FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003
COMPLETE SPECIFICATION
[See section 10, Rule 13]
BRAKE CONTROL SYSTEM, ONBOARD DEVICE CONTROL SYSTEM, BRAKE
CONTROL METHOD, AND ONBOARD DEVICE CONTROL METHOD;
MITSUBISHI ELECTRIC CORPORATION, A CORPORATION ORGANISED
AND EXISTING UNDER THE LAWS OF JAPAN, WHOSE ADDRESS IS 7-3,
MARUNOUCHI 2-CHOME, CHIYODA-KU, TOKYO 100-8310, JAPAN
THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE
INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.
2
DESCRIPTION
BRAKE CONTROL SYSTEM, ONBOARD DEVICE CONTROL SYSTEM, BRAKE
CONTROL METHOD, AND ONBOARD DEVICE CONTROL METHOD
5
Field
[0001] The present invention relates to a brake control
system and an onboard device control system to be installed
on a railroad car, a brake control method, and an onboard
10 device control method.
Background
[0002] Conventionally, in a railroad car, an arithmetic
unit of a train information management device collectively
15 manages power running, brake control, and the like of the
car. Patent Literature 1 discloses a technique in which an
arithmetic unit of a train information management device
calculates required air brake force, and a brake controller
controls a brake control valve based on the required air
20 brake force. Patent Literature 1 discloses communication
between the arithmetic unit of the train information
management device and the brake controller to be performed
via a communication interface such as Recommended Standard
(RS) 485.
25
Citation List
Patent Literature
[0003] Patent Literature 1: Japanese Patent Application
Laid-open No. 2008-143365
30
Summary
Technical Problem
[0004] In recent years, introduction of Ethernet
3
(registered trademark) into communication between onboard
devices installed on railroad cars has been considered.
Introduction of Ethernet into railroad cars enables an
increase in transmission capacity while reducing the number
5 of wires between onboard devices of the railroad cars.
However, a communication method based on Ethernet may
involve connection to an open network. In this case,
malfunction of an onboard device may be caused by
unauthorized access by a malicious third party.
10 [0005] The present invention has been made in view of
the above, and an object of the present invention is to
obtain a brake control system capable of avoiding
malfunction due to unauthorized access.
15 Solution to Problem
[0006] To solve the above problem and achieve an object,
a brake control system according to the present invention
to be installed on a railroad car is provided. The system
includes: a brake command unit to output a first brake
20 command by a first communication method and output a second
brake command by a second communication method, the first
brake command indicating details of control of a brake, the
second brake command restricting details of control of the
brake; and a brake control unit to acquire the first brake
25 command by the first communication method via a train
control and monitoring system, acquire the second brake
command by the second communication method, and control the
brake based on the first brake command and the second brake
command.
30
Advantageous Effects of Invention
[0007] According to the present invention, a brake
control system has the effect of avoiding malfunction due
4
to unauthorized access.
Brief Description of Drawings
[0008] FIG. 1 is a diagram showing a configuration
5 example of a brake control system according to a first
embodiment.
FIG. 2 is a flowchart illustrating operation to be
performed by the brake control system according to the
first embodiment at the time of power activation.
10 FIG. 3 is a flowchart illustrating operation to be
performed by the brake control system according to the
first embodiment during railroad car operation after the
power activation.
FIG. 4 is a diagram showing an example in which
15 processing circuitry included in the brake control system
according to the first embodiment includes a processor and
a memory.
FIG. 5 is a diagram showing an example in which the
processing circuitry included in the brake control system
20 according to the first embodiment includes dedicated
hardware.
FIG. 6 is a diagram showing a configuration example of
a railroad car including a brake control unit according to
a second embodiment.
25 FIG. 7 is a flowchart illustrating operation to be
performed by a brake control system according to the second
embodiment during railroad car operation after power
activation.
FIG. 8 is a diagram showing a configuration example of
30 a brake control system according to a third embodiment.
FIG. 9 is a flowchart illustrating operation to be
performed by the brake control system according to the
third embodiment after power activation.
5
Description of Embodiments
[0009] Hereinafter, a brake control system, an onboard
device control system, a brake control method, and an
5 onboard device control method according to each embodiment
of the present invention will be described in detail with
reference to the drawings. Note that the present invention
is not limited to the embodiments.
[0010] First Embodiment.
