EP3753803B1 - Method and odometry unit for testing an etcs odometry software version - Google Patents

Description

The present invention relates to a method and an odometry unit for testing an odometry software version for an ETCS computer on a vehicle driving an ETCS route with an ETCS vehicle device according to the independent patent claims.

The "European Train Control System" ETCS is the standardized train control system in the uniform European railway traffic control system ERTMS.

Another technical component of this digital railway technology ETCS is the railway mobile radio system GSM-R. This will be on the publication WO 2018/033319 A1 [1] referenced.

ETCS is intended to replace the large number of train protection systems used in the various countries, to be used in high-speed traffic in the medium term and to be implemented in all European rail traffic in the long term.

The acronyms ETCS, ERTMS, etc. used are listed at the end of this description, including references.

• eine sichere Rechen-Einheit EVC;
• eine Führerstandsanzeige DMI;
• eine Wegmesseinrichtung, (zB mit Wegimpulsgebern und Radaren);
• eine GSM-R-Übertragungseinrichtung;
• einen Balisenleser und
• einen Bremszugriff.

An ETCS vehicle device comprises at least

• a secure computing unit EVC;
• a driver's cab display DMI;
• a distance measuring device (e.g. with distance encoders and radars);
• a GSM-R transmission facility;
• a balise reader and
• a brake access.

The term "odometry" (cf. https://de.wikipedia.org/wiki/Odometrie (ETCS) ) stands for the process of measuring the movement of a train along a track. This process is used to measure speed and distance.

The odometry software installed and executable on the secure computing unit EVC is relevant to safety. This odometry software is also subject to changes, adjustments and extensions. Extensive tests and approvals are required before a new version of odometry software can be used in railway operations. The tests are carried out on the one hand in the laboratory and on the other hand for individual vehicles on a special test track (e.g. those of the test and validation center Wegberg-Wildenrath PCW), in this context the document is referred to BRAUN J ET AL: "With ETCS "active" across Germany", SIGNAL UND WIRE: SIGNALLING & DATACOMMUNICATION, EURAILPRESS, DE, Vol. 102, No. 5, 1 May 2010 (2010-05-01), pages 39-42, XP001553054,ISSN: 0037-4997 referred.

Alternatively, there is the option of activating so-called X-traces (these are special diagnostic messages) on a vehicle type and later verifying the data in a kind of replay with the software version to be tested. The disadvantage of this test variant is that the activation of the X-traces requires approval (expert/authority).

So far, there has been no way to easily test a new version of odometry software on different vehicle types in a real railway operating environment. In addition, there is currently no way to easily collect data (X-traces) from a wide variety of vehicle types in the real operating environment.

• ohne Einfluss auf die Sicherheit des betreffenden Zuges;
• keine Belästigung oder Ablenkung des Lokomotivführers;
• ohne Einfluss auf die Funktion einer überwachenden ETCS-Fahrzeugeinrichtung.

The present invention is therefore based on the object of creating a method and an odometry unit with which tests of a new version of odometry software can be carried out. These tests should be carried out in real railway operations without any operational restrictions, whereby the term “without any operational restrictions” is used very broadly:

• without affecting the safety of the train concerned;
• no harassment or distraction to the engineer;
• without affecting the function of a monitoring ETCS vehicle device.

The odometry unit to be created should also be able to be used to record the data of an ETCS on-board device that actually occurs during rail operations, without the functionality of the monitoring ETCS device being affected or even impaired.

This object is achieved by the features specified in the independent patent claims. Advantageous configurations of the invention are specified in further claims.

The method according to the invention for testing an odometry software version for an ETCS vehicle device of a vehicle traveling on an ETCS route is distinguished by the features according to which:

• einen ETCS-Rechner mit einer zugelassenen Odometrie-Software-Version,
• eine Führerstandsanzeige,
• Wegmesseinrichtungen und
• Radare zur Geschwindigkeitsmessung;

das Verfahren zeichnet sich weiter aus durch die Verfahrensschritte:

• Bereitstellen einer Odometrie-Einheit enthaltend
  • eine sichere Rechen-Einheit mit der zu testenden Odometrie-Software-Version und wobei die Odometrie-Einheit weiter eine nicht sichere Rechen-Einheit enthält;
• rückwirkungsfreies Übermitteln von den Wegmesseinrichtungen und Radaren entstammenden Daten zur Odometrie-Einheit;
• Verarbeiten der von den Wegmesseinrichtungen und Radaren entstammenden Daten durch die sichere Rechen-Einheit;
• Aufzeichnen der von Wegmesseinrichtungen und Radaren entstammenden Daten und der von der sicheren Rechen-Einheit generierten Daten in der nicht sicheren Rechen-Einheit der Odometrie-Einheit.

