EP1926650A1

EP1926650A1 - Method for determining the location and/or a movement variable of moving objects, in particular of moving track-bound vehicles

Info

Publication number: EP1926650A1
Application number: EP06793558A
Authority: EP
Inventors: Detlef Kendelbacher; Volker Pliquett; Fabrice Stein
Original assignee: Siemens AG
Current assignee: Siemens AG
Priority date: 2005-09-20
Filing date: 2006-09-15
Publication date: 2008-06-04
Also published as: DE102005046456B4; WO2007033939A1; DE102005046456A1

Abstract

The invention relates to a method for determining the location (O) and/or a movement variable of moving objects (1), in particular of moving track-bound vehicles, at least one pre-processing computer (5) being provided. In order to ensure a high degree of accuracy, it is proposed to use at least three sensors (3a, 3b, 3c) which determine sensor data (S1, S2, S3) and transmit it to processes (P1, P2, P3) of pre-processing computers (5a, 5b, 5c), in that each process (P1, P2, P3) calculates a difference factor (D1-2, D1-3, D2-3) from the sensor data (S1, S2, S3) of two sensors (3a, 3b, 3c) in each case, in that the processes (P1, P2, P3) exchange the difference factors (D1-2, D1-3, D2-3) with one another and determine the sensor quality (SG1, SG2, SG3) for each sensor (3a, 3b, 3c), in that the processes (P1, P2, P3) use the sensor data (S1, S2, S3) and the sensor quality (SG1, SG2, SG3) to calculate in each case the location (O1, O2, O3) and/or the movement variable, in each case weighted with the associated sensor quality (SG1, SG2, SG3) and transmit it to a reliable computer (7) which compares these in each case and does not reject them, and the majority of which lie within predefined tolerances, and in that the reliable computer (7) calculates the location (O) and/or the movement variable from the nonrejected locations (O1, O2, O3) and/or movement variables, in each case weighted with the associated sensor quality (SG1, SG2, SG3).

Description

description

Method for determining the location and / or a movement quantity of moving objects, in particular of moving track-bound vehicles

The invention relates to a method for determining the location and / or a movement quantity of moving objects, in particular of moving track-bound vehicles, according to the preamble of claim 1.

It is known that there erfor to control rail traffic is ^¬ sary to determine the whereabouts of the vehicles. For locating sensors in the vehicles are installed, whereby different principles of operation for locating are known. In this case, Wegimpulsgeber are widely used, which derives from the Radumdrehungen each pulse for Weg- and Ge ^¬ speed calculation. In addition, acceleration sensors and radar systems are also used. Meanwhile, the first satellite-based positioning systems based on GPS (Global Positioning System) are known. All known position sensors have specific properties and fault tolerances, which is why it may happen that the position sensors provide useless or no data in special situations. Thus, the location data of the Wegimpulsgeber are subject to increased slip in the drive and braking phases with large errors. For this reason, several sensors are sometimes used for the location and their Or ^¬ tion data linked together in order to specify the whereabouts of a train can more accurately, the sensor data are also checked for plausibility.

In the case of the European Train Control System (ETCS) for train protection, the determination of the whereabouts of a vehicle (access ges) a safety-critical object in which the staying ^¬ haltsort is to be determined within a safety-related confidence interval, which is a measure of the processing accuracy current Or ^¬. This confidence interval is dynamic, ie it depends respectively from the current location is exactly ^¬ accuracy and can be while driving the vehicle än ^¬ countries. Greater confidence interval means an inaccurate ^¬ ere determination of the location of a train, which is associated with the increase of negative influences on the operation. In order to reduce accumulation of errors of the tracking sensors, additional electronic devices can (for example, beacons) are arranged at predetermined positions along the track, which read from the vehicle who to, the vehicles use ^¬ can read information for synchronizing the location data. At this

Synchronization points, the successively increasing during the journey confidence interval is reduced again.

To meet the high requirements to meet the resilience of a train control system, the positioning ^¬ are usually redundant systems and have the failure-tolerant ^¬ of individual sensors. That is why in train control systems the existing position sensors are often installed twice.

