Patent ID: 12189825

DETAILED DESCRIPTION OF THE INVENTION

FIG.1shows a basic illustration of a starting situation for the method according to the invention for an intended authorization of control software of a rail vehicle.

The method according to the invention is based on the fact that the control software is formed as a program by a number of structurally interconnected functions FKT_1, FKT_2, FKT_3.

Each function FKT_1, FKT_2, FKT_3is assigned a task to be performed.

A respective checksum is formed by way each function FKT_1, FKT_2, FKT_3in the form of what is known as a “hash”, such thata first function FKT_1has a first checksum HFKT_1,a second function FKT_2has a second checksum HFKT_2, anda third function FKT_3has a third checksum HFKT_3.

The functions FKT_1, FKT_2, FKT_3of the control software, illustrated here in highly simplified form, are structurally interconnected with one another.

The interconnection of the functions FKT_1, FKT_2, FKT_3forms a structure STR. A checksum HSTR, referred to as a hash, is likewise formed by way of this structure STR.

In the case of the structure STR shown here, the first function FKT_1is linked to the third function FKT_3either directly or via the second function FKT_2.

An overall checksum HGES is formed from the checksums of the functions HFKT_1to HFKT_3and from the checksum of the structure HSTR and uniquely describes the control software, and may thus be considered to be its fingerprint.

The control software is authorized based on the overall checksum HGES.

FIG.2shows, with reference toFIG.1, a situation for subsequent considerations regarding the invention.

It is assumed here that authorization is not given for the second function FKT_2in a selected country, which is referred to hereinafter as destination country ZLL.

By way of example, in the context of the destination country authorization, a functionality of the second function FKT_2that is adapted to the destination country ZLL is required. This situation is illustrated by a lightning symbol on the second function FKT_2.

FIG.3shows, with reference to the previous figures, details regarding the method according to the invention.

It is assumed that a first authorization for Europe has been performed for the control software.

This authorization, which is referred to hereinafter as EU authorization, is based on an overall checksum HGES_EU.

The control software is however not authorized in the destination country ZLL, which requires, with reference toFIG.2, a change to the second function FKT_2illustrated in said figure.

The overall checksum HGES_EU is thus based on:the first checksum HFKT_1of the first function FKT_1,a second checksum HFKT_2EU of a second function FKT_2EU,the third checksum HFKT_3of the third function FKT_3, and onthe checksum HSTR of the structure STR.

With regard to the previous figures, the second function FKT_2EU shown here corresponds to the second function FKT_2described inFIG.1andFIG.2.

The second checksum HFKT_2EU thus corresponds to the second checksum HFKT_2described inFIG.1andFIG.2.

With regard to the previous figures, the overall checksum HGES_EU for the EU authorization thus corresponds to the overall checksum HGES described inFIG.1andFIG.2.

The authorization for the destination country ZLL, which is referred to hereinafter as ZLL authorization, is based on an overall checksum HGES_ZLL.

The overall checksum HGES_ZLL is based on:the first checksum HFKT_1of the first function FKT_1,a second checksum HFKT_2ZLL of a second function FKT_2ZLL,the third checksum HFKT_3of the third function FKT_3, and based onthe checksum HSTR of the structure STR.

For the destination country ZLL, the structure STR of the functions FKT_1, FKT_2ZLL, FKT_3involved is unchanged with regard to the previous figures.

Only the second function FKT_2ZLL is adapted to country-specific rules of the destination country ZLL or to rules of the associated rail network.

The second function FKT_2ZLL accordingly has a checksum HFKT_2ZLL that is assigned thereto.

As described above, “hashes” or checksums are formed for the individual functions:the first checksum HFKT_1for the first function FKT_1,the second checksum HFKT_2ZLL for the second function FKT_2ZLL adapted to the destination country ZLL,the third checksum HFKT_3for the third function FKT_3.

It should be noted that the structure STR for the destination country authorization and for EU authorization is the same:

For the EU authorization, the first function FKT_1is linked to the third function FKT_3either directly or via the second function FKT_2EU.

For the destination country authorization, the first function FKT_1is linked to the third function FKT_3either directly or via the second function FKT_2ZLL.

The checksum HSTR formed by way of the structure STR is thus identical for the countries in Europe and for the destination country.

In the context of the EU authorization, which applies for example for all countries in Europe but not for the destination country ZLL, the third function FKT_3thus uses results from the second function FKT_2EU, while, in the context of the destination country authorization, the third function FKT_3uses results from the second function FKT_2ZLL.

For the EU authorization, the checksums HFKT_1, HFKT_2EU, HFKT_3and HSTR are used. The overall checksum HGES_EU is formed from these checksums.