10 FIG. 1 is a diagram showing a configuration example of
a brake control system 30 according to a first embodiment
of the present invention. The brake control system 30 is a
system that is installed on a railroad car 100, and
controls a brake 20 of the railroad car 100. The brake
15 control system 30 includes a brake command unit 1, a load
compensating device 2, a speed sensor 3, a brake control
unit 4, a regenerative brake control unit 5, an
electropneumatic change valve 6, a main air reservoir 7, a
relay valve 8, a pressure sensor 9, a brake cylinder 10, a
20 pressure sensor 11, a brake shoe 12, a wheel 13, and a
train control and monitoring system 14. The
electropneumatic change valve 6, the main air reservoir 7,
the relay valve 8, the pressure sensor 9, the brake
cylinder 10, the pressure sensor 11, and the brake shoe 12
25 are included in the brake 20. Note that the railroad car
100 actually includes a plurality of the speed sensors 3, a
plurality of the brake control units 4, a plurality of the
wheels 13, and a plurality of the brakes 20. In addition,
when a train includes a plurality of the railroad cars 100,
30 some constituent elements such as the brake command unit 1
may be installed only on specific railroad cars such as the
front car and the rear car of the train.
[0011] The brake command unit 1 is installed in a cab
6
(not illustrated) or the like of the railroad car 100, and
generates and outputs a brake command 1A indicating details
of control of the brake 20. The details of control of the
brake 20 include control for applying the brake 20, control
5 for releasing the brake 20, and the like. The control for
applying the brake 20 refers to control for decelerating
the railroad car 100, which is so-called control for
putting on the brake. The control for releasing the brake
20 refers to control for allowing the railroad car 100 to
10 increase its speed, which is so-called control for
releasing application of the brake. The brake command unit
1 may receive an operation from a train driver or the like
and generate the brake command 1A corresponding to details
of the received operation. In addition, the brake command
15 unit 1 generates and outputs a security signal 1B for
restricting details of control to be performed by the brake
control unit 4. The brake command unit 1 outputs the brake
command 1A to the train control and monitoring system 14 by
a first communication method, and outputs the security
20 signal 1B to the brake control unit 4 by a second
communication method. The first communication method is a
communication method larger in transmission capacity than
the second communication method. Examples of the first
communication method include Ethernet. The second
25 communication method is a communication method smaller in
transmission capacity than the first communication method.
Examples of the second communication method include a
communication method based on RS 485 or the like that has
been used for conventional communication. The following
30 description is based on the assumption that the first
communication method is Ethernet, and the second
communication method is RS 485. Furthermore, in the
following description, the brake command 1A may be referred
7
to as a first brake command, and the security signal 1B may
be referred to as a second brake command.
[0012] As illustrated in FIG. 1, the brake command unit
1 includes a generation unit 21 and an output unit 22. The
5 generation unit 21 generates the brake command 1A and the
security signal 1B. The output unit 22 outputs the brake
command 1A and the security signal 1B. In order to
simplify description, description will be provided below
with a focus on the brake command unit 1.
10 [0013] The load compensating device 2 generates a load
compensation signal 2A by using an air spring pressure
sensor (not illustrated) or the like, and outputs the load
compensation signal 2A. The load compensation signal 2A
indicates a pressure applied by passengers or the like to
15 the railroad car 100.
[0014] The speed sensor 3 is a sensor that generates a
speed signal 3A based on the rotation speed of the wheel 13,
and outputs the speed signal 3A. The speed signal 3A
indicates the speed of the railroad car 100. Note that
20 although not illustrated in FIG. 1, the speed sensor 3 is
installed on each of the front and rear trucks of the
railroad car 100, so that it is possible to detect a speed
from each wheel 13 in the railroad car 100.
[0015] The brake control unit 4 serves, in the railroad
25 car 100, as a brake control device that presses the brake
shoe 12 against the wheel 13 to generate a braking force.
The brake control unit 4 includes an acquisition unit 41
and a control unit 42.
[0016] The acquisition unit 41 acquires the security
30 signal 1B from the brake command unit 1 by the second
communication method, acquires the load compensation signal
2A from the load compensating device 2, and acquires the
speed signal 3A from the speed sensor 3. In addition, the
8
acquisition unit 41 acquires a regenerative feedback signal
5A from the regenerative brake control unit 5, acquires a
feedback command 9A for air cylinder (AC) pressure from the
pressure sensor 9, and acquires a feedback command 11A for
5 brake cylinder (BC) pressure from the pressure sensor 11.
The AC pressure is a command pressure of an air signal 6A
output from the electropneumatic change valve 6. The BC
pressure is a brake cylinder pressure 8A of the relay valve
8. In addition, the acquisition unit 41 acquires the brake
10 command 1A from the train control and monitoring system 14
through Ethernet transmission 14A, the brake command 1A
having been output from the brake command unit 1. That is,
the acquisition unit 41 acquires the brake command 1A by
the first communication method via the train control and
15 monitoring system 14.
