DE102021203010A1 - Safety monitoring method for a guided vehicle - Google Patents

Abstract

The invention relates to a method (100) for security monitoring for a track-guided vehicle provided, the method (100) comprising: - Receiving (101) a safety-related message (207) (207), the safety-related message (207) for the track-guided Vehicle safety-related event (209) indicates; - Activating (103) a timer function (T) for a predetermined period of time upon receipt of the safety-related message (207); - Processing (105) the safety-related message (207) and deciding whether based on a corresponding security action (Out1, Out2,..., OutN) is to be triggered for the security-relevant message; and- resetting (107) the timer function (T) before the predetermined period of time has elapsed if, based on the processing of the security-related message (207), it has been decided that no security action (Out1, Out2,..., OutN) is to be triggered; or- triggering (109) the security action (Out1, Out2,..., OutN) before the predetermined period of time has elapsed, if it is decided based on the processing of the security-related message (207) that a security action (Out1, Out2,... , OutN) is to be triggered; or- automatic triggering (111) of the safety action (Out1, Out2,..., OutN) when the predetermined period of time of the timer function (T) has elapsed, if the safety action has not been triggered before the predetermined period of time has elapsed and the timer function ( T) is not reset.

Description

The invention relates to a safety monitoring method for a track-guided vehicle.

Many safety-relevant systems, especially in the rail transport sector, have to perform certain tasks continuously (i.e. regularly with defined maximum time intervals) and typically react to specific, especially external events/changes within a defined period of time. These periods of time are generally in the seconds or subseconds range.

In particular, such systems must reliably monitor compliance with the time specifications and trigger a security reaction if they are exceeded. Due to higher speeds, faster reaction times, higher information density, diverse spontaneous events and more complex calculations, it is becoming increasingly difficult to reliably adhere to the time periods. At the same time, other monitoring mechanisms for detecting spontaneous errors require significant portions of the available computing power. In the onboard area in particular, there are physical limits to the increase in computing power due to the environment.

The object of the invention is to provide an improved method for safety monitoring for a track-guided vehicle.

This object is achieved by a method for safety monitoring for a track-guided vehicle according to the independent claim. Advantageous configurations are specified in the dependent claims.

• - Empfangen einer sicherheitsrelevanten Nachricht, wobei die sicherheitsrelevante Nachricht ein für das spurgeführte Fahrzeug sicherheitsrelevantes Ereignis anzeigt;
• - Aktivieren einer Timer-Funktion für eine vorbestimmte Zeitdauer bei Empfang der sicherheitsrelevanten Nachricht, wobei die vorbestimmte Zeitdauer eine Zeitvorgabe für ein Ausführen einer Sicherheitsaktion erfüllt;
• - Verarbeiten der sicherheitsrelevanten Nachricht und Entscheiden, ob basierend auf der sicherheitsrelevanten Nachricht eine entsprechende Sicherheitsaktion auszulösen ist; und
• - Zurücksetzen der Timer-Funktion vor Ablauf der vorbestimmten Zeitdauer, falls basierend auf der Verarbeitung der sicherheitsrelevanten Nachricht entschieden ist, dass keine Sicherheitsaktion auszulösen ist; oder
• - Auslösen der Sicherheitsaktion vor Ablauf der vorbestimmten Zeitdauer, falls basierend auf der Verarbeitung der sicherheitsrelevanten Nachricht entschieden ist, dass eine Sicherheitsaktion auszulösen ist; oder
• - automatisches Auslösen der Sicherheitsaktion bei Ablauf der vorbestimmten Zeitdauer der Timer-Funktion, falls vor Ablauf der vorbestimmten Zeitdauer die Sicherheitsaktion nicht ausgelöst ist und die Timer-Funktion nicht zurückgesetzt ist.

According to one aspect of the invention, a method for safety monitoring for a guided vehicle is provided, the method comprising:

• - Receiving a safety-related message, the safety-related message indicating a safety-related event for the track-guided vehicle;
• - Activating a timer function for a predetermined period of time upon receipt of the security-related message, the predetermined period of time fulfilling a time specification for carrying out a security action;
• - processing the security-related message and deciding whether a corresponding security action is to be triggered based on the security-related message; and
• - Resetting the timer function before the end of the predetermined period of time if it is decided based on the processing of the security-related message that no security action is to be triggered; or
• - triggering the security action before the predetermined period of time has elapsed if it is decided based on the processing of the security-related message that a security action is to be triggered; or
• - automatic triggering of the security action when the predetermined time period of the timer function has expired if the security action is not triggered before the predetermined time period has elapsed and the timer function is not reset.