The locating of vehicles in rail traffic is often under difficult external influences, such as water, ice, pollution, tunnels, bridges and the differently designed superstructure. In order to be able to compensate for temporary failures and individual sensor failures in vehicle location in a location system with several sensors, the properties and possible errors of the sensors used must be precisely analyzed and evaluated. In particular, the calculation of the confidence interval requires locating complicated algorithms in the processing and linking of the sensor data. Due to the safety requirements of rail traffic, this is usually associated with a complex approval process.

Under changing external influences, the available position sensors show a specific and fluctuating fault behavior, which at times can lead to a reduction of the positioning accuracy. The associated increased confidence intervals in the location determination can lead to the obstruction of rail traffic.

Transient or persistent failures of individual Ortungssenso ^¬ ren continue to reduce the Ortungsgüte or even the failure of the entire vehicle location, which massive obstructions can be caused.

In order to meet the safety requirements of the rail traffic, so-called secure computers are used in the location, for example, consist of several parallel computers, which compare the results obtained with each other and make an evaluation. Only if the results from at least two computers match, the result is passed on to the process to be controlled; if no match occurs, a corresponding safety ^¬ reaction.

The object of the invention is to ensure a high degree of accuracy in determining the location and / or an amount of movement. Furthermore, the object is to make the Genauig ^¬ resistance and the availability of the locating scalable in terms of the amount of requirements so that their use is possible in different conditions and in different types of control systems. The object of the invention is achieved according to the features of claim 1; the dependent claims contain advantageous embodiments.

The solution provides that at least three sensors are arranged in the object, which independently of one another determine sensor data about the location and / or the amount of movement and transmit them to processes which run on one or more preprocessing computers likewise arranged in the object, each process containing the sensor data from at least two sensors are processed and each sensor passes its sensor data to at least two processes that each process calculates a difference ^¬ factor from the difference of the sensor data of two sensors that processes the difference factors unterein ^¬ other exchange and on the basis of the exchanged difference factors, the sensor performance determine for each sensor as a measure of aktuel ^¬ le sensor accuracy that the processes based on the sensor data and the sensor performance in each place and / or the amount of movement each weighted by the associated sensor ^¬ Q calculate that each process the locations and / or BEWE ^¬ supply sgrößen and the sensor performance to a likewise arranged in the object secure computer passes, comparing the locations and / or motion parameters and / or sensor performance in each case and the type and / or motion variables and the sensor performance will not warp, which are mostly ^¬ tolerances within predetermined tole, while the rejects, outlying and that the secure computer from the non-discarded places and / or motion quantities each weighted by the corre- sponding sensor goodness a place and / or a movement amount calculation ^¬ net. To increase the accuracy, it is proposed that the sensors work according to the location as well as to each movement variable according to different principles of action.

To increase security, it is proposed to build the processes in the preprocessing computers from different software (diversified).

To increase the availability and security is proposed to split the preprocessing functions to multiple Vorverar ^¬ beitungsrechner.

To further increase accuracy and availability, it is proposed to use more than three independently operating sensors.

Technically advantageous it is if the algorithm used to load the sensor ^¬ humor quality sensor-specific tolerances taken into account.

Increased accuracy is obtained if the sensor performance is respectively taken into account for the calculation of the confidence interval in the secure computer in addition to the sensorspe ^¬-specific tolerances. A better failure behavior can be achieved if several preprocessing computers are provided.

Increasing the accuracy also has an effect if the method with regard to the rejection of the locations and / or movement quantities and the sensor quality are combined with known plausibility methods.

With the method, a secure location of vehicles is possible, whereby error influences of individual sensors minimized become. The location calculation essentially uses only the data of the correctly operating sensors, whereby resynchronized sensors are automatically included again in the location calculation. Especially in the event that several sensors provide a low quality of data simultaneously, on ^¬ a well-usable positioning result can be obtained due to the sensor-specific evaluation and weighting of data. The consideration of the quality of the sensor data protects against wrong decisions in the majority decisions, ie if two sensors provide a lower data quality, this does not automatically lead to the suspension of a third sensor with high data quality. This reduces procedural errors. In principle, the accuracy of the ^device can be increased by additional sensors. The number of preprocessing computers used is unlimited, so that complete, diverse preprocessing of the location data can be ensured. Security, availability and performance requirements can be scaled.