For the destination country authorization, the checksums HFKT_1, HFKT_2ZLL, HFKT_3and HSTR are used. An overall checksum HGES_ZLL is formed from these checksums.

One essential advantage of the present invention has an impressive effect here:

With the structure STR staying the same, when developing the control software, it is possible to change over between country-specific functions depending on rail networks or countries—here between the functions FKT_2ZLL and FKT_2EU depending on the country.

The control software itself contains both functions FKT_2ZLL and FKT_2EU. When crossing a border, uploading of country-specific control software is thus avoided; only a functional changeover takes place when crossing the border.

The country-specific second function FKT_2ZLL means that the destination country authorization is achieved and indicated by way of the overall checksum HGES_ZLL.

At the same time, the EU authorization is maintained, since its second function FKT_2EU=FKT_2remains unchanged, meaning that the overall checksum HGES_EU=HGES does not change either.

FIG.4shows, with reference toFIG.3, a first advantageous refinement of the method according to the invention.

With regard to the respective input of the second function FKT_2EU or FKT_2ZLL and the output of the first function FKT_1, a splitter block SPLITTER1is interposed, as shown.

A country-specific selection is made using the splitter block SPLITTER1, this being controlled with selection of the network identifier Netz_ID that is supplied.

This constellation is used when either the function FKT_2EU or the function FKT_2ZLL, based on supplied results from the first function FKT_1, calculates a respective result that is then passed on to the third function FKT_3for further processing.

The splitter block SPLITTER1accordingly delivers results from the first function FKT_1either to the function FKT_2EU or to the function FKT_2ZLL.

For the splitter block SPLITTER1, the country identifier is Netz_ID=ZLL when the rail vehicle is located in the destination country. Accordingly, for the splitter block SPLITTER1, the country identifier is Netz_ID=EU when the rail vehicle is located in the countries in Europe.

If the rail vehicle is located in the destination country ZLL, the calculated results from the first function FKT_1are transmitted or switched through to the function FKT_2ZLL by the splitter block SPLITTER1using the network identifier Netz_ID=ZLL.

If the rail vehicle is located in countries in Europe, the calculated results from the first function FKT_1are transmitted or switched through to the function FKT_2EU by the splitter block SPLITTER1using the network identifier Netz_ID=EU.

Based on this, a respective result is calculated by the function FKT_2EU or FKT_2ZLL and is then passed on to the third function FKT_3for further processing.

The splitter block SPLITTER1has no influence on the structure STR; it has a neutral function and is used only for the country-specific selection of the functions FKT_2EU or FKT_2ZLL. It accordingly has no influence on the checksum HSTR, which is identical both for the countries in Europe and for the destination country.

In order to ascertain the structure STR, points of intersection begin to be sought in the selection block SPLITTER1. Connections identified by way of the points of intersection are substituted and a checksum of the structure HSTR is calculated.

This is achieved for example by ascertaining subnetworks that are located downstream of the selection block SPLITTER1:Subnetwork 1: FKT_2EU->FKT_3Subnetwork 2: FKT_2ZLL->FKT_3

These two subnetworks are intersected. It is thereby identified that a point of intersection has to be present at the input of the third function FKT_3, which is referred to here as point of intersection SP1.

FIG.5shows, with reference toFIG.3, a second advantageous development of the method according to the invention.

With regard to the respective input of the second function FKT_2EU or FKT_2ZLL and the output of the first function FKT_1, a splitter block SPLITTER2is interposed, as shown.

With regard to the respective outputs of the second function FKT_2EU or FKT_2ZLL and the input of the third function FKT_3, a selection block MERGER2is interposed.

A country-specific selection is made using the selection block MERGER2, this being controlled with selection of the network identifier Netz_ID that is supplied.

This constellation is used when both functions FKT_2EU and FKT_2ZLL calculate respective results based on the supplied results from the first function FKT_1, but only one of these is intended to be passed on to the third function FKT_3for further processing.

The splitter block SPLITTER2accordingly delivers results from the first function FKT_1both to the function FKT_2EU and to the function FKT_2ZLL.

Both functions FKT_2EU and FKT_2ZLL, based thereon, calculate respective results that are each passed on to the selection block MERGER2.

A country-specific selection is then made using the selection block MERGER2, this being controlled with selection of the network identifier Netz_ID.

For the selection block MERGER2, the country identifier is Netz_ID=ZLL when the rail vehicle is located in the destination country. Accordingly, the country identifier for the selection block MERGER2is Netz_ID=EU when the rail vehicle is located in the countries in Europe.