In this way, the technical advantage can be achieved that an improved method for safety monitoring for a track-guided vehicle can be provided, in which it can be ensured that in response to a safety-related message that indicates a corresponding safety-related event for the track-guided vehicle, within a predetermined Period of time causes a corresponding security action or can be executed. For this purpose, upon receipt of the security-relevant message, a timer function is activated, which provides that a corresponding security action is initiated when a predetermined period of time has elapsed. In addition, the received security-related message is processed at the same time, as is usual for security systems, and based on the respective security-related message, a decision is made as to whether a corresponding security action is to be carried out. If it is decided within the predetermined period of time of the timer function that no such safety action is to be carried out based on the safety-relevant message, the timer function can be reset and the safety action thus prevented from being carried out. If, on the other hand, it is decided within the predetermined period of time that a corresponding safety action is to be carried out, this can be initiated before the timer function expires, so that the safety action does not have to wait for the timer function to expire. In the event that the timer function was neither reset nor a corresponding safety action initiated before the predetermined time period of the timer function expired, a corresponding safety action is automatically initiated when the predetermined time period of the timer function expires. The method according to the invention thus makes it possible to ensure compliance with corresponding security specifications that provide for certain security-related Results are to be carried out within predetermined periods of time corresponding security actions. The execution of the corresponding security actions is thus decoupled from the processing of the security-relevant message by the method according to the invention, so that an execution of the corresponding security action that corresponds to the time requirements can be guaranteed even if the processing of the security-relevant message is not completed within the provided period of time corresponding to the security specifications can be. The decoupling can also ensure that the security actions are carried out within the predetermined time period, regardless of the computing capacities available for processing the security-relevant messages.

A track-guided vehicle can be a rail vehicle.

A predetermined period of time can be defined in particular by a point in time for carrying out the security action.

According to one specific embodiment, a period of time, starting from a point in time at which the security-related message was received and the expiry of the predetermined period of time of the timer function, meets the time specification for carrying out a security action.

As a result, the technical advantage can be achieved that it is possible to meet the security specifications for carrying out corresponding security actions. The period of time set in motion by activating the timer function is set up in such a way that a period of time between receipt of the security-related message and execution of the corresponding security action satisfies the respective security requirements. For example, the predetermined period of time can be defined in such a way that when a beacon element is run over, a corresponding safety action can be triggered within the time provided for such events from a safety point of view.

A predetermined period of time for the timer function can be given in the sense of the application by a period of time between the time at which the safety-related message is received and the safety action being triggered. For this purpose, time periods required for the data communication of the signals and messages to be transmitted in each case can be taken into account in the predetermined time period.

According to one embodiment, the security-related message is processed by a processing module, with the timer function and the triggering of the security action being performed by an output module that is implemented separately from the processing module.

As a result, the technical advantage can be achieved that improved traceability of the individual functions of the security monitoring can be provided. By separating the processing of the security-related message and the execution of the timer function or the triggering of the security action is effected, a review of the functionality of both the processing of security-related messages by the processing module as well as the execution of the timer function or the Triggering of the security action facilitated by an output module running separately from the processing module. Functionality or compatibility of the individual processing functions with one another can be facilitated and verified, particularly in the case of a plurality of different processing functions executed by the processing module for processing different security-relevant messages. In addition, the separation of the processing of the security-relevant messages and the timer function or the triggering of the security action provides simplified scalability of the various processing functions, in that the security action is triggered independently of the respective processing function and exclusively from the respective time specifications of the correspondingly recognized security-related events. In particular, the processing functions are characterized exclusively by the respective security-relevant message to be processed or the task to be processed, and distribution of a computation-intensive processing function over a number of consecutive cycles in a cycle-oriented execution of the security monitoring can be neglected. In addition, with a cyclic execution of the safety monitoring, the processing by the processing functions can be started immediately and processing does not have to be completed within a processing cycle that has already started. As a result, more time is available for processing spontaneous safety-related events, which means that the performance of safety monitoring can be increased.

According to one embodiment, the activation of the timer function and/or the resetting of the timer function and/or the triggering of the security action are initiated by the processing module before the predetermined period of time has elapsed.

