EP2643198B1 - Verfahren zur sicherung eines steuersystems eines neukonfigurierbaren fahrzeugs aus mehreren einheiten sowie gesichertes steuersystem - Google Patents

Verfahren zur sicherung eines steuersystems eines neukonfigurierbaren fahrzeugs aus mehreren einheiten sowie gesichertes steuersystem Download PDF

Info

Publication number
EP2643198B1
EP2643198B1 EP11757325.3A EP11757325A EP2643198B1 EP 2643198 B1 EP2643198 B1 EP 2643198B1 EP 11757325 A EP11757325 A EP 11757325A EP 2643198 B1 EP2643198 B1 EP 2643198B1
Authority
EP
European Patent Office
Prior art keywords
unit
unit vehicle
composition
identity
inputs
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP11757325.3A
Other languages
English (en)
French (fr)
Other versions
EP2643198A1 (de
Inventor
Eric Chenu
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Siemens SAS
Original Assignee
Siemens SAS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Siemens SAS filed Critical Siemens SAS
Priority to EP11757325.3A priority Critical patent/EP2643198B1/de
Publication of EP2643198A1 publication Critical patent/EP2643198A1/de
Application granted granted Critical
Publication of EP2643198B1 publication Critical patent/EP2643198B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L15/00—Indicators provided on the vehicle or train for signalling purposes
    • B61L15/0072—On-board train data handling
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L15/00—Indicators provided on the vehicle or train for signalling purposes
    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L15/00—Indicators provided on the vehicle or train for signalling purposes
    • B61L15/0018—Communication with or on the vehicle or train
    • B61L15/0036—Conductor-based, e.g. using CAN-Bus, train-line or optical fibres

