PROCEDURE FOR TRIP REGISTRATION FOR A RAILWAY TECHNICAL SYSTEM AND REGISTRATION PARTICIPANTS

Description

[0001] In railway technology, journey recording devices are now used, similar to those long used in aviation, for example, under the term "black box." Such journey recording devices are sometimes also referred to as data loggers or legal recorders. Particularly in light of increasing modularization and the use of components from a wide variety of manufacturers in a railway system, the use of such journey recording devices makes sense, as their records and entries are designed to be incontrovertible. Auditability using such journey recording devices can also be important due to the increasing number of hacker attacks. Journey recording devices can be problematic if their records are not trustworthy and can be subsequently manipulated.Another problem can occur if the journey registration device is destroyed, for example in a vehicle accident, and the data is lost.

[0002] US 2014 / 0052315 A1 discloses a data recorder for a train with parallel off-board data storage. EP 0 177 690 A2 describes a method for error correction, and DE 10 2018 205 917 A1 describes a device for duplicating and backing up data from a journey recording system.

[0003] It is therefore the object of the present invention to provide a method for trip registration for a railway system and a registration participant for a trip registration device whose records are secure even in the event of a vehicle accident.

[0004] According to the invention, the object is achieved by a method according to patent claim 1 for journey registration for a railway system, in which data of the railway system is read out simultaneously by several registration participants over a predetermined period of time and in each case at least one data packet is created from the data and / or at least one hash value of the data packet, in which the data packets and / or the hash values ​​are each exchanged between the registration participants by means of fieldbus communication and the data packets created by different registration participants and / or their hash value are compared with one another.

[0005] Furthermore, the object is achieved according to the invention by a registration participant according to claim 10 for a journey registration device, a railway system, with at least one reading device designed to read data from the railway system over a predetermined period of time, with at least one processing device designed to create at least one data packet from the data and / or at least one hash value of the data packet, with at least one coupling device designed to exchange the data packets and / or the hash values ​​by means of fieldbus communication, and with at least one comparison device designed to compare the data packets created by different registration participants and / or their hash values.

[0006] The inventive use of multiple registration participants ensures that if one registration participant is destroyed, for example due to an accident involving a rail vehicle in the system, additional registration participants with the recorded data are available. For this purpose, the data status on all registration participants must be ensured. Each registration participant reads predetermined data from the railway system, which can essentially be freely determined, over a predetermined point in time. A data packet is created and stored from this collected data. Additionally or alternatively, a hash value of the data packet can also be created. According to the invention, the data packets and / or the hash values ​​are exchanged between the registration participants via fieldbus communication. Fieldbus communication has the advantage that the data can be exchanged very quickly and easily.Finally, the data packets created by different registration participants and / or their hash values ​​are compared with each other. This has the advantage that differences can be identified very quickly and otherwise a consistent data status can be guaranteed for all registration participants. The railway system included known components, such as rail vehicles, signal boxes, control centers, or field elements, whose data can be recorded. The data includes, for example, vehicle data, but also data from field elements, configured routes, etc.

[0007] The solution according to the invention can be further developed by advantageous embodiments which are described below.

[0008] In an advantageous embodiment of the method according to the invention, the data packet and / or the hash value of the data packet can be signed by the registration participants, in particular with an assigned private key of a PKI (public key infrastructure). This has the advantage that the originator of the data packet or its hash value can be clearly identified. Signing with PKI, i.e., with the private key of the public key infrastructure, is suitable because it is widely used and forgery-proof. The PKI can be certified by a central authority.

[0009] To quickly detect errors by individual registration participants, the data packets and / or hash values ​​of different registration participants from the same period are checked for consistency. The goal is to ensure that all registration participants have the same data status with the same data packets. If the data packets or their hash values ​​match, this is the case.

[0010] Furthermore, an agreement can be reached if the data packets and / or hash values ​​of different registration participants differ from one another during the same period. This has the advantage that, even if there are discrepancies between the different registration participants, the same data status can be restored within a foreseeable period of time.