As a result, the technical advantage can be achieved that the timer function can be activated immediately upon detection of the security-related event described by the security-related message, so that the security-related time specifications can be met.

According to one embodiment, the safety-related message is received by a receiving module, with the timer function being activated automatically and immediately upon receipt of the safety-related message by the receiving module.

As a result, the technical advantage can be achieved that the timer function can be activated automatically immediately upon receipt of the safety-relevant message. As a result, the execution of a corresponding safety action can be guaranteed within the required, predetermined time period.

According to one embodiment, the activation of the timer function is associated with an identification message being issued by the output module, the resetting of the timer function being caused by the processing module exclusively when the identification message is specified.

As a result, the technical advantage can be achieved that the security requirements can be guaranteed when carrying out corresponding security actions. By assigning the detection message, it can be ensured that only the processing module or the processing function executed by the processing module, which is carried out with the processing of the corresponding safety-relevant message, is able to reset the timer function and thus allow the safety action to be carried out impede.

According to one embodiment, the predetermined period of time and/or the security action to be performed are/are determined by the processing module and/or by the receiving module and/or by the output module.

This can achieve the technical advantage that based on the security-related message or the described security-related event, the predetermined time duration of the timer function and the corresponding security action to be carried out can be determined by the processing module, the receiving module or the output module. This ensures increased flexibility of the security check.

According to one embodiment, the predetermined period of time is determined as a function of the security-related message and/or the security-related event.

As a result, the technical advantage can be achieved that improved safety monitoring can be provided, in which the predetermined time period available for carrying out corresponding safety actions can be individually adapted as a function of the detected safety-relevant events.

According to one embodiment, a plurality of timer functions for a plurality of different security actions are activated for the security-related message.

In this way, the technical advantage can be achieved that an improved security check can be provided. As a result, different security actions can be carried out for a security-relevant message and different timer functions can be activated for each of these. This enables a broad and flexible security concept.

According to one embodiment, a plurality of timer functions with a plurality of predetermined time periods are activated for a plurality of different security-related messages, the plurality of timer functions relating to the same security action, and the security action being triggered when one of the timer functions expires at the earliest , if the safety action is not triggered before the end of the predetermined time period of the timer function, which expires earliest, and the timer function is not reset.

In this way, the technical advantage can be achieved that a plurality of timer functions are activated for a plurality of different security-relevant messages and a plurality of security-relevant events described by them, for which the same security action is to be carried out in each case due to the type of the respective event. These can be operated with the same length of time or with different lengths of time. The respective security action can be activated when the earliest elapsing period of time expires, so that compliance with the security-related time requirements is ensured.

According to one specific embodiment, the safety-related message includes sensor data from a safety sensor system of the track-guided vehicle and/or telegram data from a vehicle controller.

In this way, the technical advantage can be achieved that the safety monitoring can take into account both safety-relevant events that were recognized based on corresponding sensor data from a safety sensor system and that were communicated to a vehicle controller by telegram data.

According to one embodiment, the safety sensor system comprises a speed sensor system and/or a beacon sensor system and/or a fire sensor system and/or a door sensor system and/or a drive power sensor system, with the sensor data indicating that a maximum speed has been exceeded and/or a fire location has been detected and/or a door blockage has been detected and/or exceeding a maximum drive power or falling below a minimum drive power, and/or wherein the telegram data includes a violation of a driving license and/or a refusal to allow the track-guided vehicle to travel on a specific rail route.

As a result, the technical advantage can be achieved that comprehensive safety monitoring can be provided, which can take into account safety-related events that occur during operation of a rail vehicle by carrying out suitable safety actions.

According to one specific embodiment, the safety action includes emergency braking of the track-guided vehicle and/or door release of doors of the track-guided vehicle and/or drive release or drive blocking of a drive of the track-guided vehicle.

As a result, the technical advantage can be achieved that safety monitoring can be provided, which can react to corresponding safety-related events with the safety actions relevant to the operation of track-guided vehicles.

According to a second aspect, a safety system for a track-guided vehicle is provided with a computing unit that is set up to execute the method for safety monitoring for a track-guided vehicle according to one of the preceding specific embodiments.

According to a third aspect, a computer program product is provided comprising instructions which, when the program is executed by a data processing unit, cause the latter to execute the method for safety monitoring for a track-guided vehicle according to one of the preceding embodiments.

