EP3483033A1 - Method and onboard control unit for controlling and/or monitoring components of a rail vehicle - Google Patents

Abstract

In the method for controlling and / or monitoring components (12, 14) of a rail vehicle (10) which communicate with a cloud architecture (20) via an onboard control unit (18) of the rail vehicle (10), a write access is made On-board control unit (18) limited to the components (12, 14) of the rail vehicle (10) according to fixed rules that meet a predetermined safety requirement.

Description

The present invention relates to a method for controlling and / or monitoring components of a rail vehicle and an on-board control unit for controlling and / or monitoring components of a rail vehicle and to a rail vehicle with such an onboard control unit.

From the DE 10 2014 113 371 A1 A method for monitoring and diagnosing components of a rail vehicle is known in which a central unit of the rail vehicle communicates with a control center via a cloud. As a central unit usually an onboard control unit (onboard control unit, OCU) is used, which is completely administered via the cloud architecture, so for example at any time (ie also during passenger operation or high-speed voyage) also new software functionalities onboard Control unit can be brought. Since this may in principle result in an unpredictable behavior of the onboard control unit relative to the rail vehicle, a write access of the onboard control unit to the components of the rail vehicle is conventionally prevented by means of hardware.

However, in practice, there is a need to allow exceptions to this write access prevention. In addition, depending on the vehicle data bus used in the rail vehicle to which the on-board control unit is connected, the system also requires write accesses from the onboard control unit.

It is an object of the present invention to provide an improved method and onboard control unit for controlling and / or monitoring components of a rail vehicle that exceptionally allow write access from the onboard control unit but still meet the required safety requirement level.

This object is achieved by the teaching of the independent claims. Particularly advantageous embodiments of the invention are the subject of the dependent claims.

In the method according to the invention for controlling and / or monitoring components of a rail vehicle which communicate with a cloud architecture via an onboard control unit of the rail vehicle, write access of the onboard control unit to the components of the rail vehicle is restricted according to fixed rules fixed rules meet a given security requirement.

Since, unlike conventional systems in which write access by a hardware solution is completely inhibited, write access is restricted according to fixed rules, write access from the onboard control unit is possible in exceptional cases permitted by the fixed rules. As these fixed rules meet a given security requirement, it is also possible to ensure compliance with a required safety requirement level for the onboard control unit.

The fixed rules are preferably designed such that they prevent a write access in principle and allow only in exceptional cases. These exceptional cases are preferably determined by the type of write access and / or the time of the write access. The dependence on the time of the write access is to be understood in particular as a function of the respective operating state of the rail vehicle. The term fixed rules is intended to clarify that these rules must not be changed in the normal operation of the rail vehicle, in particular not by the communicating with the onboard control unit cloud architecture.

With the method according to the invention, it can be achieved, for example, that the on-board control unit can normally only read data from the components of the rail vehicle in order, for example, to diagnose these components To monitor maintenance purposes, in a well-defined exceptional case such as the setting of target temperatures for warming up the rail vehicle in the early morning but also write access to the components of the rail vehicle are allowed.

With the method according to the invention not only the operational safety of the rail vehicle ("Safety") can be ensured, but also the security against unauthorized access ("Security").

The fixed rules thereby fulfill a given safety requirement, preferably in accordance with the safety integrity level SIL 1, SIL 2, SIL 3 or SIL 4.

For regulatory approval of the on-board control unit, according to the invention, it then suffices to check the security requirement level of the fixed rules for restricting or filtering the write access. The other components / aspects of the on-board control unit need not be checked.

The components of the rail vehicle which are to be controlled and / or monitored include, in particular, control units of the rail vehicle, such as the vehicle control unit (VCU), the brake system control unit (BCU), the traction control unit (TCU) ) and the like, without the invention being restricted to these control units.

In one embodiment of the invention, the components and the on-board control unit of the rail vehicle are connected to one another via a vehicle data bus of the rail vehicle. In this case, the write access of the onboard control unit is restricted to the vehicle data bus.