Definitions

  • the present invention relates to a method of securing a control system of a multi-unit vehicle and a secure control system of said multi-unit vehicle, according to the preambles of claims 1 and 7.
  • the present invention relates to the field of multi-unit reconfigurable vehicles, ie able to be composed of several units and whose configuration or composition of said units of said multi-unit vehicle is variable, or in other words likely to be modified or re-configured.
  • the present invention relates to multi-unit vehicles whose operation of a control system, including automatic, is correlated to the composition of the multi-unit vehicle.
  • Said multi-unit vehicle belongs in particular to the railway domain.
  • This is for example a train that can be formed of several units, for example several cars and / or locomotives coupled or hitched successively to each other and constituting a first train of said train.
  • the composition of said train, and thus of said first train can then vary, for example by splitting or coupling of said first train, in order to form a second train composed of at least a part of the units of said first train, to which hitched to other units.
  • the composition of a multi-unit vehicle can vary according to a change of a disposition or a distribution of said units forming said multi-unit vehicle, as well as by addition, and / or respectively withdrawal, of at least one audit unit, and / or respectively said multi-unit vehicle.
  • composition data of said multi-unit vehicle for example the number of units comprising it, the characteristics said units, the relations between these units, their coupling or coupling to one or two other units, are known to the control system for controlling said multi-unit vehicle.
  • This control system generally comprises a computer connected to input / output modules, in particular for acquiring and transmitting operating data relating to driving the multi-unit vehicle.
  • the computer is thus able to control, via the input / output modules, said multi-unit vehicle, in particular according to an automatic mode, or in a manual mode in which the control system, and therefore the computer, is capable of being controlled by a driver or a command center.
  • the operating data is in particular exchanged, via the input / output modules, between said computer and devices included in at least part of the units comprising said multi-unit vehicle to ensure its operation.
  • Said exchange of operating data may for example be implemented by means of a bidirectional connection between the computer and said devices via said input / output modules.
  • the computer and the input / output modules are thus intended to enable and control the multi-unit vehicle, or in other words its correct operation (movement, stop, opening of doors, ...), based on the composition data of said multi-unit vehicle and control operation data exchangeable with said devices of at least a part of said units.
  • said composition data When changing the configuration of said multi-unit vehicle (splitting, coupling with other units), said composition data must be updated so that the control system, in particular its computer, is informed of said change of configuration and be able to correlate the change of composition of said multi-unit vehicle with a change of operating data relating to the control. Indeed, if the computer is not informed of a change in the composition of the multi-unit vehicle, it may interpret a non-receipt of the operating data of the units that have been uncoupled from the multi-unit vehicle (and which can therefore no longer transmit operating data relating to the driving) as a security risk for said multi-unit vehicle, which can therefore result in an activation of a multi-unit vehicle safety procedure, such as, for example emergency braking.
  • a multi-unit vehicle safety procedure such as, for example emergency braking.
  • the driving system of the multi-unit vehicle must in particular be characterized by a high degree of functional safety in order to prevent any event that may affect said multi-unit vehicle or passengers or goods transported by said multi-unit vehicle.
  • the safety of such control systems can be characterized by means of safety standards.
  • the IEC 61508 standard defines the Security Integrity Level (SIL), which is the level of security integrity that a system must have in order to provide adequate protection against the risks that may arise during operation of said system.
  • SIL value the greater the risk reduction.
  • a SIL4 security system provides a risk reduction of between 10 8 to 10 9 in the continuous mode of operation, whereas for an SIL1 system, this reduction is between 10 5 to 10 6 only.
  • control system computer knows exactly the composition and configuration of said multi-unit vehicle (for example, which units make up a train and according to what order of formation are they ordered, or in other words, in what order are they coupled or coupled), so that it can exchange with the units of the multi-unit vehicle all the operating data necessary for controlling said multi-unit vehicle.
  • a theme is particularly addressed in the document WO 2007/118837 describing an automatic addressing method in a communication system, in particular linked to the railway domain.
  • the control system computer in the case of a change in the composition of a multi-unit vehicle, for example, when a train is divided into several parts, the control system computer must be promptly informed of said composition change by example in order to allow oneself to no longer take into account operating data of units that have been detached from the train during its splitting, and so as not to fall into a state of safety resulting in a warning of a monitoring center of a multi-unit vehicle network or even an activation of a trip process, such as emergency braking of said multi-unit vehicle.
  • control systems whether automatic or manual and security (SIL4) known to those skilled in the art are essentially based on "closed" computers for which the perimeter of inputs / outputs is not reconfigurable, ie the computer is connected to a fixed set of inputs / outputs of input / output modules, these inputs / outputs fixedly connecting the computer to certain functional devices of the units managed by said computer, and thus not reconfigurable during a configuration change of the multi-unit vehicle.
  • functional device reference is made to any device interacting with the control system so as to enable said multi-unit vehicle to be piloted. These include, for example, braking devices, opening doors, devices allowing or monitoring the movement of said multi-unit vehicle, etc.
  • the management a multi-unit vehicle generally uses several computers each managing a part of the multi-unit vehicle, each computer being connected to inputs / outputs connecting them in a fixed way to certain functional devices of the unit or unit that it manages.
  • this design of the control system has the disadvantage of having to manage distributed functions on the different computers, notably requiring synchronization algorithms of said computers, whose complexity increases with the number of units constituting the multi-unit vehicle.
  • composition or constitution of a multi-unit vehicle is thus generally deduced from overlapping of several application information exchanged between the different computers of said vehicle.
  • This application information is information from other devices of the multi-unit vehicle not all having the primary task of determining the composition of said multi-guided vehicle. This is, for example, the location data of the head and the tail of the multi-unit vehicle transmitted to the computer by on-board or ground locating devices, or the state of the equipment of the units, or multi-unit vehicles transmitted to the computer by a ground automatic pilot not loaded in said multi-unit vehicle.
  • the overlapping of this application information has the disadvantage of being complicated and slow, and thus reduces the driving performance of said multi-unit vehicle.
  • An object of the present invention is to provide a method of securing a system for driving a reconfigurable multi-unit vehicle and a secure control system which are simple, safe, reliable and efficient, capable of automatic updating and autonomous of a composition of the multi-unit vehicle, while having a security capacity SIL4.
  • the present invention aims to automatically determine and update the composition of the multi-unit vehicle, independently of application information, to safely ensure the multi-unit vehicle control system.
  • the method according to the invention is a method of security, preferentially automatic and in SIL4 security system, a multi-unit vehicle control system capable of reliably determining the composition of the multi-unit vehicle at all times, and guaranteeing coherence between the components at all times.
  • the multi-unit vehicle and the operating data of the multi-unit vehicle control system by the combination of at least one computer with said set of Inputs / Outputs correlated to said composition of the multi-unit vehicle.
  • the method according to the invention is in particular characterized by a cyclic verification, in particular of random or fixed frequency, but in all cases sufficiently frequent verification (for example, at least one verification per time interval less than or equal to 100 milliseconds), in particular by means of the security module, a coherence between the connection of each element of said set of elements with said set of Inputs / Outputs and said composition datum.
  • the present invention is characterized in that said set of elements comprises or is a group of computers that can be distributed in each unit of said multi-unit vehicle.
  • the control system according to the invention preferably comprises said group of computers that can be composed of several identical computers, each computer can be distributed in particular in a unit of the multi-unit vehicle, so that each unit is susceptible to be equipped by at least one calculator.
  • the security module according to the invention is in particular capable of exclusively assigning the connection to said set of inputs / outputs, in particular to each input / output of said set of inputs / outputs, to a single computer of said group. computers, the other computers of said group of computers being excluded from said connection or in other words, prohibited access to said set of Inputs / Outputs.