With the parameters of the sensor-specific localization quality, a matrix is available which, in addition to the improvement of the positioning accuracy, also permits an evaluation of the correct function of the preprocessing computers and thus supports a partial outsourcing of the safety-critical location to a platform with a lower security level. The Siche ^¬ re computer is relieved of labor-intensive tasks when the preprocessor has a significant share of vehicle tracking with the processing of the sensor data.

The invention will be described below with reference to a drawing. Show it: 1 shows a schematic representation of the method with three position sensors, three preprocessing computers and a secure computer,

FIG. 2 shows the sequence according to FIG. 1 in the preprocessing computer and FIG

FIG. 3 shows the sequence according to FIG. 1 in the secure computer.

Figure 1 shows a schematic representation of a method for determining the location of a moving track-bound vehicle as a moving object, which is shown in Figure 1 as Rah ^¬ men 1. With this method, corresponding movement variables of the vehicle can be determined in addition or independently of the location determination. Sizes of the motion ^¬ include in particular the speed and acceleration of the vehicle. The frame 1 representing the vehicle contains three further frames 2, 4, 6, the frame 2 including position sensors 3 (sensors 3a, 3b, 3c), the frame 4 preprocessing computer 5 and the frame 6 including a secure computer 7 (vehicle computer) which are all arranged in the vehicle (frame 1). The preprocessing ^¬ computer 5 can thereby significantly less safety feature requirement level as a safe computer 7 own or operate without all safety requirements.

The frame 2 shows three arranged in the vehicle continuous ^¬ acting position sensors 3, which are designed as Wegimpulsgeber 3a, as radar 3b and GPS receiver 3c (Global Positioning System) and thus work diversitively. The position sensors 3 independently of one another continuously determine sensor data S (positioning primary data), which they transfer to processes P1, P2, P3 (programs) running on the preprocessing computers 5 (the sensor data S are shown here schematically as dashed lines between the frames 2 and 3) shown, the sensor data of the Or- tion sensors 3a are designated Sl, etc.). As FIG. 1 shows, there are three preprocessing computers 5a, 5b, 5c operating independently of one another here, although these may be the same preprocessing computers 5, but do not have to act. The same processes can be done

Pl, P2, P3 be the same. In both cases, however, it is expedient, if this is not the case, to increase the recognition of errors by the use of different processes P1, P2, P3 and different computers 5a, 5b, 5c. However, it can of course also be a single preprocessing computer 5, on which then all three processes Pl, P2, P3 run independently of each other.

In the Vorverarbeitungsrechnern 5 are therefore a number of sepa- rate diverse processes Pl, P2, P3 implemented which ^¬ inde pendently, the data of the connected sensors Sl, S2, S3 process. The number of diversified processes P1, P2, P3 results from the number of sensors S1, S2, S3 used. The distribution of the diversified processes Pl, P2, P3 on the preprocessing computers 5 depends on their number. When using a preprocessing computer 5, all processes P1, P2, P3 run on this computer 5. When using a plurality of preprocessing computers 5, at least one process P1, P2, P3 can be arranged in each preprocessing computer 5. In the case of three position sensors S1, S2, S3 and three preprocessing computers 5a, 5b, 5c, a process P1, P2, P3 can be implemented for each preprocessing computer 5, for example.

Figure 1 is removable, that each sensor's sensor data S passes 3 at at least two processes Pl, P2, P3, the Sen ^¬ sordaten S of a location sensor 3a, so 3b, 3c paral ^¬ lel at least two different processes Pl and P2, P3 and P2, Pl and P3 of the preprocessing computer 5 supplied. Each process P1, P2, P3 of a preprocessing computer 5 evaluates the sensor data S (positioning primary data) of the connected sensors 3. It is advantageous for the evaluation of the processes in- nerhalb Pl, P2, carried out according to various algorithms diversitä- ren P3, the likelihood for the same algorithmic error in the execution difference ^¬ Licher processes Pl, P2, P3 to minimize.

