SAFETY MONITORING FOR A LANE-GUIDED VEHICLE

Description

[0001] The invention relates to a method for safety monitoring of a track-guided vehicle, a safety system for a track-guided vehicle and a computer program product.

[0002] Many safety-relevant systems, particularly in the rail sector, must perform certain tasks continuously (i.e., regularly at defined maximum intervals) and react to specific, especially external, events / changes typically within a defined timeframe. These timeframes are generally in the range of seconds or sub-seconds.

[0003] In particular, such systems must reliably monitor compliance with time constraints on their own and trigger a safety response if these constraints are exceeded. Higher speeds, faster response times, increased information density, numerous spontaneous events, and more complex calculations make reliably adhering to these timeframes increasingly difficult. At the same time, additional monitoring mechanisms for detecting spontaneous errors themselves require significant portions of the available computing power. Especially in onboard systems, the increase in computing power is limited by the surrounding environment.

[0004] From US patent 5,507,457 A, a method is known that enables the verification of the integrity of a train's brake line. This method, through an improvement of an end-of-train (EOT) monitoring system, checks the continuity of the train's brake line, as obstructions in the brake line, such as closed angled valves, kinks, blockages, or breaks, can compromise brake safety. For this purpose, a pressure sensor is installed in the locomotive cab unit (LCU) to detect brake application. A software timer is started in a microprocessor circuit within the LCU. If the brake line is intact, braking initiated by the locomotive should result in a corresponding pressure drop at the EOT unit. The time it takes for this pressure drop to propagate through the train is a function of the train's length. The EOT unit informs the LCU of the pressure drop, and the software timer is reset.However, if a pressure drop at the EOT unit is not detected within a specified time period, it is assumed that this is due to either a damaged brake line or a communication error between the LCU and the EOT unit. A microprocessor in the LCU then initiates a communication check by querying the EOT unit from within the LCU. If no response is received, an alarm sounds, warning the technician of a communication error. Conversely, if the LCU receives a response from the EOT unit, a brake line continuity alarm sounds, indicating a brake fault condition to the technician.

[0005] The invention is based on the objective of providing an improved method for safety monitoring of a track-guided vehicle.

[0006] This problem is solved by a method for safety monitoring of a track-guided vehicle according to the independent claim. Advantageous embodiments are specified in the dependent claims.

[0007] According to the invention, a method for safety monitoring of a track-guided vehicle is provided, the method comprising: Receiving a safety-relevant message, wherein the safety-relevant message indicates a safety-relevant event for the track-guided vehicle; activating a timer function for a predetermined duration upon receipt of the safety-relevant message, wherein the predetermined duration fulfills a time requirement for executing a safety action; processing the safety-relevant message and deciding whether a corresponding safety action should be triggered based on the safety-relevant message;and if, based on the processing of the security-relevant message, it is decided that no security action is to be triggered, the timer function is reset before the predetermined time period has expired; if, based on the processing of the security-relevant message, it is decided that a security action is to be triggered, the security action is triggered before the predetermined time period has expired; if the security action has not been triggered before the predetermined time period has expired and the timer function has not been reset, the security action is automatically triggered when the predetermined time period of the timer function has expired.

[0008] This achieves the technical advantage of providing an improved safety monitoring procedure for a track-guided vehicle, ensuring that, in response to a safety-relevant message indicating a safety-relevant event for the track-guided vehicle, a corresponding safety action can be initiated or executed within a predetermined time period. Upon receipt of the safety-relevant message, a timer function is activated, stipulating that a corresponding safety action will be initiated after a predetermined time period. Simultaneously, the received safety-relevant message is processed, as is standard practice for safety systems, and a decision is made, based on the specific message, as to whether a corresponding safety action should be executed.If, within the predetermined time period of the timer function, it is decided that no such security action should be performed based on the security-relevant message, the timer function can be reset, thus preventing the execution of the security action. Conversely, if, within the predetermined time period, it is decided that a corresponding security action should be performed, this can be initiated before the timer function expires, so that the security action does not have to wait for the timer function to expire. If the timer function has neither been reset nor a corresponding security action initiated before the predetermined time period expires, a corresponding security action will be initiated automatically when the predetermined time period expires.The method according to the invention thus enables compliance with relevant safety requirements, which stipulate that corresponding safety actions must be carried out for certain safety-relevant results within predetermined time intervals. The execution of the corresponding safety actions is thus decoupled from the processing of the safety-relevant message by the method according to the invention, so that the execution of the corresponding safety action in accordance with the time requirements can be ensured even if the processing of the safety-relevant message cannot be completed within the time period stipulated by the safety requirements.Furthermore, decoupling ensures that security actions are executed within the predetermined time period, regardless of the computing capacity available for processing security-relevant messages.

[0009] A track-guided vehicle can be a rail vehicle.

[0010] A predetermined time period can be defined, in particular, by a time for executing the security action.

[0011] According to one embodiment, a time period starting from the time of receiving the safety-relevant message and the expiry of the predetermined time period of the timer function fulfills the time requirement for executing a safety action.

[0012] This offers the technical advantage of ensuring compliance with safety requirements for executing corresponding safety actions. The timer function, activated by this mechanism, is set to a duration that meets the relevant safety requirements between receiving the safety-relevant message and executing the corresponding safety action. For example, the predetermined time can be defined so that, when a vehicle passes over a balise element, the triggering of the appropriate safety action occurs within the time frame stipulated for such events.

[0013] A predetermined time duration for the timer function can be defined, for registration purposes, as a time interval between the receipt of the security-relevant message and the triggering of the security action. This predetermined duration can take into account the time required for data communication of the respective signals and messages to be transmitted.

[0014] According to one embodiment, the processing of the safety-relevant message is carried out by a processing module, wherein the timer function and the triggering of the safety action are carried out by an output module executed separately from the processing module.

[0015] This offers the technical advantage of improved traceability of the individual functions of the security monitoring system. By separating the processing of the security-relevant message from the execution of the timer function or the triggering of the security action, verification of the functionality of both the processing of the security-relevant messages by the processing module and the execution of the timer function or the triggering of the security action by a separate output module is facilitated. Particularly when the processing module performs multiple different processing functions for various security-relevant messages, the functionality and compatibility of the individual processing functions can be easily verified.Furthermore, separating the processing of safety-relevant messages from the timer function or the triggering of the safety action simplifies the scalability of the various processing functions. This is because the triggering of the safety action is operated independently of the respective processing function and depends solely on the respective time specifications of the detected safety-relevant events. In particular, the processing functions are determined exclusively by the respective safety-relevant message or task to be processed, and the distribution of a computationally intensive processing function across several consecutive cycles in a cycle-oriented execution of the safety monitoring can be disregarded.Furthermore, with cyclical execution of security monitoring, processing by the processing functions can be started immediately, and processing does not have to be completed within an already started processing cycle. This provides more time for processing spontaneous security-relevant events, thereby increasing the performance of the security monitoring.

[0016] According to one embodiment, the activation of the timer function and / or the resetting of the timer function and / or the triggering of the safety action before the predetermined time period has elapsed is initiated by the processing module.

[0017] This allows the technical advantage to be achieved that the timer function can be activated immediately upon detection of the security-relevant event described by the security-relevant message, so that the security-relevant time specifications can be met.

[0018] According to one embodiment, the safety-relevant message is received by a receiving module, whereby the activation of the timer function is initiated automatically and immediately upon receipt of the safety-relevant message by the receiving module.

[0019] This offers the technical advantage of automatically activating the timer function immediately upon receipt of the security-relevant message. This ensures that the corresponding security action is carried out within the required predetermined timeframe.

[0020] According to one embodiment, activating the timer function is linked to the assignment of an identifier message by the output module, whereby the processing module initiates the resetting of the timer function only when the identifier message is specified.

[0021] This achieves the technical advantage of ensuring that security requirements are met when executing corresponding security actions. By assigning the recognition message, it can be guaranteed that only the processing module, or the processing function executed by the processing module, which is carried out when processing the corresponding security-relevant message, is able to reset the timer function and thus prevent the execution of the security action.

[0022] According to one embodiment, the predetermined duration and / or the safety action to be performed are determined by the processing module and / or by the receiving module and / or the output module.

[0023] This allows the technical advantage that, based on the security-relevant message or described security-relevant event, the predetermined duration of the timer function and the corresponding security action to be executed can be determined by the processing module, the receiving module, or the output module. This ensures increased flexibility in security checks.

[0024] According to one embodiment, the predetermined duration is determined depending on the safety-relevant message and / or the safety-relevant event.

[0025] This allows for the technical advantage of improved security monitoring, where the predetermined time available for carrying out corresponding security actions can be individually adjusted depending on the detected security-relevant events.

[0026] According to one embodiment, a plurality of timer functions are activated for a plurality of different security actions for the security-relevant message.

[0027] This offers the technical advantage of improved security checks. It allows for various security actions to be performed on a single security-relevant message, with different timer functions activated for each action. This enables a broad and flexible security concept.

[0028] According to one embodiment, for a plurality of different safety-relevant messages, a plurality of timer functions with a plurality of predetermined durations are activated, wherein the plurality of timer functions relate to the same safety action, and wherein the safety action is triggered at the earliest expiry of one of the timer functions if the safety action has not been triggered and the timer function has not been reset before the predetermined duration of the earliest expiry timer function has elapsed.

[0029] This achieves the technical advantage of activating multiple timer functions for a multitude of different safety-relevant messages and the multiple safety-relevant events they describe, each requiring the same safety action due to the nature of the event. These timers can operate with the same duration or with different durations. The respective safety action can be activated upon the expiration of the earliest available time period, thus ensuring compliance with safety-relevant time requirements.

[0030] According to one embodiment, the safety-relevant message includes sensor data from a safety sensor system of the track-guided vehicle and / or telegram data from a vehicle control system.

[0031] This allows the technical advantage to be achieved that the safety monitoring can take into account both safety-relevant events that were detected based on corresponding sensor data from a safety sensor system, as well as those communicated by telegram data from a vehicle control system.

[0032] According to one embodiment, the safety sensor system comprises a speed sensor system and / or a balise sensor system and / or a fire sensor system and / or a door sensor system and / or a drive power sensor system, wherein the sensor data includes an exceedance of a maximum speed and / or a detection of a fire and / or a detection of a door blockage and / or an exceedance of a maximum drive power or a shortfall in a minimum drive power, and / or wherein the telegram data includes a violation of a driving license and / or a refusal to grant the track-guided vehicle permission to travel on a specific railway track.

[0033] This allows for the technical advantage of providing comprehensive safety monitoring that can take into account safety-relevant events occurring during the operation of a rail vehicle by carrying out appropriate safety actions.

[0034] According to one embodiment, the safety action includes an emergency braking action of the track-guided vehicle and / or a release of doors of the track-guided vehicle and / or a drive release or a drive lock of a drive of the track-guided vehicle.

[0035] This allows for the technical advantage of providing safety monitoring that can react to relevant safety events with the safety actions relevant to the operation of track-guided vehicles.

[0036] According to the invention, a safety system for a track-guided vehicle is provided with a computing unit which is configured to execute the method for safety monitoring for a track-guided vehicle according to one of claims 1 - 13.

[0037] According to the invention, the computer program product is comprehensively provided with commands which, when the program is executed by a data processing unit, cause it to execute the method for safety monitoring of a track-guided vehicle according to one of claims 1-13.

[0038] The features and advantages of this invention described above, as well as the manner in which they are achieved, will become clearer and more easily understood through the explanations of the following highly simplified, schematic representations of preferred embodiments. These show: FIG 1 a schematic representation of a safety system for a track-guided vehicle according to one embodiment; FIG 2 another schematic representation of a safety system for a track-guided vehicle according to one embodiment; FIG 3 a flowchart of a method for safety monitoring for a track-guided vehicle according to one embodiment; and FIG 4 a schematic representation of a computer program product.

[0039] FIG 1 shows a schematic representation of a safety system 200 for a track-guided vehicle according to one embodiment.

[0040] The safety system 200 shown for a track-guided vehicle is set up to carry out the inventive method for safety monitoring of a track-guided vehicle.

[0041] According to the invention, the safety system 200 can be arranged in a track-guided vehicle. The track-guided vehicle can be designed as a rail vehicle.

[0042] In the embodiment shown, the system 200 comprises a processing module 203 and an output module 205, which are operated on a common computing unit 201. The processing module 203 has a plurality of processing functions F1, F2, ..., FN, while the output module 205 has a plurality of timer functions T1, T2, ..., TN.

[0043] The output module 205 is also configured to activate a plurality of security actions Out1, Out2, ..., OutN.

[0044] In the illustrated embodiment, the processing module 203 receives a safety-relevant message 207 indicating a corresponding safety-relevant event 209. The safety-relevant message can, for example, be based on sensor data from the safety sensors of the track-guided vehicle. The safety sensors can, for example, include speed sensors, balise sensors, fire sensors, door sensors, and / or drive power sensors, wherein the sensor data can describe, for example, an override of a maximum speed, a detection of a fire, a detection of a door blockage, an override of a maximum drive power, and / or a violation of a minimum drive power as a corresponding safety-relevant event.Alternatively or additionally, the safety-relevant message can include telegram data from a vehicle control system, describing, for example, a violation of a driver's license and / or a refusal to authorize the track-guided vehicle to proceed on a specific railway track as a corresponding safety-relevant event. The safety-relevant message can, in particular, be in the form of a radio message. The vehicle control system can, for example, be the control unit of the track-guided vehicle. The violation of the driver's license and / or the refusal to authorize proceed could, for example, have been transmitted to the vehicle control system by an external control center for managing traffic of multiple track-guided vehicles.

[0045] For example, the safety-related message 207 may indicate that a passenger is trapped in a door of a rail vehicle. Alternatively, a control center of a rail network may inform the rail vehicle or its driver that a corresponding section of the track is impassable.

[0046] Upon receiving the safety-relevant messages 207, the processing module 203, and in particular the plurality of processing functions F1, F2, ..., FN, activates a plurality of timer functions T1, T2, ..., TN in the illustrated embodiment. For this purpose, corresponding activation signals Act_T1, Act_T2, ..., Act_TN are transmitted from the individual processing functions F1, F2, ..., FN to the output module 205, which then activates the timer functions T1, T2, ..., TN and transmits corresponding identification messages ID1, ID2, ..., IDN to the respective processing functions F1, F2, ..., FN. In addition to activating the timer functions T1, T2, ..., TN, corresponding predetermined durations for the individual timer functions T1, T2, ..., TN can also be transmitted via the activation messages Act_T1, Act_T2, ..., Act_TN.

[0047] Alternatively, the output module 205 can be configured to determine the predetermined durations of the timer functions T1, T2, ..., TN based on the type of the respective security-relevant message 207.

[0048] Furthermore, the corresponding security actions Out1, Out2, ..., OutN to be triggered can be specified in the activation messages Act_T1, Act_T2, ..., Act_TN. Alternatively, output module 205 can be configured to automatically determine the appropriate security actions Out1, Out2, ..., OutN based on the type of security-relevant message or the security-relevant event described therein. The security actions Out1, Out2, ..., OutN can be determined depending on the type of security-relevant message and / or the criticality class of the security-relevant event.