the ETCS vehicle equipment comprises at least:

• an ETCS computer with an approved odometry software version,
• a driver's cab display,
• displacement measuring devices and
• speed measuring radars;

The process is further characterized by the process steps:

• providing an odometry unit containing
  • a secure computing unit having the odometry software version to be tested and wherein the odometry unit further includes a non-secure computing unit;
• non-reactive transmission of data originating from the path measuring devices and radars to the odometry unit;
• Processing of the data originating from the path measuring devices and radars by the secure computing unit;
• Recording of the data originating from distance measuring devices and radars and the data generated by the secure computing unit in the non-secure computing unit of the odometry unit.

1. i) Durch die rückwirkungsfreie Entkopplung braucht eine Fahrt zum Testen einer neuen Version einer Odometrie-Software bei den Behörden weder angemeldet zu werden, noch muss dazu eine Bewilligung eingeholt werden.
2. ii) Durch eine abgesetzte Anordnung der Odometrie-Einheit mittels eines Kabels und einer autarken Stromversorgung bei einer Fahrt zum Testen einer neuen Version einer Odometrie-Software kann der betreffende Lokomotivführer gar nichts bemerken.
3. iii) Da lediglich die von den Wegmesseinrichtungen und den Radaren entstammenden Daten zur Odometrie-Einheit übermittelt werden, ist das Verfahren unabhängig vom ETCS-Level der befahrenen Strecke.
4. iv) Nach erfolgter behördlicher Zulassung von Odometrie-Einheit einschliesslich Konvertierer und der auf der ETCS-Fahrzeugeinrichtung befindlichen Entkopplungsbox, ist das Verfahren wie auch die vorgenannten zwei Komponenten frei einsetzbar.

The following advantages can also result for the process:

1. i) Due to the non-reactive decoupling, a trip to test a new version of odometry software does not need to be registered with the authorities, nor does a permit need to be obtained.
2. ii) If the odometry unit is arranged remotely by means of a cable and a self-sufficient power supply when driving to test a new version of odometry software, the locomotive driver concerned cannot notice anything at all.
3. iii) Since only the data from the distance measuring devices and the radars are transmitted to the odometry unit, the procedure is independent of the ETCS level of the route travelled.
4. iv) Once the odometry unit including the converter and the decoupling box on the ETCS vehicle equipment have been approved by the authorities, the method and the two components mentioned above can be used freely.

The odometry unit according to the invention for carrying out the method for testing an odometry software version for an ETCS vehicle device of a vehicle traveling on an ETCS route is characterized by the features according to which:

• eine sichere Rechen-Einheit mit einer zu testenden Odometrie-Software-Version;
• eine nicht sichere Rechen-Einheit, wobei der Odometrie-Einheit rückwirkungsfrei Daten von der ETCS-Fahrzeugeinrichtung übermittelbar sind und die Odometrie-Einheit dazu einen Konvertierer aufweist.

The odometry unit for carrying out the method for testing an odometry software version for an ETCS vehicle device of a vehicle running on an ETCS route, and according to which the odometry unit contains at least:

• a secure computing unit with an odometry software version to be tested;
• a non-secure computing unit, data from the ETCS vehicle device being able to be transmitted to the odometry unit in a non-reactive manner and the odometry unit having a converter for this purpose.

1. i) Durch das Vorsehen einer unabhängigen Stromversorgung der Odometrie-Einheit ist der Einsatzbereich dieser Einheit autonom vom Führerstand. Die Kabellänge zur Verbindung mit der ETCS-Fahrzeugeinrichtung im betreffenden Zug stellt die einzige Beschränkung dar.
2. ii) Durch die konstruktive Ausgestaltung der Odometrie-Einheit als 19-Zoll-Standard-Rack können einerseits Komponenten wie zB die sichere Recheneinheit EVC auch in der Odometrie-Einheit eingesetzt werden und dadurch ein Kostenvorteil erreicht werden. Andererseits ist dadurch eine tragbare Odometrie-Einheit geschaffen, die flexibel auf Testfahrten einsetzbar ist.