[0011] For example, agreement on differing data can be achieved by adopting the data packets and / or hash values ​​of a majority or qualified majority of the registration participants for all registration participants. A qualified majority here is defined as a predetermined percentage of registration participants. This can be 50%, but also a higher percentage. Alternatively, or if no qualified majority exists, agreement can be achieved through a predetermined event protocol implemented via fieldbus communication. Such agreement protocols are well known and include, for example, agreement algorithms that can be used to resolve discrepancies. Such algorithms are familiar from distributed databases or fault-tolerance applications. Thus, agreement can be reached after several cycles of fieldbus communication, either deterministically or statistically.

[0012] In order to identify incorrect registration participants, registration participants whose data packets and / or hash values ​​do not match those of the other registration participants are marked. If the data repeatedly do not match, such registration participants are excluded.

[0013] Furthermore, the data packets and / or hash values ​​can be exchanged essentially in real time using fieldbus communication. This has the advantage of allowing virtually simultaneous coordination between the registration participants. This ensures that the registration participants either all have the same data status or at least a deviation from it is known. For example, in the event of a rail vehicle accident, it can be determined whether the data status of a registration participant is trustworthy.

[0014] In an advantageous embodiment, the predetermined period over which the data is read can be greater than or equal to one transmission cycle of the fieldbus communication. This has the advantage that the established fieldbus communication can be used easily. It can also be advantageous to collect data over two or more cycles and only then retransmit it.

[0015] Furthermore, each registration participant can be permanently assigned at least one area in the fieldbus communication. This has the advantage that each registration participant knows which data area is assigned to which other registration participant. This way, the data stored within the fieldbus communication can be uniquely assigned to each registration participant.

[0016] The invention also relates to a journey registration device for a railway system, comprising a plurality of registration participants which are designed to read out vehicle data and to cyclically create data packets from the vehicle data, comprising at least one fieldbus communication device by which the registration participants are connected to one another, wherein at least some of the registration participants are designed according to the above-mentioned embodiment.

[0017] In an advantageous embodiment of the journey registration device according to the invention, the fieldbus communication device can be designed to be real-time capable. This has the aforementioned advantage of rapid synchronization.

[0018] Finally, the invention also relates to a rail vehicle with at least one journey registration device according to the invention according to one of the aforementioned embodiments.

[0019] The invention is explained below with reference to the accompanying drawings.

[0020] They show: Fig. 1 is a schematic representation of an exemplary embodiment of a rail vehicle according to the invention with a journey registration device; Fig. 2 is a schematic representation of a fieldbus communication in the rail vehicle from Fig. 1 ; Fig. 3 another schematic representation of the fieldbus communication from Fig. 2 .

[0021] An exemplary embodiment of a railway system with a rail vehicle 1 according to the invention, as shown in Fig. 1 is shown. The rail vehicle 1 comprises a journey registration device 2 with several registration participants 3 and a fieldbus communication device 4. The rail vehicle 1 further comprises a plurality of components 5, which are arranged at various locations in the rail vehicle 1 and provide a wide variety of vehicle data.

[0022] In the figures, the journey registration device 2 is shown as part of the rail vehicle 1, and the data read out here is exclusively vehicle data. Alternatively or additionally, the journey registration device 2 can of course also read other data from the railway system, such as data from signal boxes or field elements. The journey registration device does not necessarily have to be located in the rail vehicle 2, but can be located anywhere in the railway system.

[0023] Components 5 are in the Fig. 1 In the exemplary embodiment shown, the components 5, like the registration participants 3, are connected to the fieldbus communication device 4. The components 5 can be, for example, an ETCS onbroad unit, a vehicle control device, a brake control device, an odometry device, or the like. The components 5 transmit a wide variety of vehicle data via the fieldbus communication device 4 within the rail vehicle 1. Vehicle data can be, for example, any type of error messages, but also speed, acceleration, position, current braking curves, energy consumption, outside temperature, vehicle temperature, etc.