  • the method according to the invention is capable of comprising a mechanism for securing and prioritizing the connection of at least one computer of said group of computers with said set of inputs / outputs, capable of exclusively assigning calculating said connection to said set of Inputs / Outputs.
  • the elected computer ie having the exclusive access to the set of inputs / outputs is called the master computer.
  • at least one other computer of said computer group is in particular associable with the master computer as a redundant computer of said master computer.
  • the control system according to the invention is capable not only of choosing a master computer from among the computer group, but also of naming a redundant computer from among said computer group.
  • the redundant computer is able to perform the same operations as the master computer, to acquire the same data composition and operation as the master computer for verification and securing of the control system. In the event of failure of the master computer, the redundant computer is able to replace said master computer and to name a new redundant computer.
  • said security and prioritization mechanism comprises a generation of an encoded association token able to lock said connection of at least one computer of said group of computers with said set of Inputs / Outputs, and a generation of an unlocking key capable of unlocking said connection of at least one computer of said group of computers with said set of Inputs / Outputs.
  • at least one computer of the control system can in particular be equipped with a security module comprising a locking module capable of locking each connection of the computer with each of the Inputs / Outputs of said set of Inputs / Outputs.
  • This locking module comprises in particular an encoded association token generator capable of generating, in particular cyclically, on the one hand said coded association token in order to lock each connection of said computer with each of the inputs / outputs of said set of inputs. / Outputs, and secondly said unlocking key adapted to unlock at least one connection of said computer with at least one of the inputs / outputs of said set of inputs / outputs.
  • the method according to the invention is characterized in that said autonomous determination comprises a successive and ordered addition to a list, according to a composition order of said multi-unit vehicle, of at least one piece of identity data of each unit. of said multi-unit vehicle so that a succession order of the identity data included in said list is correlatable to the composition order of the units of said multi-unit vehicle, each identity data being specific to a single unit of the multi-unit vehicle unit, and said list being able to be encapsulated in said composition datum.
  • the identity data item comprises at least one temporal datum, an identifier of the unit, a coding constant, and at least one identifier of a piece of equipment of said unit.
  • the control system according to the invention is characterized in that its device for determining a composition of the multi-unit vehicle comprises at least one identity generating device, each device for generating the identity of the determining device being adapted to equip a unit of the multi-unit vehicle, so that each unit can be equipped with a single identity generation device, each identity generation device being able to generate the identity data of the device. unit it is intended to equip.
  • the method according to the invention is thus characterized in particular by equipping each unit of said multi-unit vehicle with said identical identity generating device capable of generating said identity data for determining the composition of said multi-unit vehicle.
  • each unit of the multi-unit vehicle is capable of comprising an identical identity generating device, each identity generating device being connectable or connectable to at least one other identity generating device, so as to form a chain of identity generating devices each equipping a unit of said multi-unit vehicle and coupled one after the other.
  • each identity generating device equipping each of the units of the multi-unit vehicle is thus connectable to one or two identical identity generation devices so as to form a chain of identity generation devices capable of successively transmitting said list.
  • each identity generation device comprises at least two connectors, respectively a first and a second connector, each for coupling said identity generating device with another identity generating device, ie one of its neighbors in said chain of identity generation devices.
  • Said list can be created by the list generator of one of the two, see two identity generating devices located at the end of said chain as soon as the multi-unit vehicle comprises more than two units.
  • the device for determining said composition thus comprises as many identity generating devices as the multi-unit vehicle comprises units.
  • Each of these identity generation devices is capable of generating the identity data of the unit it equips and transmitting to one or the other of its neighbors, said list after it has been transmitted to it. by the other, respectively one of his neighbors.
  • identity generation devices located at the end of the chain and having a single neighbor ie the identity generating devices for which the presence of coupling with a single other identity generating device is detected, are allowed to generate the list and / or to encapsulate a list received from their unique neighbor in said identity data, so that said list at the end of the chain, it is transmitted to at least one module for securing at least one control system computer by means of said composition datum.
  • said list generator is in particular able to cyclically create said list.
  • said list generator is capable of creating said list when said connection detector detects said presence of coupling of said identity generating device with a single other identity generating device or with no other identity generating device.
  • the creation of said list by the list generator of at least one of the identity generation devices located at the end of the chain allows a control and a continuous updating of the composition of the multi-unit vehicle when the latter is composed at least two units, since said list can be continuously transmitted to the computer via said composition data as soon as said list has passed through the entire chain of identity generating devices.
  • the creation of said list by the list generator of an identity generation device coupled with no other identity generation device allows said control and the continuous updating of the composition of the multi-unit vehicle when the latter is composed of a single unit.
  • said identity data generator is in particular capable of generating polarization data capable of authorizing the transmission of said list of elements by means of only one of the two connectors of said identity generating device, so that said list traverses said chain of identity generation devices according to a priority sense definable by said polarization.
  • each unit comprising said control system is capable of being autonomous, i.e. it is able to move, to manage its movement and its operation independently of any other control system external to said unit.
  • the control system that can be associated with an autonomous unit is able to control and manage the movement of other units that can be coupled or coupled to it, that these other units comprise at least one other autonomous unit and / or at least one other unit. non autonomous unit.
  • a non-autonomous unit as opposed to said autonomous unit, is a unit which comprises only a part of the control system, in particular at least one identity generating device, each of these devices being connectable to the network of said unit, it being even connectable to the network of other units that are likely to be coupled or hitched to form the network of the multi-unit vehicle.
  • an autonomous unit will be able to embark said control system according to the invention, and a non-autonomous unit will refer to a unit that does not have all of said onboard control system.
  • a multi-unit vehicle is then likely to be formed of at least one autonomous unit that can be coupled, or not, to one or more autonomous or non-autonomous units.
  • a computer of one of the autonomous units will be in particular responsible for the management of the control and operation of the multi-unit vehicle.
  • the master computer of one of the autonomous units is intended to drive the multi-unit vehicle.
  • An automatic designation of the master computer for controlling said multi-unit vehicle is feasible as a function, for example, of the formation order of the multi-unit vehicle deductible from said composition data that can be acquired by each computer of each unit.
  • the security module of the control system is on the one hand able to connect each computer to said set of inputs / outputs to allow an exchange operating data between each computer and the functional devices of the units of the multi-unit vehicle, but also, and secondly, to prioritize the connection of said automatically designated master computer to said set of inputs / outputs and to associate a calculator redundant.
  • it is particularly referred to the exclusive allocation of the connection with said set of inputs / outputs to a computer, preferably to a single computer, for example said master computer, or said master computer with its redundant.
  • the input / output set of the I / O modules of the secure control system makes it possible to connect each computer of the multi-unit vehicle to the functional devices of said multi-unit vehicle via the network of the multi-unit vehicle, said network being common to all the calculators of the multi-unit vehicle.
  • the data of compositions and operations can be easily and quickly centralized to the same computer, ie said master computer, via said network, in order to be processed, which has the advantage of ensuring a speed of processing.
  • the control system is capable of choosing at least one computer from among all the computers distributed on the network of said vehicle so that it acts as a computer master intended to be associated directly, by connection to said set of Inputs / Outputs, the input / output modules of said vehicle to control it, for example automatically.
  • the computer acting as a master computer controls said vehicle
  • the other computers of said vehicle can in particular be in a standby state, so that only the computer chosen as the master computer by the security module controls the steering of said vehicle.
