Local device, on-board device, and DB update control method

Abstract

To enable updating a local database using public communication lines while ensuring the integrity of received data and achieving low processing load. [Solution] The onboard device 7, which controls the running of the train 5 using the onboard DB42, obtains the latest DB code information, which is the latest version of the onboard DB42 (the latest DB60), from the management device 3. Based on the differences between the onboard DB code information obtained by the code generation process for the onboard DB42 and the latest DB code information, it determines whether the onboard DB42 needs to be updated. If it determines that an update is necessary, it obtains the latest DB60 from the management device 3. Based on the difference between the verification code information obtained by the code generation process for the acquired latest DB60 and the latest DB code information, it makes a pass / fail judgment. If it passes, it updates the acquired latest DB as the new onboard DB42.

Description

Technical Field

[0004] , , , , , , , , ,

[0005] , , , , , , , ,

[0001] The present invention relates to a local device, an on-vehicle device, and a DB update method.

Background Art

[0002] In a wireless train control system with an on-vehicle main body, a database (DB: Data Base) related to track information and vehicle performance is installed on the vehicle. The update of this on-vehicle DB has been performed by replacing a storage medium by an operator, which has required a great deal of labor. Therefore, as a method for updating the on-vehicle DB without human intervention, a method using wireless communication has been proposed.

[0003] When using wireless communication, it is important to ensure the integrity of received data. For example, a public communication line is used for distributing the DB, and a method of transmitting version information etc. necessary for checking the integrity of the received DB via a railway dedicated communication means (transponder) (see, for example, Patent Document 1), or a method of checking the integrity of the received DB by transmitting and receiving version information and CRC (Cyclic Redundancy Check) etc. and transmitting and receiving differential data before and after the update for comparison (see, for example, Patent Document 2) are known.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0005] Incidentally, fail-safe devices used in signal safety systems, which require high levels of security, have limitations on the amount of computation per unit time. In the case of on-board wireless train control systems, train control is the primary process, and it is undesirable to place a load on the secondary process of database (DB) update processing. Therefore, it has been difficult to implement complex processes such as encryption to ensure the integrity of the received DB. Furthermore, when using railway-specific communication means (transponders), there are also issues of installation costs and limitations on update locations. This problem is not limited to updating on-board DBs, but also applies to updating DBs (local DBs) used in various devices (local devices) that perform train safety control, such as level crossing control devices and switch control devices.

[0006] The problem that this invention aims to solve is to enable the updating of a local database using a public communication line with low processing load while ensuring the integrity of the received data. [Means for solving the problem]

[0007] The first invention for solving the above problem is: A local device (for example, the on-board device 7 in Figure 8) comprises a fail-safe function unit (for example, the fail-safe device 10b in Figure 8) that performs control for the operational safety of a train using a local database (hereinafter, the database will be referred to as "DB") (for example, the on-board DB 42 in Figure 8), and a non-fail-safe function unit (for example, the non-fail-safe device 50b in Figure 8) that performs a predetermined code generation process on given information to generate coded information for said given information, and is capable of communicating via a public communication line with a management device that manages the latest DB, which is the latest version of the local DB, The aforementioned fail-safe function unit is A storage means for storing the aforementioned local DB (for example, the storage unit 40 in Figure 8), A DB update control means (for example, the DB update control unit 20 in Figure 8) controls the updating of the local DB stored in the storage means, Equipped with, The DB update control means is Latest DB code information acquisition means (for example, the latest DB code information acquisition unit 22 in Figure 8) acquires the latest DB code information obtained from the management device by performing the code generation process on the latest DB, Based on the differences between the local DB code information obtained by the code generation process for the local DB and the latest DB code information obtained by the latest DB code information acquisition means, an update necessity determination means (for example, the update necessity determination unit 24 in Figure 8) determines whether or not the local DB needs to be updated, If the update necessity determination means determines that an update is necessary, the latest DB acquisition means (for example, the latest DB acquisition unit 26 in Figure 8) acquires the latest DB from the management device, Verification code information generation means (for example, verification code information generation unit 28 in Figure 8) generates verification code information by causing the non-failsafe function unit to perform the code generation process on the latest DB obtained by the latest DB acquisition means, Based on the results of the pass / fail determination based on the differences between the latest DB code information obtained by the latest DB code information acquisition means and the verification code information generated by the verification code information generation means, if the result is a pass, an update means (for example, the update unit 30 in Figure 8) updates the stored data of the storage means as a new local DB using the latest DB obtained by the latest DB acquisition means. Having, It is a local device.