[0024] The registration participants 3 are each designed to record current vehicle data and can also be referred to as distributed judicial recorders or data loggers. The registration participants 3 each have a readout device 6, a processing device 7, a coupling device 8 and a comparison device 9. The readout device 6 is designed to read the vehicle data of the rail vehicle 1, with all registration participants 3 reading the same vehicle data. The processing device 7 is designed to create a data packet from the vehicle data. The structure or layout of the data packet D is also fixed for all registration participants 3. The coupling device 8 connects the registration participant 3 to the fieldbus communication device 4 and can also be referred to as a switch. Since in the exemplary embodiment in Fig. 1 If the components 5 each transmit the vehicle data via fieldbus communication and the readout device 6 subsequently reads the vehicle data from the fieldbus communication device 4, the readout device 6 and the coupling device 8 can also be designed together. The comparison device 9 is designed to compare data packets or hash values ​​that have been created by different registration participants 3, as described in more detail below. The comparison device 9 can also be designed together with the processing device 7. In the simplest case, the registration participants 3 can each be a computer with a network interface, such as Ethernet, or just part of a computer, and the readout device 6, the processing device 7, the coupling device 8 and the comparison device 9 can be at least partially designed in software.

[0025] In Fig. 2 is the fieldbus communication of the fieldbus communication device 4 from Fig. 1 shown in detail. Fieldbus communication devices of this type are known per se. In principle, the time is synchronized and divided into transmission cycles z1, z2, z3. Generally, within each transmission cycle z1, z2, z3, fixed areas or slots B1, B2, B3 are reserved for various information, for example, for real-time messages (B1 or B2 depending on the priority of the data) and B3 for standard communication. The cycle time is in the exemplary embodiment in Fig. 2 Specified in ms and typically lies between 50 and 500 ms, for example, z=100 ms here. The ranges or parts thereof are permanently assigned to participants, and each participant can read all data but only write to their own range.

[0026] The following describes how the procedure for registering journeys works during operation of rail vehicle 1.

[0027] The fieldbus communication device 4 is designed in a manner known per se and operates, for example, according to the Profinet standard. Both the registration participants 3 and the components 5 are participants of the fieldbus communication device 4 and are connected to it. These participants each have a permanently assigned area in which they can write data and thus transmit it via the fieldbus communication. The fieldbus communication device 4 operates cyclically in a known manner with a fixed cycle time z, which in the embodiment in Fig. 1 For example, z = 100 ms. Although registration participants 3 can only write to a specific area of ​​the fieldbus communication, they can read all areas. This allows them to read both the vehicle data transmitted by components 5 and data packets from other registration participants 3.

[0028] Each registration participant 3 collects vehicle data over a fixed number of cycles of the fieldbus communication device 4. From the collected vehicle data, each registration participant 3 creates a data packet D with a predetermined, fixed data structure. Thus, the data packets D of the various registration participants 3 or their hash values ​​are comparable. In the exemplary embodiment in Fig. 1 Each registration participant 3 also creates a hash value of each newly created data packet D. The hash value is then signed using a private key from a public key infrastructure (PKI) of the respective registration participant 3. Finally, at least the signed hash value is stored by each registration participant 3 in the area of ​​the fieldbus communication device 4 reserved for it. The entire data packet D can also be written into the fieldbus communication. However, the hash values ​​are sufficient for comparison between the registration participants 3.

[0029] In the exemplary embodiment in Fig. 1 The hash value and / or the data packet D is stored in a real-time area of ​​the fieldbus communication device 4, which is transmitted in real time. Each registration participant 3 reads the hash values ​​of the other registration participants 3 and saves them together with current information, the hash value, and the signature. Using the existing public keys of the other registration participants 3, the signed hash values ​​of each registration participant 3 can be verified for authenticity. Each registration participant 3 checks whether the hash values ​​of all registration participants 3 match. This would mean that the recorded data packets D from all registration participants 3 are identical. This state is desirable so that the recorded vehicle data is up to date for all registration participants 3.

[0030] Those registration participants 3 whose hash values ​​do not match those of a qualified majority of registration participants 3 are flagged. If they repeatedly do not match the majority, they may, for example, be excluded.

