Control system for a railway consist, in particular for freight transport

Abstract

A control system for a railway convoy (400), specifically a control system for a freight convoy, is described, comprising carriages (102), a main locomotive (101), and at least one subordinate locomotive (402, 403). The railway convoy (400) includes a brake pipe (105) extending along the entire convoy (400). The main locomotive (101) is arranged to control the pressure in the brake pipe (105) and to send traction and / or braking commands to the subordinate locomotives (402, 403) via a communication channel. At least one subordinate locomotive (402, 403) 02, 403) includes a transceiver device (230) arranged to receive traction and / or braking commands sent by the main locomotive (101) and to retransmit the commands to the traction control unit (232) and the braking control unit (211) of the subordinate locomotives (402, 403). The control system includes a safety unit (501) arranged to prevent the relay valve (212) from supplying the brake pipe (105) when at least one fault condition occurs in the control system for the railway fleet (400).

Description

Technical Field

[0001] This invention generally belongs to the field of railway braking systems, and more specifically, it relates to a control system for railway convoys, particularly a control system for railway convoys used in freight transport. Background Technology

[0002] In the following text, reference will be made to European standards EN50129:rev.2018, EN50159:rev.2010, EN50126-1:rev.2017, EN50126-2:rev.2017 and EN50128:rev.2011, which are:

[0003] -EN50126 [“Railway applications - Specifications and examples of reliability, availability, maintainability and safety (RAMS)”;

[0004] -EN50128 ["Railway applications - Communication, signaling and processing systems. Software for railway control and protection systems"];

[0005] -EN50129 ["Railway applications - Communication, signaling and processing systems. Electronic systems for signaling related to safety"];

[0006] -EN50159 [“Railway applications - Communication, signaling and processing systems. Communication in transmission systems related to safety”].

[0007] Specifically, standard EN50126 specifies a method for assigning safety levels SIL0 / 1 / 2 / 3 / 4 (with SIL4 representing the highest safety level) to subsystems that make up a system based on the results of a safety analysis. Standards EN50128 and EN50129 specify the basis for assigning SIL levels based on the above safety analysis results, which are applicable to the design standards of software and hardware components, respectively.

[0008] What is known in the prior art is:

[0009] - Based on safety calculations related to emergency braking functions according to European standard EN50126, the safety integrity level (SIL) ≥ 3 is systematically assigned to emergency braking functions, and therefore usually to the subsystems that implement these functions;

[0010] - Safety calculations relating to service braking functions, performed in accordance with European standard EN50126, typically assign a safety integrity level (SIL) ≤ 2 to service braking functions, and therefore to the subsystems that implement these functions.

[0011] - According to the SIL≥3 level in accordance with EN50128 and EN50129, the development of control units, which are typically based on microprocessors or field-programmable gate arrays (FPGAs), involves design, verification and certification costs that are about an order of magnitude higher than those of designs based on the SIL≤2 level.

[0012] Regarding the last point above, it is clear that features developed based on a SIL≥3 security level are worth retaining, as they are very limited and simple.

[0013] Figure 1 A known configuration of a train used for transporting goods is shown.

[0014] Train 100 is formed by locomotive 101 pulling multiple carriages 102.

[0015] The braking system of the train 100 installed on the locomotive 101 includes a unit 103 for generating, filtering and storing compressed air, which is arranged to supply compressed air to the brake control unit 104. The compressed air is typically stored at a pressure value that varies between 6 bar and 10 bar.

[0016] The brake control unit 104 provides a conduit 105, referred to as a "brake pipe," which extends along the entire length of the train and typically includes a rigid section 107 mounted on the carriage 102 and a flexible element 106 mounted between the carriages. The flexible element 106 is adapted to ensure the aerodynamic continuity of the brake pipe 105 under all conditions of railway track curvature.

[0017] On each carriage 102, a braking unit 108 is connected to a brake pipe 105. The braking unit 108 collects compressed air from the brake pipe 105 to supply the brake cylinder 109, and its pressure depends on the current pressure value applied in the brake pipe 105 by the brake control unit 104.

[0018] Figure 3 The transfer function of the braking unit 108 as specified by the UIC (International Union of Railways) standard is shown: the X-axis represents the pressure in the brake tube 105, and the Y-axis represents the braking pressure output by the braking unit 108.

[0019] When the pressure in the brake pipe, i.e. the input pressure of the brake unit 108, has a rated value of 5 bar, the value of the brake pressure output by the brake unit 108 is assumed to be 0 bar, i.e., no braking action is performed.

[0020] When the pressure in the brake pipe, i.e. the input pressure of the brake unit 108, has any other value equal to or less than the rated value of 3.5 bar, the value of the brake pressure output by the brake unit 108 is assumed to be 3.8 bar, i.e. the maximum brake pressure applied, which corresponds to emergency braking.

[0021] The pressure value in the brake pipe, i.e. the input pressure of the brake unit 108, is between the rated value of 3.5 bar and the rated value of 5 bar. The brake pressure output by the brake unit 108 is assumed to be a linear pressure value between the rated value of 3.8 bar and the rated value of 0 bar, except that the minimum pressure range on the X-axis is approximately the rated value of 5 bar.

