DE102017220068A1 - Method and on-board control unit for controlling and / or monitoring components of a rail vehicle - Google Patents

Abstract

In the method for controlling and / or monitoring components (12, 14) of a rail vehicle (10) which communicate with a cloud architecture (20) via an onboard control unit (18) of the rail vehicle (10), a write access is made On-board control unit (18) limited to the components (12, 14) of the rail vehicle (10) according to fixed rules that meet a predetermined safety requirement.

Description

The present invention relates to a method for controlling and / or monitoring components of a rail vehicle and an on-board control unit for controlling and / or monitoring components of a rail vehicle and to a rail vehicle with such an onboard control unit.

From the DE 10 2014 113 371 A1 A method for monitoring and diagnosing components of a rail vehicle is known in which a central unit of the rail vehicle communicates with a control center via a cloud. As a central unit usually an onboard control unit (onboard control unit, OCU) is used, which is completely administered via the cloud architecture, so for example at any time (ie also during passenger operation or high-speed voyage) also new software functionalities onboard Control unit can be brought. Since this may in principle result in an unpredictable behavior of the onboard control unit relative to the rail vehicle, a write access of the onboard control unit to the components of the rail vehicle is conventionally prevented by means of hardware.

However, in practice, there is a need to allow exceptions to this write access prevention. In addition, depending on the vehicle data bus used in the rail vehicle to which the on-board control unit is connected, the system also requires write accesses from the onboard control unit.

It is an object of the present invention to provide an improved method and onboard control unit for controlling and / or monitoring components of a rail vehicle that exceptionally allow write access from the onboard control unit but still meet the required safety requirement level.

This object is achieved by the teaching of the independent claims. Particularly advantageous embodiments of the invention are the subject of the dependent claims.

In the method according to the invention for controlling and / or monitoring components of a rail vehicle which communicate with a cloud architecture via an onboard control unit of the rail vehicle, write access of the onboard control unit to the components of the rail vehicle is restricted according to fixed rules fixed rules meet a given security requirement.

Since, unlike conventional systems in which write access by a hardware solution is completely inhibited, write access is restricted according to fixed rules, write access from the onboard control unit is possible in exceptional cases permitted by the fixed rules. As these fixed rules meet a given security requirement, it is also possible to ensure compliance with a required safety requirement level for the onboard control unit.

The fixed rules are preferably designed such that they prevent a write access in principle and allow only in exceptional cases. These exceptional cases are preferably determined by the type of write access and / or the time of the write access. The dependence on the time of the write access is to be understood in particular as a function of the respective operating state of the rail vehicle. The term fixed rules is intended to clarify that these rules must not be changed in the normal operation of the rail vehicle, in particular not by the communicating with the onboard control unit cloud architecture.

With the method according to the invention, it can be achieved, for example, that the onboard control unit can normally only read data from the components of the rail vehicle in order to monitor these components for diagnostic or maintenance purposes, for example, in a precisely defined exceptional case such as the setting of desired values Temperatures for warming up the rail vehicle in the early morning but also write access to the components of the rail vehicle are allowed.

With the method according to the invention not only the operational safety of the rail vehicle ("Safety") can be ensured, but also the security against unauthorized access ("Security").

The fixed rules thereby fulfill a given safety requirement, preferably in accordance with the safety integrity level SIL 1, SIL 2, SIL 3 or SIL 4.

For regulatory approval of the on-board control unit, according to the invention, it then suffices to check the security requirement level of the fixed rules for restricting or filtering the write access. The other components / aspects of the on-board control unit need not be checked.

The components of the rail vehicle which are to be controlled and / or monitored include, in particular, control units of the rail vehicle, such as the vehicle control unit (VCU), the brake system control unit (BCU), the traction control unit (TCU) ) and the like, without the invention being restricted to these control units.

In one embodiment of the invention, the components and the on-board control unit of the rail vehicle are connected to one another via a vehicle data bus of the rail vehicle. In this case, the write access of the onboard control unit is restricted to the vehicle data bus.