  • the figure 1 shows a secure control system adapted to driving a reconfigurable multi-unit vehicle comprising three units 1, 2, 3.
  • the control system comprises at least one identity generation device 4, each identity generation device 4 being intended to equip a unit 1, 2, 3.
  • each unit 1, 2, 3 is able to include said identity generation device 4.
  • Each identity generation device 4 is connectable to its neighbors in order to form a chain of identity generation devices. Said chain of identity generation devices connectable one after the other forms said device for determining a composition of the multi-unit vehicle according to the invention.
  • Said secure control system further comprises at least one computer 5 intended to equip each autonomous unit 1, 2 of the multi-unit vehicle, at least one input / output module 91, and at least one of said computers 5 of the secure control system comprising at least one security module 6, possibly included in the computer 5.
  • several computers 5 are distributed in several autonomous units 1, 2, and several modules d Inputs / Outputs 91 are distributed in several units, whether autonomous or non-autonomous.
  • a network 8 of the multi-unit vehicle makes it possible to connect the computers 5, the security modules 6, the device for determining the composition of the multi-unit vehicle, the I / O modules 91, and the functional devices 7 of each to each other so that they can communicate and exchange information, such as composition data and operating data, with each other.
  • the I / O modules 91 of the control system allow the connection, via the network 8, of the computers to a set of I / Os, each I / O being able to connect at least one functional device 7 to at least one computer 5.
  • Each computer 5 is in particular dynamically reconfigurable on the basis of the composition data supplied by the device for determining the composition of the multi-unit vehicle, in order to maintain in real time a connection with said inputs / outputs. consistent with the composition of said multi-unit vehicle.
  • the figure 2 presents an exemplary embodiment of an identity generation device 4 according to the invention.
  • Each identity generation device 4 is connectable, in particular by means of a bidirectional series low bit rate differential connection, to at least one other identical identity generation device 4a, 4b, in particular to two other generation devices.
  • identity 4a, 4b identical as presented in Fig. 2 .
  • Each identity generation device 4, 4a, 4b comprises an identity data generator 41, a connection detector 42, a signal generator list 43, a serialization component 44, a list transmitter 45, and at least two connectors, respectively a first connector 46a and a second connector 46b, for the acquisition and transmission of the list.
  • a third connector 47 may in particular connect the identity generating device to the network of the unit or the multi-unit vehicle.
  • connection detector of the identity generation device is particularly characterized in that it is able to guarantee in safety that a list has an input on the first connector 46a or respectively the second connector 46b and intended to to be acquired by said identity generating device, can not be found by crosstalk or any other coupling on the second 46b or respectively the first connector 46a.
  • the connection detector, connectable to said connectors 46b, 46a may in particular comprise at least one electrically isolated differential buffer, in particular a first buffer 422 connectable to the first connector and a second buffer connectable to the second connector, as well as receivers opto-couplers, in particular a first optocoupler receiver connectable to the first connector and a second opto-coupler receiver 421 connectable to the second connector.
  • protection components against disturbances and overvoltages may be added to said detection device, as well as filters to ensure safety isolation between the first and second connector 46a, 46b.
  • said serialization component 44 may comprise two distinct digital components 441, 442, for example FPGAs, capable of performing serialization and deserialization functions of an element of said list, as well as the function of adding another element following the last element of that list, in particular in order to guarantee in safety that a list can not pass through the identity generation device of the connector 46a to the connector 46b, or vice versa, without having been enriched with the identity data of said identity generating device.
  • two distinct digital components 441, 442 for example FPGAs
  • the identity data generator 41 is in particular capable of generating polarization information, said polarization information permitting, possibly propagating the list comprising said identity data only to one and only one of said first or second connectors 46a or 46b.
  • said identity data may advantageously comprise various information allowing identification of the unit it equips, such as for example an equipment number or a unit number of the unit it equips.
  • the list transmitter 45 is able to act as an interface between the network, for example an IP Ethernet network, the multi-unit vehicle and the identity generation device. For this purpose, it may optionally comprise a digital component, such as an FPGA programmable logic circuit.
  • the control system according to the invention is thus able to guarantee that at least one computer, preferably the master computer, is associated in a coherent manner with all the functional devices of the multi-unit vehicle in order to control said vehicle. multi-unit.
  • the device for determining the composition of the multi-unit vehicle makes it possible to discover said composition by propagation of said list from one unit to another unit composing said multi-unit vehicle.
  • the security module associates, preferably exclusively, a connection to a set of I / O distributed on the network of said multi-unit vehicle with a computer, in particular with a master computer, said inputs / outputs being intended to connect said calculator to the functional devices of the units that make up said multi-unit vehicle.
  • each computer is coupled to a security module according to the invention, and each security module according to the invention is able, depending on said composition data to enter an inactive mode or in an active mode, to so that a single security module is active for the multi-unit vehicle.
  • at least one predefinable condition in each of said securing modules allows each of the security modules to determine its own mode of operation, ie either said active mode or said inactive mode. Said predefinable condition can for example be correlated to a position within the multi-unit vehicle of the unit equipped with a computer comprising said security module.
  • the figure 3 shows an example of a mechanism for securing the association of at least one computer of a control system according to the invention with a set of inputs / outputs of input / output modules for equipping the multi-unit vehicle .
  • a security module is chosen, for example according to said composition datum, in order to secure the connection.
  • a calculator or a computer group for example a master computer and its redundant computer, with a set of inputs / outputs of input / output modules.
  • the security module comprises in particular an encoded association token generator capable of generating an encoded association token, in particular comprising a specific identification code of the computer or the group of computers authorized to be connected to the Inputs. / Outputs of said input / output modules.
  • the locking module of the security module is capable of transmitting said token to all I / O modules whose I / O must be connected to the computer or computer group in order to remain coherent with said composition data of the multi-unit vehicle, and to allow control by the computer or the computer. computer group, functional devices of the multi-unit vehicle.
  • composition data in particular makes it possible for the security module to determine which Inputs / Outputs of which input / output modules must be controlled by the computer or computer group in order to ensure the operation of the multi-unit vehicle, and therefore of determine which inputs / outputs must be connected to the calculator or computer group.
  • Each input / output module receiving said coded association token is particularly capable, during a response phase, of transmitting periodically or sufficiently frequently a confirmation message capable of confirming the connection of said computer with the inputs / outputs of said module.
  • I / O and transmit said confirmation message to said computer, in particular to said securing module of said computer secure management system.
  • Said confirmation message may for example be issued periodically to a transmission period whose time value, ie its duration, may be predefined.
  • the response phase may be preceded by an initialization phase 1 for generating and initializing the confirmation message.
  • the duration of this initialization phase is in particular greater than the duration of said transmission period in order to guarantee in safety that the security mechanism has the time to detect that a computer or a group of computers previously connected to an input / Output of an I / O module has or have lost said connection with said I / O before another computer or group of computers has had the time to connect to said Input / Output.
  • This duration of the initialization phase greater than the transmission period may be for example guaranteed by a pseudo-random generator forced to operate continuously during said initialization phase of the confirmation message.
  • an initialized confirmation message 2 is generated by the input / output module.
  • the input / output module is able to associate, during an association phase 4, said coded association token. audit confirmation message initialized.
  • said confirmation message 5 is ready to be transmitted periodically to the security module.
  • this confirmation message comprises on the one hand said identification data of the computer or group of computers, but also on the other hand, an identification of the inputs / outputs of the input module. / Outputs connected to said calculator or group of computers, and a temporal data to verify a freshness of the confirmation message.