[0017] The control unit 42 calculates necessary brake
force for the railroad car 100 based on the brake command
1A, the security signal 1B, the load compensation signal 2A,
and the speed signal 3A, and outputs a regenerative pattern
20 signal 4A indicating the necessary brake force for the
railroad car 100. The control unit 42 generates and
outputs a pressure control signal 4B indicating an air
brake supplement amount obtained by subtraction of the
value of the regenerative feedback signal 5A from the
25 necessary brake force for the railroad car 100.
Furthermore, the control unit 42 controls the brake 20
based on the brake command 1A and the security signal 1B.
Specifically, when control details indicated by the brake
command 1A match control details restricted by the security
30 signal 1B, the control unit 42 controls the brake 20 as
indicated by the brake command 1A. When the control
details indicated by the brake command 1A do not match the
control details restricted by the security signal 1B, the
9
control unit 42 maintains the current state of the brake 20.
[0018] The regenerative brake control unit 5 calculates
actual regenerative brake force corresponding to actual
torque on the basis of the regenerative pattern signal 4A,
5 and generates and outputs the regenerative feedback signal
5A indicating the actual regenerative brake force.
[0019] The electropneumatic change valve 6 converts a
control signal of the pressure control signal 4B, which is
an electric signal output from the control unit 42 of the
10 brake control unit 4, into the air signal 6A indicating
control details with air pressure.
[0020] The main air reservoir 7 is an air tank that
outputs compressed air 7A. The compressed air 7A is air
having been stored and compressed.
15 [0021] The relay valve 8 outputs the compressed air 7A
at a pressure corresponding to a command pressure that is
the air pressure of the air signal 6A output from the
electropneumatic change valve 6. As a result, the relay
valve 8 outputs, to the brake cylinder 10, air at a
20 pressure of the brake cylinder pressure 8A in accordance
with the command pressure of the air signal 6A. The brake
cylinder pressure 8A is obtained by amplification of the
air signal 6A with the compressed air 7A. The brake
cylinder pressure 8A and the command pressure of the air
25 signal 6A are in a direct proportional relationship in
which as the command pressure of the air signal 6A
increases or decreases, the brake cylinder pressure 8A also
increases or decreases.
[0022] The pressure sensor 9 is a sensor that detects
30 the command pressure that is the air pressure of the air
signal 6A. The command pressure is a physical quantity
indicating a force of pressing the brake shoe 12 against
the wheel 13. The pressure sensor 9 returns the detected
10
command pressure of the air signal 6A as the feedback
command 9A to the brake control unit 4.
[0023] The brake cylinder 10 presses the brake shoe 12
against the wheel 13 due to the brake cylinder pressure 8A.
5 [0024] The pressure sensor 11 is a sensor that detects
the brake cylinder pressure 8A which is the air pressure of
the brake cylinder 10. The brake cylinder pressure 8A is a
physical quantity indicating a force of pressing the brake
shoe 12 against the wheel 13. The pressure sensor 11
10 returns the detected brake cylinder pressure 8A as the
feedback command 11A to the brake control unit 4.
[0025] The brake shoe 12 has a friction coefficient.
The brake shoe 12 is pressed against the wheel 13 by the
brake cylinder 10 to generate a brake force, that is, a
15 braking force. The brake force in the brake control system
30 can be calculated as the product of the friction
coefficient of the brake shoe 12 and the brake cylinder
pressure 8A.
[0026] The brake cylinder 10 presses the brake shoe 12
20 against the wheel 13, so that the wheel 13 generates a
brake force, that is, a braking force.
[0027] The train control and monitoring system 14
manages the states of onboard devices installed on the
railroad car 100. The train control and monitoring system
25 14 communicates with onboard devices such as the brake
command unit 1 and the brake control unit 4 by the first
communication method, that is, Ethernet. In the example of
FIG. 1, the train control and monitoring system 14 outputs
the brake command 1A acquired from the brake command unit 1,
30 to the brake control unit 4 through the Ethernet
transmission 14A.
[0028] Next, operation of the brake control system 30
will be described. In the brake control system 30, the
11
train control and monitoring system 14 communicates with
each onboard device via Ethernet as described above.
Ethernet is larger in transmission capacity than RS 485 and
the like. Meanwhile, Ethernet may be connected to an open
5 network. When connected to an open network, Ethernet may
be subjected to unauthorized access by a malicious third
party. In particular, when the brake control unit 4 is
subjected to unauthorized access, there arises a problem
that the brake 20 does not work.
10 [0029] Therefore, in the present embodiment, the brake
command unit 1 outputs the brake command 1A to the brake
control unit 4 via the train control and monitoring system
14, and also outputs the security signal 1B that restricts
details of control of the brake 20 directly to the brake
15 control unit 4. When control details indicated by the
brake command 1A acquired from the brake command unit 1 via
the train control and monitoring system 14 match the
control details restricted by the security signal 1B
directly acquired from the brake command unit 1, the brake
20 control unit 4 controls the brake 20 based on the brake
command 1A. When the control details indicated by the
brake command 1A acquired from the brake command unit 1 via
the train control and monitoring system 14 do not match the
control details restricted by the security signal 1B
25 directly acquired from the brake command unit 1, the brake
control unit 4 does not perform control on the brake 20,
that is, maintains the current state.