The vehicle data bus may be a wired or a wireless data bus. Particular advantages of the invention result from the use of Ethernet as a vehicle data bus, since ethernet-based data buses require system access to write access. However, the invention can also be used in combination with other vehicle data buses such as CAN, MVB, etc.

Preferably, the fixed rules remain unchanged after regulatory approval of the on-board control unit. This means that the fixed rules can indeed be changed in principle, but in such a case, a renewed regulatory approval of the onboard control unit is required.

Since the security requirements for the onboard control unit and the rail vehicle are already met by the fixed rules for write access from the onboard control unit, write access of the cloud architecture to the onboard control unit of the rail vehicle is preferably unrestricted.

Preferably, a read access of the onboard control unit to the components or the vehicle data bus of the rail vehicle is unrestricted. Likewise preferably a write access of the cloud architecture to the onboard control unit of the rail vehicle takes place without limitation.

The onboard control unit for controlling and / or monitoring components of a rail vehicle according to the invention comprises a first computing device for communicating with a cloud architecture and additionally a second computing device for limiting write access of the first computing device to the components of the rail vehicle according to fixed rules fulfill a predetermined security requirement.

With this onboard control unit, the same advantages as with the method of the invention described above can be achieved. In particular, it suffices for an authorization of the on-board control unit to check the security requirement level of the second computer device, while the first computer device can not be tested and therefore changed, updated, etc. as desired.

In one embodiment of the invention, the on-board control unit is configured to communicate with the components of the rail vehicle via a vehicle data bus. In this case, the second computer device of the on-board control unit is preferably designed to limit the write access of the first computer device to the vehicle data bus.

Preferably, the first computer device and the second computer device of the on-board control unit are independently programmable. This is preferably achieved by using two separate CPUs or two cores of a CPU for the two computer devices.

With regard to further advantageous embodiments, advantages, definitions of terms, etc., reference is made to the above statements in connection with the method according to the invention.

Finally, the subject matter of the invention is also a rail vehicle which has a plurality of components to be controlled and / or monitored, an onboard control unit of the invention described above and a vehicle data bus for connecting the components and the onboard control unit to one another.

• 1 eine Darstellung eines Schienenfahrzeugs mit einem erfindungsgemäßen Steuerungs- und/oder Überwachungssystem; und
• 2 den Aufbau einer erfindungsgemäßen Onboard-Steuereinheit für ein Schienenfahrzeug von 1.

The above and other advantages and features of the invention will become more apparent from the following description of an embodiment with reference to the accompanying drawings. In it show, mostly schematically:

• 1 a representation of a rail vehicle with a control and / or monitoring system according to the invention; and
• 2 the structure of an onboard control unit according to the invention for a rail vehicle of 1 ,

1 shows in a very simplified form the structure of a rail vehicle 10 to which the present invention is applicable.

In the rail vehicle 10 are in the usual way several components 12 . 14 intended to be controlled and monitored. These include, for example, a central one Vehicle Control Unit (VCU), a Brake Control Unit (BCU), a Traction Control Unit (TCU), and the like.

These components 12 . 14 of the rail vehicle 10 are with a vehicle data bus 16 connected. As a vehicle data bus 16 For example, an Ethernet-based data bus is used.

With this vehicle data bus 16 is also an onboard vehicle unit (OCU) 18 of the rail vehicle 10 connected with the components 12 . 14 of the rail vehicle 10 be controlled and monitored. For this purpose, this onboard control unit communicates 18 with a cloud architecture 20 , The cloud architecture 20 For example, it includes a cloud, a control center, mobile devices, and the like.

2 shows the structure of an embodiment of such an onboard control unit 18 which on the one hand a write access of the onboard control unit 18 on the components 12 . 14 of the rail vehicle in exceptional cases and at the same time fulfills the specified safety requirement level.

