JP7708633B2 - Railway security system, security management system, and update control method - Google Patents

Description

The present invention relates to railway security systems, etc.

Software (programs, data, etc.) stored in security devices, which are components of railway security systems, may need to be updated, and errors cannot be tolerated during such updates. For this reason, the main conventional update methods have been to directly connect a PC (personal computer) containing the update software to the security device to be updated via a cable, or to install a storage medium such as a ROM (Read Only Memory) or CF (Compact Flash) card containing the update software in the security device to be updated. Either method requires a visit to the site where the security device to be updated is located, making the task of updating the software for a large number of security devices a time-consuming task.

In recent years, methods of updating software remotely via a network without having to go to the site have been considered. For example, Patent Document 1 discloses a remote loading technology in which a loading instruction device that stores update software and multiple loading target devices (corresponding to security devices) to be updated are connected on the same communication path, and the update software is transmitted from the loading instruction device to the loading target devices.

Remote software update methods that use a dedicated network are highly secure, but they require the construction of a dedicated network, which has the problem of high equipment and maintenance costs. For this reason, for example, if the technology of Patent Document 2 is realized using general-purpose wireless, it is possible to reduce the equipment and maintenance costs of the network.

JP 2018-036975 A JP 2015-196422 A

However, communication via general-purpose wireless has the problem of being less reliable and secure than wired communication, so it is necessary to ensure the reliability and security of communication. In other words, it is necessary to deal with data errors caused by noise superimposition on the communication path.

The present invention was made in consideration of the above circumstances, and its purpose is to provide high reliability and safety when a security device receives and updates update software wirelessly.

The first invention for solving the above problem is:
A security device that performs a predetermined control operation based on the stored software;
a central control device that performs predetermined safety control related to train operation by communicating with the safety devices via wireless;
a management device capable of wirelessly communicating with the security device and communicatively connected to the central control device;
A railway security system comprising:
The management device includes:
A software update transmission unit (e.g., the DB transmission unit 802 in FIG. 7) for transmitting software updates to the security device;
a sending code sending means (e.g., a sending code sending unit 804 in FIG. 7) for sending a sending check code for the update software calculated according to a predetermined calculation method for calculating a check code for given data to the central control device;
Equipped with
The security device includes:
an update software receiving unit (e.g., the DB receiving unit 502 in FIG. 6) for receiving the update software from the management device;
a receiving side code transmitting means (for example, the receiving side code transmitting unit 504 in FIG. 6) for calculating a receiving side check code for the received update software according to the calculation method and transmitting the calculated code to the central control device;
an update unit (e.g., update unit 506 in FIG. 6 ) that updates the software using the received update software when an update instruction is received from the central control device;
Equipped with
The central control device
an update instruction unit (e.g., the update instruction unit 202 in FIG. 4 ) that transmits the update instruction to the security device when the sending side check code received from the management device matches the receiving side check code received from the security device;
Equipped with
It is a railway security system.

Other inventions include:
A railway safety system including a safety device that performs a predetermined control operation based on stored software, and a safety management system, comprising:
a central control device that performs predetermined safety control related to train operation by communicating with the safety devices via wireless;
a management device capable of wirelessly communicating with the security device and communicatively connected to the central control device;
Equipped with
the security device has a function of, when receiving a given update software, calculating a receiver check code for the update software according to a predetermined calculation method for calculating a check code for given data, and transmitting the calculated check code to the central control device, and, when receiving an update instruction from the central control device, updating the software using the received update software;
The management device includes:
an update software transmission means for transmitting the update software to the security device;
a sender code sending means for sending a sender check code for the update software calculated according to the calculation method to the central control device;
having
The central control device
an update instruction means for transmitting the update instruction to the security device when the sending side check code received from the management device matches the receiving side check code received from the security device;
having
A security management system may be configured.