[0030] In the brake control system 30 illustrated in FIG.
1, the onboard devices perform communication with the train
30 control and monitoring system 14 via Ethernet. As a result,
the number of wires can be reduced as compared with the
case of communication based on RS 485 in which Ethernet is
not used. Furthermore, in the brake control system 30
12
illustrated in FIG. 1, the number of wires is increased for
only a wire that directly connects the brake control unit 4
and the brake command unit 1 compared with a case where the
brake control unit 4 communicates with the brake command
5 unit 1 only via the train control and monitoring system 14.
The brake control system 30 of the present embodiment can
avoid malfunction due to unauthorized access while using
Ethernet, by increasing the number of wires by one.
[0031] Operation of the brake control system 30 will be
10 described with reference to a flowchart. FIG. 2 is a
flowchart illustrating operation to be performed by the
brake control system 30 according to the first embodiment
at the time of power activation. In the brake control
system 30, the control unit 42 of the brake control unit 4
15 applies the brake 20 at the time of power activation
regardless of whether the brake command 1A has been
acquired from the brake command unit 1 via the train
control and monitoring system 14 (step S1). When the brake
command 1A to release the brake 20 has not been acquired
20 via the train control and monitoring system 14 through the
acquisition unit 41 (step S2: No), the control unit 42
waits until the brake command 1A to release the brake 20 is
acquired. When acquiring the brake command 1A to release
the brake 20 via the train control and monitoring system 14
25 through the acquisition unit 41 (step S2: Yes), the control
unit 42 determines whether a brake release command has been
directly acquired as the security signal 1B from the brake
command unit 1 (step S3). When acquiring a brake release
command as the security signal 1B from the brake command
30 unit 1 via the acquisition unit 41 (step S3: Yes), the
control unit 42 releases the brake 20 (step S4). When the
control unit 42 has acquired no brake release command as
the security signal 1B from the brake command unit 1 via
13
the acquisition unit 41 (step S3: No), the control unit 42
maintains the current state of the brake 20 without
releasing the brake 20, that is, while keeping the brake 20
working (step S5).
5 [0032] FIG. 3 is a flowchart illustrating operation to
be performed by the brake control system 30 according to
the first embodiment during operation of the railroad car
100 after the power activation. In the brake control
system 30, the control unit 42 of the brake control unit 4
10 acquires the brake command 1A from the brake command unit 1
via the train control and monitoring system 14 through the
acquisition unit 41 (step S11). The control unit 42
directly acquires the security signal 1B from the brake
command unit 1 via the acquisition unit 41 (step S12). The
15 control unit 42 determines whether control details
indicated by the brake command 1A match control details
restricted by the security signal 1B (step S13). When the
control details indicated by the brake command 1A match the
control details restricted by the security signal 1B (step
20 S13: Yes), the control unit 42 controls the brake 20 based
on the control details indicated by the brake command 1A
(step S14).
[0033] When the control details indicated by the brake
command 1A do not match the control details restricted by
25 the security signal 1B (step S13: No), the control unit 42
determines that unauthorized access has occurred (step S15),
and does not perform, on the brake 20, control based on the
control details indicated by the brake command 1A, that is,
maintains the current state of the brake 20 (step S16).
30 The control unit 42 outputs an alarm indicating that
unauthorized access has occurred (step S17). As an alarm,
the control unit 42 may provide display indicating that
unauthorized access has occurred, on a display unit of the
14
cab (not illustrated) of the railroad car 100, or may
output a sound indicating that unauthorized access has
occurred from a speaker of the cab (not illustrated) of the
railroad car 100.
5 [0034] Note that, in the present embodiment, whether
unauthorized access has occurred is determined by the brake
command unit 1 and the brake control unit 4 as onboard
devices that are installed on the railroad car 100 and
control the brake 20, but the present invention is not
10 limited thereto. In the railroad car 100, another onboard
device may determine whether unauthorized access has
occurred. For example, a command unit that gives an
instruction on control details to an onboard device in an
onboard device control system installed on the railroad car
15 100, outputs a first command by the first communication
method, and also outputs a second command by the second
communication method. The first command indicates details
of control of an onboard device installed on the railroad
car 100. The second command restricts details of control
20 of the onboard device. A control unit that controls the
onboard device acquires the first command by the first
communication method via the train control and monitoring
system 14, acquires the second command by the second
communication method, and controls the onboard device based
25 on the first command and the second command. In the above
description, the first command corresponds to the brake
command 1A described above, and the second command
corresponds to the security signal 1B described above.