The following advantages can also result for the odometry unit:

1. i) By providing an independent power supply for the odometry unit, the operational area of this unit is autonomous from the driver's cab. The cable length to Connection to the ETCS on-board equipment on the train in question is the only limitation.
2. ii) Due to the design of the odometry unit as a 19-inch standard rack, components such as the secure computing unit EVC can also be used in the odometry unit, thereby achieving a cost advantage. On the other hand, this creates a portable odometry unit that can be used flexibly on test drives.

• Figur 1 Blockschaltbild und Anschaltung einer Odometrie-Einheit zum Testen einer ETCS-Software-Version;
• Figur 2 Entkopplungskonzept zwischen ETCS-Fahrzeugeinrichtung und Odometrie-Einheit.

The invention is explained in more detail below with reference to the drawing, for example. show:

• figure 1 Block diagram and connection of an odometry unit for testing an ETCS software version;
• figure 2 Decoupling concept between ETCS vehicle equipment and odometry unit.

figure 1 shows a significantly simplified block diagram for connecting an odometry unit 1 to a monitoring ETCS vehicle device 3.

The ETCS vehicle device 3 contains: A beacon antenna 44, two radars 45.1 and 45.2 and two distance encoders 46.1 and 46.2 are arranged in the underfloor of the vehicle. The radars 45.1 and 45.2 measure the speed of a train using the Doppler effect. The radars 45.1 and 45.2 and the distance encoders 46.1 and 46.2 are routed to a connection box 43, which in turn is connected to the secure computing unit 36.

• die bereits erwähnte sichere Rechen-Einheit 36,
• eine nicht sichere Rechen-Einheit 35,
• eine GSM-R - Übertragungseinrichtung 30,
• ein Ortungsempfänger 31, üblicherweise ein GPS-Empfänger.

The driver's cab contains a driver's cab display 37, a buzzer 38, an acknowledgment button 39 and an isolation switch 41 as usual components. The following are provided in the ETCS vehicle device 3 for control/monitoring:

• the already mentioned secure computing unit 36,
• a non-secure arithmetic unit 35,
• a GSM-R transmission device 30,
• a location receiver 31, typically a GPS receiver.

The locating receiver 31 is connected to a secure recording unit (JRU Juridical Recording Unit) via an amplifier—that is, a GPS amplifier 33. This secure recording unit JRU is used to record the safety-relevant data, which can be analyzed later, for example after an accident. Instead of the term recording unit, the term digital tachograph is also used. Further connections to this secure recording unit JRU, which is arranged remotely and securely in the vehicle, are not shown. The reference number 40 designates the interface 40 to this recording unit JRU and not the recording unit JRU itself. The GPS receiver is powered by the recording unit JRU. In this embodiment, the specific technology is called GPS. The present exemplary embodiment and the invention are technology-neutral in this regard and are also referred to as GNSS, ie GNSS antenna 31, GNSS receiver 31 or locating receiver.

• ein Triebfahrzeug und für
• einen Steuerwagen.

Ein Steuerwagen ist ein antriebsloser Eisenbahnwagen mit einem Führerstand, von dem aus ein nicht an der Zugspitze laufendes Triebfahrzeug ferngesteuert werden kann.In the context of an ETCS vehicle device 3, the term «vehicle» stands for

• a traction vehicle and for
• a control car.

A control car is a non-powered railway car with a driver's cab from which a traction vehicle that is not running at the head of the train can be remotely controlled.

In order to be able to connect the odometry unit 1 according to the invention to the ETCS vehicle device with a connecting cable 53, a connection must be provided on the vehicle side. For this purpose, the connecting line or bus systems in the ETCS vehicle equipment 3 must not simply be tapped, since any electrical or electromagnetic effects that may occur are not permissible for safety reasons. A decoupling box 42 is provided for the connection of the aforementioned connection cable 53, which is connected via a connection cassette 43 to the sensors 45.1, 45.2, 46.1, 46.2 on the underside of the vehicle. As well the decoupling box 42 is connected to the secure computing unit 36. In the decoupling box 42, the required signals are split between the secure computing unit 36 and the odometry unit 1. Signals that are not relevant to the odometry unit 1 are passed through to the secure computing unit 36 on a 1:1 basis. Relevant signals from the distance encoders 46.1 / 46.2 and the radars 45.1 / 45.2 are decoupled in a reaction-free manner via optocouplers built into the decoupling box 42.