As yet another invention,
A method for controlling software update in a railway safety system comprising: a safety device that performs a predetermined control operation based on stored software; a central control device that performs predetermined safety control related to train operation by communicating with the safety device via wireless; and a management device that can communicate with the safety device via wireless and is communicatively connected to the central control device, comprising:
an update software transmission step (e.g., step S9 in FIG. 3 ) in which the management device transmits update software to the security device;
a transmitting side code transmitting step (e.g., step S5 in FIG. 3) in which the management device transmits to the central control device a transmitting side check code for the update software calculated according to a predetermined calculation method for calculating a check code for given data;
an update software receiving step (e.g., steps S11 to S17 in FIG. 3) in which the security device receives the update software from the management device;
A receiving side code transmission step (e.g., steps S19 to S21 in FIG. 3) in which the security device calculates a receiving side check code for the received update software according to the calculation method and transmits the calculated code to the central control device;
an updating step (e.g., step S31 in FIG. 3 ) of updating the software by using the received update software when the security device receives an update instruction from the central control device;
an update instruction step (e.g., steps S23 to S29 in FIG. 3) in which the central control device transmits the update instruction to the security device when the sending side check code received from the management device matches the receiving side check code received from the security device;
An update control method including the above may be configured.

According to the first invention, high reliability and safety can be achieved when the security device receives update software wirelessly and updates it. That is, the management device transmits the update software to the security device and transmits a sender check code for the update software to the central control device. The security device calculates a receiver check code for the received update software using the same calculation method as the sender check code in the management device, and transmits the calculated receiver check code to the central control device. The central control device then compares the sender check code with the receiver check code, and if they match, transmits a software update instruction to the security device.

If the security device receives the update software without error, the sending check code and receiving check code will match. Furthermore, since the central control device is connected to the management device for communication, the sending check code received by the central control device from the management device can be said to be highly reliable and safe. Furthermore, the central control device that performs security control is a fail-safe device, and the check code comparison performed by the central control device, which is a fail-safe device, can be said to be highly reliable and safe. Furthermore, if the check codes do not match as a result of the comparison, an update instruction is not sent, and therefore the software is not updated in the security device. This ensures high reliability and safety when the security device receives and updates update software via wireless.

In addition, the management device transmits the update software, which has a heavy processing load. The central control device compares the check code, which has a lighter processing load than the processing involved in transmitting the update software. This reduces the processing load on the central control device, which performs security control.

The second invention is the first invention,
The security devices include target security devices that are targets for updating the software stored in the security devices, and non-target security devices that are not targets for updating the software stored in the security devices,
The central control device
A notification means (e.g., the notification unit 204 in FIG. 4 ) that notifies each of the management device and the target security device of an update start instruction including designation of the target security device;
Further comprising:
The update software transmission means transmits the update software to the target security device based on the update start instruction,
the update software receiving means receives the update software from the management device based on the update start instruction;
the update instruction means transmits the update instruction to the target security device when the sending check code received from the management device matches the receiving check code received from the target security device.
It is a railway security system.

According to the second invention, prior to sending the update software, the central control device notifies each of the management device and the target safety device of an update start instruction, which includes the designation of the target safety device. This makes it possible to update the software only in the target safety device. Furthermore, even if the update software is sent to a non-target safety device by mistake, it is possible to prevent the software from being updated in the non-target safety device.

A third invention is the first or second invention,
The safety device is an on-board device mounted on a train or a railroad crossing control device.
It is a railway security system.

According to the third invention, it is possible to ensure high reliability and safety when updating by wirelessly transmitting update software to on-board equipment or crossing control devices installed on trains.

A fourth aspect of the present invention relates to the second aspect of the present invention,
the central control device executes the predetermined security control based on communication with the non-target security devices that are not targets of the software update during the software update in the target security devices.
It is a railway security system.

According to the fourth invention, it is possible to execute safety control based on communication with non-target safety devices that are not subject to software updates, and to transmit update software to target safety devices and update the software in parallel.