• 1 eine schematische Darstellung eines Sicherheitssystems für ein spurgeführtes Fahrzeug gemäß einer Ausführungsform;
• 2 eine weitere schematische Abbildung eines Sicherheitssystems für ein spurgeführtes Fahrzeug gemäß einer Ausführungsform;
• 3 ein Flussdiagramm eines Verfahrens zur Sicherheitsüberwachung für ein spurgeführtes Fahrzeug gemäß einer Ausführungsform; und
• 4 eine schematische Darstellung eines Computerprogrammprodukts.

The above-described features and advantages of this invention, and the manner in which they are attained, will be more clearly and fully understood through the discussion of the following highly simplified schematic representations of preferred embodiments. Each show:

• 1 a schematic representation of a safety system for a guided vehicle according to an embodiment;
• 2 a further schematic illustration of a safety system for a guided vehicle according to an embodiment;
• 3 a flowchart of a method for security monitoring for a guided vehicle according to an embodiment; and
• 4 a schematic representation of a computer program product.

1 12 shows a schematic representation of a safety system 200 for a guided vehicle according to an embodiment.

The safety system 200 shown for a track-guided vehicle is set up to carry out the method according to the invention for safety monitoring for a track-guided vehicle.

According to the invention, the safety system 200 can be arranged in a track-guided vehicle. The track-guided vehicle can be designed as a rail vehicle.

In the embodiment shown, the system 200 comprises a processing module 203 and an output module 205 which are operated on a common processing unit 201 . The processing module 203 has a plurality of processing functions F1, F2, ..., FN, while the output module 205 has a plurality of timer functions T1, T2, ..., TN. The output module 205 is also set up to activate a plurality of security actions Out1, Out2, . . . OutN.

In the embodiment shown, the processing module 203 receives a security-related message 207 in which a corresponding security-related event 209 is indicated. The safety-related message can, for example, be based on sensor data from a safety sensor system of the guided vehicle. The safety sensor system can include, for example, a speed sensor system and/or a beacon sensor system and/or a fire sensor system and/or a door sensor system and/or a drive power sensor system, with the sensor data for example overwriting a maximum speed and/or detecting a fire and/or detecting a door blockage and/or being able to describe an overwriting of a maximum drive power and/or an underwriting of a minimum drive power as a corresponding safety-relevant event. Alternatively or additionally, the safety-related message can include telegram data from a vehicle controller that describes, for example, a violation of a driving license and/or a refusal to allow the track-guided vehicle to travel on a specific rail route as a corresponding safety-related event. The safety-relevant message can be designed in particular as a radio message. The vehicle controller can be a controller of the track-guided vehicle, for example. Violation of the permission to drive and/or refusal to allow travel may have been communicated to the vehicle controller, for example, by an external control center for controlling traffic of a plurality of track-guided vehicles.

For example, the safety-related message 207 can indicate that a passenger is trapped in a door of the guided vehicle. Or a rail traffic control center of a rail network can indicate to the track-guided vehicle or the driver of the track-guided vehicle that a corresponding section of the track is not passable.

Upon receipt of the safety-related messages 207, a plurality of timer functions T1, T2, . . . For this purpose, corresponding activation signals Act_T1, Act_T2, ..., Act_TN are transmitted from the individual processing functions F1, F2, ..., FN to the output module 205, which then activates the timer functions T1, T2, ..., TN and the respective processing functions F1, F2, ..., FN corresponding identification messages ID1, ID2, ..., IDN transmits. In addition to activating the timer functions T1, T2, . . . , TN, the activation messages Act_T1, Act T2, .

As an alternative to this, the output module 205 can be set up to determine the predetermined time durations of the timer functions T1, T2, . . .

In addition, the safety actions Out1, Out2, ..., OutN to be triggered accordingly can be determined in the activation messages Act_T1, Act T2, ..., Act TN. As an alternative to this, the output module 205 can in turn be set up to independently determine the appropriate and appropriate security actions Out1, Out2, . The security actions Out1, Out2, .

The safety actions Out1, Out2, ..., OutN can, for example, be an emergency braking of the track-guided vehicle and/or a door release of doors of the track-guided vehicle and/or a drive release or a withdrawal of a drive release of a drive of the track-guided vehicle or similar from the operation of track-guided Vehicles include well-known security actions.

After activation of the timer functions T1, T2, . The processing functions F1, F2, . As an alternative to this, the processing functions F1, F2, . . . , FN can be applicable to any security-related events or security-related messages 207. The security functions F1, F2, .