The vehicle data bus may be a wired or a wireless data bus. Particular advantages of the invention result from the use of Ethernet as a vehicle data bus, since ethernet-based data buses require system access to write access. But the invention is also in Combination with other vehicle data buses such as CAN, MVB, etc. can be used.

Preferably, the fixed rules remain unchanged after regulatory approval of the on-board control unit. This means that the fixed rules can indeed be changed in principle, but in such a case, a renewed regulatory approval of the onboard control unit is required.

Since the security requirements for the onboard control unit and the rail vehicle are already met by the fixed rules for write access from the onboard control unit, write access of the cloud architecture to the onboard control unit of the rail vehicle is preferably unrestricted.

Preferably, a read access of the onboard control unit to the components or the vehicle data bus of the rail vehicle is unrestricted. Likewise preferably a write access of the cloud architecture to the onboard control unit of the rail vehicle takes place without limitation.

The onboard control unit for controlling and / or monitoring components of a rail vehicle according to the invention comprises a first computing device for communicating with a cloud architecture and additionally a second computing device for limiting write access of the first computing device to the components of the rail vehicle according to fixed rules fulfill a predetermined security requirement.

With this onboard control unit, the same advantages as with the method of the invention described above can be achieved. In particular, it suffices for an authorization of the on-board control unit to check the security requirement level of the second computer device, while the first computer device can not be tested and therefore changed, updated, etc. as desired.

In one embodiment of the invention, the on-board control unit is configured to communicate with the components of the rail vehicle via a vehicle data bus communicate. In this case, the second computer device of the on-board control unit is preferably designed to limit the write access of the first computer device to the vehicle data bus.

Preferably, the first computer device and the second computer device of the on-board control unit are independently programmable. This is preferably achieved by using two separate CPUs or two cores of a CPU for the two computer devices.

With regard to further advantageous embodiments, advantages, definitions of terms, etc., reference is made to the above statements in connection with the method according to the invention.

Finally, the subject matter of the invention is also a rail vehicle which has a plurality of components to be controlled and / or monitored, an onboard control unit of the invention described above and a vehicle data bus for connecting the components and the onboard control unit to one another.

Fig. 1

eine Darstellung eines Schienenfahrzeugs mit einem erfindungsgemäßen Steuerungs- und/oder Überwachungssystem; und

Fig. 2

den Aufbau einer erfindungsgemäßen Onboard-Steuereinheit für ein Schienenfahrzeug von Fig. 1.

The above and other advantages and features of the invention will become more apparent from the following description of an embodiment with reference to the accompanying drawings. In it show, mostly schematically:

Fig. 1

a representation of a rail vehicle with a control and / or monitoring system according to the invention; and

Fig. 2

the structure of an onboard control unit according to the invention for a rail vehicle of Fig. 1 ,

Fig. 1 shows in greatly simplified form the structure of a rail vehicle 10, in which the present invention is applicable.

In the rail vehicle 10, a plurality of components 12, 14 are provided in a conventional manner, which are to be controlled and monitored. These include, for example a central vehicle control unit (VCU), a brake control unit (BCU), a traction control unit (TCU), and the like.

These components 12, 14 of the rail vehicle 10 are connected to a vehicle data bus 16. As the vehicle data bus 16, for example, an Ethernet-based data bus is used.

An on-board vehicle unit (OCU) 18 of the rail vehicle 10, with which the components 12, 14 of the rail vehicle 10 are to be controlled and monitored, is also connected to this vehicle data bus 16. For this purpose, this onboard control unit 18 communicates with a cloud architecture 20. The cloud architecture 20 includes, for example, a cloud, a control center, mobile devices, and the like.

Fig. 2 shows the structure of an embodiment of such an onboard control unit 18, which on the one hand allows write access of the onboard control unit 18 to the components 12, 14 of the rail vehicle in exceptional cases and at the same time meets the predetermined safety requirement level.

