 1 designed to, for the new, changed state of the route element 3 a new block of create blockchain. The interlocking computer 6 thus takes over the task of the so-called miner, which creates or calculates new blocks of the blockchain, appends them to the existing blockchain and distributes them. In order to keep the effort involved in creating the new block for the interlocking computer 6 low and to create this as quickly as possible, the interlocking computer 6 verifies the new block using the proof-of-authority method. In particular, a PKI (Public Key Infrastructure) is used for this and the interlocking computer 6 validates the new block with its personal key. By using the proof-of-authority method, it is possible for the interlocking computer 6 to send the new block with the changed status of the route element 3 within a relatively small time window of z. B. maximum 5 seconds created and distributed. This is an advantage over the alternative proof-of-work method, which would require more computing power and time. The current status or the new blockchain is then distributed to all network nodes 4 . The current states of the route elements 3 are thus always stored in the blockchain and can be read out by all network nodes 4 . If the status changes, the current status is saved in the blockchain together with the current time. That is, the new state flows into a new block and is distributed as a new or updated blockchain.

The operating and display computer 5 in the control center of the railway system graphically displays the status of the route elements 3 for the operator. In this case, the operator is, for example, a dispatcher.

2 shows this graphic display with the reference number 9. The status of the route elements 3 at the respective point in time is in 2 shown with reference numeral 10. In between, the blockchain of the distributed database 8 with the history of the various states of the route elements 3 stored therein is shown with reference numeral 11 .

The safe operation of the railway system 1 by an operator in the control center is shown schematically in 3 shown. In the first process step 12 in 3 the operator starts a so-called command-release required operation of the railway system 1 by a first input, for example by a separate keystroke. The operator then enters the operation into the operation and display computer 5 and confirms at the end of the operation, ie with a time delay, with a second input, for example again by pressing a separate button. Then in step 13 in 3 checked by the control and display computer 5 and/or by the interlocking computer 6 whether one of the states of the route elements 3 has changed between the first and the second input. The period of time between the first and second input is greater than 5 seconds and thus larger than the time window for creating a new block. This ensures that when the state changes, a new block is calculated, appended, signed and distributed before the second input is made. An unnoticed change of status is therefore not possible.

In step 14 in 3 the operation is executed if the state has not changed between the first and second input. However, in step 14, the service is rejected if a state change between the first and second inputs is detected. Thus, the previously necessary test steps from the prior art are no longer necessary.

With the method according to the invention, all network nodes 4 can check the respective states of the route elements 3 by accessing the blockchain.

The status information in the distributed database 8 can also be used for diagnostic purposes. A diagnostic computer (not shown) can also be integrated into the data network 2 for this purpose.

The method according to the invention makes it possible to dispense with some test steps that are customary today when operating the railway system 1 and the operator input, as a result of which the implementation is significantly less complicated and less complex. As in 3 shown, only a few process steps are required for this.

Claims (5)

1. Method for securely operating a railway engineering system (1),

   with which a state of at least one track element (3) in the railway engineering system (1) or a value which is representative of the state is stored in a distributed database (8),

   characterised in that

   with a change in the state of the track element (3), this changed state or the value of the track element (3) which is representative of the changed state is stored in the distributed database (8) in such a way that the change can be identified, wherein the operation is requested by means of at least one first input and a second input which is subsequent to the first input by at least one operator and the operation is only executed if the state stored in the distributed database (8) or the representative value of the state of the track element (3) has not changed between the first input and the second input.
2. Method according to claim 1,
   characterised in that
   the state or the representative value of the state is stored in a blockchain.
3. Method according to one of the preceding claims,
   characterised in that

   the state stored in the distributed database (8) or

   representative value of the state can be verified by means of a proof of authority method, in particular by means of a PKI - public key infrastructure.
4. Network node (4) of a data network (2) in a railway engineering system (1),

   having at least one storage device, wherein the network node (4) is embodied as part of a distributed database (8) in which a state of at least one track element (3) of the railway engineering system (1) or a value which is representative of the state is stored,

   characterised in that

   the network node (4) is embodied a changed state or a value of the track element (3) which is representative of the changed state is stored in the distributed database such that the change can be identified and the network node (4) is embodied for operation of the railway engineering system (1) by means of at least one first input and a second input which is subsequent to the first input by at least one operator,

   wherein the operation is only executed if, by means of reading out from the distributed database, no change in the state or the representative value of the state of the track element (3) was identified between the first input and the second input.
5. Railway engineering system (1) with at least one data network (2),
   characterised in that
   the data network (2) has at least one network node (4) according to claim 4.

Images