[0031] To ensure that all registration participants 3 have the same data, it is also intended that the hash values ​​of a qualified majority of registration participants 3 are also adopted for all other registration participants 3. Should a qualified majority not be achieved, an agreement can be reached via a predetermined agreement protocol. This protocol can, for example, use known agreement algorithms.

[0032] In Fig. 3 is an agreement within the cycles of fieldbus communication from Fig. 2 represents it in an exemplary and schematic manner.

[0033] The data is collected over two intervals z0, z1. Cycle time is again z=100 ms. Arrow 10 indicates that the data collection and creation of the data packet D is complete. Typically, the data is verifiably matched and stored in the next interval z2 if the majority agrees. If the cycle time z is very short, a cycle offset can also be incorporated, e.g., to allow sufficient time for the calculations. Ideally, the oldest data is in Fig. 3 after z0+z1+z2=300 ms, the data is stored bindingly in the registration participants 3, possibly with a latency after 400 ms. This is indicated by arrow 11. If no agreement could be reached immediately, consensus is only reached after (z0+z1+z2+m) ms, but if m<7, a latency of less than 1 s is still achieved, which can be considered fast.

Claims

1. Method for registering travel for a rail system, in which rail system data from a plurality of registration participants (3) is read in each case over a predefined time period and at least one data packet from the data and / or at least one hash value of the data packet is created and stored in each case, in which the data packets and / or the hash values are exchanged by means of field bus communication between the registration participants (3) in each case and the data packets created from different registration participants (3) and / or their hash value are compared with one another, characterised in that the data packets and / or the hash values of different registration participants (3) from the same time period are checked for conformity, registration participants (3) whose data packets and / or hash values do not conform to those of the remaining registration participants (3) are marked and registration participants (3) with repeatedly non-conforming data are excluded.

2. Method according to claim 1, characterised in that the data packet and / or the hash value of the data packet is / are signed by the registration participants (3) in each case.

3. Method according to claim 2, characterised in that the data packet and / or the hash value of the data packet is / are signed by the registration participants (3) with an associated private key of a PKI - public key infrastructure - in each case.

4. Method according to one of the above-mentioned claims, characterised in that a unification is carried out if the data packets and / or the hash values of different registration participants (3) from the same time period deviate from one another.

5. Method according to claim 4, characterised in that the unification is achieved in that the data packets and / or the hash values of a majority or qualified majority of the registration participants (3) are adopted for all registration participants (3).

6. Method according to claim 4 or 5, characterised in that the unification is achieved by a predefined unification protocol which is carried out by means of field bus communication.

7. Method according to one of the above-mentioned claims, characterised in that the data packets and / or the hash values are exchanged in real time by means of field bus communication.

8. Method according to one of the above-mentioned claims, characterised in that the predefined time period, over which the data is read, is greater than or equal to a transfer cycle of the field bus communication.

9. Method according to one of the above-mentioned claims, characterised in that at least one area in the field bus communication is assigned in a fixed manner to each registration participant.

10. Registration participant (3) for a travel registration facility (2) of a rail system, with at least one read facility (6) which is designed to read rail system data over a predefined time period, with at least one processing facility (7), which is designed to create and store at least one data packet from the data and / or at least one hash value of the data packet, with at least one coupling facility (8) which is designed to exchange the data packets and / or the hash values by means of field bus communication and with at least one comparison facility (9) which is designed to compare data packets created by different registration participants (3) and / or their hash values, characterised in that the registration participant (3) is designed to check the data packets and / or the hash values of different registration participants (3) from the same time period for conformity, to mark registration participants (3), whose data packets and / or hash values do not conform to those of the remaining registration participants (3) and to exclude registration participants (3) with repeatedly non-conforming data.

11. Travel registration facility (2) for a rail system, with a plurality of registration participants which are designed to read data and to cyclically create data packets from the data, with at least one field bus communication facility (4) by way of which the registration participants (3) are connected with one another, wherein at least some of the registration participants (3) are designed according to claim 10.

12. Travel registration facility (2) according to claim 11, characterised in that the field bus communication facility (4) is designed to be able to function in real time.

13. Rail vehicle (1) with at least one travel registration facility (2) according to claim 11 or 12.