[0035] Next, a hardware configuration of the brake
30 control system 30 will be described. In the brake control
system 30, constituent elements other than the brake
command unit 1 and the brake control unit 4 are implemented
by devices to be installed on a general railroad car. The
15
brake control unit 4 is implemented by processing circuitry.
The processing circuitry may be a memory and a processor
that executes programs stored in the memory, or may be
dedicated hardware.
5 [0036] FIG. 4 is a diagram showing an example in which
processing circuitry included in the brake control system
30 according to the first embodiment includes a processor
and a memory. In a case where the processing circuitry
includes a processor 91 and a memory 92, each function of
10 the processing circuitry of the brake control system 30 is
implemented by software, firmware, or a combination of
software and firmware. The software or firmware is
described as a program, and stored in the memory 92. The
processor 91 reads and executes the program stored in the
15 memory 92 to implement each function of the processing
circuitry. That is, the processing circuitry includes the
memory 92 for storing programs. As a result of execution
of the programs, the brake control system 30 is caused to
perform processing. In addition, it can also be said that
20 these programs cause a computer to execute a procedure and
a method for the brake control system 30.
[0037] Here, the processor 91 may be a central
processing unit (CPU), a processing device, an arithmetic
device, a microprocessor, a microcomputer, a digital signal
25 processor (DSP), or the like. Furthermore, for example, a
nonvolatile or volatile semiconductor memory such as a
random access memory (RAM), a read only memory (ROM), a
flash memory, an erasable programmable ROM (EPROM), or an
electrically EPROM (EEPROM) (registered trademark), a
30 magnetic disk, a flexible disk, an optical disk, a compact
disk, a mini disk, or a digital versatile disc (DVD) is
applicable to the memory 92.
[0038] FIG. 5 is a diagram showing an example in which
16
the processing circuitry included in the brake control
system 30 according to the first embodiment includes
dedicated hardware. In a case where the processing
circuitry includes dedicated hardware, for example, a
5 single circuit, a composite circuit, a programmed processor,
a parallel-programmed processor, an application specific
integrated circuit (ASIC), a field programmable gate array
(FPGA), or a combination thereof is applicable to
processing circuitry 93 illustrated in FIG. 5. The
10 functions of the brake control system 30 may be implemented
by the processing circuitry 93 function by function.
Alternatively, the functions of the brake control system 30
may be collectively implemented by the processing circuitry
93.
15 [0039] Note that some of the functions of the brake
control system 30 may be implemented by dedicated hardware,
and some of the other functions thereof may be implemented
by software or firmware. Thus, the processing circuitry
can implement each of the above-described functions by
20 means of dedicated hardware, software, firmware, or a
combination thereof.
[0040] The hardware configuration of the brake control
unit 4 has been described in detail. Meanwhile, the brake
command unit 1 is also implemented by processing circuitry
25 in the same manner. The processing circuitry may be a
memory and a processor that executes programs stored in the
memory, or may be dedicated hardware.
[0041] As described above, in the brake control system
30 according to the present embodiment, the brake control
30 unit 4 controls the brake 20 based on the brake command 1A
when control details indicated by the brake command 1A
match control details restricted by the security signal 1B,
and maintains the current state of the brake 20 when the
17
control details indicated by the brake command 1A do not
match the control details restricted by the security signal
1B. As a result, even when communication is performed via
Ethernet in the railroad car 100 and the brake command 1A
5 is transmitted via Ethernet, the brake control system 30
can avoid malfunction due to unauthorized access by using
the security signal 1B transmitted by a communication
method other than Ethernet.
[0042] Second Embodiment.
10 In a second embodiment, a case will be described in
which the brake control unit 4 determines that unauthorized
access has occurred and stops operation of another onboard
device when control details indicated by the brake command
1A do not match control details restricted by the security
15 signal 1B.
[0043] In the second embodiment, the configuration of
the brake control system 30 is the same as that in the
first embodiment. In the first embodiment, when
determining that unauthorized access has occurred, the
20 control unit 42 of the brake control unit 4 does not
perform, on the brake 20, control based on the control
details indicated by the brake command 1A. In such a case,
it is assumed that unauthorized access to the other onboard
devices may also have occurred in the brake control system
25 30. Therefore, when determining that unauthorized access
has occurred, the control unit 42 of the brake control unit
4 stops operation of the other onboard devices. FIG. 6 is
a diagram showing a configuration example of the railroad
car 100 including the brake control unit 4 according to the
30 second embodiment. In FIG. 6, a variable voltage variable
frequency (VVVF) 15 and a static inverter (SIV) 16
correspond to the above-described other onboard devices.
