Patent Grant
9536076
This disclosure relates generally to automatic train operation and, more specifically, to a system and method for verifying software to be used as part of an automatic train operation system.
A goal of automatic train operation systems is to eliminate the need for an operator aboard the locomotive. Automatic train operation systems may integrate multiple control systems with an end result of driverless operation of the locomotive. The system must be accompanied by proven safety cases and software validation. As such, only specific, approved combinations of control system software will be allowed to be used. There exists a need for a method of enforcing the required software combinations onboard the locomotive.
One proposed implementation of software validation is described in U.S. Patent Application Publication No. 2014/036851 A1 (“the '851 publication”). The train information managing apparatus of the '851 publication operates according to predetermined control software. Software is also used in the devices in other cars that are communicatively connected to the central train information managing apparatus, which runs the control software. Train information managing apparatuses each include a plurality of pieces of control software of versions different from each other. When functions related to each other in the control software of the train information managing apparatus and the software used in the devices are improved, it is necessary to simultaneously update the control software and the software of the devices. The train information managing apparatus compares version information of software for all devices in a formation and version correspondence information included in each of the plurality of pieces of control software. Then, the train information managing apparatus discriminates control software including version correspondence information consistent with the version information of the software for all the devices in the formation. When the discriminated, or preferred, control software is different from already-started control software, the train information managing apparatus selects and starts the discriminated control software, and transmits a switching command for switching from the already-started control software to the discriminated control software to all of the devices in the formation.
The method and system provided by the '851 publication may be subject to a number of possible drawbacks. For example, the method and system of the '851 publication only provides for version control of the same type of software running on different devices. It does not provide a means of coordinating multiple versions of multiple types of software running on different subsystems within a larger system. Further, it does not provide a mechanism for verifying the proper software prior to operating the locomotive. There is no safety mechanism in place to prevent the locomotive from running if it is using unauthorized software.
The presently disclosed systems and methods are directed to overcoming one or more of the problems set forth above and/or other problems in the art.
In one aspect, this disclosure is directed to an automatic train operation system. The automatic train operation system may include a first control system configured to run a first software for controlling a first vehicle subsystem and a second control system configured to run a second software for controlling a second vehicle subsystem. The automatic train operation system may also include a software verification controller. The software verification controller may be configured to identify a first identifier of the first software and a second identifier of the second software as a software configuration and determine whether the software configuration is preapproved. The software verification controller may also be configured to, if the software configuration is preapproved, authorize the first control system and the second control system to run the first and second software.
According to another aspect, this disclosure is directed to vehicle including a first vehicle subsystem and a second vehicle subsystem. The vehicle may include a first control system configured to run a first software for controlling the first vehicle subsystem. The vehicle may also include a second control system configured to run a second software for controlling the second vehicle subsystem. The vehicle may also include a software verification controller configured to identify a first identifier of the first software and a second identifier of the second software as a software configuration. The software verification controller may be configured to determine whether the software configuration is preapproved and, if the software configuration is preapproved, authorize the first control system and the second control system to run the first and second software.
According to another aspect, this disclosure is directed to method for verifying a software configuration. The method may include identifying a first identifier of a first software to be run on a first system and a second identifier of a second software to be run on a second system as the software configuration. The method may include determining whether the software configuration is present in a first database and a second database. The method may also include, if the software configuration is present in both the first database and the second database, authorizing the first system and the second system to operate.
Reference will now be made in detail to the exemplary embodiments implemented according to the disclosure, the examples of which are illustrated in the accompanying drawings. Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts.
Automatic train operation system 200 may include a plurality of control systems to control subsystems of locomotive 100. For example, automatic train operation system 200 may include a first control system 210 configured to run a first software 220. First control system 210 may be configured to control a system of locomotive 100, such as first vehicle subsystem 250. Automatic train operation system 200 may also include a second control system 230 configured to run a second software 240 for controlling a second vehicle subsystem 260. First control system 210 and second control system 230 may control a variety of locomotive subsystems, including, for example, systems for dynamic braking, air brakes, throttle, propulsion, cooling, power, monitoring, communication, and user interface. For example, first vehicle subsystem 250 may be braking system 130 and/or engine system 140.