  • the confirmation message is then sent, in particular cyclically, during the response phase 6, at least to said security module having issued the coded association token.
  • the locking module of said security module is capable of decoding the confirmation message in order to check that the inputs / outputs of said input / output module are connected to said calculator or to said calculator group, and not to other calculators. .
  • the association token generator of said locking module is capable of generating an unlocking key intended to be transmitted by the locking module to all the I / O modules whose connections to the computer or the computer group must be disconnected.
  • the I / O module is particularly adapted to disassociate the coded association token from the initialized confirmation message in order to restore said initialized confirmation message 2.
  • the I / O module is able to reset by returning to the initialization phase of the confirmation message. to allow, for example, that a coded association token of another computer is likely to be associated with said initialized confirmation message.
  • the response phase 6 makes it possible to send, in particular cyclically, to the security module the confirmation, via said confirmation message, that the inputs / outputs of said input / output module are connected and controlled by the computer, for example the computer master, or by a group of computers, for example the master computer and its redundant.
  • Said security module is thus particularly capable of constantly checking a coherence of the connection of the computer with each input / output module for which it has received said confirmation message and said composition data, thereby guaranteeing the secure connection of a calculator auditing set of Inputs / Outputs.
  • the figure 4 describes an automatic coupling of a first multi-unit vehicle 1 with a second multi-unit vehicle 2 each comprising a secure steering system according to the invention, in order to form a new multi-unit vehicle.
  • the two multi-unit vehicles for example a first train comprising three cars and a second train comprising two cars, each comprise a distributed secure control system of their own, said secure control systems of each of the multi-vehicles. -units being independent of each other.
  • the first multi-unit vehicle 1 comprises in particular three units
  • the second multi-unit vehicle 2 comprises two units.
  • the control system of the first multi-unit vehicle 1 comprises in particular at least three computers 51, 52, 53 and at least three I / O modules 91, 92, 93 connected by a first network 81, for example Ethernet,
  • the second multi-unit vehicle 2 comprises in particular at least two computers 54, 55, and at least two I / O modules 94, 95, connected by a second network 82.
  • two multi-unit vehicles, at least one computer and at least one input / output module of the secure control system are intended to equip a unit, so that each unit comprises at least one computer and at least one input module /Exits. So, in this example, each unit is an autonomous unit.
  • said first and second multi-unit vehicles could equally well include one or more non-autonomous units, each non-autonomous unit comprising for example at least one input / output module and an identity generating device.
  • One of the computers 51, 52, 53 of the first multi-unit vehicle 1 is chosen to be the master computer of the first multi-unit vehicle 1, for example the computer 51 adapted to be positioned at one end of said first multi-unit vehicle 1, and possibly another of the computers 51, 52, 53 of the first multi-unit vehicle 1 is chosen to be its redundant, for example the computer 53 positionable at the other end of the first multi-unit vehicle 1.
  • one of the computers 54 , 55 of the second multi-unit vehicle 2 is chosen to be the master computer of the second multi-unit vehicle 2, for example the computer 54 that can be positioned at one end of the second multi-unit vehicle 2, and possibly another of the computers 54, 55 of the second multi-unit vehicle 2 is chosen to be its redundant, for example the computer 55 positionable at the other end of the second multi-unit vehicle 2.
  • the secure control system includes in particular a master calculator positionable, especially in a standalone unit, at one end of the multi-unit vehicle and a calculator redundant said master computer, ie redundant sound, positionable, in particular in an autonomous unit, at the other end of said multi-unit vehicle, to allow efficient splitting of said multi-unit vehicle.
  • the other computers of the first multi-unit vehicle 1, respectively of the second multi-unit vehicle 2 are in an inactive state, such as, for example, the computer 52 of the first multi-unit vehicle 1.
  • the choice of the computer master and its redundant may be based on an algorithm of choice using a numbering, such as for example an IP address or a computer number, or a determination of a position of the computers in the multi-unit vehicle, said position being by example a position central, a position at the head or tail of multi-unit vehicle, the position of a computer being deductible from said composition data.
  • At least one mechanism for securing and prioritizing a security module of a control system computer is able to choose said master computer and its redundant , and therefore allows a prioritization of the master computer, or in other words, an exclusive connection of the master computer with the Inputs / Outputs of the I / O modules of the multi-unit vehicle, so that only the master computer is able to control the inputs / outputs of the input / output modules for equipping said multi-unit vehicle.
  • the redundant computer is able to take control of said inputs / outputs in the event of failure of the master computer.
  • said security module adapted to perform said securing mechanism and prioritization may optionally be chosen automatically according to said composition data for each of said multi-unit vehicles.
  • the security module is able to choose as master computer via its mechanism of securing and prioritizing the computer that it is intended to equip.
  • the security module is able to preferentially prioritize the computer that it equips.
  • a security module 6 of the first multi-unit vehicle 1 is able to choose said computer 51 as master computer to allow the latter to control the inputs / outputs of the I / O modules 91, 92, 93 of the first multi-unit vehicle 1 via the first network 81.
  • a security module 6 of the second multi-unit vehicle 2 is able to select said computer 54 as master computer to enable it to control the inputs / Outputs of the I / O modules 94, 95 of the second multi-unit vehicle 2 via the second network 82.
  • each computer according to the invention when it is the redundant computer of a master computer, is in particular able to verify a state of synchronization of its context with a context of said master computer.
  • the master computer and its redundant when the context of the latter is verified synchronous with that of the master computer, are able to be connected to the inputs / outputs of the input / output modules which are associable to them.
  • the security module 6 of the master computer is able to lock, by means of a coded association token, the connection of said master computer and its redundant with said inputs / outputs.
  • a master computer and its redundant are connected via a connection locked to a set of inputs / outputs, only the master computer is authorized to control the functional devices of the multi-unit vehicle, while the redundant computer is able to verify operations performed by the master computer and replace said master computer in case of failure of the latter.
  • the control system of the first multi-unit vehicle 1 is further characterized in that it comprises at least one identity generation device, in particular three identity generation devices 41, 42, 43, each intended to equip a unit of the first multi-unit vehicle 1.
  • the control system of the second multi-unit vehicle comprises two identity generation devices intended to equip, each, a unit of said second multi-unit vehicle 2.
  • a first identity generating device 41, a second identity generating device 42 and a third identity generating device 43 each a unit of the first multi-unit vehicle 1, and a first identity generation device 44 and a second identity generating device equip said second multi-unit vehicle.
  • the identity generating devices 41, 42, 43 of the first multi-unit vehicle 1, respectively those of the second multi-unit vehicle 2, are connectable one after the other in order to form a first device chain. generation of identity, respectively a second chain of identity generating devices, each of said chains being in other words a first, respectively second, device for determining the composition of the multi-unit vehicle according to the invention.
  • Each identity generation device is capable of communicating and exchanging data, in particular said list according to the invention, with its neighbor or neighbors.
  • communication can be established from one end of the chain of identity generating devices to another, or in other words end-to-end of the multi-unit vehicle, either in a first direction from the head to the tail of the multi-unit vehicle, for example from the identity generating device 41 located at the head of the multi-unit vehicle at the identity generation device 43 located at the tail of said multi-unit vehicle, or conversely, from the tail to the head of the multi-unit vehicle, for example from the identity generating device 43 at the tail to the device of identity generation 41 at the head, or even in both directions at the same time.
  • the identity generating devices 44, 45 of the second multi-unit vehicle are examples of the second multi-unit vehicle.
  • At least one of the identity generation devices 41, 42, 43 of the first multi-unit vehicle 1, respectively of the second multi-unit vehicle 2, in particular located at the end of the first chain, respectively of the second chain, is able to initialize said list according to the invention, for example a first list for the control system of the first multi-unit vehicle 1, and a second list for the second multi-unit vehicle 2.
  • Each of these lists preferably comprises a time data, for example a date , and allows an encoding of the composition of the multi-unit vehicle for which it was generated.
  • the first list will be able to be initialized for the first multi-unit vehicle 1 by one of its identity generation devices and will allow an encoding of the composition of said first multi-unit vehicle 1, and a second list will be suitable for to be initialized for the second multi-unit vehicle 2 by one of its identity generation devices, and will also allow encoding of its composition.