A fifth aspect of the present invention is the method according to any one of the first to fourth aspects of the present invention,
the update software transmission means transmits the update software by adding additional information including a division serial number to each of a plurality of divided data pieces obtained by dividing the update software into a predetermined data size;
the update software receiving means determines whether or not reception has been successful for each of the divided data based on the additional information of the divided data;
the receiving code transmitting means calculates and transmits the receiving check code when the update software receiving means determines that all of the divided data have been successfully received.
It is a railway security system.

In wireless communication, data is divided into a certain data size called a packet for example before being transmitted, and the divided data must be joined and reconstructed on the receiving side. For this reason, as in the fifth invention, the management device adds additional information including the serial number of the division to the divided data into which the update software is divided, and transmits the divided data. Then, based on the additional information added to the received divided data, the security device can determine whether the divided data is missing or the order of reception is reversed, and reliably reconstruct the original update software. This ensures high reliability and safety when the security device receives and updates update software wirelessly.

An example of the configuration of a railway security system. FIG. 11 is an explanatory diagram of a procedure for transmitting an update database. FIG. 11 is an explanatory diagram of a procedure for transmitting an update database. 1 shows an example of the functional configuration of a central control device. 13 is an example of DB update management information. An example of the functional configuration of a security device. 3 shows an example of a functional configuration of a management device. 13 is an example of update DB management information.

Below, a preferred embodiment of the present invention will be described with reference to the drawings. Note that the forms to which the present invention can be applied are not limited to the following embodiments. In addition, in the description of the drawings, the same elements are given the same reference numerals.

[System configuration]
FIG. 1 is a diagram showing an example of the configuration of a railway security system 1 according to the present embodiment. As shown in FIG. 1, the railway security system 1 according to the present embodiment includes a central control device 3, a plurality of security devices 5, and a management device 7. The central control device 3 and the management device 7 are installed in a command center, an equipment room, etc., and are connected to each other by a dedicated line such as an optical cable to constitute a security management system 10. The central control device 3 and the management device 7 are also connected to a base station device 9 by a dedicated line, and can communicate with the security devices 5 via a mobile wireless communication network N connected to the base station device 9. That is, the central control device 3 and the management device 7 can communicate with the security devices 5 via wireless communication. The mobile wireless communication network N is a general-purpose wireless communication network operated by a telecommunications carrier.

The central control device 3 is a fail-safe device that performs predetermined safety control related to train operation by communicating with the safety device 5 wirelessly via the mobile wireless communication network N. Examples of safety control include train control, in which the central control device 3 wirelessly communicates with the on-board device 5a and the crossing control device 5b, which are the safety devices 5, to obtain train positions from the on-board device 5a and transmit train control information to the on-board device 5a for controlling the speed of each train based on the obtained train positions, and crossing control, in which crossing control information for controlling crossing equipment (crossing warning devices, barriers, etc.) is transmitted to the crossing control device 5b.

The safety device 5 is an on-site device with fail-safe properties used for safety control, such as an on-board device 5a mounted on a train, or a crossing control device 5b installed near a crossing to control the crossing equipment. One or more on-board devices 5a and crossing control devices 5b are arranged within the railway safety system 1. The safety device 5 also stores a database 602 related to safety control. The database 602 is an example of software (programs and data), and contains content according to the type and use of the safety device 5 that is stored therein.

The management device 7 is a device for updating the database 602 stored in the security device 5. The management device 7 stores an update database 912 for each of the multiple security devices 5, and transmits the update database 912 corresponding to a specified security device 5 to that security device 5 under the control of the central control device 3.