For each type of first control system 210, there may be multiple types and multiple versions of first software 220 that first control system 210 may run. First software 220 may have a first identifier that includes the type and/or version of first software 220. Similarly, second software 240 may have a second identifier that includes the type and/or version of second software 240. Different combinations of first software 220 and second software 240 may be tested for operability and safety. For example, prior testing may have confirmed the operability and safety of a combination of version 2.0 of first software 220 with version 2.5 of second software 240. It may be desirable to permit only preapproved combinations of software to run on locomotive 100. A software verification controller 270 may be configured to confirm the combination of first software 220 and second software 240, also referred to as the software configuration, is preapproved prior to allowing locomotive 100 to operate.
During testing and/or system design, different software configurations may have been tested and confirmed safe for real-world application. It may be advantageous to keep track of software configurations that have been approved. This information may be stored in a database 280. Optionally, database 280 may also store software configurations that have been rejected. Software verification controller 270 may use database 280 to verify a software configuration.
According to some embodiments, software verification controller 270 may be configured to determine a first identifier of first software 220 and a second identifier of second software 240 as a software configuration. As discussed above, the first identifier and the second identifier may refer to the type and/or version of first software 220 and second software 240, respectively. This may include querying first control system 210 and second control system 230 to determine the first identifier and the second identifier. Additionally or alternatively, software verification controller 270 may determine the software configuration based on data received from a locomotive control system 290. Software verification controller 270 may communicate with, and/or be a part of, locomotive control system 290.
Software verification controller 270 may also be configured to determine whether the software configuration is preapproved. This may include, for example, determining whether the software configuration matches an entry in database 280 of preapproved software configurations. Additionally or alternatively, this may include querying other systems associated with locomotive 100, including a back office, locomotive control system 290, or any other signaling system containing data regarding the preapproved configurations of first software 220 and second software 240. To determine if the software configuration is preapproved, software verification controller 270 may be configured to crosscheck a plurality of sources. For example, software verification controller 270 may be configured to check a plurality of databases 280 of preapproved software configurations. Further, software verification controller 270 may be configured to determine that the software configuration is not preapproved if the software configuration is not included in each of the plurality of databases 280. For example, software verification controller 270 may check three databases 280 and conclude that the software configuration is preapproved only if the software configuration is included in all three databases 280.
Software verification controller 270 may be configured to authorize first control system 210 and second control system 230 to run first software 220 and second software 240, respectively, if the software configuration is preapproved. Software verification controller 270 may be configured to do this by communicating an authorization signal to locomotive control system 290. Additionally or alternatively, software verification controller 270 may communicate the approval of the software configuration directly to first control system 210 and/or second control system 230. If software verification controller 270 determines that the software configuration is not preapproved, software verification controller 270 may be configured to send a signal indicating verification failure. For example, software verification controller 270 may communicate this information to first control system 210, second control system 230, locomotive control system 290, and/or a back office system associated with locomotive 100.
At step 320, software verification controller 270 may be configured to determine whether the software configuration is present in first database 280 and second database 280. As discussed above, databases 280 may include preapproved software configurations. If the software configuration is present in both first database 280 and second database 280, at step 330 software verification controller 270 may authorize first control system 210 and second control system 230 to operate. Additionally or alternatively, software verification controller 270 may authorize first vehicle subsystem 250 and second vehicle subsystem 260 to operate. If the software configuration is not present in both first database 280 and second database 280, at step 340, software verification controller 270 may prevent locomotive 100 including first vehicle subsystem 250 and second vehicle subsystem 260 from operating. Depending on the function of first vehicle subsystem 250 and second vehicle subsystem 260, it may be dangerous to operate at least some other systems of locomotive 100. Thus, software verification controller 270 may prevent other systems besides first vehicle subsystem 250 and second vehicle subsystem 260 from operating if the software configuration for first vehicle subsystem 250 and second vehicle subsystem 260 is not preapproved.