  • a second list will be suitable for to be initialized for the second multi-unit vehicle 2 by one of its identity generation devices, and will also allow encoding of its composition.
  • Each identity generation device 41, 42, 43 of the first multi-unit vehicle 1, respectively each identity generation device 44, 45 of the second multi-unit vehicle 2, is capable of accumulating or adding a piece of identity data in said first list, respectively second list, following the last element (for example following the last identity data) added in said first, respectively second list by the previous identity generating device.
  • the identity generation device located at the other end of said first chain, or second chain, ie located at the end of the chain, is in particular able to transmit, in particular cyclically, said first list, respectively second a list, encapsulated in a composition datum, to the master computer 51 and its redundant 53 via said first network 81 in the case of the first multi-unit vehicle 1, and to the master computer 54 and its redundant 55, via said second network 82 in the case of the second multi-unit vehicle 2.
  • the identity generating device capable of receiving the first list by one of its connectors and the second list by another of its connectors is in particular able to create a new list comprising the elements of the first list, which is added first of all the identity data created by said generation device likely to receive the first and second list, and then the elements of the second list.
  • the new list thus includes the identity data of all the units comprising the multi-unit vehicle.
  • the identity generation device capable of receiving the first list by one of its connectors and the second list by another of its connectors is able to choose either the first list or the second list, ie only one of the two lists. , in order to transmit it to an identity generation device located at the end of the chain.
  • one and only one of the two lists is able to propagate to one and only one identity generation device located at the end of the chain, intended to support the creation of the complete list of identity data of all the units composing the multi-unit vehicle.
  • the identity generating device having created said new list is further capable of encapsulating said new list in said composition data so that it is transmitted, in particular cyclically, to at least one computer, for example to all the computers equipping each multi-unit vehicles, or preferably to the master computer 51 and its redundant 53.
  • the identity generation devices being all identical and connectable to each other, it follows that the generation devices of 41, 42, 43 of the first multi-unit vehicle 1 are connectable to the identity generation devices 44, 45 of the second multi-unit vehicle 2 to form a new chain of identity generation devices composed of the first channel connected to the second chain, and thus forming a new device for determining the composition of the new multi-unit vehicle 3.
  • This new device for determining the composition of the new multi-unit vehicle 3 is capable of automatically determining the composition of the new vehicle multi-unit 3 and generate a composition data encoding said composition of the new multi-unit vehicle 3.
  • the first network 81 and the second network 82 are connectable to each other to form a new network 83, said new network 83 being a meeting of the first network 81 and the second network 82.
  • the new device for determining the composition of the new multi-unit vehicle 3, formed by the identity generating devices of the first and second multi-unit vehicles, is capable of transmitting via said new network 83, said composition datum of the new multi-unit vehicle 3, to all the computers of the new multi-unit vehicle 3, in particular so that at least one security module receives said composition data.
  • the master computer 51 and its redundant 53 of the first multi-unit vehicle 1, as well as the master computer 54 and its redundant 55 of the second multi-unit vehicle 2 are able, by means of their security module, to disconnect from the inputs / outputs of the input / output modules to which they were connected when the first and the second mutli-unit were unmated, ie independent.
  • each control system according to the invention is capable, by means of said unlocking key transmitted by their respective security modules, to cut off the connection of at least one of its computers, in particular of all its computers, together of I / O as soon as a variation of said composition data is detected.
  • the security module of the control system according to the invention is capable of detecting said variation of the composition datum and of cutting the connection of at least one computer with said set of I / O, in particular the connection the master computer and its redundant, to allow a new master computer and its redundant to take control of said inputs / outputs by connecting.
  • the new master computer is located at one end of the new multi-unit vehicle 3, for example the computer 51, and its redundant at the other end, for example the computer 55.
  • the other computers 52, 53, 54 of the new multi-unit vehicle 3 are preferably in an inactive state.
  • the new security module 6 of the control system of the new multi-unit vehicle 3 is then able, on the basis of said composition data, to connect at least one computer, in particular said new master computer and its redundant, to the set of inputs / outputs of the I / O modules 91 to 95 of the new multi-unit vehicle 3.
  • the control system of the new multi-unit vehicle 3 is able to take control of said Inputs / Outputs in order to control the functional devices of the new multi-unit vehicle for its control.
  • the Figure 4 also makes it possible to explain a splitting of a multi-unit vehicle equipped with a secure steering system according to the invention.
  • a multi-unit vehicle for example of said new multi-unit vehicle 3, into two or more other multi-unit vehicles, for example into a first multi-unit vehicle 1 and a second multi-unit vehicle 2
  • said new chain of identity generating devices of said new multi-unit vehicle formed by identity generation devices 41 to 45 is broken, separated into two parts, for example into said first chain of identity generating devices 41 to 43 of the first multi-unit vehicle 1, and said second chain of identity generating devices 44, 45 of the second multi-unit vehicle 2.
  • the network 83 of the new multi-unit vehicle unit 3 is separated into a first network 81 of the first multi-unit vehicle 1 and into a second network 82 of said second multi-unit vehicle 2.
  • each of the two parts of the identity device chain of the new multi-unit vehicle 3 is capable of independently and automatically generating a new composition datum characterizing the first multi-unit vehicle 1, and the second multi-unit vehicle respectively.
  • unit 2 the new composition data is in particular capable of causing the generation by at least one security module of the unlocking key allowing a disconnection of each of the computers, of with the Inputs / Outputs to which they were previously connected in the configuration of said new multi-unit vehicle 3.
  • said unlocking key is capable of being transmitted to each security module of a secure control system according to the invention, so that each security module is able to disconnect a calculator connection with at least one input / output during said splitting.
  • connection of the master computer 51 and its redundant 55 with the inputs / outputs of their I / O modules 91 to 95 is able to be cut off by means of said unlocking key that can be provided by the module. securing, either during said detection of the variation of the composition data during the splitting, or during a prior process of notifying splitting to said control system of said new multi-unit vehicle.
  • the present invention makes it possible, during a splitting or a coupling, to automatically correlate the new composition of the multi-unit vehicle with all the inputs / outputs to be taken into consideration by the master computer, so that a loss of a connection of the master computer with a part of its inputs / outputs does not result in an activation of an emergency procedure of the control system.
  • At least one computer among all the computers distributed on the network of said vehicle is able to act as a master computer to control said vehicle and to be directly associated, by connection to said set of Inputs / Outputs, to the input / output modules of said vehicle.
  • the computer acting as master computer controls said vehicle
  • the other computers of said vehicle can in particular be in a standby state, so that only the computer identified as master computer by the security module controls the steering of said vehicle, preferably , the security module identifies the computer that it equips as the master computer.
  • the present invention has made it possible to describe a secure control system capable of autonomously discovering the composition of a multi-unit vehicle such as a train, and of checking in a secure manner the correct connection of at least one system computer. control with a set of inputs / outputs of I / O modules distributed on the network of said multi-unit vehicle.
  • composition data of said multi-unit vehicle capable of describing a set of characteristics of the units capable of composing said multi-unit vehicle, and a set of possible configurations of said multi-unit vehicle can serve as a reference for the control, in particular cyclic , consistency between all the inputs / outputs able to be connected and locked with said computer and the composition of the multi-unit vehicle.
  • the present invention makes it possible to validate the integrity of a free multi-unit vehicle by resorting to application-level information, such as localization, for example, and by providing greater genericity of processing thanks to direct access to all the inputs / outputs of the multi-unit vehicle and the possibility of centralizing the software processing related to securing the control system on a single computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Mechanical Engineering (AREA)
  • Small-Scale Networks (AREA)
  • Traffic Control Systems (AREA)
  • Lock And Its Accessories (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Claims (15)