In this embodiment, the central control device 3 performs safety control by wirelessly communicating with each of the multiple safety devices 5 that are not the target of updating the database 602 (hereinafter referred to as "non-target safety devices"), while simultaneously controlling the transmission of the update database 912 and the update of the database 602 to the safety devices 5 that are the target of updating the database 602 (hereinafter referred to as "target safety devices"). In other words, while updating the database 602 in the safety device 5 that is the target of updating the database 602 (target safety device), safety control can be performed based on communication with other safety devices 5 that are not the target of updating the database 602 (non-target safety devices). For example, if the target safety device is an on-board device 5a, the transmission of the update database 912 and the update of the database 602 are performed when the vehicle on which the on-board device 5a is installed has finished its work and is placed in a garage or the like. At this time, safety control can be continued for vehicles other than the vehicle and crossing control devices, so that safety control for normal train operation can be performed. Furthermore, if the target safety device is a railroad crossing control device 5b, the update database 912 is transmitted and the database 602 is updated at night after the operation has ended.

[Transmission procedure]
2 and 3 are diagrams for explaining the procedure for transmitting the update database 912 to the security device 5. Fig. 2 is a diagram focusing on instructions and data transmitted and received between the devices, and Fig. 3 is a diagram focusing on the processing flow of each device.

First, the management device 7 accepts an update operation that specifies a security device 5 (target security device 5X) to be updated in the database 602 from among a plurality of security devices 5 (step S1). The management device 7 then notifies the central control device 3 of the acceptance of the update of the database 602 that specifies the target security device 5X (step S3). The management device 7 also transmits a check code (hereinafter referred to as the "sender check code") for the update database 912 that corresponds to the target security device 5X (step S5). This sender check code for the update database 912 is calculated in advance using a predetermined calculation method and stored in the management device 7 in association with the update database 912.

The central control device 3 then notifies each of the management device 7 and the target security device 5X of an update start instruction that includes designation of the target security device 5X (step S7). Upon receiving this update start instruction, the target security device 5X knows that its own device is the update target of the database 602, and receives the update database 912 sent from the management device 7. That is, the security device 5 receives the update database 912 only when it is notified of an update start instruction that designates its own device as the target security device 5X. The non-target security device 5Y does not receive the update database 912 because it is not notified of an update start instruction that designates its own device. This prevents the non-target security device 5Y from updating the database 602.

Then, the management device 7 transmits the update database 912 to the target security device 5X (step S9). The update database 912 is transmitted wirelessly via the mobile wireless communication network N, so it is divided and transmitted in packets by a communication device that controls communication via the mobile wireless communication network N. To avoid division of the update database 912 by this communication device, the management device 7 divides the update database 912 in advance into data sizes that fit into one packet even with additional information added, and sequentially transmits transmission data with additional information added to the divided data (hereinafter referred to as "divided data"). The additional information is information that includes the serial number and total number of divisions. The transmission data is encrypted and has error detection codes such as CRC (cyclic redundancy check) added, and is transmitted to the target security device 5X as one packet.

The target security device 5X sequentially receives packets transmitted from the management device 7. The received packets are first decoded by a communication device that controls communication via the mobile wireless communication network N and error detection is performed using an error detection code such as CRC to determine whether the packets have been received correctly. If the packets have been received correctly, the target security device 5X further determines whether the divided data has been received successfully based on the additional information added to the received divided data (step S11). Specifically, if the received divided data has been received within a certain time from the previous divided data and has the same serial number as the previous divided data, it is determined that the reception was successful, and otherwise it is determined that the reception was unsuccessful. The target security device 5X then transmits a reception response to the management device 7 that includes information on whether the divided data has been received successfully or not, and a request to resend the corresponding divided data in the case of a reception failure (step S13).

When the target safety device 5X has successfully received all the split data (step S15: YES), it reconstructs the update database 604 by combining the split data in the order according to the serial numbers (step S17). Next, the target safety device 5X calculates a check code for the received update database 604 (hereinafter referred to as the "receiving side check code") (step S19) and transmits the calculated receiving side check code to the central control device 3 (step S21). Here, the receiving side check code calculated by the target safety device 5X is calculated using the same calculation method as the transmitting side check code for the update database 912 stored in the management device 7. The calculation method for the check code is arbitrary, and any error detection code such as a checksum or CRC can be used, for example.