In FIG. 1, the sensor 3a transfers its sensor data S1 to the processes P2 and P3, the sensor 3b transfers its sensor data S2 to the processes P1 and P3, and the sensor 3c transfers its sensor data S3 to the processes P1 and P2. This means that here each process Pl, P2, P3 receives the sensor data from exactly two sensors 3. Each process Pl, P2, P3 calculates from the difference of the sensor data Sl, S2, S3 a difference factor, namely Dl-2, Dl-3 and D2-3. The arrows 8 are intended to indicate that the processes P exchange at least the difference factors Dl-2, Dl-3, D2-3. Thus, the small arrow 9 shows that the process P3 transfers the difference factor Dl-2 to the process P2. Conversely, over ^¬ the process P2 is the difference factor DL-3 to the process P3 (arrow 10). A corresponding exchange, as shown in FIG. 1, also takes place between the processes P1 and P2 as well as P1 and P3. Thus, all three difference factors Dl-2, Dl-3, D2-3 are available to all processes P1, P2, P3, from which the processes P1, P2, P3 determine a sensor quality SG as a measure of the calculated sensor accuracy. The sensor performance SGl, SG2, SG3 is assessed higher, the lower the Dif ^¬ ference factors DL-2, DL-3, D2-3 two Vorverarbeitungspro- processes Pl, P2, P3 with respect to a common sensor 3a, 3b fail, 3c. A high sensor quality SG1, SG2, SG3 for a sensor 3a, 3b, 3c is thus based on the matching evaluation of three sensors 3a, 3b, 3c by two preprocessing processes P1, P2, P3. Based on the sensor data S and the Sensor quantities SG calculate the processes P 1, P 2, P 3 in each case a middle location O1, O2, O3, which in each case is weighted with the associated sensor quality SG1, SG2, SG3. As FIG. 1 shows, the locations Ol, 02, 03 and the sensor quality SG1, SG2, SG3 are transferred from the preprocessing computers 5a, 5b, 5c to the secure computer 7 (schematically, the transfer of the sensor quality SG and the locations 0 is shown as dashed lines) Zvi lines ^¬ rule the frame 4 and) shown. 6 Thus, the host computer ago ^¬ 5a passes a determined location 03 and the two sensor grades SGl and SG2 of the two sensors 3a, 3b, since the preprocessor 5a, the sensor data Sl, S2 received from the two sensors 3a, 3b to the secure computer 7 , A corresponding transfer is carried out by the Vorverarbei ^¬ performance computers 5b and 5c.

If required, additional sensors can be connected to the secure computer 7, such as a balise reader (not shown here).

FIG. 2 schematically shows the above-described sequence in the preprocessing computer 5a, which is divided into three steps in FIG. 2 (the sequences in the other two preprocessing computers 5b, 5c take place correspondingly).

In the first step, the transfer of the sensor data Sl, S3, which are read by the preprocessing computer 5a takes place. After reading, the sensor data S1, S3 are processed (for example, a transformation into a suitable coordinate system can be carried out). Subsequently, the preprocessing computer 5a carries out a subtraction of the sensor data S1, S3 by calculating the difference factor D2-3.

The first process step in-process serves thereby al ^¬ so the determination of the agreement of the sensor data S (Or- tung primary data) of the connected sensors 3. For this determination is optionally pre-processing the sensor data S supplied necessary, such as transfor mation ^¬ in a suitable coordinate system. The measure of the conformity of the sensor data S is determined by means of a parameter

(the difference factor Dl-2, Dl-3, D2-3) evaluated. The current difference factor Dl-2, Dl-3, D2-3 can be between a minimum (best match) and a maximum (no match). To determine the difference factor Dl-2, Dl-3, D2-3, process-specific defined tolerances can be used.

In the second step, the difference factors Dl-2, Dl-3 are taken over by the two other preprocessing computers 5b, 5c, and the difference factor D2-3 is transferred to the two other preprocessing computers 5b, 5c. The sensor data are subjected to a plausibility test with the aid of the difference factors Dl-2, Dl-3, D2-3, which has the goal of revealing significant sensor errors and excluding their data S1, S2, S3 from further processing. Subsequently, the calculation of the sensor quality SG1, SG2, SG3 is carried out for all sensors 3a, 3b, 3c whose data S1, S2, S3 are plausible. From the comparison of Dl-2 with D2-3 the sensor quality SG2 becomes and from the comparison of Dl-3 with D2-3 the sensor quality SG3 is determined. This is followed by the third step, in which an averaged location Ol is calculated on the basis of the sensor data S2, S3 and the sensor quality SG2, SG3 as weighting factors. The thus calculated location Ol with the determined sensor quality SG2, SG3 is then transferred to the secure computer 7. The entire process repeats cyclically for the respective current sensor data Sl, S2, S3.