When determining that unauthorized access has occurred, the
18
brake control unit 4 instructs the VVVF 15 and the SIV 16
to stop operation. At this time, the brake control unit 4
may instruct the VVVF 15 and the SIV 16 to stop operation
via Ethernet, or may instruct the VVVF 15 and the SIV 16 to
5 stop operation by using a dedicated communication line. In
FIG. 6, solid lines connecting the brake control unit 4,
the VVVF 15, and the SIV 16 indicate Ethernet communication
lines, and dotted lines connecting the brake control unit 4,
the VVVF 15, and the SIV 16 indicate dedicated
10 communication lines. Note that when determining that
unauthorized access has occurred, the brake control unit 4
does not necessarily need to instruct the SIV 16 to stop
operation. Instead, the brake control unit 4 may instruct
only the VVVF 15 to stop operation and cause railroad car
15 devices other than the VVVF 15, including the SIV 16, to
continue operation.
[0044] FIG. 7 is a flowchart illustrating operation to
be performed by the brake control system 30 according to
the second embodiment during operation of the railroad car
20 100 after power activation. In FIG. 7, operation to be
performed in steps S11 to S16 is the same as the operation
in the first embodiment illustrated in FIG. 3. After step
S16, the control unit 42 further stops operation of the
other onboard devices (step S21). The control unit 42
25 outputs an alarm indicating that unauthorized access has
occurred (step S17). As described above, when control
details indicated by the brake command 1A do not match
control details restricted by the security signal 1B, the
brake control unit 4 instructs the other onboard devices
30 connected to the train control and monitoring system 14 to
stop operation, directly or through Ethernet communication.
[0045] Note that, in the present embodiment, the brake
control unit 4 determines whether unauthorized access has
19
occurred, but the present embodiment is not limited thereto.
At least either a constituent element that controls the
VVVF 15 or a constituent element that controls the SIV 16
may determine whether unauthorized access has occurred, and
5 cause the other onboard devices including the brake control
unit 4 to stop operation when it is determined that
unauthorized access has occurred.
[0046] As described above, according to the present
embodiment, the brake control system 30 stops operation of
10 other onboard devices of the railroad car 100 when
determining that unauthorized access has occurred. As a
result, the brake control system 30 can avoid malfunction
of the other onboard devices of the railroad car 100 due to
unauthorized access.
15 [0047] Third Embodiment.
In the first and second embodiments, the brake control
unit 4 directly communicates with the regenerative brake
control unit 5. In a third embodiment, a case will be
described in which the brake control unit 4 communicates
20 with the regenerative brake control unit 5 via the train
control and monitoring system 14 and in addition,
communication between the brake control unit 4 and the
train control and monitoring system 14 is duplicated.
[0048] FIG. 8 is a diagram showing a configuration
25 example of a brake control system 30a according to the
third embodiment. The brake control system 30a is a system
that is installed on a railroad car 100a, and controls the
brake 20 of the railroad car 100a. The brake control
system 30a is different from the brake control system 30 of
30 the first embodiment in that the regenerative brake control
unit 5 is connected to the train control and monitoring
system 14 instead of the brake control unit 4 in the brake
control system 30a. The brake control unit 4 outputs the
20
regenerative pattern signal 4A in FIG. 1 to the train
control and monitoring system 14 through Ethernet
transmission 14A and 14B. The train control and monitoring
system 14 outputs the regenerative pattern signal 4A in FIG.
5 1 to the regenerative brake control unit 5 through Ethernet
transmission 14C. The regenerative brake control unit 5
outputs the regenerative feedback signal 5A to the train
control and monitoring system 14. The train control and
monitoring system 14 outputs the regenerative feedback
10 signal 5A to the brake control unit 4 through the Ethernet
transmission 14A and 14B.
[0049] Here, as illustrated in FIG. 8, communication
between the brake control unit 4 and the train control and
monitoring system 14 is communication through the Ethernet
15 transmission 14A and 14B, that is, duplicated communication.
In this case, the train control and monitoring system 14
also outputs the brake command 1A acquired from the brake
command unit 1 to the brake control unit 4 through the
Ethernet transmission 14A and 14B. Therefore, when control
20 details indicated by at least either of the brake commands
1A acquired via the train control and monitoring system 14
through the Ethernet transmission 14A and 14B match control
details restricted by the security signal 1B directly
acquired from the brake command unit 1, the brake control
25 unit 4 controls the brake 20 based on the brake command 1A
indicating the matching control details.
[0050] FIG. 9 is a flowchart illustrating operation to
be performed by the brake control system 30a according to
the third embodiment after power activation. In the brake
30 control system 30a, the control unit 42 of the brake
control unit 4 acquires the brake commands 1A from the
brake command unit 1 via the train control and monitoring
system 14 and the acquisition unit 41 through the
21
duplicated, that is, two transmission lines (step S31).