  1. Verfahren zur Sicherung eines Lenksystems, das dazu bestimmt ist, ein aus mehreren Einheiten bestehendes Fahrzeug auszurüsten und zu lenken, wobei das Verfahren umfasst:
    - eine autonome Bestimmung einer Zusammensetzung eines aus mehreren Einheiten bestehenden Fahrzeugs durch eine Vorrichtung zur Bestimmung der Zusammensetzung des aus mehreren Einheiten bestehenden Fahrzeugs in Verbindung mit einer Erzeugung eines Datenelements der Zusammensetzung des aus mehreren Einheiten bestehenden Fahrzeugs;
    - eine Übertragung des Datenelements der Zusammensetzung zu einer Gesamtheit von Elementen des Lenksystems, wobei wenigstens ein Element der Gesamtheit von Elementen ein Computer (5) des Lenksystems ist;
    und dadurch gekennzeichnet, dass das Verfahren umfasst:
    - eine Bestimmung, durch den Computer (5) und mittels des Datenelements der Zusammensetzung, einer Gesamtheit von Eingängen/Ausgängen wenigstens eines Eingangs-/Ausgangsmoduls (91), das zur Ausrüstung des aus mehreren Einheiten bestehenden Fahrzeugs bestimmt ist;
    - eine Verbindung jedes Elements der Gesamtheit von Elementen mit der Gesamtheit von Eingängen/Ausgängen.
  2. Verfahren nach Anspruch 1, dadurch gekennzeichnet, dass die Gesamtheit von Elementen eine Gruppe von Computern umfasst.
  3. Verfahren nach Anspruch 2, gekennzeichnet durch einen Mechanismus zur Sicherung und Priorisierung der Verbindung wenigstens eines Computers (5) der Gruppe von Computern mit der Gesamtheit von Eingängen/Ausgängen.
  4. Verfahren nach Anspruch 3, dadurch gekennzeichnet, dass der Mechanismus zur Sicherung und Priorisierung eine Erzeugung eines codierten Verknüpfungs-Tokens, der geeignet ist, die Verbindung wenigstens eines Computers (5) der Gruppe von Computern mit der Gesamtheit von Eingängen/Ausgängen zu verriegeln, und eine Erzeugung eines Entriegelungsschlüssels, der geeignet ist, die Verbindung wenigstens eines Computers (5) der Gruppe von Computern mit der Gesamtheit von Eingängen/Ausgängen zu entriegeln, umfasst.
  5. Verfahren nach einem der Ansprüche 1 bis 4, gekennzeichnet durch eine zyklische oder ausreichend häufige Überprüfung einer Kohärenz zwischen der Verbindung jedes Elements der Gesamtheit von Elementen mit der Gesamtheit von Eingängen/Ausgängen und dem Datenelement der Zusammensetzung.
  6. Verfahren nach einem der Ansprüche 1 bis 5, dadurch gekennzeichnet, dass die autonome Bestimmung ein sukzessives und geordnetes Hinzufügen, gemäß einer Reihenfolge der Zusammensetzung des aus mehreren Einheiten bestehenden Fahrzeugs, wenigstens eines Identifikationsdatenelements jeder Einheit (1, 2, 3) des aus mehreren Einheiten bestehenden Fahrzeugs zu einer Liste umfasst, derart, dass eine Reihenfolge der in der Liste enthaltenen Identifikationsdatenelemente mit der Reihenfolge der Zusammensetzung der Einheiten (1, 2, 3) des aus mehreren Einheiten bestehenden Fahrzeugs korrelierbar ist, wobei jedes Identifikationsdatenelement für eine einzige Einheit (1, 2, 3) des aus mehreren Einheiten bestehenden Fahrzeugs spezifisch ist, und wobei die Liste geeignet ist, in das Datenelement der Zusammensetzung eingebettet zu werden.
  7. Gesichertes Lenksystem eines aus mehreren Einheiten bestehenden Fahrzeugs, wobei das System umfasst:
    - eine Vorrichtung zur Bestimmung einer Zusammensetzung des aus mehreren Einheiten bestehenden Fahrzeugs, die in der Lage ist, auf autonome Weise die Zusammensetzung des aus mehreren Einheiten bestehenden Fahrzeugs zu bestimmen und ein Datenelement der Zusammensetzung zu erzeugen, das mit der Zusammensetzung des aus mehreren Einheiten bestehenden Fahrzeugs korrelierbar ist;
    - wenigstens einen Computer (5), der wenigstens ein Sicherungsmodul (6) umfasst, wobei der Computer (5) zur Ausrüstung wenigstens einer Einheit (1, 2, 3) des aus mehreren Einheiten bestehenden Fahrzeugs bestimmt ist, wobei jeder Computer mittels wenigstens einer Verbindung und über ein Netz (8) einerseits mit einer Gesamtheit von Eingängen/Ausgängen von Eingangs-/Ausgangsmodulen (91), die zur Ausrüstung einer oder mehrerer Einheiten (1, 2, 3) bestimmt sind, und andererseits mit der Vorrichtung zur Bestimmung der Zusammensetzung des aus mehreren Einheiten bestehenden Fahrzeugs verbindbar ist, um über jedes Eingangs-/Ausgangsmodul (91) Funktionsdaten der Einheit (1, 2, 3) und/oder des aus mehreren Einheiten bestehenden Fahrzeugs auszutauschen und um von der Vorrichtung zur Bestimmung ein Datenelement der Zusammensetzung des aus mehreren Einheiten bestehenden Fahrzeugs zu beziehen;
    und dadurch gekennzeichnet, dass das System umfasst:
    - das dynamische Sicherungsmodul (6) der Verbindung jedes Computers (5) mit der Gesamtheit von Eingängen/Ausgängen, wobei das Sicherungsmodul (6) in der Lage ist, aus dem Datenelement der Zusammensetzung die Gesamtheit von Eingängen/Ausgängen zu bestimmen, die mit jedem Computer (5) verbindbar sind, jeden Computer (5) mit der Gesamtheit von Eingängen/Ausgängen zu verbinden und eine Kohärenz zwischen jeder Verbindung jedes Computers (5) mit der Gesamtheit von Eingängen/Ausgängen zu überwachen.
  8. Lenksystem nach Anspruch 7, dadurch gekennzeichnet, dass es eine Gruppe von Computern umfasst, und dadurch, dass das Sicherungsmodul (6) in der Lage ist, die Verbindung eines einzigen Computers (5) der Gruppe von Computern mit der Gesamtheit von Eingängen/Ausgängen zu priorisieren.
  9. Lenksystem nach einem der Ansprüche 7 oder 8, dadurch gekennzeichnet, dass das Sicherungsmodul (6) ein Verriegelungsmodul umfasst, das in der Lage ist, jede Verbindung des Computers (5) mit jedem der Eingänge/Ausgänge der Gesamtheit von Eingängen/Ausgängen zu verriegeln.
  10. Lenksystem nach Anspruch 8, dadurch gekennzeichnet, dass das Verriegelungsmodul einen Generator eines codierten Verknüpfungs-Tokens umfasst, der geeignet ist, einen codierten Verknüpfungs-Token, um jede Verbindung des Computers (5) mit jedem der Eingänge/Ausgänge der Gesamtheit von Eingängen/Ausgängen zu verriegeln, und einen Entriegelungsschlüssel, der geeignet ist, wenigstens eine Verbindung des Computers (5) mit wenigstens einem der Eingänge/Ausgänge der Gesamtheit von Eingängen/Ausgängen zu entriegeln, zu erzeugen.
  11. Lenksystem nach einem der Ansprüche 7 bis 10, dadurch gekennzeichnet, dass die Vorrichtung zur Bestimmung einer Zusammensetzung des aus mehreren Einheiten bestehenden Fahrzeugs wenigstens eine Vorrichtung zur Identitätserzeugung (4) umfasst, wobei jede Vorrichtung zur Identitätserzeugung (4) der Vorrichtung zur Bestimmung zur Ausrüstung einer Einheit des aus mehreren Einheiten bestehenden Fahrzeugs bestimmt ist, wobei jede Vorrichtung zur Identitätserzeugung (4) in der Lage ist, ein Identifikationsdatenelement der Einheit (1, 2, 3) zu erzeugen, zu deren Ausrüstung sie bestimmt ist.
  12. Vorrichtung zur Identitätserzeugung (4), die dazu bestimmt ist, eine Bestimmung einer Zusammensetzung eines aus mehreren Einheiten bestehenden Fahrzeugs, das wenigstens eine Einheit (1, 2, 3) umfasst, zu ermöglichen, wobei die Vorrichtung zur Identitätserzeugung (4), die zur Ausrüstung einer Einheit des aus mehreren Einheiten bestehenden Fahrzeugs bestimmt ist, umfasst:
    - einen Generator von Identifikationsdaten, der in der Lage ist, ein Identifikationsdatenelement der Einheit (1, 2, 3) zu erzeugen, zu deren Ausrüstung die Vorrichtung zur Identitätserzeugung bestimmt ist, wobei das Identifikationsdatenelement dazu bestimmt ist, eine Identifikation der Einheit (1, 2, 3) zu ermöglichen;
    - einen Verbindungsdetektor, der geeignet ist, ein Vorhandensein oder Nichtvorhandensein einer Kopplung der Vorrichtung zur Identitätserzeugung (4) mit wenigstens einer weiteren Vorrichtung zur Identitätserzeugung (4) zu erkennen;
    - einen Listengenerator, der in der Lage ist, eine Liste von Elementen zu erzeugen, die dazu bestimmt ist, Elemente zu umfassen, die geeignet sind, geordnet und aufeinanderfolgend hinzugefügt zu werden;
    dadurch gekennzeichnet, dass die Vorrichtung umfasst:
    - eine Serialisierungskomponente, die in der Lage ist, ein weiteres Element zu der Liste hinzuzufügen, entweder im Anschluss an ein letztes Element einer Liste von Elementen, die aufeinanderfolgend geordnet werden können, die dazu bestimmt ist, durch die Vorrichtung zur Identitätserzeugung empfangen zu werden, oder als erstes Element der Liste von Elementen, die durch den Listengenerator erzeugbar ist, wobei das weitere Element das Identifikationsdatenelement umfasst;
    - einen Listensender, der in der Lage ist, die Liste von Elementen, die das weitere Element umfasst, nach Einbettung der Liste in ein Datenelement der Zusammensetzung des aus mehreren Einheiten bestehenden Fahrzeugs entweder zu einer weiteren Vorrichtung zur Identitätserzeugung (4) oder zu wenigstens einem Computer (5) des aus mehreren Einheiten bestehenden Fahrzeugs zu übertragen.
  13. Vorrichtung nach Anspruch 12, dadurch gekennzeichnet, dass der Listengenerator in der Lage ist, die Liste zyklisch oder ausreichend häufig zu erzeugen.
  14. Vorrichtung nach einem der Ansprüche 12 bis 13, dadurch gekennzeichnet, dass die Vorrichtung zur Identitätserzeugung (4) wenigstens zwei Verbinder umfasst, nämlich einen ersten und einen zweiten Verbinder, von denen jeder zur Kopplung der Vorrichtung zur Identitätserzeugung (4) mit einer weiteren Vorrichtung zur Identitätserzeugung (4) bestimmt ist.
  15. Vorrichtung nach Anspruch 14, dadurch gekennzeichnet, dass der Generator von Identifikationsdaten in der Lage ist, ein Polarisationsdatenelement zu erzeugen, das in der Lage ist, die Übertragung der Liste von Elementen nur mittels eines der beiden Verbinder zu autorisieren.
EP11757325.3A 2010-11-23 2011-09-15 Verfahren zur sicherung eines steuersystems eines neukonfigurierbaren fahrzeugs aus mehreren einheiten sowie gesichertes steuersystem Active EP2643198B1 (de)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP11757325.3A EP2643198B1 (de) 2010-11-23 2011-09-15 Verfahren zur sicherung eines steuersystems eines neukonfigurierbaren fahrzeugs aus mehreren einheiten sowie gesichertes steuersystem