The second processing step thus serves to determine the quality of the current data S1, S2, S3 of each connected Sensor 3 (sensor-specific detection quality as sensor quality SG1, SG2, SG3). In this step, the difference factor Dl-2, Dl-3, D2-3 determined in-process is compared with that of the other processes Pl, P2, P3. This takes place by mutual transmission of the process-specific difference factors Dl-2, Dl-3, D2-3 between the processes P1, P2, P3. For this purpose are those processes Pl, P2, P3 gekop together ^¬ pelt, which at least one common sensor 3a, 3b, 3b (Or ^¬ tung sensor) use. From the comparison of Differenzfakto- ren DL-2, DL-3, D2-3 two processes Pl, P2, P3 with a ge ^¬ common sensor 3a, 3b, 3b can with high probability on the quality of the sensor data Sl, S2, S3 (Ortungsprimärda ^¬ th) of the common sensor 3a, 3b, 3b concluded who ^¬ the. If, for example, the difference factors Dl-2, Dl-3, D2-3 of two processes P 1, P 2, P 3 are comparable and use a common sensor 3 a, 3 b, 3 b, the sensor quality SG 1, SG 2, SG 3 or localization quality of the common sensor 3a, 3b, 3b are evaluated consistently. On the other hand, if the difference ^factors Dl-2, Dl-3, D2-3 are very different, a conclusion on the sensor quality can be drawn from the comparison

SGl, SG2, SG3 or locating quality of the other sensors 3 a, 3 b, 3 b involved.

In addition to the comparison of the difference factors Dl-2, Dl-3, D2-3, further analyzes according to the prior art can be carried out in this processing step in order to evaluate the plausibility of the data S1, S2, S3 of individual sensors 3a, 3b, 3b. For example, analyzes based on previous sensor data S (positioning primary data) and the known vehicle dynamics are possible. The processing in this step ermittel ^¬ te sensor-specific sensor performance SGl, SG2, SG3 and Ortungsgü ^¬ te is a measure of the confidence that the current sensor data Sl, S2, S3 may be placed in. It can lie between a maximum (highest quality of the sensor data S1, S2, S3) and a minimum (sensor data S1, S2, S3 can not be used). For determining the sensor-specific sensor quality SG1, SG2, SG3 or localization quality, sensor and process-specific tolerances can be defined. Each process individually calculates the current locations

01, 02, 03 (location data) on the basis of the available sensor data S1, S2, S3 (primary location data) of the connected sensors 3a, 3b, 3b and their sensor-specific sensor quality SG1, SG2, SG3 (localization quality). The data Sl, S2, S3 of a sensor 3a, 3b, 3b (position detector) are weighted according to its Sen ^¬ sorgüte SGl, SG2, SG3 (locating quality) in the calculation. The higher the sensor quality SG1, SG2, SG3 (localization quality) of a sensor 3a, 3b, 3b, the more its ^data S flow into the overall result. With minimal sensor quality SG1, SG2, SG3 (localization quality), the data S1, S2, S3 of the relevant sensor 3a, 3b, 3b can not be used for the location calculation.

For the calculation of the locations Ol, 02, 03, various process-specific algorithms, such as filtering, integration, transformation, etc., can be applied. As a result of the calculation is per process Pl, P2, P3, the current vehicle location Ol, 02, 03 in a suitable temperatures for the application in Siche ^¬ computer 7 format.

In the third processing step, then the calculation of the current locations Ol, 02, 03 (position data) in the preprocessing beitungsrechnern 5a, 5b, 5c, and (not shown) the output to the Applikati ^¬ on the secure computer. 7

The processing of the transferring data, the locations Ol, 02, 03 and the sensor quality SG1, SG2, SG3, is shown schematically in FIG. 3, these data first being read by the secure computer. This starts the first step, namely the process test, which compares the location data (places Ol,

02, 03) follows, ie the locations Ol, 02, 03, which were determined by the three preprocessing computers 5a, 5b, 5c. Further, the sensor-specific sensor performance SGl, SG2, SG3 and location quality (two values for each sensor) are compared, and then each ^¬ weils faulty by majority decision data to SUS pendieren. Majority decision means here that the locations Ol, 02, 03 and the sensor quality SG1, SG2, SG3 are not discarded, which are mostly within specified tolerances. From the remaining places oil and / or 02 and / or 03 and the sensor quality SGl and / or SG2 and / or SG3 ermit ^¬ telt secure computer 7 a vehicle location 0, in the remaining places oil and / or 02 and / or 03 weighted with the associated sensor quality SGl and / or SG2 and / or SG3.