Optionally, if the software configuration is not in both first database 280 and second database 280, method 300 may include displaying the software configuration and at least one preapproved configuration of first database 280. For example, this may include displaying the preapproved configuration that is closest or most similar to the software configuration. Additionally or alternatively, this may include displaying the software configuration and at least one preapproved software configuration from one of the first and second databases that is identified as an acceptable substitute for the software configuration. A user or operator may use this information to change first software 220 and/or second software 240 so that software configuration matches the displayed preapproved configuration.
Embodiments herein include computer-implemented methods, systems, and user interfaces. The computer-implemented methods may be executed, for example, by at least one processor that receives instructions from a non-transitory computer-readable storage medium. Similarly, systems consistent with the present disclosure may include at least one processor and memory, and the memory may be a non-transitory computer-readable storage medium. As used herein, a non-transitory computer-readable storage medium refers to any type of physical memory on which information or data readable by at least one processor may be stored. Examples include random-access memory (RAM), read-only memory (ROM), volatile memory, nonvolatile memory, hard drives, CD ROMs, DVDs, flash drives, disks, and any other known physical storage medium. Singular terms, such as “memory” and “computer-readable storage medium,” may additionally refer to multiple structures, such a plurality of memories and/or computer-readable storage mediums. As referred to herein, a “memory” may include any type of computer-readable storage medium unless otherwise specified. A computer-readable storage medium may store instructions for execution by at least one processor, including instructions for causing the processor to perform steps or stages consistent with embodiments herein. Additionally, one or more computer-readable storage mediums may be utilized in implementing a computer-implemented method. The term “computer-readable storage medium” should be understood to include tangible items and exclude carrier waves and transient signals.
The disclosed systems and methods provide a robust solution for verifying software to be used for automatic train operation. The presently disclosed systems and methods may have several advantages over other attempted solutions. For example, the disclosed systems and methods provide a verification system for addressing different combinations of software where the version and software type to be run on different subsystems differ from one another. This allows for the safe operation of vehicles including multiple types of systems by verifying not only the individual systems but also the specific combination of these systems prior to operation of the vehicle. Further, the disclosed systems and methods provide a protection against operation of the vehicle itself if even a subset of the software configuration is not preapproved. This ensures safety by preventing a vehicle from operating under untested conditions.
It will be apparent to those skilled in the art that various modifications and variations can be made to the automatic train operation software verification systems and associated methods for operating the same. Other embodiments of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the present disclosure. It is intended that the specification and examples be considered as exemplary only, with a true scope of the present disclosure being indicated by the following claims and their equivalents.
| Number | Name | Date | Kind |
|---|---|---|---|
| 6580975 | Lovelace, II et al. | Jun 2003 | B2 |
| 6647356 | Pierro et al. | Nov 2003 | B2 |
| 6876907 | Kanner et al. | Apr 2005 | B2 |
| 7133756 | Jammu et al. | Nov 2006 | B2 |
| 7188341 | Hawthorne et al. | Mar 2007 | B1 |
| 7280013 | Lewis | Oct 2007 | B2 |
| 7908047 | Smith et al. | Mar 2011 | B2 |
| 8364338 | Peltonen et al. | Jan 2013 | B2 |
| 8655505 | Sprock et al. | Feb 2014 | B2 |
| 8868267 | Deitz et al. | Oct 2014 | B2 |
| 20080244555 | Welvaert et al. | Oct 2008 | A1 |
| 20100029209 | Daum et al. | Feb 2010 | A1 |
| 20100204856 | Smith et al. | Aug 2010 | A1 |
| 20120123617 | Noffsinger et al. | May 2012 | A1 |
| 20130113579 | Barnas et al. | May 2013 | A1 |
| 20130179689 | Matsumoto | Jul 2013 | A1 |
| 20140059534 | Daum | Feb 2014 | A1 |
| 20140117167 | Donnelly, III | May 2014 | A1 |
| 20140336851 | Kadono et al. | Nov 2014 | A1 |
| 20150006443 | Rose | Jan 2015 | A1 |
| 20150012750 | Matsumoto | Jan 2015 | A1 |
| 20160098561 | Keller | Apr 2016 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 20160306960 A1 | Oct 2016 | US |