The central control device 3 compares the sending check code received from the management device 7 with the receiving check code received from the target security device 5X (step S23), and if they match (step S25: YES), it transmits an instruction to update the database 602 to the target security device 5X (step S29). If the check codes do not match (step S25: NO), it notifies the management device 7 that the transmission of the update database 912 has failed (transmission error) (step S27).

When the target safety device 5X receives an update instruction from the central control device 3, it updates the stored database 602 using the received update database 604 (step S31). Then, when the update of the database 602 is complete, it notifies the central control device 3 that the update is complete (step S33). Thereafter, the central control device 3 notifies the management device 7 that the update of the database 602 of the target safety device 5X is complete (step S35). The update of the database 602 in the safety device 5 is performed as described above.

[Functional configuration]
(A) Central control device Fig. 4 is a diagram showing the functional configuration of the central control device 3, and shows the functional units according to this embodiment. According to Fig. 4, the central control device 3 includes an operation unit 102, a display unit 104, a communication unit 106, a processing unit 200, and a storage unit 300, and is configured as a computer system having fail-safe properties.

The operation unit 102 is realized by an input device such as a button switch, a touch panel, or a keyboard, and outputs an operation signal corresponding to the operation performed to the processing unit 200. The display unit 104 is realized by a display device such as an LCD (Liquid Crystal Display) or a touch panel, and performs various displays corresponding to display signals from the processing unit 200. The communication unit 106 is realized by a wired or wireless communication device, and communicates with external devices such as the management device 7 and base station device 9 via a dedicated line.

The processing unit 200 is realized by a calculation device such as a CPU (Central Processing Unit), and issues instructions and transfers data to each part constituting the central control device 3 based on the programs and data stored in the memory unit 300, thereby controlling the entire central control device 3. The processing unit 200 also has an update instruction unit 202 and a notification unit 204 as functional units according to this embodiment. However, these functional units can also be configured as independent calculation circuits using an ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array), etc.

If the sending side check code received from the management device 7 matches the receiving side check code received from the target security device 5X, the update instruction unit 202 sends an update instruction to the target security device 5X (steps S23 to S29 in Figure 3).

The notification unit 204 notifies each of the management device 7 and the target security device 5X of an update start instruction including the designation of the target security device 5X (step S7 in FIG. 3). For example, the management device 7 can receive an update operation that designates the target security device 5X, and can notify an update start notification in accordance with a notification from the management device 7 that this update operation has been received.

The storage unit 300 is realized by a storage device such as a hard disk, ROM (Read Only Memory), or RAM (Random Access Memory), and stores programs and data for the processing unit 200 to comprehensively control the central control unit 3. The storage unit 300 is also used as a working area for the processing unit 200, and temporarily stores the results of calculations performed by the processing unit 200 according to various programs, and input data via the operation unit 102 and communication unit 106. In this embodiment, the storage unit 300 stores DB update management information 310.

Figure 5 is a diagram showing an example of DB update management information 310. DB update management information 310 is information for managing updates to the database 602 in the security device 5, and is generated for each update. One piece of DB update management information 310 stores, in association with the security device ID of the target security device 5X, the update date and time, the sending side check code received from the management device 7, the receiving side check code received from the target security device 5X, and the result of matching the sending side check code and the receiving side check code performed by the update instruction unit 202.

(B) Safety Device Fig. 6 is a diagram showing the functional configuration of the safety device 5, and shows the functional units according to this embodiment. According to Fig. 6, the safety device 5 includes an operation unit 402, a display unit 404, a wireless communication unit 406, a processing unit 500, and a storage unit 600, and is configured by a computer system having fail-safe properties.

The operation unit 402 is realized by an input device such as a button switch, a touch panel, or a keyboard, and outputs an operation signal corresponding to the operation performed to the processing unit 500. The display unit 404 is realized by a display device such as an LCD (Liquid Crystal Display) or a touch panel, and performs various displays corresponding to display signals from the processing unit 500. The wireless communication unit 406 is realized by a wireless communication device, connects to the mobile wireless communication network N, and communicates wirelessly with external devices such as the central control unit 3 and the management device 7.

