EP3907119A1 - Method for generating a security-relevant acceptance letter of a track maintenance machine - Google Patents

Abstract

A method for generating a safety-relevant acceptance letter (C) of a track maintenance machine (A) for the release of tracks after maintenance work has been carried out in the track area is described. For an advantageous generation, it is proposed that before the start of the maintenance work, acceptance sensors (5, 6, 7) are checked for compliance with a permitted tolerance and test data are stored, that during the maintenance work there is a check for compliance with clearance tolerances (10), that the acceptance sensors ( 5, 6, 7) after the maintenance work has been completed, it is checked again for compliance with an allowed tolerance and the test data is saved so that a subsequent check is carried out to determine whether a valid acceptance recorder certificate, a valid approval of the tamping machine (EVN number) and a digital signature a responsible person is available on site (D) and that if all requirements are met, a valid certificate (1) with a digital signature of the machine and, if available, with the signature of the responsible person (D) is created.

Description

The invention relates to a method for checking the validity of a safety-relevant acceptance letter for the clearance of tracks after maintenance work in the track area with a track maintenance machine.

After the recording, compliance with the clearance tolerances, the function of the acceptance recorder via test deflections, the approval of the recorder and the approval of the machine are checked and sent to the client with a digital signature to clear the track for train operation.

Most of the tracks for the railway are designed as ballast superstructures. The sleepers are in the gravel. The ballast has the task of diverting the wheel forces into the subgrade, absorbing transverse forces that act on the rail and sleeper and diverting the surface water. The acting wheel forces of the trains driving over it cause irregular settlements in the ballast and shifts in the lateral geometry of the track. The settlement of the ballast bed causes errors in the longitudinal height, the cant (in the arch), the twist, the track and the straightening position.

If certain comfort limit values or safety limit values of these geometrical variables specified by the railway management are exceeded, maintenance work is planned and carried out on time. If defined risk limit values are exceeded, depending on the size of the error, the speed is reduced or the track is blocked and these so-called individual errors are rectified immediately. Today, track construction machines are mostly used to correct and correct these geometric track errors. To control the process there are Measuring systems for recording the current track position for the parameters straightening, lifting, twisting and cross slope. So that the track can be released for operation again after such track geometry improvement work, the permanent way machines are equipped with so-called acceptance measuring systems or acceptance recorder systems. For the quality of the track position after the improvement by means of permanent way machines or other methods, the railway administrations have defined so-called acceptance tolerances. Acceptance tolerances represent the minimum requirements for the quality of the generated geometric improvements.

In addition to the acceptance tolerances, there are the safety-relevant release tolerances. These represent the limits that must be adhered to so that the processed track can be safely released again for train traffic.

Compliance with these tolerances is verified by the acceptance recorder systems. The recorded results represent official safety-relevant documents. Therefore, such acceptance measuring systems and acceptance recorder systems must be subjected to regular calibration and acceptance by authorized bodies. The recorder system is provided with a test sticker or a test certificate stating the period of validity and when the system was checked and when the next test must take place at the latest. A so-called test deflection is carried out before the maintenance work to prove that the recorder system is in working order. In this case, the sensors corresponding to the measured variables are mechanically deflected by a certain amount and the actual measurement signal is compared with a target measurement signal. If these match up to a specified tolerance, then it is assumed that the recorder system is in order.

On track construction machines there is the front car driver who is responsible for controlling the machine with regard to the target geometry and with regard to the recording of the is responsible for the track position left behind by the recorder system after the maintenance work.

It is known to print out the acceptance letter of the measurement recording on paper or to save the acceptance letter electronically, for example on a USB stick. The printout is signed by the driver and a person supervising the construction. On the basis of the inspection and signature of the printout by the person supervising the construction, the track is released for traffic if the clearance tolerances are adhered to. If the clearance tolerances are exceeded due to faulty maintenance work, the corresponding track faults must be rectified immediately. To do this, the machine is usually reset and the relevant point is processed again. If this is not possible, measures such as speed limits or track closures are imposed.

The signed measurement record is usually taken from the machine by the person supervising the construction and stored. In addition, the acceptance letter can also be stored digitally on a storage medium and taken with you.