The onboard control unit 18 contains a first computer device 22 and a second computer device 24 , The two computer devices 22 . 24 For example, there are two separate CPUs or two CPU cores that are independently programmable. Through independent programming, the two computing devices 22 . 24 especially meet different security requirement levels.

So the software of the first computer device 22 for example, without safety requirement level (ie SIL 0) be executed. That is the cloud architecture 20 has an unrestricted read and write access to the first computer device 22 , The software of the first computer device 22 can always be changed if necessary, without requiring a new regulatory approval for the onboard control unit 18 requirement. The first computer device 22 It's also designed to be that of the cloud architecture 20 or components 12 . 14 of the rail vehicle 10 preprocess received data.

The second computer device 24 serves to monitor or filter the read and write access of the first computer device 22 on the components 12 . 14 or the vehicle data bus 16 of the rail vehicle 10 , Data processing takes place in the second computer device 24 typically not. While the read access can usually be unlimited, the write access is performed by the second computer device 24 restricted by strict rules to allow write access only in exceptional cases.

The software of the second computer device 24 or their fixed rules for write access satisfy a specified safety requirement level of SIL 1, SIL 2, SIL 3 or SIL 4. For approval of the onboard control unit 18 it only requires a check or approval of their second computer device 24 , The fixed rules for write access remain unchanged after official approval. If the fixed rules in the second computer device 24 nevertheless, once changed, a new regulatory approval must be given. The approval of the second computer device 24 can be carried out vehicle-specific with reusable frameworks relatively cost and low cost.

LIST OF REFERENCE NUMBERS

10

track vehicle

12

Component (VCU) of the rail vehicle

14

Component (BCU, TCU, etc.) of the rail vehicle

16

vehicle data

18

Onboard Control Unit (OCU)

20

Cloud architecture

22

first computer device

24

second computer device

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102014113371 A1 [0002]

Claims (9)

Method for controlling and / or monitoring components (12, 14) of a rail vehicle (10), wherein the components (12, 14) communicate with a cloud architecture (20) via an onboard control unit (18) of the rail vehicle (10) characterized in that a write access of the on-board control unit (18) to the components (12, 14) of the rail vehicle (10) is restricted according to fixed rules, the fixed rules meeting a predetermined safety requirement. Method according to Claim 1 , characterized in that the components (12, 14) and the onboard control unit (18) of the rail vehicle (10) via a vehicle data bus (16) of the rail vehicle (10) are interconnected and the write access of the onboard control unit (18) the vehicle data bus (16) is limited. Method according to Claim 1 or 2 , characterized in that the fixed rules remain unchanged after a regulatory approval of the onboard control unit (18). Method according to one of Claims 1 to 3 , characterized in that a write access of the cloud architecture (20) on the onboard control unit (18) of the rail vehicle (10) takes place without restriction. Method according to one of Claims 1 to 4 , characterized in that a read access of the onboard control unit (18) to the components (12, 14) or the vehicle data bus (16) of the rail vehicle (10) takes place without restriction. On-board control unit (18) for controlling and / or monitoring components (12, 14) of a rail vehicle (10), having a first computer device (22) for communicating with a cloud architecture (20), characterized by a second computer device (24 ) for restricting a write access of the first computing device (22) to the components (12, 14) of the rail vehicle (10) according to fixed rules that meet a predetermined security requirement. Onboard control unit after Claim 6 , Characterized in that it is designed to interact with the components (12, 14) of the rail vehicle (10) via a vehicle (16), and their second computer means (24) is configured to write access of the first computing device (22 ) to the vehicle data bus (16). Onboard control unit after Claim 6 or 7 , characterized in that the first computer means (22) and the second computer means (24) are independently programmable. Rail vehicle (10), comprising: a plurality of components (12, 14) to be controlled and / or monitored; an on-board control unit (18) according to one of Claims 6 to 8th ; and a vehicle data bus (16) for connecting the components (12, 14) and the onboard control unit (18) to each other.

Images