The processing unit 500 is realized by a calculation device such as a CPU (Central Processing Unit), and issues instructions and transfers data to each component of the security device 5 based on the programs and data stored in the memory unit 600, thereby controlling the security device 5 as a whole. The processing unit 500 also has a DB receiving unit 502, a receiving code transmitting unit 504, and an update unit 506 as functional units according to this embodiment. However, these functional units can also be configured as independent calculation circuits using an ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array), etc.

The DB receiving unit 502 receives the update database 912 from the management device 7 based on an update start instruction from the central control device 3. The update database 912 is transmitted sequentially in units of split data obtained by dividing the update database 912, so for each received split data, the reception success or failure is determined based on the additional information of the split data, and the determination result is transmitted to the management device 7 as a reception response. The reception success or failure of split data is determined if the split data was received within a certain time from the reception of the previous split data and has the same serial number as the previous split data received, and if not, the reception failure is determined. Then, when all the split data have been successfully received, the split data are combined based on the additional information of the split data to reconstruct the received update database 604 (steps S11 to S17 in FIG. 3).

When the DB receiving unit 502 determines that all divided data has been successfully received, the receiving code transmitting unit 504 calculates the receiving check code for the received update database 604 according to a predetermined calculation method, and transmits it to the central control device 3 (steps S19 to S21 in FIG. 3). The calculation method for the receiving check code is the same as the calculation method for the sending check code for the update database 912 stored in the management device 7.

When the update unit 506 receives an update instruction from the central control unit 3, it updates the stored database 602 using the received update database 604 (step S31 in Figure 3).

The storage unit 600 is realized by a storage device such as a hard disk, a ROM (Read Only Memory), or a RAM (Random Access Memory), and stores programs and data for the processing unit 500 to comprehensively control the security device 5. The storage unit 600 is also used as a working area for the processing unit 500, and temporarily stores the results of calculations performed by the processing unit 500 according to various programs, and input data via the operation unit 402 and the wireless communication unit 406. In this embodiment, the storage unit 600 stores a database 602, an update database 604 received from the management device 7, and a receiving check code 606 for the update database 604 calculated by the receiving code transmission unit 504.

(C) Management Device Fig. 7 is a diagram showing the functional configuration of the management device 7, and shows the functional units according to this embodiment. According to Fig. 7, the management device 7 includes an operation unit 702, a display unit 704, a communication unit 706, a processing unit 800, and a storage unit 900, and can be configured as a type of computer system.

The operation unit 702 is realized by an input device such as a button switch, a touch panel, or a keyboard, and outputs an operation signal corresponding to the operation performed to the processing unit 800. The display unit 704 is realized by a display device such as an LCD (Liquid Crystal Display) or a touch panel, and performs various displays corresponding to display signals from the processing unit 800. The communication unit 706 is realized by a wired or wireless communication device, and communicates with external devices such as the central control unit 3 and base station device 9 via a dedicated line.

The processing unit 800 is realized by a calculation device such as a CPU (Central Processing Unit), and issues instructions and transfers data to each part constituting the management device 7 based on the programs and data stored in the memory unit 900, thereby controlling the management device 7 as a whole. The processing unit 800 also has a DB transmission unit 802 and a transmission side code transmission unit 804 as functional units according to this embodiment. However, these functional units can also be configured as independent calculation circuits using an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array), etc.

The DB transmission unit 802 transmits the update database 912 to the target safety device 5X based on an update start instruction from the central control device 3. The update database 912 is transmitted by dividing the update database 912 into a plurality of divided data of a predetermined data size, and transmitting the divided data with additional information including the division serial number. Specifically, the transmission data 913 that has been generated and prepared in advance in the corresponding update DB management information 910 is transmitted in sequence (step S9 in FIG. 3).