The processing by the security functions F1, F2, . . . , FN includes a decision as to whether a corresponding security action Out1, Out2, .

If one of the processing functions F1, F2, ..., FN comes before the end of the predetermined time period of the respective timer function T1, T2, ..., TN the result that the respective safety action Out1, Out2, ..., OutN is not to be carried out, the respective processing function F1, F2, ..., FN can reset the respective timer function T1, T2, ..., TN. For this purpose, however, the identification message ID1, ID2, ..., IDN assigned when the respective timer function T1, T2, ..., TN is activated must be specified by the respective processing function F1, F2, ..., FN, so that a Timer function T1, T2, ..., TN can only be reset by the processing function F1, F2, ..., FN, through which the respective timer function T1, T2, ..., TN was originally activated.

The respective timer function T1, T2, . . . , TN is only reset when the calculations by the processing function F1, F2, . In the context of a safety-relevant application with multi-channel calculation, the timer function T1, T2, . . . However, just one of several independent activations is sufficient to activate a timer function T1, T2, . . . , TN. As a result, the failure of a single message does not lead to the corresponding security action Out1, Out2, ..., OutN not being taken. In this way, channel participation for safety-critical monitoring/functions can be guaranteed as a safety principle.

If the processing function F1, F2, . . . , FN comes to the conclusion that the corresponding security action Out1, Out2, is, by sending a corresponding activation message (in 1 not shown) including the identification message ID1, ID2, ..., IDN, the corresponding safety action Out1, Out2, ..., OutN can be triggered before the predetermined period of time has elapsed.

If a processing function F1, F2, of processing functions F1, F2, ..., FN, then when the timer function T1, T2, ..., TN expires, the safety action Out1 , Out2, ..., OutN triggered.

As an alternative to the embodiment shown here, an identical safety action Out1, Out2, ..., OutN can be triggered by a plurality of activated timer functions T1, T2, ..., TN. For example, for different safety-related events, the same safety action Out1, Out2, ..., OutN, for example emergency braking for a blocked door that suggests a trapped object, as well as for a non-existent driving license or a message from a fire sensor that indicates a fire.

As an alternative to the embodiment shown here, the processing module 203 and the output module 205 can be executed on two different computing units 201 that are separate from one another.

The predetermined durations of the activated timer functions T1, T2, . Alternatively or additionally, the predetermined time duration of the timer function T1, T2, ..., TN can be configured such that from the time the security-relevant message is received or the security-relevant event is recognized by the processing module 203 and the corresponding security action Out1 is triggered, Out2, ..., OutN elapsed period of time a predetermined security-related time requirement for corresponding security actions or security-related events is met. For example, the predetermined period of time can be coordinated in such a way that the predefined time requirement for driving over a beacon element and a corresponding triggering of emergency braking is complied with.

2 FIG. 12 shows a further schematic illustration of a safety system 200 for a guided vehicle according to a further embodiment.

in the in 2 shown embodiment, the security system 200 also includes a receiving module 211, which is set up to receive security-related messages 207.

In the embodiment shown, the receiving module 211 is embodied in a safety sensor system 213 .

In addition, the processing module 203 and the output module 205 are implemented on two computing units 201 that are separate from one another.

When the security-related message 207 is received, a timer function T of the output module 205 is automatically activated by sending out an activation message Act T . As above already mentioned, both the predetermined time duration of the timer function T and the safety action Out1, Out2, . . . , OutN to be carried out can be defined via the corresponding activation message Act T. As an alternative to this, the output module 205 can be set up to independently define the duration of the timer function T or the safety action Out1, Out2, .

After activation of the timer function T, the output module 205 provides a corresponding identification message ID.

The receiving module 211 forwards both the security-related message 207 and the identifier message ID to a processing function F of the processing module 203 .

As for the embodiment in 1 already mentioned, the security-relevant message 207 is processed by the processing function F. If the processing function F comes to the conclusion before the predetermined period of time of the timer function T has expired that the corresponding security action Out1, Out2, ..., OutN is to be carried out, a corresponding activation message Act_Out including the identifier message ID, which is sent by the processing function F is transmitted to the output module 205, the corresponding security action Out1, Out2, ..., OutN are triggered. If, on the other hand, the processing function F comes to the conclusion before the end of the predefined period of time of the timer function T that the safety action Out1, Out2, ..., OutN is not to be carried out, the timer function T can be reset by means of a reset message Res_T including the identification message ID will. If the processing of the safety-related message 207 by the processing function F before the end of the predefined time period of the timer function T does not produce any result, the corresponding safety action is automatically triggered when the predefined time period of the timer function T has expired.