The control unit 42 directly acquires the security signal
1B from the brake command unit 1 via the acquisition unit
41 (step S32). The control unit 42 determines whether
5 control details indicated by at least either of the two
brake commands 1A match control details restricted by the
security signal 1B (step S33). When the control details
indicated by at least either of the two brake commands 1A
match the control details restricted by the security signal
10 1B (step S33: Yes), the control unit 42 determines whether
the control details indicated by the two brake commands 1A
match (step S34). When the control details indicated by
the two brake commands 1A match (step S34: Yes), the
control unit 42 controls the brake 20 based on the control
15 details indicated by the brake commands 1A (step S35).
[0051] When it does not fall under the case where the
control details indicated by at least either of the two
brake commands 1A match the control details restricted by
the security signal 1B (step S33: No), the control unit 42
20 determines that unauthorized access has occurred (step S36),
and does not perform, on the brake 20, control based on the
control details indicated by the brake commands 1A, that is,
maintains the current state of the brake 20 (step S37). A
case where it does not fall under the case where the
25 control details indicated by at least either of the two
brake commands 1A match the control details restricted by
the security signal 1B (step S33: No) refers to a case
where neither of the two brake commands 1A indicates
control details matching the control details restricted by
30 the security signal 1B. The control unit 42 outputs an
alarm indicating that unauthorized access has occurred
(step S38). Note that the control unit 42 may also stop
operation of other onboard devices as in the second
22
embodiment.
[0052] When the control details indicated by the two
brake commands 1A do not match (step S34: No), the control
unit 42 controls the brake 20 based on the control details
5 indicated by the brake command 1A matching the control
details restricted by the security signal 1B (step S39).
With regard to the brake command 1A indicating control
details that do not match the control details restricted by
the security signal 1B, the control unit 42 determines that
10 unauthorized access has occurred (step S40). As in step
S38, the control unit 42 may output an alarm indicating
that unauthorized access has occurred.
[0053] Note that, in the present embodiment, the brake
control system 30a has been described in which
15 communication between the brake control unit 4 and the
train control and monitoring system 14 is duplicated in a
case where the brake control unit 4 communicates with the
regenerative brake control unit 5 via the train control and
monitoring system 14. However, the configuration is not
20 limited thereto. The brake control system may be
configured such that communication between the brake
control unit 4 and the train control and monitoring system
14 is duplicated in a case where the brake control unit 4
directly communicates with the regenerative brake control
25 unit 5 as in the first and second embodiments.
[0054] As described above, according to the present
embodiment, when an Ethernet transmission section is
duplicated, and the control details indicated by at least
either of the two brake commands 1A match the control
30 details restricted by the security signal 1B, the brake
control system 30a controls the brake 20 based on the
control details indicated by the brake command 1A matching
the control details restricted by the security signal 1B.
23
As a result, even if either of the two Ethernet
transmission sections is subjected to unauthorized access,
the brake control system 30a can control the brake 20 while
avoiding malfunction due to unauthorized access as long as
5 the other is not subjected to unauthorized access.
[0055] The configurations set forth in the above
embodiments show examples of the subject matter of the
present invention, and it is possible to combine the
configurations with another technique that is publicly
10 known, and is also possible to make omissions and changes
to part of the configurations without departing from the
gist of the present invention.
Reference Signs List
15 [0056] 1 brake command unit; 1A brake command; 1B
security signal; 2 load compensating device; 2A load
compensation signal; 3 speed sensor; 3A speed signal; 4
brake control unit; 4A regenerative pattern signal; 4B
pressure control signal; 5 regenerative brake control
20 unit; 5A regenerative feedback signal; 6 electropneumatic
change valve; 6A air signal; 7 main air reservoir; 7A
compressed air; 8 relay valve; 8A brake cylinder
pressure; 9, 11 pressure sensor; 10 brake cylinder; 12
brake shoe; 13 wheel; 14 train control and monitoring
25 system; 14A, 14B, 14C Ethernet transmission; 15 VVVF; 16
SIV; 20 brake; 21 generation unit; 22 output unit; 30,
30a brake control system; 41 acquisition unit; 42 control
unit; 100, 100a railroad car.

We Claim :
1. A brake control system to be installed on a railroad
car, the system comprising:
a brake command unit to output a first brake command
5 by a first communication method and output a second brake
command by a second communication method, the first brake
command indicating details of control of a brake, the
second brake command restricting details of control of the
brake; and
10 a brake control unit to acquire the first brake
command by the first communication method via a train
control and monitoring system, acquire the second brake
command by the second communication method, and control the
brake based on the first brake command and the second brake
15 command.