This and other similar methods commonly used today have decisive safety disadvantages. Documents printed on paper require that a properly functioning printer is available. The printouts are not forgery-proof and can be manipulated. This also applies to electronically secured data. The time of the prescribed test and calibration of the recorder system may be exceeded (test badge invalid), the test deflection may be invalid, and the maintenance machine may not have a valid approval. The verification of these boundary conditions is subject to the care of the responsible person, is therefore dependent on people and therefore prone to errors. The storage of paper printouts in folders or digital records on any computer is associated with the risk of that these are lost or subsequently changed. In addition, there is the need for a responsible person to be on the maintenance machine at the end of the work in order to take over the acceptance letter, check it, sign it and then release the route for train traffic. In view of the importance of these documents for the safety of rail traffic, the security measures on which they are based are inadequate. In addition, the usual procedure requires the physical presence of a person who has been trained to interpret the acceptance letter, which is associated with corresponding personnel costs.

Secure electronic signatures have been introduced in Europe according to the "Regulation (EU) No. 910/2014" Process for electronic identification and trust services for electronic transactions. "Digital signatures ensure the authenticity of data. The document content is converted into a hash value for this purpose and this is cryptographically signed with the private key (the hash value can be imagined as a fingerprint of a file). A certificate is attached to the document for signature verification. This means that it is known who signed, whether the content of the document has been changed and whether The verification chain for digital signatures is summarized under the term Public Key Infrastructure (PKI).

Railway vehicles have an internationally unique vehicle number. In Europe this is the European Vehicle Number (EVN). Only approved maintenance machines receive approval and an EVN number after being checked by Notified Bodies. Devices such as the acceptance recorder are provided with a unique serial number.

The invention is based on the object of specifying a method which avoids the above-mentioned disadvantages and decisively increases the security of the entire method in view of the security-critical documents.

The invention solves the problem set with the features of claim 1. Advantageous further developments of the invention are presented in the subclaims.

A procedure is described for checking the approval, the functionality of the acceptance recorder system and the authenticity of the data transmitted to clear the tracks after maintenance work.

Before and after the maintenance work, there is a test deflection of the acceptance recorder system. Appropriate test deflections are applied to the acceptance sensors and the sensor data are saved.

The test deflections are automatically checked by the acceptance recorder computer (master computer) for compliance with all tolerances and the result is saved.

The general data for the following maintenance work (track data, machine identification, machine operator, monitoring officer (so on site)) is entered or accepted in the header of the acceptance report.

Start of the work and start of the recording of the acceptance letter until the end of the work and end of the recording.

The track acceptance computer then carries out the following tests: If the certificate for the acceptance recorder system is valid, the approval of the tamping machine is valid (EVN number), the test deflections are correct and the tolerances for the release of the track have been observed.

If the tests are positive, the acceptance computer provides the acceptance letter with an indication of whether or not all requirements for the release of the track to train operations have been met and then provides the acceptance letter with a corresponding valid signature of the machine and if a responsible construction supervisor is on site with the valid digital signature of the construction supervisor, which he announced via smart card / USB stick or by entering it manually into the computer.

In addition, the track inspection computer then sends the following information electronically with a valid certificate to the electronic addresses specified in a list and the specified database (if available): the approval letter, the valid recorder approval, the valid test deflection of the inspection sensors, whether clearance tolerances have been complied with, a Valid machine approval with international rail vehicle number (EVN), a certificate (digital signature) of the machine and a certificate (digital signature) of the construction supervisor (if available).

If one of the requirements is not met, the data is marked accordingly.

The person responsible for the release, who receives the document with a valid, checked certificate, releases the track if the fulfillment of all requirements is positive. This person responsible can be a corresponding computer that checks the validity.

The track can be released automatically after the transfer of the valid, secure data (valid certificate) and positive identification.

Fig. 1

eine Darstellung einer Abnahmeschreiberaufzeichnung nach einer durchgeführten Instandhaltungsarbeit gemäß dem Stand der Technik und

Fig. 2

eine schematische Darstellung der Prüfung eines Gleisabnahmeschriebes und der Übersendung mit gültigem Zertifikat.

In the drawing, the subject matter of the invention is shown, for example. Show it

Fig. 1

a representation of an acceptance recorder recording after a maintenance work carried out according to the prior art and

Fig. 2

a schematic representation of the examination of a track acceptance report and the transmission with a valid certificate.

