SOFTWARE VERIFICATION FOR AUTOMATIC TRAIN OPERATION

摘要

An automatic train operation system includes a first control system configured to run a first software for controlling a first vehicle subsystem and a second control system configured to run a second software for controlling a second vehicle subsystem. The automatic train operation system also includes a software verification controller. The software verification controller is configured to identify a first identifier of the first software and a second identifier of the second software as a software configuration and determine whether the software configuration is preapproved. The software verification controller is also configured to, if the software configuration is preapproved, authorize the first control system and the second control system to run the first and second software.

主权项

1. An automatic train operation system comprising:
a first control system configured to run a first software for controlling a first vehicle subsystem; a second control system configured to run a second software for controlling a second vehicle subsystem; a software verification controller configured to:
identify a first identifier of the first software and a second identifier of the second software as a software configuration;query a plurality of databases that each contain data regarding preapproved software configurations including combinations of at least one of different types and different versions of software that have been tested for operability and safety when used together on at least two vehicle subsystems;determine whether the software configuration is preapproved by comparing the first identifier of the first software and the second identifier of the second software to the data regarding preapproved software configurations in at least two of the plurality of databases and determining whether the software configuration matches entries in at least two of the plurality of databases; andif the software configuration is preapproved, authorize the first control system and the second control system to run the first and second software by communicating an authorization signal either directly or indirectly to at least one of the first control system and the second control system.