According to the embodiment in 1 In the embodiment shown, the safety-related message 207 can be processed by a plurality of processing functions F1, F2, . . . , FN. In addition, a plurality of timer functions T1, T2, . . . , TN of the output module 205 can be activated for each security-related message 207.

According to a further embodiment, a plurality of security-related messages 207 can be processed simultaneously by the processing functions F of the processing module 203 and for each of the security-related messages 207 either by the receiving module 211 or by the corresponding processing functions F1, F2, ..., FN of the processing module 203 corresponding timer functions T1, T2, ..., TN are activated. The individual timer functions T1, T2, . . . , TN can be associated with the same security action Out1, Out2, . Alternatively, the individual timer functions T1, T2, ..., TN can be associated with different security functions. The various timer functions T1, T2, . . . , TN can be activated for individual periods of time or common identical periods of time.

The processing of the safety-related messages 207 by processing functions F1, F2, . . . , FN of the processing module 203 can, in particular, take place cyclically. The activation of the timer function T1, T2, extended over several processing cycles.

Alternatively, the receiving module 211 can also be implemented on a computing unit 201 that is not part of a safety sensor system 213 . For example, the processing module 203, the output module 205 and the receiving module 211 can be executed on an identical computing unit 201.

3 FIG. 10 shows a flow diagram of a method 100 for safety monitoring for a guided vehicle according to an embodiment.

For safety monitoring for a track-guided vehicle according to method 100 according to the invention, a safety-related message 207 is first received in a method step 101, in which a corresponding safety-related event 209 for the track-guided vehicle is displayed.

In a method step 103, a timer function T is activated for a predetermined period of time upon receipt of the security-related message 207, the predetermined period of time fulfilling a time specification for carrying out a security action Out1, Out2, . . . , OutN.

Subsequently, in a method step 105, the safety-related message 207 is processed and a decision is made as to whether based on the safety-related message 207 a corresponding safety action Out1, Out2, ..., OutN is to be triggered.

If the processing of the safety-related message 207 before the predetermined time period of the timer function T has elapsed, the result is that no safety action Out1, Out2, . . . , OutN is to be triggered, in a method step 107 the timer function T is reset.

If, on the other hand, the processing of the safety-relevant message 207 before the predetermined time period of the timer function T has expired comes to the conclusion that a safety action Out1, Out2, ..., OutN is to be triggered, in a method step 109 the safety action Out1, Out2, ..., OutN causes.

If, on the other hand, the safety action Out1, Out2, ..., OutN is not triggered before the predetermined time period has elapsed and the timer function T is not reset, the safety action Out1, Out2, ..., OutN is activated in a method step 111 when the predetermined time period has expired triggered automatically by the timer function T.

4 shows a schematic representation of a computer program product 300.

4 shows a computer program product 300, comprising instructions which, when the program is executed by a computing unit, cause the latter to execute the method 100 according to one of the above-mentioned embodiments. The computer program product 300 is stored on a storage medium 301 in the embodiment shown. The storage medium 401 can be any storage medium known from the prior art.

Although the invention has been illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

Reference List

100

procedure

101

Receiving a security-related message

103

Activating a timer function

105

Processing the security relevant message

107

Reset the timer function

109

Triggering a security action

111

automatic triggering of a safety function

200

security system

201

unit of account

203

processing module

205

output module

207

security related message

209

Security Event

211

receiving module

213

safety sensors

T

timer function

T1

timer function

T2

timer function

TN

timer function

F1

processing function

F2

processing function

FN

processing function

Out1

security action

Out2

security action

OutN

security action

ID

identifier message

ID1

identifier message

ID2

identifier message

IDN

identifier message

Act T

activation message

Act_T1

activation message

Act_T2

activation message

Act_TN

activation message

Act_Out

trigger message

Rest

reset message

Claims (15)