The process-specific positioning result (location determination resulting ^¬ nis) of each process Pl, P2, P3 is thus output to the application in the secure computer. 7 Together with the locating result of each process P 1, P 2, P 3 for all connected sensors 3 a, 3 b, 3 b, their sensor-specific sensor quality SG 1, SG 2, SG 3 or localization quality is transferred to the application.

The location results provided in the safe vehicle computer 7 are based on various sensors 3a, 3b, 3b and diversified processing by the processes P1, P2, P3. With proper function of the sensors 3a, 3b, 3b (location sensors) and preprocessing functions Pl, P2, P3 which have Or ^¬ processing results of the various processes Pl, P2, P3 within the framework of men ^¬ sensor tolerances match. Any other deviations can have the following causes:

a) faulty sensor data Sl, S2, S3 - for example, by failure of a sensor 3a, 3b, 3b or

b) erroneous function of a preprocessing process Pl, P2, P3 - for example, by an implementation error in the preprocessing computer 5a, 5b, 5c.

Since the vehicle location is a safety-critical function, there is the task for the safe vehicle computer 7, faulty ler of the sensors 3a, 3b, 3b (sensors) and the preprocessing uncover and initiate an adapted response. At the same time, there is the task of designing the locating function tole ^¬ rant against error influences of individual sensors 3a, 3b, 3b and preprocessing processes P1, P2, P3 in order to ensure system availability. By using at least three sensors 3a, 3b, 3b and three processes Pl, P2, P3, the preprocessing results (locations Ol, 02, 03) can be checked and judged by majority (majority vote). The majority vote is a well-known method for security-relevant multi-channel data processing. This method is extended so that the multi-channel pre-processing results (locations Ol, 02, 03) contain criteria for their assessment by the secure application (application on the secure computer 7). Furthermore, the criteria allow a differentiated error analysis of the causes according to a) and b).

The evaluation and processing of diversely deter- mined localization results (Places Ol, 02, 03) performance computers from the Vorverarbei ^¬ 5 takes place in a safe vehicle computer 7 in two steps. The first step consists of checking the correct function of the processes P1, P2, P3 of the preprocessing computer 5 on the basis of their results (analysis according to b). If the positioning results (Places Ol, 02, 03) of a pro ^¬ zesses Pl, P2, recognized P3 by testing as error-free, the use of which takes place in the further positioning calculation in safe computer 7. Otherwise, this location resulting ^¬ Menus (places Ol, 02 , 03) for further use.

On the one hand, the supplied location data (locations O1, O2, O3) of the processes and, on the other hand, the data of the sensor-specific sensor quality SG1, SG2, SG3 (location quality) can be used for the process test.

The different location results (locations Ol, 02, 03) of the preprocessing processes Pl, P2, P3 can be checked for plausibility. The plausibility check can equal to the location data (locations Ol, 02, 03) and the determination of the deviations between the location data (locations Ol, 02, 03). If the location data (locations Ol, 02, 03) of a process Pl, P2, P3 deviate so much from the location data (locations Ol, 02, 03) of the other processes Pl, P2, P3 that defined tolerances are exceeded, this can occur Indication of incorrect processing in the process Pl, P2, P3.

Furthermore, in the context of the plausibility check, a comparison of the data of the sensor-specific sensor quality SG1, SG2, SG3 (detection quality) supplied by different processes P1, P2, P3 to a sensor 3a, 3b, 3b takes place. For example, if two processes report a sensor-specific location quality SG1, SG2, SG3 whose difference is greater than a specified tolerance for the same sensor 3a, 3b, 3b, this can be taken as an indication of a processing error in one of the participating processes P1, P2, P3 , As a result, when the Plausibili ^¬ tätsprüfung a mismatch of sensor-specific localization quality SGl, SG2, SG3 two processes Pl, P2, is found P3 for egg NEN sensor 3a, 3b, 3b, the positioning resultant ^¬ Menus (Type Ol, 02, 03) can the involved processes Pl, P2, P3 may be used with possibly lower weight in the location calculation in the secure computer 7. Is detected in the Plausibili ^¬ tätsprüfung that, for example Q-processing the sensor-specific or- SGl, SG2, SG3 several sensors 3a, 3b, 3b of a