If the rail vehicle is located in the destination country ZLL, the calculated results from the second function FKT_2ZLL are transmitted or switched through to the third function FKT_3by the selection block MERGER2using the network identifier Netz_ID=ZLL.

If the rail vehicle is located in countries in Europe, the calculated results from the second function FKT_2EU are transmitted or switched through to the third function FKT_3by the selection block MERGER2using the network identifier Netz_ID=EU.

The structure STR is ascertained in the same way as already described above: depending on the signal flow through ascertained subnetworks, a multiplicity of points of intersection or branching points are ascertained and taken into consideration. Identified connections are substituted and ultimately a checksum of the structure HSTR is calculated.

The splitter block SPLITTER2has no influence on the structure STR; it has a neutral function. It accordingly has no influence on the checksum HSTR, which is identical both for the countries in Europe and for the destination country.

The selection block MERGER2has no influence on the structure STR; it has a neutral function and is used only for the country-specific selection of the results from the functions FKT_2EU and FKT_2ZLL. It accordingly has no influence on the checksum HSTR, which is identical both for the countries in Europe and for the destination country.

FIG.6shows, with reference toFIG.3, a third advantageous development of the method according to the invention.

With regard to the respective input of the second function FKT_2EU or FKT_2ZLL and the output of the first function FKT_1, a splitter block SPLITTER3is interposed as shown.

With regard to the respective outputs of the second function FKT_2EU or FKT_2ZLL and the input of the third function FKT_3, a selection block MERGERS is interposed.

A country-specific selection is made using the splitter block SPLITTER3, this being controlled with selection of the network identifier Netz_ID that is supplied.

This constellation is used when either the function FKT_2EU or the function FKT_2ZLL calculates a respective result based on supplied results from the first function FKT_1, which is then passed on to the third function FKT_3for further processing.

The splitter block SPLITTER3accordingly delivers results from the first function FKT_1either to the function FKT_2EU or to the function FKT_2ZLL.

For the splitter block SPLITTER3, the country identifier is Netz_ID=ZLL when the rail vehicle is located in the destination country. Accordingly, the country identifier for the splitter block SPLITTER3is Netz_ID=EU when the rail vehicle is located in the countries in Europe.

If the rail vehicle is located in the destination country ZLL, the calculated results from the first function FKT_1are transmitted or switched through to the function FKT_2ZLL by the splitter block SPLITTER3using the network identifier Netz_ID=ZLL.

If the rail vehicle is located in countries in Europe, the calculated results from the first function FKT_1are transmitted or switched through to the function FKT_2EU by the splitter block SPLITTER3using the network identifier Netz_ID=EU.

Based thereon, a respective result is calculated by the function FKT_2EU or by the function FKT2_ZLL, which is then passed on by the selection block MERGER3to the third function FKT_3for further processing.

The structure STR is ascertained in the same way as already described above: depending on the signal flow through ascertained subnetworks, a multiplicity of points of intersection or branching points are ascertained and taken into consideration. Identified connections are substituted and ultimately a checksum of the structure HSTR is calculated.

The splitter block SPLITTER3has no influence on the structure STR; it has a neutral function and is used only for the country-specific selection of the functions FKT_2EU or FKT_2ZLL. It accordingly has no influence on the checksum HSTR, which is identical both for the countries in Europe and for the destination country.

The selection block MERGER3has no influence on the structure STR; it has a neutral function. It accordingly has no influence on the checksum HSTR, which is identical both for the countries in Europe and for the destination country.

In the context of one functionality not illustrated in more detail in the figures, it is possible, with regard to the figuresFIG.5andFIG.6, to appropriately interpose both a splitter block SPLITTER3and a selection block MERGER2in the functions. Both blocks are controlled using the country identifier Netz_ID. This refinement would be particularly safe during operation or additionally made safer in line with a possible client wish.

In the case of complex control software, a multiplicity of points of intersection or branching points should be taken into consideration depending on the signal flow when ascertaining subnetworks, these each having to be ascertained and taken into consideration.

In summary, in the invention, with regard to the control software, a structure for its interconnected functions is ascertained.

A structure-dependent checksum is ascertained or calculated for the structure in the form of a “hash”.

The structure-dependent checksum clearly indicates an associated property of the structure.

A function-dependent checksum is ascertained or calculated for each function of the control software in the form of a “hash”. The function-dependent checksum clearly indicates content or a property of the function.

An overall checksum is ascertained or calculated from the function-dependent checksums and from the structure-dependent checksum and constitutes a unique fingerprint for the control software.

The overall checksum thus clearly indicates content or a property of the control software.

An unchanged overall checksum indicates unchanged control software that does not have to be checked again and does not have to be authorized again.

A changed overall checksum indicates changed control software that has to be checked and authorized again.