[0049] The safety actions Out1, Out2, ..., OutN may include, for example, an emergency braking action of the track-guided vehicle and / or a door release of the doors of the track-guided vehicle and / or a drive release or a reversal of a drive release of a drive of the track-guided vehicle or similar safety actions known from the operation of track-guided vehicles.

[0050] After activation of the timer functions T1, T2, ..., TN, the respective safety-relevant message 207 is processed by the individual processing functions F1, F2, ..., FN. The processing functions F1, F2, ..., FN can be configured to process predetermined safety-relevant events, such as passing over a balise unit or refusing a movement clearance. Alternatively, the processing functions F1, F2, ..., FN can be applied to any safety-relevant event or safety-relevant message 207. Furthermore, the safety functions F1, F2, ..., FN can be operated independently of one another or configured as sequential or mutually communicating sub-functions.

[0051] The processing by the safety functions F1, F2, ..., FN includes a decision as to whether, based on the information of the safety-relevant message 207, a corresponding safety action Out1, Out2, ..., OutN is to be executed.

[0052] If, before the predetermined time period of the respective timer function T1, T2, ..., TN has elapsed, one of the processing functions F1, F2, ..., FN concludes that the respective safety action Out1, Out2, ..., OutN is not to be executed, then the respective processing function F1, F2, ..., FN can reset the respective timer function T1, T2, ..., TN. For this to happen, however, the respective processing function F1, F2, ..., FN must specify the identifier message ID1, ID2, ..., IDN assigned when the respective timer function T1, T2, ..., TN was activated, so that a timer function T1, T2, ..., TN can only be reset by the processing function F1, F2, ..., FN that originally activated the respective timer function T1, T2, ..., TN.

[0053] A reset of the respective timer function T1, T2, ..., TN is only triggered upon complete and correct completion of the calculations by the processing function F1, F2, ..., FN. In the context of a safety-relevant application with multi-channel computing, the reset of the timer function T1, T2, ..., TN can also occur multiple times, particularly via independent channels, provided the corresponding identifier message is transmitted. However, a single activation of a timer function T1, T2, ..., TN is sufficient to trigger it. Therefore, the failure of a single message does not prevent the corresponding safety action Out1, Out2, ..., OutN from occurring. In this way, channel participation for safety-critical monitoring / functions can be ensured as a safety principle.

[0054] If the processing function F1, F2, ..., FN concludes that the corresponding safety action Out1, Out2, ..., OutN must be executed before the respective predetermined time period of the activated timer function T1, T2, ..., TN has elapsed, an activation message can be sent (in Fig. 1 (not shown) including the identifier message ID1, ID2, ..., IDN, the corresponding security action Out1, Out2, ..., OutN is triggered before the predetermined time period expires.

[0055] If a processing function F1, F2, ..., FN does not achieve a result before the respective predetermined time period of the correspondingly activated timer function T1, T2, ..., TN has elapsed, for example due to interference within the processing of different tasks by the majority of processing functions F1, F2, ..., FN, then the safety action Out1, Out2, ..., OutN associated with the activated timer function T1, T2, ..., TN is automatically triggered when the timer function T1, T2, ..., TN has elapsed.

[0056] As an alternative to the embodiment shown here, an identical safety action Out1, Out2, ..., OutN can be triggered by a plurality of the activated timer functions T1, T2, ..., TN. For example, the same safety action Out1, Out2, ..., OutN can be triggered for various safety-relevant events, such as an emergency braking action for a blocked door indicating a trapped object, for a missing driver's license, or for a fire sensor signal indicating a fire.

[0057] As an alternative to the embodiment shown here, the processing module 203 and the output module 205 can be executed on two different and separate computing units 201.

[0058] The predetermined durations of the activated timer functions T1, T2, ..., TN can each be aligned with the corresponding safety-relevant message 207 or the safety-relevant event described therein. Alternatively or additionally, the predetermined duration of the timer function T1, T2, ..., TN can be configured such that, from the time the safety-relevant message is received or the safety-relevant event is detected by the processing module 203 and the corresponding safety action Out1, Out2, ..., OutN is triggered, a predetermined safety-relevant time requirement for corresponding safety actions or safety-relevant events is met. For example, the predetermined duration can be configured to ensure that the predefined time requirement for driving over a balise element and triggering an emergency brake is met.

[0059] FIG 2shows another schematic illustration of a safety system 200 for a track-guided vehicle according to a further embodiment.

[0060] In the Figure 2 In the embodiment shown, the safety system 200 further comprises a receiving module 211 which is configured to receive safety-relevant messages 207.

[0061] In the embodiment shown, the receiving module 211 is formed in a safety sensor 213.

[0062] Furthermore, the processing module 203 and the output module 205 are executed on two separate computing units 201.

[0063] Upon receiving the security-relevant message 207, a timer function T of the output module 205 is automatically activated by sending an activation message Act_T. As mentioned above, the corresponding activation message Act_T can define both the predetermined duration of the timer function T and the security action to be executed (Out1, Out2, ..., OutN). Alternatively, the output module 205 can be configured to automatically define the duration of the timer function T or the security action to be triggered (Out1, Out2, ..., OutN) based on the type of security-relevant message or event, for example, through configuration.

[0064] After activating the timer function T, the output module 205 provides a corresponding identifier message ID.

[0065] The receiving module 211 forwards both the security-relevant message 207 and the identifier message ID to a processing function F of the processing module 203.

[0066] As to the embodiment in Figure 1As already mentioned, the processing function F processes the security-relevant message 207. If, before the predetermined time period of the timer function T has elapsed, the processing function F determines that the corresponding security action Out1, Out2, ..., OutN must be executed, the corresponding security action Out1, Out2, ..., OutN can be triggered by means of a corresponding activation message Act_Out including the identifier message ID, which is transmitted from the processing function F to the output module 205. Conversely, if, before the predefined time period of the timer function T has elapsed, the processing function F determines that the security action Out1, Out2, ..., OutN does not need to be executed, the timer function T can be reset by means of a reset message Res_T including the identifier message ID.Should the processing of the security-relevant message 207 by the processing function F not produce a result before the expiry of the predefined time period of the timer function T, the corresponding security action will be automatically triggered when the predefined time period of the timer function T has expired.

[0067] According to the embodiment in Figure 1 In the illustrated embodiment, the safety-relevant message 207 can be processed by a plurality of processing functions F1, F2, ..., FN. Furthermore, a plurality of timer functions T1, T2, ..., TN of the output module 205 can be activated for each safety-relevant message 207.

[0068] According to a further embodiment, a plurality of safety-relevant messages 207 can be processed simultaneously by the processing functions F of the processing module 203, and for each of the safety-relevant messages 207, corresponding timer functions T1, T2, ..., TN can be activated either by the receiving module 211 or by the corresponding processing functions F1, F2, ..., FN of the processing module 203. The individual timer functions T1, T2, ..., TN can be associated with the same safety action Out1, Out2, ..., OutN, so that an identical safety action is triggered for each safety-relevant message 207. Alternatively, the individual timer functions T1, T2, ..., TN can be associated with different safety functions. The different timer functions T1, T2, ..., TN can be activated for individual durations or for identical durations.

[0069] The processing of the security-relevant messages 207 by processing functions F1, F2, ..., FN of processing module 203 can be carried out cyclically. The activation of the timer functions T1, T2, ..., TN, or the corresponding predefined durations of the timer functions T1, T2, ..., TN, are not limited to the respective cycle times of the processing of processing module 203, but can be extended over several processing cycles.

[0070] Alternatively, the receiver module 211 can also be run on a computing unit 201 that is not part of a safety sensor system 213. For example, the processing module 203, the output module 205, and the receiver module 211 can be run on an identical computing unit 201.

[0071] FIG 3 shows a flowchart of a method 100 for safety monitoring of a track-guided vehicle according to one embodiment.

[0072] For safety monitoring of a track-guided vehicle according to the inventive method 100, a safety-relevant message 207 is first received in a process step 101, in which a corresponding safety-relevant event 209 for the track-guided vehicle is indicated.

[0073] In a process step 103, a timer function T is activated for a predetermined duration upon receipt of the safety-relevant message 207, where the predetermined duration fulfills a time requirement for executing a safety action Out1, Out2, ..., OutN.

[0074] Subsequently, in a process step 105, the security-relevant message 207 is processed and a decision is made as to whether a corresponding security action Out1, Out2, ..., OutN is to be triggered based on the security-relevant message 207.

[0075] If the processing of the security-relevant message 207 concludes, before the predetermined time period of the timer function T has elapsed, that no security action Out1, Out2, ..., OutN is to be triggered, the timer function T is reset in a procedure step 107.

[0076] If, however, the processing of the security-relevant message 207 results in a security action Out1, Out2, ..., OutN being triggered before the predetermined time period of the timer function T has elapsed, the triggering of the security action Out1, Out2, ..., OutN is effected in a procedure step 109.

[0077] However, if the safety action Out1, Out2, ..., OutN is not triggered and the timer function T is not reset before the predetermined time period has elapsed, the safety action Out1, Out2, ..., OutN is automatically triggered in a procedure step 111 when the predetermined time period of the timer function T has elapsed.

[0078] FIG 4 shows a schematic representation of a computer program product 300.

[0079] Figure 4 Figure 300 shows a computer program product comprising instructions that, when executed by a processing unit, cause the unit to execute the method 100 according to one of the embodiments described above. In the embodiment shown, the computer program product 300 is stored on a storage medium 301. The storage medium 401 can be any storage medium known from the prior art.

[0080] Although the invention has been illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples and other variations can be derived by the person skilled in the art without departing from the scope of protection of the invention as defined by the independent claims. Reference symbol list

[0081] 100 Procedure 101 Receiving a security-relevant message 103 Activating a timer function 105 Processing the security-relevant message 107 Resetting the timer function 109 Triggering a security action 111 Automatically triggering a security function 200 Security system 201 Computing unit 203 Processing module 205 Output module 207 Security-relevant message 209 Security-relevant event 211 Receiving module 213 Security sensors TTimer function T1Timer function T2Timer function TNTimer function F1Processing function F2Processing function FNProcessing function Out1Security action Out2Security action OutNSecurity action IDIdentifier message ID1Identifier message ID2Identifier message IDNIdentifier message Act_TActivation message Act_T1Activation message Act_T2Activation message Act_TNActivation message Act_OutTrigger message Res_TReset message

Claims

1. Method (100) for safety monitoring for a track-bound vehicle, wherein the method (100) comprises: - receiving (101) a safety-relevant notification (207), wherein the safety-relevant notification (207) indicates a safety-relevant event (209) for the track-bound vehicle; - on receipt of the safety-relevant notification (207), activating (103) a timer function (T) for a predefined duration, wherein the predefined duration complies with a time specification for an execution of a safety action (Out1, Out2, ..., OutN); - processing (105) the safety-relevant notification (207) and deciding, based on the safety-relevant notification, whether a corresponding safety action (Out1, Out2, ..., OutN) is to be triggered; and - if it is decided, based on the processing of the safety-relevant notification (207), that no safety action (Out1, Out2, ..., OutN) is to be triggered, resetting (107) the timer function (T) before the predefined duration lapses, - if it is decided, based on the processing of the safety-relevant notification (207), that a safety action (Out1, Out2, ..., OutN) is to be triggered, triggering (109) the safety action (Out1, Out2, ..., OutN) before the predefined duration lapses, - if the safety action is not triggered and the timer function (T) not reset prior to the lapsing of the predefined duration, automatically triggering (111) the safety action (Out1, Out2, ..., OutN) when the predefined duration of the timer function (T) lapses.