The sending code sending unit 804 sends to the central control device 3 a sending check code for the update database 912 calculated according to a predetermined calculation method for calculating a check code for given data. Specifically, it sends a sending check code 914 that has been calculated and prepared in advance in the corresponding update DB management information 910 (step S5 in FIG. 3).

The memory unit 900 is realized by a storage device such as a hard disk, ROM (Read Only Memory), or RAM (Random Access Memory), and stores programs and data for the processing unit 800 to comprehensively control the management device 7. The memory unit 900 is also used as a working area for the processing unit 800, and temporarily stores the results of calculations performed by the processing unit 800 according to various programs, and input data via the operation unit 702 and communication unit 706. In this embodiment, the memory unit 900 stores update DB management information 910.

Figure 8 is a diagram showing an example of update DB management information 910. Update DB management information 910 is information for managing update database 912 to be transmitted to security device 5, and is prepared for each security device 5. One update DB management information 910 stores update database 912, transmission data 913, and transmission side check code 914 in association with security device ID 911 of the corresponding security device 5. Transmission data 913 is data for dividing and transmitting update database 912, and is prepared for each of a plurality of divided data obtained by dividing update database 912 into a predetermined data size. One transmission data 913 includes the corresponding divided data, and the division number and total number of divisions of the divided data, which are additional information. Transmission side check code 914 is a check code calculated for update database 912 using a predetermined calculation method.

[Action and Effect]
According to this embodiment, high reliability and safety can be achieved when the security device 5 wirelessly receives the update database 912 and updates the database 602. That is, the management device 7 transmits the update database 912 to the target security device 5X, which is the security device 5 that is the target for updating the database 602, and transmits a transmitting side check code for the update database 912 to the central control device 3. The target security device 5X calculates a receiving side check code for the received update database 912 using the same calculation method as the transmitting side check code in the management device 7, and transmits the calculated receiving side check code to the central control device 3. The central control device 3 then compares the transmitting side check code with the receiving side check code, and if they match, transmits an instruction to update the database 602 to the target security device 5X.

If the target safety device 5X receives the update database 912 without error, the sending check code and the receiving check code will match. In addition, since the central control device 3 is connected to the management device 7 via a dedicated line, the sending check code received by the central control device 3 from the management device 7 can be said to be highly reliable and safe. In addition, the central control device 3 that performs safety control is a fail-safe device, and the check code matching performed by the central control device 3, which is a fail-safe device, can be said to be highly reliable and safe. If the check codes do not match as a result of the matching, an update instruction is not sent, and therefore software is not updated in the target safety device 5X. This ensures high reliability and safety when the target safety device 5X receives and updates the update database 912 wirelessly.

In addition, the management device 7 transmits the update database 912, which has a heavy processing load, and the central control device 3 compares the check code, which has a lighter processing load than the processing involved in transmitting the update database 912. This reduces the processing load of the central control device 3, which performs safety control. And because the processing load of the central control device 3 is light, the central control device 3 can simultaneously perform safety control based on communication with the non-target safety device 5Y, which is not the target for updating the database 602, and transmit the update database 912 to the target safety device 5X and update the database 602.

The applicable embodiments of the present invention are not limited to the above-mentioned embodiments, and can of course be modified as appropriate without departing from the spirit of the present invention.

For example, in the above embodiment, an example was described in which the software was a database, but the software may be other software such as a program (e.g., a specific program of the security device 5) rather than a database.

1 ... Railway safety system 3 ... Central control device 200 ... Processing unit 202 ... Update instruction unit 204 ... Notification unit 300 ... Storage unit 310 ... DB update management information 5 ... Safety device 500 ... Processing unit 502 ... DB receiving unit 504 ... Receiving side code transmitting unit 506 ... Update unit 600 ... Storage unit 602 ... Database 604 ... Update database 606 ... Receiving side check code 7 ... Management device 800 ... Processing unit 802 ... DB transmitting unit 804 ... Transmitting side code transmitting unit 900 ... Storage unit 910 ... Update DB management information 912 ... Update database 9 ... Base station device N ... Mobile wireless communication network