Fig. 1 shows schematically the acceptance record Z of a known digital recorder of the geometric track position according to the prior art after a maintenance work. The bottom line 9 shows the kilometrage (arc length). The course of the measured arrow height (direction) is shown in the top line 5 and the permissible release tolerances 10 are drawn around this measured value. The second line 6 from the top shows the course of the measured elevation with the associated release tolerance lines. The third line 7 from the top shows the course of the longitudinal height with the associated release tolerance lines. The permissible tolerances have been exceeded here. Finally, in the fourth line 8 from the top, a variable derived from the elevation 6, the twist, is shown. The twist 8 is a size that is particularly safety-critical because of its importance for safety against derailment. The shown exceeding 14 of the clearance tolerance requires reworking by the tamping machine as soon as possible. Position 12 of the vertical line represents the position of the current measurement recording or the end of the measurement recording.

Fig. 2 shows a tamping machine A which is equipped with an acceptance recorder system for creating an acceptance letter C and an acceptance recorder computer (control computer) B. A unique certificate is issued for the machine. The digital signature of a responsible person on site can be read in via a smart card D. After the end of work, the control computer B carries out checks such as the approval certificate of the work recorder, valid test deflections, compliance with the clearance tolerances, unique machine identification number EVN, marking whether the data meet all requirements, in particular whether tolerances have been complied with, and whether the track can be released. The document that has been checked and created in this way is provided with a valid certificate (signature) and sent electronically H to the client E, for example via a radio network.

The certificate sent is checked for authenticity by a trustworthy, approved certification authority J and, if it is a valid certificate, confirmed as genuine G. The client E thus holds a valid, secure and checked acceptance document F in his hands. The e-mail can be sent via VPN (sending private data over a public network). The data can also be sent indirectly via a server as a buffer (cloud services). If this is agreed with the client, the data can also be sent encrypted using the TLS encryption protocol. In addition, it can also be agreed with the client to encrypt the data to be sent himself (end-to-end encryption). Common techniques for end-to-end encryption are, for example, OpenPGP and S / MIME. The dispatch process is as follows: first: verification with digital signature 1, second: electronic dispatch 2, third: verification of the certificate by an approved certification body 3 and fourth: confirmation of authenticity 4, with the final release of the track for train traffic ( E).

Claims (7)

Method for generating a safety-relevant acceptance letter (C) of a track maintenance machine (A) for the release of tracks after maintenance work has been carried out in the track area, characterized in that
Before the start of the maintenance work, acceptance sensors (5, 6, 7) are exposed to a defined test deflection, with measured test deflections being checked for compliance with an allowed tolerance and test data being stored in an acceptance recorder computer (B) so that
the maintenance work is carried out while recording the acceptance letter (C, 5, 6, 7, 8, 9, Z), with a check being made for compliance with the release tolerances (10) assigned to the measurement data, that
the acceptance sensors (5, 6, 7) after completion of the maintenance work and the recording (C) of the acceptance letter are again exposed to a defined test deflection, with the measured test deflections being checked for compliance with an allowed tolerance and the test data again being stored in the acceptance recorder computer (B), that
Subsequently, a check is carried out to determine whether a valid acceptance recorder certificate and a valid approval of the tamping machine (EVN number) is available, that
it is checked whether there is a digital signature of a responsible person on site (D), that
if all requirements are met so that the track can be released, a valid certificate (1) with a digital signature of the machine and, if available, with the signature of the person responsible (D) is created and that electronic dispatch (2, H) of the Certificate takes place. Method according to Claim 1, characterized in that the electronic certificate is sent (2, H) via an encrypted communication channel. Method according to Claim 2, characterized in that the dispatch takes place according to a known end-to-end encryption method. Method according to one of Claims 1 to 3, characterized in that the electronic certificate is sent (2, H) indirectly via a server as an intermediate store (cloud services). Method according to one of Claims 1 to 4, characterized in that the track is automatically released for train traffic after the certificate has been digitally signed. Method according to one of Claims 1 to 5, characterized in that the electronic certificate is transmitted to the client and / or an authority (E, F) which carries out a certificate check (3, 4) via an approved certification body (J). Method according to Claim 6, characterized in that the authority releases the track after a positive certificate check.

Images