2. The brake control system according to claim 1, wherein
the brake control unit controls the brake based on the
first brake command when the control details indicated by
20 the first brake command match the control details
restricted by the second brake command, and maintains a
current state of the brake when the control details
indicated by the first brake command do not match the
control details restricted by the second brake command.
25
3. The brake control system according to claim 1 or 2,
wherein
in a case where the brake control unit applies the
brake at a time of power activation, and acquires a command
30 to release the brake as the first brake command from the
train control and monitoring system by the first
communication method, the brake control unit maintains a
current state of the brake when a brake release command is
25
not acquired as the second brake command from the brake
command unit by the second communication method, and
releases the brake when a brake release command is acquired
as the second brake command from the brake command unit by
5 the second communication method.
4. The brake control system according to any one of
claims 1 to 3, wherein
when the control details indicated by the first brake
10 command do not match the control details restricted by the
second brake command, the brake control unit instructs,
directly or by the second communication method, another
onboard device to stop operation, the another onboard
device being connected to the train control and monitoring
15 system.
5. The brake control system according to claim 1, wherein
in a case where communication between the brake
control unit and the train control and monitoring system is
20 duplicated:
when control details indicated by at least either of
two first brake commands acquired from the train control
and monitoring system match the control details restricted
by the second brake command, the brake control unit
25 controls the brake based on the at least either of the two
first brake commands indicating the control details
matching the control details restricted by the second brake
command; and when neither of the two first brake commands
acquired from the train control and monitoring system
30 indicates control details matching the control details
restricted by the second brake command, the brake control
unit maintains a current state of the brake.
26
6. An onboard device control system to be installed on a
railroad car, the system comprising:
a command unit to output a first command by a first
communication method and output a second command by a
5 second communication method, the first command indicating
details of control of an onboard device installed on the
railroad car, the second command restricting details of
control of the onboard device; and
a control unit to acquire the first command by the
10 first communication method via a train control and
monitoring system, acquire the second command by the second
communication method, and control the onboard device based
on the first command and the second command.
15 7. A brake control method to be performed in a brake
control system to be installed on a railroad car, the
method comprising:
a first step of causing a brake command unit to output
a first brake command by a first communication method and
20 output a second brake command by a second communication
method, the first brake command indicating details of
control of a brake, the second brake command restricting
details of control of the brake; and
a second step of causing a brake control unit to
25 acquire the first brake command by the first communication
method via a train control and monitoring system, acquire
the second brake command by the second communication method,
and control the brake based on the first brake command and
the second brake command.
30
8. The brake control method according to claim 7, wherein
in the second step, the brake control unit controls
the brake based on the first brake command when the control
27
details indicated by the first brake command match the
control details restricted by the second brake command, and
maintains a current state of the brake when the control
details indicated by the first brake command do not match
5 the control details restricted by the second brake command.
9. The brake control method according to claim 7 or 8,
wherein
in the second step, in a case where the brake control
10 unit applies the brake at a time of power activation, and
acquires a command to release the brake as the first brake
command from the train control and monitoring system by the
first communication method, the brake control unit
maintains a current state of the brake when a brake release
15 command is not acquired as the second brake command from
the brake command unit by the second communication method,
and releases the brake when a brake release command is
acquired as the second brake command from the brake command
unit by the second communication method.
20
10. The brake control method according to any one of
claims 7 to 9, wherein
in the second step, when the control details indicated
by the first brake command do not match the control details
25 restricted by the second brake command, the brake control
unit instructs, directly or by the second communication
method, another onboard device to stop operation, the
another onboard device being connected to the train control
and monitoring system.
30
11. The brake control method according to claim 7, wherein
in a case where communication between the brake
control unit and the train control and monitoring system is
28
duplicated:
when control details indicated by at least either of
two first brake commands acquired from the train control
and monitoring system match the control details restricted
5 by the second brake command, the brake control unit
controls the brake in the second step based on the at least
either of the two first brake commands indicating the
control details matching the control details restricted by
the second brake command; and when neither of the two first
10 brake commands acquired from the train control and
monitoring system indicates control details matching the
control details restricted by the second brake command, the
brake control unit maintains a current state of the brake
in the second step.
12. An onboard device control method to be performed in an
onboard device control system to be installed on a railroad
car, the method comprising:
a first step of causing a command unit to output a
first command by a first communication method and output a
20 second command by a second communication method, the first
command indicating details of control of an onboard device
installed on the railroad car, the second command
restricting details of control of the onboard device; and
a second step of causing a control unit to acquire the
25 first command by the first communication method via a train
control and monitoring system, acquire the second command
by the second communication method, and control the onboard
device based on the first command and the second command.