Secure Operator Station Computer Mediator Architecture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing railway track system control arrangements lack a cost-effective method to ensure a high safety standard, particularly when using insecure operator station computers for generating safety-critical commands, as they may bypass safety checks and lead to dangerous situations.
Innovation Solution
Implementing a secure operator station computer connected via a secure data connection to an interlocking computer, with insecure computers transmitting commands indirectly through the secure one, ensuring plausibility and executability checks before implementation, and using redundant memory areas and a comparison module to maintain data consistency and accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If insecure operator station computers are used to generate safety-critical commands, then cost is reduced and ease of operation is improved, but safety reliability deteriorates because they may bypass safety checks
Solution Approach 1:
A secure operator station computer is introduced as an intermediary between the insecure operator station computer and the interlocking computer. The secure computer receives commands from the insecure computer, performs safety checks, and only forwards validated commands to the interlocking computer. This mediator architecture allows the system to use cost-effective insecure computers for the operator interface while maintaining high safety standards through the secure computer's verification processes.
2Device complexity
If insecure operator station computers are connected directly to the interlocking computer, then device complexity is reduced, but safety reliability deteriorates due to inability to perform plausibility checks
Solution Approach 1:
The secure operator station computer serves as a mandatory intermediary in the communication path between the insecure operator station computer and the interlocking computer. All commands generated by insecure computers must pass through the secure computer, which performs plausibility and safety checks before forwarding to the interlocking computer. This indirect connection structure adds a verification layer without significantly increasing overall system complexity.
3Adaptability or versatility
If multiple operator station computers are used with different security levels, then adaptability is improved, but device complexity increases due to indirect connections and verification processes
Solution Approach 1:
The operator station computers are segmented into different security levels (secure and insecure), with each type having specific functions. Insecure computers handle operator interaction and display, while secure computers handle safety-critical command validation. This segmentation allows the system to use cost-effective insecure computers for non-critical functions while maintaining high security where needed, balancing adaptability with manageable complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to an assembly (10) for controlling a technical system (20), in particular a railway track system, wherein the assembly (10) comprises a signal box computer (25), which can trigger a switchover of the technical system (20), and at least two operating station computers (30, 40, 50), by means of which operating commands (BB) can be produced and transmitted to the signal box computer (25). According to the invention, of the operating station computers (30, 40, 50), at least one operating station computer (30) is a secure operating station computer (30) having a security level that reaches a predefined minimum standard, and at least one operating station computer (40, 50) is an insecure operating station computer (40, 50) having a security level that is below the predefined minimum standard, the secure operating station computer (30) is connected to the signal box computer (25) by means of a secure data connection (200) that guarantees predefined transmission security, and the at least one insecure operating station computer (40, 50) is connected to the signal box computer (25) indirectly, specifically by means of the secure operating station computer (30), and the operating commands (BB) of the insecure operating station computer (40, 50) are transmitted to the secure operating station computer (30) and, by means of the secure operating station computer and the secure data connection (200), to the signal box computer (25).