Software verification for automatic train operation

Patent metadata

Field	Value
Publication number	US-9536076-B2
Application number	US-201514689448-A
Country	US
Kind code	B2
Filing date	Apr 17, 2015
Priority date	Apr 17, 2015
Publication date	Jan 3, 2017
Grant date	Jan 3, 2017

Abstract

An automatic train operation system includes a first control system configured to run a first software for controlling a first vehicle subsystem and a second control system configured to run a second software for controlling a second vehicle subsystem. The automatic train operation system also includes a software verification controller. The software verification controller is configured to identify a first identifier of the first software and a second identifier of the second software as a software configuration and determine whether the software configuration is preapproved. The software verification controller is also configured to, if the software configuration is preapproved, authorize the first control system and the second control system to run the first and second software.

First claim

What is claimed is:

1. An automatic train operation system comprising:
a first control system configured to run a first software for controlling a first vehicle subsystem;
a second control system configured to run a second software for controlling a second vehicle subsystem;
a software verification controller configured to:
identify a first identifier of the first software and a second identifier of the second software as a software configuration;
query a plurality of databases that each contain data regarding preapproved software configurations including combinations of at least one of different types and different versions of software that have been tested for operability and safety when used together on at least two vehicle subsystems;
determine whether the software configuration is preapproved by comparing the first identifier of the first software and the second identifier of the second software to the data regarding preapproved software configurations in at least two of the plurality of databases and determining whether the software configuration matches entries in at least two of the plurality of databases; and
if the software configuration is preapproved, authorize the first control system and the second control system to run the first and second software by communicating an authorization signal either directly or indirectly to at least one of the first control system and the second control system.

2. The automatic train operation system of claim 1 , wherein the first identifier and the second identifier each includes a software version number.

3. The automatic train operation system of claim 1 , wherein the software verification controller is further configured to, if the software configuration is not preapproved, send a signal indicating verification failure.

4. The automatic train operation system of claim 1 , wherein the software verification controller is part of a locomotive control system.

5. The automatic train operation system of claim 1 , wherein the software verification controller is configured to authorize the first control system and the second control system to run the first and second software by communicating an authorization signal to a locomotive control system.

6. The automatic train operation system of claim 1 , wherein to determine whether the software configuration is preapproved, the software verification controller is further configured to:
check a plurality of databases of preapproved software configurations; and
if the software configuration is not included in each of the plurality of databases, determine that the software configuration is not preapproved.

7. A vehicle comprising:
a first vehicle subsystem and a second vehicle subsystem;
a first control system configured to run a first software for controlling the first vehicle subsystem;
a second control system configured to run a second software for controlling the second vehicle subsystem; and
a software verification controller configured to:
identify a first identifier of the first software and a second identifier of the second software as a software configuration;
query a plurality of databases that each contain data regarding preapproved software configurations including combinations of at least one of different types and different versions of software that have been tested for operability and safety when used together on at least two vehicle subsystems;
determine whether the software configuration is preapproved by comparing the first identifier of the first software and the second identifier of the second software to the data regarding preapproved software configurations in at least two of the plurality of databases and determining whether the software configuration matches entries in at least two of the plurality of databases; and

if the software configuration is preapproved, authorize the first control system and the second control system to run the first and second software by communicating an authorization signal either directly or indirectly to at least one of the first control system and the second control system.

8. The vehicle of claim 7 , wherein the first identifier and the second identifier each include a software version number.

9. The vehicle of claim 7 , wherein the software verification controller is further configured to, if the software configuration is not preapproved, send a signal indicating verification failure.

10. The vehicle of claim 7 , wherein the software verification controller is part of a locomotive control system.

11. The vehicle of claim 7 , wherein the software verification controller is configured to authorize the first control system and the second control system to run the first and second software by communicating an authorization signal to a locomotive control system.

12. The vehicle of claim 7 , wherein to determine whether the software configuration is preapproved, the software verification controller is further configured to:
check a plurality of databases of preapproved software configurations; and
if the software configuration is not included in each of the plurality of databases, determine that the software configuration is not preapproved.

13. A method for verifying a software configuration comprising:
identifying, using a controller, a first identifier of a first software to be run on a first system and a second identifier of a second software to be run on a second system as the software configuration;
querying, using the controller, a plurality of databases that each contain data regarding preapproved software configurations including combinations of at least one of different types and different versions of software that have been tested for operability and safety when used together on at least two vehicle subsystems;
determining whether the software configuration is present in a first database and a second database of the plurality of databases by using the controller to compare the first identifier of the first software and the second identifier of the second software to the data regarding preapproved software configurations in the first and second databases and determining with the controller whether the software configuration matches entries in the first and second databases; and
if the software configuration is present in both the first database and the second database, authorizing the first system and the second system to operate by communicating an authorization signal using the controller either directly or indirectly to at least one of the first system and the second system.

14. The method of claim 13 , wherein authorizing the first system and the second system to operate includes communicating an authorization signal to a vehicle control system.

15. The method of claim 13 , further including, if the software configuration is not present in both the first database and the second database, preventing a vehicle including the first system and the second system from operating.

16. The method of claim 13 , further including, if the software configuration is not present in both the first database and the second database, displaying the software configuration and at least one preapproved configuration from one of the plurality of databases that is identified as an acceptable substitute for the software configuration.

17. The method of claim 13 , wherein the first identifier includes a software type and a software version.

Assignees

• Electro Motive Diesel Inc

Inventors

• Gajulapalli Venkata Swamy Reddy
• Kubycheck Russell
• Seaton James
• Shubs Jr Alexander
• Tannous Ola

Classifications

• B61L99/00

  Subject matter not provided for in other groups of this subclass · CPC title

• B60W50/045

  Monitoring control system parameters · CPC title

• G06F21/44 Primary

  Program or device authentication · CPC title

• B61L15/0063

  Multiple on-board control systems, e.g. "2 out of 3"-systems · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title