• eine sichere Rechen-Einheit 16 (auf Seite der ETCS-Fahrzeugausrüstung 3 synonym ETCS-Rechner 36 genannt),
• eine nicht sichere Rechen-Einheit 15,
• eine Stromversorgung mit einer Batterie 10 und zugehöriger Steuerung 11 einschliesslich einem «Battery Watch» BW um die Batterie vor einer Tiefentladung zu schützen und einschliesslich einem «Battery Balancer», um den Ladungszustand zweier in Serie geschalteter Batterien auszugleichen. Alle diese bezüglich der Stromversorgung erforderlichen funktionalen Komponenten werden hier unter dem Begriff Steuerung subsummiert.

The odometry unit 1 contains the same as the ETCS vehicle equipment 3:

• a safe computing unit 16 (on the side of the ETCS vehicle equipment 3 synonymously called ETCS computer 36),
• a non-secure arithmetic unit 15,
• a power supply with a battery 10 and associated controller 11 including a "Battery Watch" BW to protect the battery from deep discharge and including a "Battery Balancer" to equalize the state of charge of two batteries connected in series. All of these functional components required for the power supply are subsumed here under the term controller.

The aforesaid decoupling is also required on the odometry unit 1 side. A converter 12 is provided for this purpose. A differential transmission method is used for the unidirectional transmission from the ETCS vehicle device 3 to the odometry unit 1 because external electromagnetic errors are unavoidable, particularly on a locomotive. The normal useful signal is transmitted on a first line (wire) and the inverted useful signal on a second line (wire) of exactly the same length. On the receiving side - that is, in the converter 12 - the difference between the two signals is formed and the original useful signal is thus converted back again. If a disturbance acts on the twisted wires, this disturbance occurs on both lines and therefore occurs identically in both signals → common mode. In the subsequent level difference formation at a differential amplifier as a component of the converter 12, this in-phase interference signal is eliminated and the undisturbed signal is thus restored. This ensures a high level of immunity to interference from electromagnetic fields.

An odometry software version to be tested is loaded and executable in the secure computing unit 16 . The odometry software version to be tested processes the data coming from the ETCS vehicle device 3 (called signals above to describe the technical process of transmission), which, as described above, are fed to this secure computing unit 16 without any reaction via the decoupling box 42 and the converter 12. Additional software components are loaded on the secure computing unit 36 of the ETCS vehicle equipment and are executed accordingly, while generally only one odometry software version to be tested is loaded and executable on the secure computing unit 16 of the odometry unit 1 . A program runs on the non-safe computing unit 15 and stores the data generated by the safe computing unit 16 (for example a speed specification for the driver's cab signaling) in a non-volatile memory. The non-volatile memory can be designed as a plug-in memory module. The data stored in this way can later be analyzed offline to verify the correct functioning of the odometry software version to be tested.

From the FIG 2 the basic wiring can be seen. A connecting cable 52 between the secure computing unit 36 and the decoupling box 42 is secured with a cable gland 49 with strain relief. This applies analogously to the odometry unit 1 and the connecting cable 14 and the cable gland 19 with strain relief. A cable 53 with corresponding sockets 48/18 and plugs 47/17 is provided between the ETCS vehicle device 3 and the odometry unit 1. A typical cable length of the Cable 53 is 5 to 10m. This ensures that the odometry unit 1 is arranged outside the driver's cab, for example also in the passenger compartment of a control car. The odometry unit 1 is preferably supplied with energy from a power supply with a battery 10 and associated converter and controller 11 . It is conceivable to feed the battery with a charger. To ensure that the ETCS vehicle equipment is not affected, it is important that the energy comes from a source other than one in the driver's cab environment. This is the case, for example, when the odometry unit 1 is placed in the passenger compartment of a control car and a 230V socket that is also made available to the passengers is used. However, the test is preferably carried out in such a way that the odometry unit is fed from the battery 10 alone, that is to say without connecting a charging device.

Since the connecting cables between the ETCS computer 36 and radars 45.1 / 45.2 and the distance encoders 46.1 / 46.2 are provided with secured plugs in an ETCS vehicle device 3, the decoupling box 42 can easily be installed in an ETCS vehicle device 3 with correspondingly shortened connector cables.

The structural design is preferably provided in the same way as for the ETCS vehicle device 1 in order to be able to use identical assemblies for the computing units 35/15 or 36/16, for example. The housing of the odometry unit 1 is therefore preferably a 19-inch standard rack with an oscillating frame and 12 height units HU. For example, the 19" FRONT-LOAD container from DIGIPACK Kappeler can be used for this purpose. The 19" devices are operated from the front. The swing frame guarantees a high level of protection for the built-in components. All additional components such as the batteries can therefore be installed in 19" rack drawers. A 3U drawer can be used for the control of the power supply, namely a 2U drawer for accessories such as cables, converters and an optional charger. With the structural design as a 19" standard rack the odometry unit 1 is also referred to as the odometry case 1.