Claims (7)

A security device that performs a predetermined control operation based on the stored software;
a central control device that performs predetermined safety control related to train operation by communicating with the safety devices via wireless;
a management device capable of wirelessly communicating with the security device and communicatively connected to the central control device;
A railway security system comprising:
The management device includes:
an update software transmission means for transmitting update software to the security device;
a sender code sending means for sending a sender check code for the update software, the sender check code being calculated according to a predetermined calculation method for calculating a check code for given data, to the central control device;
Equipped with
The security device includes:
an update software receiving means for receiving the update software from the management device;
a receiver code transmitting means for calculating a receiver check code for the received update software according to the calculation method and transmitting the calculated code to the central control device;
an update means for updating the software using the received update software when an update instruction is received from the central control device;
Equipped with
The central control device
an update instruction means for transmitting the update instruction to the security device when the sending side check code received from the management device matches the receiving side check code received from the security device;
Equipped with
Railway security system. The security devices include target security devices that are targets for updating the software stored in the security devices, and non-target security devices that are not targets for updating the software stored in the security devices,
The central control device
a notification means for notifying each of the management device and the target security device of an update start instruction including designation of the target security device;
Further comprising:
The update software transmission means transmits the update software to the target security device based on the update start instruction,
the update software receiving means receives the update software from the management device based on the update start instruction;
the update instruction means transmits the update instruction to the target security device when the sending check code received from the management device matches the receiving check code received from the target security device.
2. A railway security system according to claim 1. The safety device is an on-board device mounted on a train or a railroad crossing control device.
3. A railway security system according to claim 1 or 2. the central control device executes the predetermined security control based on communication with the non-target security devices that are not targets of the software update during the software update in the target security devices.
3. A railway security system according to claim 2. the update software transmission means transmits the update software by adding additional information including a division serial number to each of a plurality of divided data pieces obtained by dividing the update software into a predetermined data size;
the update software receiving means determines whether or not reception has been successful for each of the divided data based on the additional information of the divided data;
the receiving code transmitting means calculates and transmits the receiving check code when the update software receiving means determines that all of the divided data have been successfully received.
A railway security system according to any one of claims 1 to 4. A railway safety system including a safety device that performs a predetermined control operation based on stored software, and a safety management system, comprising:
a central control device that performs predetermined safety control related to train operation by communicating with the safety devices via wireless;
a management device capable of wirelessly communicating with the security device and communicatively connected to the central control device;
Equipped with
the security device has a function of, when receiving a given update software, calculating a receiver check code for the update software according to a predetermined calculation method for calculating a check code for given data, and transmitting the calculated check code to the central control device, and, when receiving an update instruction from the central control device, updating the software using the received update software;
The management device includes:
an update software transmission means for transmitting the update software to the security device;
a sender code sending means for sending a sender check code for the update software calculated according to the calculation method to the central control device;
having
The central control device
an update instruction means for transmitting the update instruction to the security device when the sending side check code received from the management device matches the receiving side check code received from the security device;
having
Security management system. A method for controlling software update in a railway safety system comprising: a safety device that performs a predetermined control operation based on stored software; a central control device that performs predetermined safety control related to train operation by communicating with the safety device via wireless; and a management device that can communicate with the safety device via wireless and is communicatively connected to the central control device, comprising:
an update software transmission step in which the management device transmits update software to the security device;
a transmitting side code transmitting step in which the management device transmits to the central control device a transmitting side check code for the update software calculated according to a predetermined calculation method for calculating a check code for given data;
an update software receiving step in which the security device receives the update software from the management device;
a receiver code transmission step in which the security device calculates a receiver check code for the received update software according to the calculation method and transmits the calculated code to the central control device;
an updating step of updating the software by using the received update software when the security device receives an update instruction from the central control device;
an update instruction step of transmitting the update instruction to the security device by the central control device when the sending side check code received from the management device and the receiving side check code received from the security device match;
An update control method comprising: