Method for securing functionalities of a passenger car

Abstract

The invention relates to a method for securing functionalities (6, 7, 8) of a passenger car (PW1) in rail traffic. The functionalities (6, 7, 8) of the passenger car (PW1) are controlled by a primary vehicle controller (1) in the passenger car (PW1), wherein the primary vehicle controller (1) sends respective control commands to the functionalities (6, 7, 8). In normal operation, the primary vehicle controller (1) transmits status information to a communication link (9) of the passenger car (PW1). Function information is transmitted by means of the status information, by means of which function information a technical state of the functionalities and of the primary vehicle controller (1) is signalled. The communication link (9) examines the status information. If a fault in the primary vehicle controller (1) is detected, the communication link (9) requests redundant control commands for the functionalities (6, 7, 8) from a stationary control point (LS). The redundant control commands are transmitted from the control point to the communication link (9). The redundant control commands are transmitted to the functionalities (6, 7, 8) by the communication link (9) when the primary vehicle controller (1) is deactivated and are executed by said functionalities. The communication link (9) monitors the communication between the communication link (9) and the stationary control point (LS). If a fault in the communication is detected, a failure function (11) stored in the passenger car (PW1) is executed via the communication connection (9), by means of which failure function the functionalities (6, 7, 8) to be controlled are put into a predefined state.

Description

Method for securing functionalities of a passenger car The invention relates to a method for securing functionalities of a passenger car in rail transport. Introduction and prior art Passenger cars have to have particularly high technical availability in railway engineering in order to ensure essential functions during the operation of the passenger car. These functions include, in particular, controls which influence the comfort and safety of passengers, namely the control of lighting, power supply or air conditioning of the passenger car. Provided in the passenger car is a primary vehicle controller which, during normal operation, takes over the control of the essential functions of the passenger car. A secondary vehicle controller is provided in the passenger car for fault operation. Said secondary vehicle controller takes over the control of the essential functions of the passenger car if the primary vehicle controller has become faulty or has failed completely. The secondary vehicle controller enables, within the scope of "redundancy control", at least limited technical operation of the passenger car by taking over, for example, simplified control of the lighting, of the energy supply and simplified control of a load circuit of the passenger car. FIG 3 shows a basic illustration of a passenger car PW constructed and secured in such a way in accordance with the known prior art. The following functionalities are provided in the passenger car PW: 1 - a primary vehicle controller, 2 - a redundancy controller as a secondary vehicle controller, 3 - operating elements, 4 - a first I / O system ("input / output system"), 5 - a second I / O system ("input / output system"), 6 - an energy supply, 7 - (at least) one load circuit and 8 - lighting. The connections between the functionalities shown here are logical connections which are realized by data traffic. Associated data are transmitted via a common vehicle bus (e.g. Ethernet, MVB, CAN, etc.). During normal operation, the primary vehicle controller 1 continuously controls all the necessary functions of the passenger car PW. In this case, the vehicle controller 1 sends respective control commands to assigned functionalities, namely, in particular, to the energy supply 6, to the load circuit 7 and to the lighting 8, by means of the first I / O system 4. Correspondingly, the primary vehicle controller 1 receives respective signals from the mentioned functionalities by means of the first I / O system 4. Control commands of the operating elements 3 are also received via the first I / O system 4, by means of which control commands the train crew can perform operating actions (e.g. switching on or switching off or dimming lights, etc.). Although the redundancy controller 2 is activated during the normal operation described, it does not itself control the functionalities via control commands. The redundancy controller 2 continuously monitors the functioning of the primary vehicle controller 1 or the functioning of the first I / O system 4 by means of a corresponding sensor system. If a fault is detected by the redundancy controller 2, it takes over the control of the functionalities considered important during the fault operation. In this case, the redundancy controller 2 deactivates the primary vehicle controller 1 and transmits control commands to the functionalities considered essential by means of the second I / O system 5. In this example, the redundancy controller 2 ensures the correct functioning of the energy supply 6, of the load circuit 7 and of the lighting 8. The disadvantage here is that the software required for this purpose, the secondary redundancy controller and the second I / O system, as well as the data bus required for the connection, are kept available for a fault case which occurs only rarely or never during a life cycle of a passenger car PW. This causes correspondingly high costs for the operation and for the maintenance of the mentioned functionalities in each individual passenger car Object It is therefore the object of the invention described below to specify a method for cost-effective and simply designed securing of functionalities of a passenger car in rail transport. This object is achieved by the features of patent claim 1. Advantageous developments are specified in the dependent patent claims. Description of the invention The invention relates to a method for securing functionalities of a passenger car in rail transport. The functionalities of the passenger car are controlled by a primary vehicle controller in the passenger car, wherein the primary vehicle controller sends respective control commands to the functionalities. During normal operation, the primary vehicle controller transmits status information to a communication link of the passenger car. The status information is used to transmit functional information, by means of which a technical state of the functionalities and of the primary vehicle controller is signaled. The communication link examines the status information. If a fault in the primary vehicle controller is detected, the communication link requests redundant control commands for the functionalities from a stationary control point. The redundant control commands are transmitted from the stationary control point to the communication link. The redundant control commands are transmitted to the functionalities by the communication link when the primary vehicle controller is deactivated and are executed by said functionalities. The communication link monitors the communication between the communication link and the stationary control point. If a fault in the communication is detected, a failure function stored in the passenger car is executed via the communication link (9), which failure function puts the functionalities that are to be controlled into a predefined state or basic state. In one advantageous development, the functionalities influence the comfort and safety of passengers in the passenger car. In one advantageous development, the functionalities are used to carry out a controlled energy supply and / or a controlled load circuit and / or control of lighting in the passenger car. In one advantageous development, the communication link, using the status information transmitted by the vehicle controller, continuously and cyclically forms a process image which contains the functional information relating to the functionalities. In one advantageous development, the process image is transmitted to the control point and evaluated there in order to create the redundant control commands. Advantages: The present invention saves hardware costs and software costs per passenger car. Changes to the redundancy control software are made centrally via the land side and transmitted via remote data transmission (e.g. by mobile radio) to assigned passenger cars. The present invention makes it possible for changes to the redundancy control software to be transmitted to all passenger cars of a vehicle fleet, or for only a single passenger car or a group of passenger cars to be addressed thereby. The present invention makes it possible for changes to the redundancy control software to be made easily and cost-effectively. The present invention avoids work having to be carried out manually by maintenance personnel on the passenger car. The present invention makes it possible to functionally adapt the control software to different vehicle types or types of passenger cars via the land side. Description of the figures: The invention is explained in more detail below by way of example with the aid of a drawing. In the drawing: FIG 1 shows a basic illustration of a passenger car with securing according to the invention, FIG 2 shows an overview of land-side software elements with reference to FIG 1, and FIG 3 shows the passenger car described in the introduction, as an example of the known prior art. FIG 1 shows a basic illustration of a passenger car PW1 with securing according to the invention. The following functionalities are provided in the passenger car PW1: 1 - a primary vehicle controller, 3 - operating elements, 4 - a first I / O system ("input / output system"), 5 - a second I / O system ("input / output system"), 6 - an energy supply, 7 - one or more load circuits, 8 - lighting, 9 - a communication link, 10 - a process image PROAB, 11 - a failure function, and 13 - a GPS receiver. The following functionalities are provided in a stationary control point designated as land side LS: ITSYS - an IT system and 15 - a redundancy controller. The land side LS and the passenger car PW1 are connected to one another via the respective "remote communication with antennas" functionalities 12 and 14, which are preferably part of a mobile radio system. The connections between the functionalities shown here are logical connections which are realized by data traffic. Associated data are transmitted via a common vehicle bus (e.g. Ethernet, MVB, CAN, etc.). During normal operation, the primary vehicle controller 1 continuously controls all the necessary functions of the passenger car PW1. In this case, the vehicle controller 1 sends respective control commands to assigned functionalities by means of the first I / O system 4, namely in particular to: - the energy supply 6, - to the load circuit 7 and to - the lighting 8. Correspondingly, the primary vehicle controller 1 receives respective signals and information from the mentioned functionalities by means of the first I / O system 4. Control commands of the operating elements 3 are also received at the primary vehicle controller 1 via the first I / O system 4, by means of which control commands a train crew can perform an operating action (e.g. switching on or switching off or dimming lights, etc.). During normal operation, the primary vehicle controller 1 cyclically and continuously sends status information to the communication link 9. This status information contains functional information relating to the functionalities controlled by the primary vehicle controller 1, namely - relating to the energy supply 6, - to the load circuit 7, - to the lighting controller 8, - to the operating elements 3, as well as - to the primary vehicle controller 1 and - to the first I / O system 4. The functional information of the functionalities 3, 6, 7, 8 allows a statement to be made about the (technical) state of the respective functionality, for example in the form of diagnostic information. The functional information of the functionalities 1 and 4 allows a statement to be made as to whether fault-free operation is provided in these two functionalities or whether there is a fault therein. The status information additionally contains a so-called "live byte", by means of which communication failures between transmitting and receiving functionalities, that is to say failures in the data traffic or in the vehicle bus, are able to be uncovered. Using the status information transmitted by the vehicle controller 1, the communication link 9 continuously and cyclically generates a so-called process image PROAB in a unit 10, which process image contains the functional information relating to the following functionalities: - energy supply 6, - load circuit 7, - lighting controller 8, - operating elements 3, - primary vehicle controller 1, - first I / O system 4. The process image PROAB is provided with time information, location information and a suitable checksum in order to be able to detect data tampering. The location information preferably comes from the GPS receiver 13, which is optionally also able to be used to determine the time information. The process image PROAB is transmitted to the IT system ITSYS of the land side LS by means of a secured data transmission method (e.g. using VPN tunnel technology) and by means of the remote communication 12 and 14. The IT system ITSYS receives and evaluates the process image PROAB on the basis of the co-transmitted checksum and on the basis of the co-transmitted time information. If the process image PROAB is considered valid, it is processed further on the land side. By means of the IT system ITSYS, a functional evaluation of the vehicle controller 1 and of the first I / O system 4 is carried out by means of the respective functional information transmitted in the process image PROAB. If it is established on the land side that the vehicle controller 1 or the first I / O system 4 is functioning in a faulty manner, the redundancy controller 15 is activated. This creates suitable control commands based on the process image PROAB with the aim of replacing the faulty primary vehicle controller 1. The generation of the control commands by the redundancy controller 15 is done cyclically and continuously. When generating the control commands, the redundancy controller 15 optionally also uses the location information of the GPS receiver 13 contained in the process image PROAB in order to also take into account local circumstances (e.g. imminent tunnel passages) when controlling the functionalities. The control commands of the redundancy controller 15 are addressed to the following functionalities: - energy supply 6, - load circuit 7, and - lighting 8. In the event of the fault in the vehicle controller 1 or in the first I / O system 4 established on the land side, the land-side IT system ITSYS sends corresponding information together with the control commands of the redundancy controller 15 to the communication link 9. The communication link 9 distributes the control commands of the redundancy controller 15 to the above-mentioned functionalities via the second I / O system 5. This ensures at least limited operation of the passenger car PW1. The control commands of the redundancy controller 15 are transmitted to the passenger car PW1 in a secure manner again and checked for their validity via the communication link 9. A special case of the described method constitutes the situation when a total failure of the primary vehicle controller 1 occurs on the vehicle side. This total failure is detected directly by the communication link 9 because the status information and "live byte" sent by the primary vehicle controller 1 in the normal case simply do not exist in this case. In this case, the communication link 9 requests the creation and the return transmission of the control commands of the redundancy controller 15 from the land-side IT system ITSYS via the remote communication 12 and 14. Further details of the invention are briefly described below: - Both for the transmission path from the passenger car PW1 to the land side and for the transmission path back, the receiving unit ignores or rejects received signal contents if an error or tampering is detected during the transmission. - In this case, the signal contents that were respectively last received and considered valid remain active until there is fault-free transmission. - Both the land side LS and the communication link 9 send back a confirmation of receipt upon receiving valid signal content. The respective transmitting unit can thus recognize that new commands or information have arrived and are pending processing. - Should the communication between the passenger car PW1 and the land side LS be permanently faulty, a corresponding diagnostic note and a warning are output on the passenger car PW1 to a driver of the traction vehicle or to a member of the train crew. Correspondingly, a corresponding diagnostic note is made on the land side and personnel on the land side are informed. - The passenger car PW1 is designed in such a way that, in the event of software or transmission errors to the land side LS, no dangerous state can arise and there is a corresponding self-securing of the vehicle. - Optionally, the communication link 9 can access the first I / O system 4 directly. This allows the second I / O system 5 to be dispensed with, if necessary. In addition to the above example, a failure function 11 is provided by the passenger car PW1, which failure function puts those functions of the components that are to be controlled: - energy supply 6, - load circuit 7, and - lighting controller 8, into a predefined state or basic state in the event of a fault. The failure function 11 is used when the communication between the communication connection 9 and the land side LS fails completely or the communication is faulty. The failure function 11 cannot be influenced by the vehicle controller 1 or by the communication link 9. The failure function 11 can be updated or influenced by the land side (LS) so long as the associated communication is stable and present. FIG 2 shows an overview of land-side software elements with reference to FIG 1. On the land side LS, a respective software container SW1, SW2, SW3 is stored for each vehicle or for each individual passenger car PW1, PW2, PW3. The software container SW1 contains the control commands SB1, which are provided via the redundancy controller 15 for the passenger car PW1. The software container SW2 contains the control commands SB2, which are provided via the redundancy controller 15 for the passenger car PW2. The software container SW3 contains the control commands SB3, which are provided via the redundancy controller 15 for the passenger car PW3. 5 The software container SW1 contains the process image PROAB of the passenger car PW1. The software container SW2 contains the process image PROAB of the passenger car PW2. The software container SW3 contains the process image PROAB of 10 the passenger car PW3. The software containers SW1 to SW3 are embodied such that they cannot negatively influence one another. This ensures that, in the event of a software error in a software container for a first passenger car, the control of other passenger cars is not 15 impaired.

Claims

Patent claims1. A method for securing functionalities (6,  7,  8) of apassenger car (PW1) in rail transport,- in which the functionalities (6, 7, 8) of the passenger car (PW1) are controlled by a primary vehicle controller (1) in the passenger car (PW1), wherein the primary vehicle controller (1) sends respective control commands to the functionalities (6, 7, 8),- in which, during normal operation, the primary vehicle controller (1) transmits status information to a communication link (9) of the passenger car (PW1),- in which the status information is used to transmit functional information, by means of which a technical state of the functionalities and of the primary vehicle controller (1) is signaled,- in which the communication link (9) examines the status information and, if a fault in the primary vehicle controller (1) is detected:o the communication link (9) requests redundant control commands for the functionalities (6,  7,  8) from astationary control point (LS),o the redundant control commands are transmitted from said stationary control point to the communication link (9),o the redundant control commands are transmitted to the functionalities (6, 7, 8) by the communication link (9) when the primary vehicle controller (1) is deactivated and are executed by said functionalities, and- in which the communication link (9) monitors the communication between the communication link (9) and the stationary control point (LS) and, if a fault in the communication is detected, a failure function (11) stored in the passenger car (PW1) is executed via the communication link (9), by means of which failure functionthe functionalities that are to be controlled are put into a predefined state.2.The method as claimed in claim 1, in which the functionalities (6, 7, 8) influence the comfort and safety of passengers in the passenger car (PW1).

3. The method as claimed in claim 1 or 2, in which the functionalities (6, 7, 8) are used to control an energy supply (6) and / or a load circuit (7) and / or lighting (8) in the passenger car (PW1).4.The method as claimed in claim 1, in which the communication link (9), using the status information transmitted by the vehicle controller (1), continuously and cyclically forms a process image (PROAB) which contains the functional information relating to the functionalities.

5. The method as claimed in claim 4, in which the process image (PROAB) is transmitted to the control point (LS) and evaluated there in order to create the redundant control commands.6.The method as claimed in one of the preceding claims, in which the stationary control point (LS) holds redundant control commands respectively assigned to a multiplicity of passenger cars (PW1), which redundant control commands are preferably held in separated software containers and independently of one another.

7. The method as claimed in claim 6, in which the stationary control point (LS) carries out fleet-wide securing of functionalities (6, 7, 8) of the multiplicity of passenger cars (PW1).

8. The method as claimed in one of the preceding claims, in which the failure function (11) is adapted to operating conditions by the stationary control point (LS) as required, so long as communication with the communication link (9) exists

Images