The structural and design measures mentioned above ensure that the odometry unit 1 can be brought into a vehicle by personnel using muscle power. A portable odometry unit 1 is thus created and can therefore be used universally for all traction vehicles and all control cars of a railway company.

Optionally, what is known as a "safe navigation receiver" 2 can be connected to the odometry unit 1 , which, to put it in a technology-neutral way, has a "GNSS sensor" 23 with an integrated "inertial measurement unit" IMU 23 . This "Inertial Measurement Unit" essentially consists of an acceleration sensor that is used to detect movement. For this purpose, either a GPS antenna / GNSS antenna / locating receiver 21 is additionally attached to the vehicle roof with a magnet, or the GPS antenna / GNSS antenna 31 of the ETCS vehicle device 3 is connected to the "GNSS sensor" 23 via a splitter 34 of the ETCS vehicle device 3 . The function of this «Inertial Measurement Unit» is to bridge short-term GNSS/GPS reception gaps in order to be able to measure the movement of the vehicle. It can be switched on optionally via switch 22. The "GNSS Sensor" calculates, compares, monitors and checks the speed and position for plausibility. The information is transferred to the secure computing unit 16 of the odometry unit 1 via a serial interface.

In detail, the speed and position of the vehicle are checked for plausibility by the “GNSS sensor” 23 with the integrated acceleration sensor 23, which can be connected to the odometry unit 1. The determination of the speed and position of the train is based on the location information originating from the GNSS receiver 21 and the acceleration values originating from the acceleration sensor 23 .

List of References

1

Odometry case, odometry unit

2

Safe Navigation Receiver SANAR, safe navigation receiver

3, 3'

ETCS vehicle equipment including driver's cab of a vehicle

10

battery

11

Power supply control

12

converter

14

Connection cable inside odometry unit

15

non-secure computing unit NVC

16

secure computing unit EVC,

16.1

Assembly of the secure computing unit EVC

17

Plug

18

cable socket

19

Cable glands with strain relief

21

GPS Receiver/Antenna GNSS Antenna/Antenna, Locator Receiver

22

switch

23

«GNSS Sensor» with integrated «Inertial Measurement Unit»/accelerator

30

GSM-R transmission device, GSM-R transmitter/receiver

31

GPS Receiver/Antenna, GNSS Receiver/Antenna

32

power supply

33

GPS repeater; GNSS amplifier

34

GPS splitter; GNSS splitter

35

non-secure computing unit NVC

36

secure computing unit EVC, ETCS computer

36.1

Assembly of the secure computing unit EVC

37

ETCS display

38

ETCS buzzer

39

ETCS acknowledgment button

40

Interface to the JRU recording unit/ interface to the JRU digital tachograph

41

ETCS isolation switch

42

decoupling box

43

connection cassette

44

balise antenna

45.1, 45.2

Speed measurement radars

46.1, 46.2

displacement encoder

47

Plug

48

cable socket

49

Cable glands with strain relief

50

male connector

51

Vehicle side connector

52

Connection cable within ETCS vehicle equipment

53

Connection cable between ETCS vehicle equipment and odometry unit

I

Interface between ETCS vehicle equipment and an optional secure navigation receiver

II

Interface between ETCS on-board equipment and odometry unit

List of abbreviations used, references, glossary

BW

Battery Watch

DMI

Driver Machine Interface; cab display

ERMTS

European Rail Traffic Management System https://ec.europa.eu/transport/modes/rail/ertms/what -is-ertms/levels and modes en http://www.ertms.net/ https://en.wikipedia.org/wiki/European Rail Traffic Management System

ETC

European Train Control System https://en.wikipedia.org/wiki/European Train Control System

ETC

European Train Control System

EVC

European vital computers; secure computing unit

GNSS

Global Navigation Satellite System https://de.wikipedia.org/wiki/Globales Navigation Satellite System

GPS

Global positioning system

IMU

inertial measurement unit; accelerometer

JRU

Juridical Recording Unit; secure data recording unit

NVC

non-vital computers; non-secure arithmetic unit

PCW

Test and Validation Center Wegberg-Wildenrath https://de.wikipedia.org/wiki/Prüfcenter Wegberg-Wildenrath