2. Method (100) according to claim 1, wherein, starting from a point in time when the safety-relevant notification (207) is received and the predefined duration of the timer function (T) lapses, a duration complies with the time specification for an execution of a safety action (Out1, Out2, ..., OutN).

3. Method (100) according to claim 1 or 2, wherein the processing of the safety-relevant notification (207) is performed by a processing module (203), and wherein the timer function (T) and the triggering of the safety action (Out1, Out2, ..., OutN) is performed by an output module (203) embodied separately from the processing module (201).

4. Method (100) according to claim 3, wherein the activation of the timer function (T) and / or the resetting of the timer function (T) and / or the triggering of the safety action (Out1, Out2, ..., OutN) is effected by the processing module (203) prior to the lapsing of the predefined duration.

5. Method (100) according to one of the preceding claims, wherein the safety-relevant notification (207) is received by a receive module (211), and wherein the activation of the timer function (T) is effected automatically and directly on receipt of the safety-relevant notification (207) by the receive module (211).

6. Method (100) according to claim 3, 4 or 5, wherein the activation of the timer function (T) is linked to an issuance of an identification notification (ID) by the output module (203), and wherein the effecting of the resetting of the timer function (T) takes place by way of the processing module (203) only when the identification notification (ID) is specified.

7. Method (100) according to one of the preceding claims 3 to 6, wherein the predefined duration and / or the safety action (Out1, Out2, ..., OutN) to be executed is determined by the processing module (203) and / or by the receive module (211) and / or by the output module (205).

8. Method (100) according to one of the preceding claims, wherein the predefined duration is determined depending on the safety-relevant notification (207) and / or the safety-relevant event (209).

9. Method (100) according to one of the preceding claims, wherein, for the safety-relevant notification (207), a number of timer functions (T1, T2, ..., TN) are started for a number of different safety actions (Out1, Out2, ..., OutN).

10. Method (100) according to one of the preceding claims, wherein, for a number of different safety-relevant notifications (207), a number of timer functions (T1, T2, ..., TN) with a number of predefined durations are started, wherein the number of timer functions (T1, T2, ..., TN) pertain to the same safety action (Out1, Out2, ..., OutN), and wherein, for an earliest lapse of one of the timer functions (T1, T2, ..., TN), the safety action (Out1, Out2, ..., OutN) is triggered if, prior to the lapsing of the predefined duration of the earliest lapsed timer function (T1, T2, ..., TN), the safety action (Out1, Out2, ..., OutN) is not triggered and the timer function (T1, T2, ..., TN) is not reset.

11. Method (100) according to one of the preceding claims, wherein the safety-relevant notification (207) comprises sensor data of a safety sensor system (213) of the track-bound vehicle and / or telegram data of a vehicle controller.

12. Method (100) according to claim 11, wherein the safety sensor system (213) comprises a speed sensor system and / or a balise sensor system and / or a fire detection system and / or a door sensor system and / or a traction power monitoring system, and wherein the sensor data comprises an exceedance of a maximum speed and / or a detection of a fire location and / or a detection of a door obstruction and / or an exceedance of a maximum traction power or an undershooting of a minimum traction power, and / or wherein the telegram data comprises a violation of a movement authority and / or denial of a movement release of the track-bound vehicle for a particular railway track.

13. Method (100) according to one of the preceding claims, wherein the safety action (Out1, Out2, ..., OutN) comprises an emergency braking of the track-bound vehicle and / or a door release of doors of the track-bound vehicle and / or a traction release of a drive of the track-bound vehicle.

14. Safety system (200) for a track-bound vehicle with a computing unit (201), which is configured to carry out the method (100) for safety monitoring for a track-bound vehicle according to one of the preceding claims 1 to 13.

15. Computer program product (300) comprising commands, which, when the program is executed by a data processing unit, prompt it to carry out the method (100) for safety monitoring for a track-bound vehicle according to one of the preceding claims 1 to 13.