[0008] Other inventions include, A DB update control method for a local device comprising a fail-safe function unit that performs control for train operation safety using a local database (hereinafter, the database is referred to as "DB"), and a non-fail-safe function unit that performs a predetermined code generation process on given information to generate coded information for said given information, and which can communicate via a public communication line with a management device that manages the latest DB, which is the latest version of the local DB, wherein The fail-safe function unit includes a storage means for storing the local DB, The aforementioned fail-safe function unit, The latest DB code information obtained from the management device after performing the code generation process on the latest DB, Based on the differences between the local DB code information obtained through the code generation process for the local DB and the latest DB code information obtained, it is determined whether or not the local DB needs to be updated. If the determination of whether an update is necessary is made, the latest DB is obtained from the management device. The code generation process is performed on the latest DB obtained from the management device by the non-failsafe function unit to generate verification code information, Based on the results of the pass / fail determination, which is determined by the differences between the latest DB code information obtained from the management device and the generated verification code information, if the result is a pass, the latest DB obtained from the management device is used as the new local DB to update the data stored in the storage means. Execute A DB update control method may be configured.

[0009] According to the first invention, it is possible to update a local database using a public communication line with a low processing load while ensuring the integrity of the received data. In the local device, the fail-safe function unit ensures the safety of processing by performing communication with the management device via the public communication line, such as acquiring the latest database code information and the latest database, as well as determining whether or not to update the local database and updating the local database. By having the non-fail-safe function unit perform the encoding process, which has a high processing load, it is possible to ensure the integrity of the latest database acquired from the management device via the public communication line. Furthermore, by using the latest database code information acquired from the management device to determine whether or not to update the local database and to determine whether or not to update the latest database acquired from the management device, it is possible to reduce the processing load required for transmission and reception.

[0010] The second invention is, in the above invention, The means for obtaining the latest DB code information is: Receiving, from the management device, the latest DB symbol information and the symbol information for management-side communication verification obtained by performing the symbol generation process on the latest DB symbol information; Causing the non-fail-safe function unit to perform the symbol generation process on the received latest DB symbol information to generate local-side communication verification symbol information; Based on the result of pass / fail determination based on the identity and difference between the management-side communication verification symbol information and the local-side communication verification symbol information, if it passes, determining that the acquisition of the received latest DB symbol information is complete; Performing the above steps, is a local device.

[0011] According to a second invention, in a local device, it becomes possible to acquire the latest DB symbol information from a management device by verifying the authenticity of the transmission source being the management device and the soundness of the latest DB symbol information received via a non-fail-safe public communication line.

[0012] A third invention is an on-vehicle device which is a local device that performs train running control using the local DB.

[0013] According to a third invention, it becomes possible to update the on-vehicle DB in an on-vehicle device while ensuring the soundness of received data and with a low processing load.

[0014] A fourth invention is, in the above invention, performing control to cause the DB update control means to function before the train departs from a section; is an on-vehicle device.

[0015] According to a fourth invention, it becomes possible for the train to depart after updating the on-vehicle DB regarding the section to be traveled to the latest DB.