Method (100) for safety monitoring for a track-guided vehicle, the method (100) comprising: - receiving (101) a safety-related message (207), the safety-related message (207) indicating a safety-related event (209) for the track-guided vehicle; - Activating (103) a timer function (T) for a predetermined period of time upon receipt of the safety-related message (207), the predetermined period of time fulfilling a time specification for carrying out a safety action (Out1, Out2,..., OutN); - Processing (105) the security-related message (207) and deciding whether based on the security-related message a corresponding security action (Out1, Out2, ..., OutN) is to be triggered; and - resetting (107) the timer function (T) before the predetermined period of time has elapsed if, based on the processing of the security-related message (207), it has been decided that no security action (Out1, Out2,..., OutN) is to be triggered; or - triggering (109) the security action (Out1, Out2,..., OutN) before the predetermined period of time has elapsed, if it is decided based on the processing of the security-related message (207) that a security action (Out1, Out2,... , OutN) is to be triggered; or - automatic triggering (111) of the safety action (Out1, Out2,..., OutN) when the predetermined period of time of the timer function (T) has elapsed, if the safety action has not been triggered before the predetermined period of time has elapsed and the timer function ( T) is not reset. Method (100) according to claim 1 , wherein a period of time based on a time of receiving the security-related message (207) and the expiry of the predetermined period of time of the timer function (T) the time specification for executing a security action (Out1, Out2, ..., OutN) meets. Method (100) according to claim 1 or 2 , wherein the processing of the safety-relevant message (207) is carried out by a processing module (203), and wherein the timer function (T) and the triggering of the safety action (Out1, Out2,..., OutN) are carried out by a processing module (201 ) separately executed output module (203). Method (100) according to claim 3 , wherein the activation of the timer function (T) and/or the resetting of the timer function (T) and/or the triggering of the safety action (Out1, Out2,..., OutN) by the processing module ( 203) can be initiated. Method (100) according to one of the preceding claims, wherein the security-related message (207) is received by a receiving module (211), and wherein the activation of the timer function (T) automatically and immediately upon receipt of the security-related message (207) by the Receiving module (211) is initiated. Method (100) according to claim 3 , 4 or 5 , wherein the activation of the timer function (T) is connected to an allocation of an identification message (ID) by the output module (203), and wherein the resetting of the timer function (T) is caused by the processing module (203) only when specified the identification message (ID) takes place. A method (100) according to any preceding claims 3 until 6 , wherein the predetermined period of time and/or the security action to be performed (Out1, Out2,..., OutN) are determined by the processing module (203) and/or by the receiving module (211) and/or the output module (205). Method (100) according to one of the preceding claims, wherein the predetermined time period is determined as a function of the security-related message (207) and/or the security-related event (209). Method (100) according to one of the preceding claims, wherein for the security-related message (207) a plurality of timer functions (T1, T2,..., TN) for a plurality of different security actions (Out1, Out2,..., OutN ) to be started. Method (100) according to one of the preceding claims, wherein for a plurality of different safety-related messages (207) a plurality of timer functions (T1, T2, ..., TN) are started with a plurality of predetermined time periods, the plurality of timers -functions (T1, T2,..., TN) relate to the same safety action (Out1, Out2,..., OutN), and where one of the timer functions (T1, T2,..., TN ) the safety action (Out1, Out2,..., OutN) is triggered if the safety action (Out1, Out2,.. ., OutN) is not triggered and the timer function (T1, T2,..., TN) is not reset. Method (100) according to one of the preceding claims, wherein the safety-related message (207) comprises sensor data from a safety sensor system (213) of the track-guided vehicle and/or telegram data from a vehicle controller. Method (100) according to claim 11 , wherein the safety sensor system (213) comprises a speed sensor system and/or a balise sensor system and/or a fire sensor system and/or a door sensor system and/or a drive power sensor system, and the sensor data indicate that a maximum speed has been exceeded and/or a detection of a fire site and/or a Detection of a door blockage and/or exceeding or falling below a maximum drive power includes a minimum drive power, and/or wherein the telegram data includes a violation of a driving license and/or a refusal to allow the track-guided vehicle to travel on a specific rail route. Method (100) according to one of the preceding claims, wherein the safety action (Out1, Out2, ..., OutN) includes emergency braking of the track-guided vehicle and/or door release of doors of the track-guided vehicle and/or drive release of a drive of the track-guided vehicle . Safety system (200) for a track-guided vehicle with a computing unit (201) which is set up, the method (100) for safety monitoring for a track-guided vehicle according to one of the preceding ones Claims 1 until 13 to execute. Computer program product (300) comprising instructions which, when the program is executed by a data processing unit, cause the latter to implement the method (100) for safety monitoring for a track-guided vehicle according to one of the preceding ones Claims 1 until 13 to execute.

Images