Process Pl, P2, P3 non-Q to the sensor-specific positioning ^¬ SGl, SG2, SG3 of the identical sensors 3a, 3b, 3b of the neighboring processes fits, this is an indication of faulty process in the respective processing process Pl, P2, P3. In this case, the location results of this process Pl, P2, P3 are blocked for further processing. By Überprü ^¬ the sensor-specific quality locating Fung (sensor performance SGl, SG2, SG3) for all sensors 3a, 3b, 3b may all processes Pl, P2, P3 are systematically checked.

With sufficient agreement of the sensor-specific detection quality (sensor quality SG1, SG2, SG3) for all sensors 3a, 3b, 3b of a process P1, P2, P3 with the sensor-specific Location quality (sensor quality SG1, SG2, SG3) of these sensors 3a, 3b, 3b in the other processes Pl, P2, P3 are the results of this process Pl, P2, P3 supported by the Neighborhood ^¬ relation to the other processes Pl, P2, P3 and are trustworthy with that. Since the sensor-specific Or ^¬ tung Q (sensor performance SGl, SG2, SG3) is not exchanged between the pre ^¬ host computers 5a, 5b, 5c, a faulty operating process Pl, P2, P3 its data for the sensor-specific location quality (sensor performance SGl, SG2, SG3) should not be manipulated in such a way that they regularly match the data of the other processes Pl, P2, P3 and thereby mask its malfunction (robustness against Byzantine errors).

As a result of the process check in the first step, for each process P1, P2, P3, the preprocessing computer 5a, 5b, 5c determines whether the localization results (locations O1, 02, 03) for the location calculation may be reused in the secure computer 7.

The second step of processing the location results (locations Ol, 02, 03) in the safe computer is to calculate the safety-critical vehicle location (location 0) including a confidence interval.

For this step, only the location results (locations Ol and / or 02 and / or 03) permitted from the first step are used.

In the calculation of a resulting vehicle location, the location results (locations Ol, 02, 03) are proportional and weighted. The weight of a locating result (locations Ol, 02, 03) is obtained by taking into account the sensor-specific locating quality (sensor quality SG1, SG2, SG3) for all sensors 3a, 3b, 3b of a process P1, P2, P3. The higher the average ^¬ Liche locating quality (sensor performance SGl, SG2, SG3) of all sensors 3a, 3b, 3b of a process Pl, P2, P3, the stronger flows ^¬ SEN whose positioning results (places Ol, 02, 03) in the calculation tion of the resulting vehicle location (location O) and vice versa. The resulting vehicle location (location O) can be done by averaging the weighted location results (locations Ol, 02, 03).

Next, additional available location data of Siche ^¬ ren computer 7 such as Baliseninformationen be used in the positioning calculation. The result of the location calculation (location O) can be checked for plausibility, for example by comparison with extrapolated chronological location data (locations Ol, 02, 03).

The calculation of the confidence interval for the stay ^¬ place (places Ol, 02, 03) of the vehicle depends on the positioning accuracy achieved. The location accuracy is subject to fol ^¬ ing influences:

1. Number of processes Pl, P2, P3 approved for the calculation after the plausibility check

2. Number of sensors 3a, 3b, 3b, on which the resulting vehicle location is based

3. achieved level of the sensor-specific detection quality (Sen-care SGl, SG2, SG3) of the sensors used 3a, 3b, 3b

(Quality of the location results)

These influencing factors can be taken into account when calculating the confidence interval. For example, the size of the confidence interval may change each time a location sensor 3a, 3b, 3b temporarily supplies unusable data and subsequently resynchronizes. Wei be ^¬ terhin can confidence interval by additional Or ^¬ tung sensors in the secure vehicle computer improved (for example, by taking account of beacons).

The resulting confidence interval of the vehicle is there ^¬ dynamic. To increase accuracy, therefore, a confidence interval is formed in the secure computer 7 using the sensor quality SG1, SG2, SG3 and / or the sensor-specific tolerances.