The on-board control unit 18 includes a first computing device 22 and a second computing device 24. The two computing devices 22, 24 are, for example, two separate CPUs or two cores of a CPU, which are independently programmable. Due to the independent programming, the two computer devices 22, 24 can fulfill in particular different security requirement levels.

For example, the software of the first computer device 22 may be designed without a security requirement level (ie SIL 0). That is, the cloud architecture 20 has an unrestricted read and write access to the first computer device 22. The software of the first computer device 22 can always be changed if necessary without requiring a new regulatory approval for the onboard control unit 18. The first computing device 22 is also designed to be that of the cloud architecture 20 preprocessing data received from components 12, 14 of rail vehicle 10.

The second computer device 24 serves to monitor or filter the read and write access of the first computer device 22 to the components 12, 14 or the vehicle data bus 16 of the rail vehicle 10. Data processing typically does not take place in the second computer device 24. While the read access can usually be unlimited, the write access is limited by the second computer means 24 according to fixed rules, to allow write access only in exceptional cases.

The software of the second computer device 24 or their fixed rules for write access meet a predetermined safety requirement level of SIL 1, SIL 2, SIL 3 or SIL 4. For approval of the onboard control unit 18, it only requires a check or approval of their second computer device 24. The fixed rules for write access remain unchanged after regulatory approval. If the fixed rules in the second computing device 24 nevertheless need to be changed once, a new regulatory approval must be made. The approval of the second computer device 24 can be carried out relatively inexpensively and cost-effectively vehicle-specific with reusable frameworks.

LIST OF REFERENCE NUMBERS

10

track vehicle

12

Component (VCU) of the rail vehicle

14

Component (BCU, TCU, etc.) of the rail vehicle

16

vehicle data

18

Onboard Control Unit (OCU)

20

Cloud architecture

22

first computer device

24

second computer device

Claims (9)

Method for controlling and / or monitoring components (12, 14) of a rail vehicle (10), wherein the components (12, 14) communicate with a cloud architecture (20) via an onboard control unit (18) of the rail vehicle (10) .
characterized in that
a write access of the on-board control unit (18) to the components (12, 14) of the rail vehicle (10) is restricted according to fixed rules, wherein the fixed rules fulfill a predetermined safety requirement. Method according to claim 1,
characterized in that
the components (12, 14) and the onboard control unit (18) of the rail vehicle (10) are interconnected via a vehicle data bus (16) of the rail vehicle (10) and the write access of the onboard control unit (18) to the vehicle data bus (16) is limited. Method according to claim 1 or 2,
characterized in that
the fixed rules remain unchanged after official approval of the on-board control unit (18). Method according to one of claims 1 to 3,
characterized in that
a write access of the cloud architecture (20) to the onboard control unit (18) of the rail vehicle (10) takes place without restriction. Method according to one of claims 1 to 4,
characterized in that
a read access of the on-board control unit (18) to the components (12, 14) or the vehicle data bus (16) of the rail vehicle (10) takes place without restriction. On-board control unit (18) for controlling and / or monitoring components (12, 14) of a rail vehicle (10), having a first computer device (22) for communicating with a cloud architecture (20),
marked by
second computer means (24) for limiting a write access of the first computing device (22) to the components (12, 14) of the rail vehicle (10) according to fixed rules that fulfill a predetermined security requirement. On-board control unit according to claim 6,
characterized in that
configured to communicate with the components (12, 14) of the rail vehicle (10) via a vehicle data bus (16), and their second computing device (24) is adapted to write the first computing device (22) to the vehicle data bus ( 16). On-board control unit according to claim 6 or 7,
characterized in that
the first computer device (22) and the second computer device (24) are independently programmable. Rail vehicle (10), comprising: a plurality of components (12, 14) to be controlled and / or monitored; an on-board control unit (18) according to any one of claims 6 to 8; and a vehicle data bus (16) for connecting the components (12, 14) and the on-board control unit (18) to each other.

Images