SANAR

Safe Navigation Receiver, safe navigation receiver

WIG

displacement encoder

List of documents cited, references

1. [1] WO 2018/033319 A1
   METHOD OF OPERATING AN ETCS (EUROPEAN TRAIN CONTROL SYSTEM) RAIL VEHICLE WITH A GSM-R COMMUNICATION ARRANGEMENT AND ETCS (EUROPEAN TRAIN CONTROL SYSTEM) RAIL VEHICLE WITH A GSM-R COMMUNICATION ARRANGEMENT SIEMENS AKTIENGESELLSCHAFT; DE - 80333 Munich

Claims (14)

1. Method for testing an odometry software version for an ETCS vehicle facility (3) of a vehicle travelling on an ETCS route, wherein the ETCS vehicle facility (3) at least comprises

   - an ETCS computer (36) with a permitted odometry software version,

   - a driver's cab display (37),

   - distance measuring facilities (46.1, 46.2) and

   - radars (45.1, 45.2) for speed measurement; characterised by the method steps

   - provision of an odometry unit (1) containing

   - a secure computing unit (16) with the odometry software version to be tested
   and containing

   - a non-secure computing unit (15);

   - non-reactive transmission of data originating from the distance measuring facilities (46.1, 46.2) and radars (45.1, 45.2) to the odometry unit (1);

   - processing of the data originating from the distance measuring facilities (46.1, 46.2) and radars (45.1, 45.2) by way of the secure computing unit (16);

   - recording of the data originating from the distance measuring facilities (46.1, 46.2) and radars (45.1, 45.2) and the data generated by the secure computing unit (16) in the non-secure computing unit (15) of the odometry unit (1).
2. Method according to claim 1,
   characterised in that
   for the non-reactive transmission there is provision in the ETCS vehicle facility (3) for a decoupling box (42), in which the data intended for the ETCS computer (36) and the secure computing unit (16) is decoupled, wherein the decoupling box (42) contains a photocoupler for this purpose.
3. Method according to claim 1 or 2,
   characterised in that
   for the non-reactive transmission a differential transfer method is used, in order to achieve an immunity to electromagnetic interference.
4. Method according to claim 3,
   characterised in that
   contained in the odometry unit (1) is a converter (12), which has a differential amplifier, in order to eliminate in-phase interfering signals.
5. Method according to one of claims 1 to 4,
   characterised in that
   the odometry unit (1) has a power supply (10, 11) which is independent of the ETCS vehicle facility (3) and comprises a battery (10) and a controller (11).
6. Method according to one of claims 1 to 5,
   characterised in that
   only the odometry software version to be tested is stored and can be executed on the secure computing unit (16) of the odometry unit (1).
7. Method according to one of claims 1 to 6,
   characterised in that
   in order to check the plausibility of speed and position of the vehicle, a GNSS sensor (23) with an integrated acceleration sensor (23) can be connected to the odometry unit (1), wherein the determination of speed and position of the train is based on the location information originating from a GNSS receiver (21) and the acceleration values originating from the acceleration sensor (23).
8. Method according to one of claims 1 to 7,
   characterised in that
   the odometry unit (1) is connected by a cable (53) to the ETCS vehicle facility (3) and is arranged outside the driver's cab.
9. Method according to one of claims 1 to 8,
   characterised in that
   in the method step of the recording of the data originating from the distance measuring facilities (46.1, 46.2) and radars (45.1, 45.2) and the data generated by the secure computing unit (16), the data is stored in a pluggable memory module of the non-secure computing unit (15).
10. Odometry unit (1) for performing the method for testing an odometry software version for an ETCS vehicle facility (3) of a vehicle travelling on an ETCS route according to one of claims 1 to 9,
    characterised in that

    the odometry unit (1) at least contains:

    - a secure computing unit (16) with an odometry software version to be tested,

    - a non-secure computing unit (15),

    wherein data from the ETCS vehicle facility (3) can be transmitted to the odometry unit (1) in a non-reactive manner and the odometry unit (1) has a converter (12) for this purpose.
11. Odometry unit (1) according to claim 10,
    characterised in that
    an independent power supply (10, 11) is installed.
12. Odometry unit (1) according to claim 10 or 11,
    characterised in that
    the odometry unit (1) is designed as a 19 inch standard rack and is portable.
13. Odometry unit (1) according to one of claims 10 to 12, characterised in that
    the odometry unit (1) has an interface (23) for an optional GNSS sensor (21).
14. Odometry unit (1) according to one of claims 10 to 13, characterised in that
    the non-secure computing unit (15) is assigned a pluggable memory module, in which the transmitted data and the data generated by the secure computing unit (16) are recorded.

Images