To further increase the accuracy, the secure computer 7 uses as an example the information provided by a balise in order to carry out a correction of the calculated location O, wherein it subsequently subjects the calculated location O to a plausibility check. The location O thus determined stands thus for use e.g. ready for train control.

The entire process repeats itself with a defined cycle in the secure computer 7 or after the arrival of new ones

Data Sl, S2, S3 from the preprocessing computers 5a, 5b, 5c. The synchronization by means of balises only takes place if current balis data are available.

Claims

claims

1. A method for determining the location (O) and / or a movement amount of moving objects (1), in particular of moving track-bound vehicles, wherein at least one in the object (1) arranged sensor (3) is provided, the sensor data (S ) determined by the location (O) and / or the amount of movement, characterized in that at least three sensors (3a, 3b, 3b) are arranged on ^¬ at the object (1) independently sensor data (Sl, S2, S3) via determine the location (Ol, 02, 03) and / or the amount of movement and passed to processes (Pl, P2, P3) on egg ^¬ nEM or more, likewise arranged in the object (1) pre-processing computers (5a, 5b, 5c ), each process (P1, P2, P3) processing the sensor data (S1, S2, S3) from at least two sensors (3a, 3b, 3b) and each sensor (3a, 3b, 3b) transmitting its sensor data (P1, P2, S3). Sl, S2, S3) to at least two processes (P1, P2, P3), that each process (P1, P2, P3) transmits a difference factor (D1-2, Dl-3, D2-3) from the difference of the sensor data (Sl, S2, S3) of two sensors (3a, 3b, 3b) calculated that the processes (Pl, P2, P3) the difference factors (Dl-2, Dl-3, D2-3) and, based on the exchanged differential factors (Dl-2, Dl-3, D2-3), the sensor quality (SG1, SG2, SG3) for each sensor (3a, 3b, 3b) as Measure for the calculated sensor accuracy determine that the processes (Pl, P2, P3) based on the sensor data (Sl, S2, S3) and the sensor quality (SGl, SG2, SG3) respectively the location (Ol, 02, 03) and / or the movement quantity weighted with the associated sensor quality (SG1, SG2, SG3) calculate that each process (P1, P2, P3) determines the locations (O1, 02, 03) and / or movement quantities and the sensor quality (SG1, SG2, SG3) to a safe object also arranged in the object (1). ner (7) passes, the supply sizes places (Ol, 02, 03) and / or BEWE ^¬ and / or the sensor performance (SGl, SG2, SG3), respectively and compares the Type (Ol, 02, 03) and / or movement variables and does not discard the sensor quality (SG1, SG2, SG3), which are mostly within specified tolerances, while discarding the external ones, and that the secure computer (7) from the non-rejected locations (Ol, 02, 03) and / or movement quantities each weighted with the associated sensor quality (SGl, SG2, SG3) calculates the location (0) and / or the amount of movement.

2. The method according to claim 1, characterized in that the sensors (3a, 3b, 3b) based on the location (Ol, 02, 03) as well as on each movement size to work according to different principles of action.

3. The method according to claim 1 or 2, characterized in that the processes (Pl, P2, P3) from different ^{programs ¬} men / different software are constructed.

4. The method according to any one of claims 1-3, characterized in that the algorithm for determining the sensor quality (SGl, SG2, SG3) takes into account sensor-specific tolerances.

5. The method according to any one of claims 1-4, characterized in that in the secure computer (7) for calculating the confidence interval using the sensor quality (SGl, SG2, SG3) and / or the sensor-specific tolerances is formed.

6. The method according to any one of claims 1-5, characterized in that a plurality of preprocessing computers (5a, 5b, 5c) are provided.

7. The method according to any one of claims 1-6, characterized in that the method with respect to the rejection of the places (Ol, 02, 03) and / or the movement quantities and the sensor quality (SGl, SG2, SG3) is combined with known plausibility method.

8. The method according to any one of claims 1-7, characterized in that the processes (Pl, P2, P3) on several preprocessing ^¬ computer (5a, 5b, 5c) are divided.

9. The method according to any one of claims 1-8, characterized in that more than three independently operating sensors (3a, 3b, 3b) are used.