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
EP10290624 2010-11-23
PCT/EP2011/066032 WO2012069223A1 (fr) 2010-11-23 2011-09-15 Méthode de sécurisation d'un système de pilotage d'un véhicule multi-unité reconfigurable et système de pilotage sécurisé
EP11757325.3A EP2643198B1 (de) 2010-11-23 2011-09-15 Verfahren zur sicherung eines steuersystems eines neukonfigurierbaren fahrzeugs aus mehreren einheiten sowie gesichertes steuersystem

Publications (2)

Publication Number Publication Date
EP2643198A1 EP2643198A1 (de) 2013-10-02
EP2643198B1 true EP2643198B1 (de) 2017-11-01

Family

ID=44651808

Family Applications (1)

Application Number Title Priority Date Filing Date
EP11757325.3A Active EP2643198B1 (de) 2010-11-23 2011-09-15 Verfahren zur sicherung eines steuersystems eines neukonfigurierbaren fahrzeugs aus mehreren einheiten sowie gesichertes steuersystem

Country Status (9)

Country Link
US (1) US8755957B2 (de)
EP (1) EP2643198B1 (de)
KR (1) KR20130140743A (de)
CN (1) CN103313902A (de)
BR (1) BR112013012848B1 (de)
CA (1) CA2818605A1 (de)
ES (1) ES2658184T3 (de)
HU (1) HUE037885T2 (de)
WO (1) WO2012069223A1 (de)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2992620B1 (fr) * 2012-06-27 2014-08-15 Alstom Transport Sa Train et procede de determination de la composition d'un tel train en securite
AT515454A3 (de) * 2013-03-14 2018-07-15 Fts Computertechnik Gmbh Verfahren zur Behandlung von Fehlern in einem zentralen Steuergerät sowie Steuergerät
CN108163012B (zh) * 2017-12-27 2019-12-03 卡斯柯信号有限公司 一种支持列车动态连挂和解编的控制方法
CN109441280B (zh) * 2018-09-12 2020-07-14 南京康尼机电股份有限公司 一种sil4安全级轨道车辆门控器的安全电路及其控制方法
CN113194472B (zh) * 2021-03-31 2023-03-31 新华三技术有限公司成都分公司 Agv无线接入方法及车载设备、网络设备、存储介质

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6144900A (en) * 1998-04-17 2000-11-07 General Electric Company Automatic serialization of an array of wireless nodes based on coupled oscillator model
DE19929644C2 (de) * 1999-06-28 2002-02-21 Deutsche Bahn Ag System zur Initialisierung von Zügen auf Basis eines Datenkommunikationssystems, bei dem allen Kommunikationsteilnehmern die Informationen in der Initialisierungsphase zugänglich sind
US8037204B2 (en) * 2005-02-11 2011-10-11 Cisco Technology, Inc. Method and system for IP train inauguration
DE102006018163B4 (de) * 2006-04-19 2008-12-24 Siemens Ag Verfahren zur automatischen Adressvergabe
CA2706087C (en) * 2007-11-30 2013-11-26 Mitsubishi Electric Corporation Train configuration recognition system and train configuration recognition apparatus
GB2461386B (en) * 2007-12-21 2010-06-09 Nomad Spectrum Ltd Establishing a wireless connection between component vehicles where order/orientation information is used to issue instructions to components

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
HUE037885T2 (hu) 2018-09-28
US20130245865A1 (en) 2013-09-19
BR112013012848A2 (pt) 2016-08-23
US8755957B2 (en) 2014-06-17
WO2012069223A1 (fr) 2012-05-31
BR112013012848B1 (pt) 2020-10-20
EP2643198A1 (de) 2013-10-02
ES2658184T3 (es) 2018-03-08
KR20130140743A (ko) 2013-12-24
CA2818605A1 (en) 2012-05-31
CN103313902A (zh) 2013-09-18

Similar Documents

Publication Publication Date Title
EP2643198B1 (de) Verfahren zur sicherung eines steuersystems eines neukonfigurierbaren fahrzeugs aus mehreren einheiten sowie gesichertes steuersystem
EP2008376B1 (de) Verfahren und einrichtung zur kommunikation auf einer kommunikationsverbindung zwischen einem flugzeug und einer bodenstation
EP2679466B2 (de) Sicheres Verfahren zu Bestimmung der Zusammenstellung eines Zugs
EP2638528B1 (de) Verfahren und system zum senden und empfangen von daten aus einer black box eines flugzeugs
FR3020910A1 (fr) Systeme de connexion d'un dispositif mobile a un reseau sans fil d'un aeronef
EP2296405A1 (de) Vorrichtung und Verfahren zur drahtlosen Kommunikation, und System mit einer solchen Vorrichtung
FR2649574A1 (fr) Reseau de communication entre equipements utilisateurs
FR2999152A1 (fr) Systeme de commande d'aeronef a voies fusionnees
CA1209712A (fr) Procede et installation de transmission de donnees numeriques
EP1304836B1 (de) Deterministisches Feldbus und Verwaltungsverfahren dafür
EP3408990B1 (de) Gateway-vorrichtung für ein bordkommunikationssystem eines kraftfahrzeuges
EP1647112B1 (de) Verfahren und vorrichtung zur übertragung von daten
FR3030162A1 (fr) Procede d'echange de trames de donnees numeriques et systeme de communication associe
FR3067192B1 (fr) Appareil electronique comportant deux memoires et procede d'appairage associe
FR3082960A1 (fr) Architecture electronique de vehicule automobile avec redondance des reseaux d’alimentation electrique et de communication inter-calculateurs.
FR2831355A1 (fr) Coupleur logique dans un reseau de communication
WO2010102677A1 (fr) Contrôle en sécurité de l'exclusivité d'un état actif/passif d'unités de traitements
EP4057190A1 (de) Vereinfachter client und zugehörige architekturen für die übertragung von quantenberechnungen an einen quantenserver
EP0471633A1 (de) Kommunikationsnetz mit Schreib- und Lesering, und Zugriffs- und Rekonfigurationsverfahren eines solchen Netzes
WO2023118035A1 (fr) Système pour la transmission de données entre dispositifs clients, procédé de mise en oeuvre d'un tel système
EP4026292A1 (de) Unidirektionales datenübertragungssystem und entsprechendes verfahren
FR3107634A1 (fr) Procédé de surveillance d’un système, dispositifs, système et programme correspondant
FR2969443A1 (fr) Procede de gestion de services sur un reseau
FR3031645A1 (fr) Procede d'allocation de ressources pour l'envoi de balises dans un reseau de communication

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20130408

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

DAX Request for extension of the european patent (deleted)
RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: SIEMENS S.A.S.

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: SIEMENS S.A.S.

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20170502

RIN1 Information on inventor provided before grant (corrected)

Inventor name: CHENU, ERIC

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

Free format text: NOT ENGLISH

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

Ref country code: AT

Ref legal event code: REF

Ref document number: 941725

Country of ref document: AT

Kind code of ref document: T

Effective date: 20171115

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

Free format text: LANGUAGE OF EP DOCUMENT: FRENCH

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602011042929

Country of ref document: DE

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20171101

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2658184

Country of ref document: ES

Kind code of ref document: T3

Effective date: 20180308

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 941725

Country of ref document: AT

Kind code of ref document: T

Effective date: 20171101

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180201

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180201

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180202

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180301

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602011042929

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 8

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

REG Reference to a national code

Ref country code: HU

Ref legal event code: AG4A

Ref document number: E037885

Country of ref document: HU

26N No opposition filed

Effective date: 20180802

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 602011042929

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20180915

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20180930

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180915

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180915

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20190402

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180930

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180930

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180930

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20180915

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

REG Reference to a national code

Ref country code: ES

Ref legal event code: PC2A

Owner name: SIEMENS MOBILITY SAS

Effective date: 20200507

REG Reference to a national code

Ref country code: HU

Ref legal event code: FH1C

Free format text: FORMER REPRESENTATIVE(S): SBGK SZABADALMI UEGYVIVOEI IRODA, HU

Representative=s name: SBGK SZABADALMI UEGYVIVOEI IRODA, HU

Ref country code: HU

Ref legal event code: GB9C

Owner name: SIEMENS MOBILITY SAS, FR

Free format text: FORMER OWNER(S): SIEMENS S.A.S., FR

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

REG Reference to a national code

Ref country code: FI

Ref legal event code: PCE

Owner name: SIEMENS MOBILITY SAS

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MK

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20171101

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20171101

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FI

Payment date: 20230920

Year of fee payment: 13

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20230918

Year of fee payment: 13

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: ES

Payment date: 20231218

Year of fee payment: 13

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: HU

Payment date: 20231122

Year of fee payment: 13