Brief Description of the Drawings

[0016] [Figure 1] Configuration example of a train control system. [Figure 2] Configuration example of a management device and an on-vehicle device. [Figure 3] Overview diagram of the on-board database update process. [Figure 4] Diagram explaining whether or not the onboard database needs to be updated. [Figure 5] Diagram illustrating the latest database update. [Figure 6] Diagram illustrating the verification of received data. [Figure 7] Diagram illustrating the verification of non-failsafe devices. [Figure 8] Example of a functional configuration for on-board equipment. [Modes for carrying out the invention]

[0017] Preferred embodiments of the present invention will be described below with reference to the drawings. However, the applicable forms of the present invention are not limited to the following embodiments. Furthermore, in the drawings, the same elements are denoted by the same reference numerals.

[0018] This embodiment is an example of applying the present invention to an on-board device that controls the running of a train, which is an example of control for the safety of train operation.

[0019] Figure 1 is a schematic diagram of the train control system in this embodiment. The train control system 1 in this embodiment is an on-board type wireless train control system and comprises a management device 3 installed on the ground and an on-board device 7, which is a local device mounted on the train 5. The management device 3 and the on-board device 7 are connected via wireless communication over a public communication line.

[0020] The control device 3 controls each train 5 by communicating wirelessly with each onboard device 7, and also manages the latest DB60, which is the latest version of the onboard DB42.

[0021] The onboard device 7 communicates wirelessly with the management device 3 to perform control of the train 5's movement, which is the control for the operation safety of the train 5, using the onboard DB 42, which is a local DB, and also performs the process of updating the onboard DB 42 to the latest DB 60. The onboard DB 42 is a database that stores information necessary for performing movement control, such as track information and information on the vehicle performance of the train 5.

[0022] As shown in Figure 2, the management device 3 and the on-board device 7 each include a fail-safe device 10 (10a, 10b), which is a fail-safe function unit, and a non-fail-safe device 50 (50a, 50b), which is a non-fail-safe function unit. The fail-safe device 10 is a device in which the soundness and safety of the calculation process are guaranteed by having all of its internal calculation circuits duplicated and matching of calculation results is performed, and therefore the amount of calculation per unit time is lower than that of the non-fail-safe device 50. For this reason, if all data-intensive processes such as updating the on-board DB 42 are performed by the fail-safe device 10, the processing load becomes high and it takes a relatively long time. On the other hand, if all the processing related to updating the on-board DB 42 is performed by the non-fail-safe device 50, the processing time can be shortened, but the soundness of the data in the updated on-board DB 42 is not guaranteed. Therefore, this embodiment achieves a process in which both the fail-safe device 10 and the non-fail-safe device 50 function organically, thereby enabling the updating of the on-board DB 42 with a low processing load while ensuring the integrity of the data.

[0023] The fail-safe device 10 performs control for the safety of train operation and controls wireless communication with external devices (such as the management device 3 and onboard device 7) via the public communication line. Specifically, the fail-safe device 10a of the management device 3 controls each train and manages the latest DB60. The fail-safe device 10b of the onboard device 7 controls the running of its own train 5 using the onboard DB42 and performs update processing for the onboard DB42. The public communication line is a non-fail-safe communication line.

[0024] The non-failsafe device 50 generates coded information by performing a coded generation process on given information. The coded generation process is, for example, encryption using an encryption key or hash coding using a hash function. The encryption key and hash function to be used for the coded generation process are shared in advance between the management device 3 and the on-board device 7. Therefore, the coded information generated by the coded generation process on the same information in both the management device 3 and the on-board device 7 will be the same.

[0025] This section explains the update process for the on-board DB42. Figure 3 is a diagram illustrating the general flow of the series of processes related to updating the on-board DB42 (on-board DB update process). Figure 4 focuses on the determination of whether or not the on-board DB42 needs to be updated during the on-board DB update process, and Figure 5 focuses on the verification of the latest received DB60 (received DB) during the on-board DB update process, highlighting the flow of data (information) in each case. In Figures 3 to 5, circled numbers indicate the execution order of the processes. The circled numbers in Figures 3 to 5 correspond to each other, and in Figures 4 and 5, the same circled number as in Figure 3 is executed in the process corresponding to the circled number in Figure 3.

[0026] The onboard DB update process is primarily performed by the fail-safe device 10b of the onboard device 7, and is initiated, for example, at the time when the train 5 departs the depot. First, in Figure 3, the fail-safe device 10b of the onboard device 7 requests the management device 3 to transmit the latest DB code information in order to determine whether or not an update of the onboard DB 42 is necessary (update requirement) (1). In response to this request, the management device 3 transmits the latest DB code information to the onboard device 7 (2). Specifically, as shown in Figure 4, the fail-safe device 10a of the management device 3 causes the non-fail-safe device 50a to perform the code generation process for the latest DB 60, and transmits the generated code information, the latest DB code information, to the onboard device 7. This latest DB code information can be said to be information corresponding to the version information of the latest DB 60.

[0027] Returning to Figure 3, the on-board device 7 determines whether the on-board DB 42 needs to be updated based on the latest DB code information received from the management device 3 (3). Specifically, as shown in Figure 4, the fail-safe device 10b of the on-board device 7 causes the non-fail-safe device 50b to perform the code generation process for the on-board DB 42, and determines whether the on-board DB 42 needs to be updated based on the similarity or difference between the generated code information, which is the on-board DB code information, and the latest received DB code information. If the two match, it is determined that the on-board DB 42 is identical to the latest DB 60 and therefore does not need to be updated; if the two do not match (are different), it is determined that they are not identical and therefore need to be updated. The latest received DB code information is also stored in the storage unit 40.

[0028] Returning to Figure 3, if the on-board device 7 determines that an update is necessary, it requests the management device 3 to send the latest DB (4). In response to this request, the management device 3 sends the latest DB 60 to the on-board device 7 (5), and the on-board device 7 receives and stores the transmitted latest DB (6). Specifically, as shown in Figure 5, the fail-safe device 10a of the management device 3 sequentially sends each of the divided data from the latest DB 60 to the on-board device 7 (5). Meanwhile, the fail-safe device 10b of the on-board device 7 stores the divided data received sequentially from the management device 3 in the storage unit 40 (6).

[0029] Returning to Figure 3, the on-board device 7 verifies the received DB 46 stored in the storage unit 40 (7) and then updates the on-board DB 42 (8). Specifically, as shown in Figure 5, once all the segmented data has been received from the management device 3 and stored in the storage unit 40 (6), these segmented data are combined to form the received DB 46, and the non-failsafe device 50b is instructed to perform the code generation process for this received DB 46. Then, a pass / fail determination (verification) is made based on the similarity or difference between the generated code information, which is the verification code information, and the latest DB code information stored in the storage unit 40 (7). If the two match, it is determined that the latest DB 60 was received successfully and the device passes; if they do not match, it is determined that a reception error occurred with the latest DB 60 and the device fails. If the on-board device 7 determines that the device passes, it updates the on-board DB 42 with the received DB 46 (which can also be called the latest DB 60) (8).

[0030] Furthermore, communication between the management device 3 and the on-board device 7 via the public communication line is verified step by step. Although omitted in Figures 3 to 5 above, verification (confirmation of integrity) of received data is performed during communication between the management device 3 and the on-board device 7 via the public communication line, as shown in Figure 6. This verification of received data is performed for all data transmission and reception between the management device 3 and the on-board device 7 via the public communication line. For example, it is performed for each individual message in transmission and reception, such as requests for the latest DB code information and the latest DB from the on-board device 7 to the management device 3, and requests for the latest DB code information and each segmented data of the latest DB60 from the management device 3 to the on-board device 7.

[0031] Figure 6 shows a case where a given message is transmitted from the transmitting device to the receiving device, with the transmitting device on the left and the receiving device on the right.

[0032] First, the transmitting device has the fail-safe device 10 send the message to the receiving device. The non-fail-safe device 50 then performs code generation processing on this message to generate code information, which is the transmitting communication verification code information, and sends the generated transmitting communication verification code information to the receiving device.

[0033] When the receiving device receives the message and the code information for verifying the transmitting side's communication from the transmitting device, it has the non-failsafe device 50 perform a code generation process for the received message and determines whether the generated code information, which is the receiving side's communication verification code information, matches the received transmitting side's communication verification code information. If they match, it is determined that the message has been received successfully and that the acquisition of the message is complete.

[0034] For example, when the latest DB code information is transmitted from the management device 3 to the on-board device 7, the management device 3 is the transmitting device, the on-board device 7 is the receiving device, and the latest DB code information becomes the message. Then, the management-side communication verification code information generated by the code generation process for the latest DB code information in the management device 3 becomes the transmitting-side communication verification code information, and the local-side communication verification code information generated in the on-board device 7 becomes the receiving-side communication verification code information.

[0035] Next, the verification of the non-failsafe device 50 will be explained. The failsafe devices 10 of the management device 3 and the on-board device 7 perform verification (confirmation of normality) as shown in Figure 7 before allowing the non-failsafe device 50 to perform code generation processing. The verification performed by the failsafe device 10 is performed for all code generation processing performed by the non-failsafe device 50. For example, it is performed when generating the latest DB code information for the latest DB 60 in the management device 3, generating on-board DB code information for the on-board DB 42 in the on-board device 7, and generating verification code information for the latest DB 60 received by the on-board device 7. It is also performed when generating transmitting communication verification code information for messages in the transmitting device of the management device 3 and the on-board device 7, and when generating receiving communication verification code information for received messages in the receiving device.

[0036] As shown in Figure 7, the fail-safe device 10 of the management device 3 or the on-board device 7 causes the non-fail-safe device 50 to perform code generation processing on given information and obtains the generated code information. It also causes the non-fail-safe device 50 to perform code generation processing on a message for which the code information is known, and determines whether the generated verification code information matches the known code information of the message. If they match, it is determined that the fail-safe device 10 is operating normally and that the acquisition of code information for the given information is complete.

[0037] Figure 8 shows an example of the functional configuration of the on-board device 7. According to Figure 8, the on-board device 7 includes a fail-safe device 10b and a non-fail-safe device 50b, and is implemented as a type of computer system. The on-board device 7 may be implemented as a single device, or it may be configured by connecting multiple devices.

[0038] The fail-safe device 10b has, as functional units, a driving control unit 12, a communication control unit 14, a DB update control unit 20, and a storage unit 40.

[0039] The running control unit 12 controls the running of its own train 5 using the onboard DB 42.

[0040] The communication control unit 14 controls wireless communication with external devices such as the management device 3 via a public communication line.

[0041] The DB update control unit 20 controls the updating of the onboard DB 42, which is a local DB stored in the memory unit 40. This update is performed, for example, before the train departs the depot. The DB update control unit 20 also includes a latest DB code information acquisition unit 22, an update necessity determination unit 24, a latest DB acquisition unit 26, a verification code information generation unit 28, and an update unit 30.

[0042] The latest DB code information acquisition unit 22 acquires the latest DB code information, which has undergone code generation processing for the latest DB 60, from the management device 3. Specifically, it receives the latest DB code information and the management-side communication verification code information, which has undergone code generation processing for the latest DB code information, from the management device 3. It then has the non-failsafe device 50b perform code generation processing on the received latest DB code information to generate local-side communication verification code information. Based on the similarity or difference between the management-side communication verification code information and the local-side communication verification code information, if the result of the pass / fail judgment is successful, the acquisition of the received latest DB code information is considered complete.

[0043] In other words, in order to determine whether or not the onboard DB42 needs to be updated (update requirement), the system requests the management device 3 to transmit the latest DB code information. The system then receives the latest DB code information transmitted from the management device 3 in response to this request, as well as the management-side communication verification code information generated by the code generation process for the latest DB code information. Next, the system has the non-failsafe device 50b perform the code generation process for the received latest DB code information, and determines whether the generated code information, the local-side communication verification code information, matches the received management-side communication verification code information. If they match, the system determines that the latest DB code information has been successfully received and that the acquisition of the latest DB code information is complete (see Figure 4).

[0044] The update necessity determination unit 24 determines whether the on-board DB 42 needs to be updated based on the differences between the local DB code information generated by the code generation process for the on-board DB 42, which is a local DB, and the latest DB code information obtained by the latest DB code information acquisition unit 22.

[0045] Specifically, the non-failsafe device 50b is instructed to perform the code generation process for the on-board DB 42, and it is determined whether the generated code information, the on-board DB code information, matches the received latest DB code information. If they match, it is determined that the on-board DB 42 is identical to the latest DB 60 and does not need to be updated; if they do not match (are different), it is determined that they are not identical and therefore need to be updated. The received latest DB code information is also stored in the storage unit 40 (see Figure 4).

[0046] The latest database acquisition unit 26 acquires the latest database from the management device 3 if the update necessity determination unit 24 determines that an update is necessary.

[0047] In other words, a request is made to the management device 3 to send the latest DB60. In response to this request, the latest DB60 is sequentially sent from the management device 3, and the divided data is received, and each of the received divided data is stored in the storage unit 40 (see Figure 5).

[0048] The verification code information generation unit 28 generates verification code information by having the non-failsafe device 50b perform code generation processing on the latest DB acquired by the latest DB acquisition unit 26.

[0049] In other words, once all the segmented data obtained by dividing the latest DB60 transmitted from the management device 3 has been received, the non-failsafe device 50 is instructed to perform a code generation process on the received DB46, which is the data obtained by combining these segmented data, and generates verification code information, which is the code information (see Figure 4).

[0050] The update unit 30 determines whether the latest DB code information obtained by the latest DB code information acquisition unit 22 is correct or incorrect based on the differences between the latest DB code information obtained by the latest DB code information acquisition unit 22 and the verification code information generated by the verification code information generation unit 28. If the result is correct, the update unit 30 updates the stored data in the storage means with the latest DB obtained by the latest DB acquisition unit 26 as the new local DB.

[0051] In other words, it is determined whether the latest DB code information stored in the memory unit 40 matches the verification code information generated by the verification code information generation unit 28. If they match, it is determined that the latest DB 60 was received successfully, and the on-board DB 42 is updated with the received DB (latest DB 60). If they do not match, it is determined that there was a reception error with the latest DB 60, and the system fails.

[0052] The memory unit 40 stores the on-board DB 42, the on-board DB code information 44, and the received DB 46.

[0053] The non-failsafe device 50b has a code generation processing unit 52.

[0054] The code generation processing unit 52 generates coded information for given information by performing a predetermined code generation process on the given information.

[0055] According to this embodiment, it is possible to update the on-board DB 42, which is a local DB using a public communication line, with a low processing load while ensuring the integrity of the received data. In the on-board device 7, which is a local device, the fail-safe device 10b ensures the safety of processing by performing communication with the management device 3 via the public communication line, such as acquiring the latest DB code information and the latest DB, as well as processing such as determining whether the on-board DB 42 needs to be updated and updating the on-board DB 42. By having the non-fail-safe device 50b perform the encoding processing, which has a high processing load, it is possible to ensure the integrity of the latest DB 60 acquired from the management device 3 via the public communication line. Furthermore, by using the latest DB code information acquired from the management device 3 to determine whether the on-board DB 42 needs to be updated and to perform a pass / fail judgment on the latest DB 60 acquired from the management device 3, it is possible to reduce the processing load required for transmission and reception.

[0056] It should be noted that the applicable embodiments of the present invention are not limited to those described above, and can be modified as appropriate without departing from the spirit of the invention.

[0057] (A) Local device In the above-described embodiment, an example was explained in which a local device that performs control for the safety of train operation is applied to an on-board device that controls the movement of a train using an on-board DB. However, the same can be applied to other devices such as level crossing control devices and switch control devices. [Explanation of Symbols]

[0058] 1…Train control system 3…Management device 10a(10)... Fail-safe device 60…Latest DB 50a(50)...Non-fail-safe device 7...Onboard equipment 10b(10)...Fail-safe device 12…Traction Control Unit 14…Communication Control Unit 20…DB update control unit 22…Latest DB code information acquisition unit 24…Update necessity determination unit 26…Latest DB acquisition part 28...Verification code information generation unit 30…Update section 40...Storage section 42…Onboard DB 44…Latest DB code information 46...Received DB 50b(50)...Non-fail-safe device 52... Code generation processing unit 5... Train

Claims

1. A local device comprising a fail-safe function unit that performs control for the safety of train operation using a local database (hereinafter, the database is referred to as "DB"), and a non-fail-safe function unit that performs a predetermined code generation process on given information to generate coded information for said given information, and a local device that can communicate via a public communication line with a management device that manages the latest DB, which is the latest version of the local DB, The aforementioned fail-safe function unit is A storage means for storing the aforementioned local DB, DB update control means for controlling updates to the local DB stored in the storage means, Equipped with, The DB update control means is Latest DB code information acquisition means for acquiring the latest DB code information obtained from the management device after performing the code generation process on the latest DB, A means for determining whether or not to update the local DB, which determines whether or not to update the local DB based on the differences between the local DB code information obtained by the latest DB code information acquisition means and the local DB code information obtained by the latest DB code information acquisition means. If the update requirement determination means determines that an update is required, the latest DB acquisition means acquires the latest DB from the management device, Verification code information generation means generates verification code information by causing the non-failsafe function unit to perform the code generation process on the latest DB acquired by the latest DB acquisition means, Based on the results of a pass / fail determination based on the differences between the latest DB code information obtained by the latest DB code information acquisition means and the verification code information generated by the verification code information generation means, if the result is a pass, the update means updates the stored data of the storage means with the latest DB obtained by the latest DB acquisition means as a new local DB, Having, Local device.

2. The aforementioned latest DB code information acquisition means is The management device receives the latest DB code information and the management-side communication verification code information obtained by performing the code generation process on the latest DB code information. The code generation process for the latest received DB code information is performed by the non-failsafe function unit to generate code information for local-side communication verification. Based on the results of the pass / fail determination using the differences between the management-side communication verification code information and the local-side communication verification code information, if the result is a pass, the acquisition of the latest received DB code information will be considered complete. To do The local device according to claim 1.

3. An on-board device which is a local device according to claim 1 or 2, which controls the running of a train using the local DB.

4. The DB update control means is controlled to function before the train departs the depot. The on-board device according to claim 3.

5. A DB update control method for a local device comprising a fail-safe function unit that performs control for train operation safety using a local database (hereinafter, the database is referred to as "DB"), and a non-fail-safe function unit that performs a predetermined code generation process on given information to generate coded information for said given information, and which can communicate via a public communication line with a management device that manages the latest DB, which is the latest version of the local DB, The fail-safe function unit includes storage means for storing the local DB, The aforementioned fail-safe function unit, The latest DB code information obtained from the management device after performing the code generation process on the latest DB, Based on the differences between the local DB code information obtained by the code generation process for the local DB and the latest DB code information obtained, it is determined whether or not the local DB needs to be updated. If the determination of whether or not an update is necessary is made, the latest DB is obtained from the management device. The code generation process for the latest DB obtained from the management device is performed by the non-failsafe function unit to generate verification code information, Based on the results of the pass / fail determination, which is determined by the differences between the latest DB code information obtained from the management device and the generated verification code information, if the result is a pass, the latest DB obtained from the management device is used as the new local DB to update the data stored in the storage means. Execute DB update control method.

Images