[0022] Figure 2 A simplified embodiment of the brake control unit 104 is shown. In the prior art, the brake control unit 104 can take various more or less complex forms, for example, such as Figure 2 As shown.

[0023] The main pipeline 201 is supplied by unit 103 for generating, filtering and storing compressed air, the pressure of which typically varies between 6 bar and 10 bar.

[0024] The main pipe 201 supplies pressure relief valve 202, which is designed to supply a pressure value typically below 6 bar to a set of pneumatic solenoid valves 203, 204, and 205.

[0025] The pneumatic solenoid valve 203 is actuated by the electrical command signal 206. When the electrical command signal 206 does not provide a signal, it presents a first state that prevents the supply pressure from propagating to the valve 204. When the electrical command signal 206 provides a signal, it presents a second state that allows the supply pressure to propagate to the pneumatic solenoid valve 204.

[0026] The electrical command signal 206 can be generated by the brake control unit 211 or an external source, and its nature depends on the general structure of the locomotive 101.

[0027] The main pipeline 201 also supplies power to the pneumatic solenoid valve 209.

[0028] The pneumatic solenoid valve 209 is actuated by the electrical command signal 210. When the electrical command signal 210 does not provide a signal, it presents a first state that prevents the supply pressure from propagating to the relay valve 212. When the electrical command signal 210 provides a signal, it presents a second state that allows the supply pressure to propagate to the relay valve 212.

[0029] The electrical command signal 210 can be generated by the brake control unit 211 or an external source, and its nature depends on the general structure of the locomotive 101.

[0030] The pneumatic solenoid valve 204 is actuated by the electrical command signal 207. When the electrical command signal 207 does not provide a signal, it can present a first state that prevents the supply pressure from propagating to the pilot chamber 213 of the relay valve 212. When the electrical command signal 207 provides a signal, it can present a second state that allows the supply pressure to propagate to the pilot chamber 213 of the relay valve 212.

[0031] The pneumatic solenoid valve 205 is actuated by the electrical command signal 208. When the electrical command signal 208 does not provide a signal, it can present a first state that allows the pressure in the pilot chamber 213 of the relay valve 212 to be discharged to the atmosphere. When the electrical command signal 208 provides a signal, it can present a second state that inhibits the pressure in the pilot chamber 213 of the relay valve 212 from being discharged to the atmosphere.

[0032] Electrical command signals 207 and 208 are generated by the brake control unit 211.

[0033] The brake control unit 211 receives a request command 217 to apply pressure to the brake pipe 105, the pressure value being within the rated range of 0 bar and a maximum value typically between 5 bar and 5.5 bar.

[0034] According to the request received from command 217, the brake control unit 211 supplies power to the two pneumatic solenoid valves 204 and 205 by modulating electrical signals 207 and 208 to increase the pressure at the outlet 214 of the relay valve 212, de-energizes the two pneumatic solenoid valves 204 and 205 to decrease the pressure at the outlet 214 of the relay valve 212, de-energizes the pneumatic solenoid valve 204 and supplies power to the pneumatic solenoid valve 205 to maintain the pressure at the outlet 214 of the relay valve 212 unchanged, and closes the circuit controlling the pressure of the pilot chamber 213 by reading the first pressure sensor 236 pneumatically connected to the pilot chamber 213, thereby decreasing, maintaining and increasing the pressure at the outlet 214 of the relay valve 212.

[0035] The pneumatic solenoid valve 215 is located between the outlet 214 of the relay valve 212 and the brake pipe 105. The pneumatic solenoid valve 215 is actuated by the electrical command signal 218. When the electrical command signal 218 does not provide a signal, it presents a first state that inhibits the pneumatic connection between the brake pipe 105 and the relay valve 212. When the electrical command signal 218 provides a signal, it presents a second state that allows the pneumatic connection between the brake pipe 105 and the relay valve 212.

[0036] In many practical applications, depending on the local regulations of different railway operators, Figure 2 The block diagram shown contains either only pneumatic solenoid valve 209 or only pneumatic solenoid valve 215.

[0037] The pneumatic solenoid valve 219 is pneumatically connected to the brake pipe 105. The pneumatic solenoid valve 219 is actuated by an electrical signal 220 defined as an “emergency circuit”. When the emergency circuit 220 provides a signal, it presents a first state that inhibits the pneumatic connection between the brake pipe 105 and the atmosphere. When the emergency circuit 220 does not provide a signal, it presents a second state that allows the pneumatic connection between the brake pipe 105 and the atmosphere.

[0038] Emergency circuit 220 can be interrupted by one or more contacts 222, which are actuated by one or more devices 221 that can request emergency braking of the train.

[0039] In the event of an event requiring emergency braking, one or more devices 221 open one or more corresponding contacts 222, thereby interrupting the emergency circuit 220 and causing the pneumatic solenoid valve 219 to enter its second state.

[0040] In this way, the pneumatic solenoid valve 219 connects the brake pipe 105 to the atmosphere, that is, makes the pressure in the brake pipe 105 reach the nominal value of 0 bar, which corresponds to the pressure value of emergency braking.

[0041] In some non-exclusive cases, one or more devices 221 may be compatible with transceiver device 230 and / or with brake control unit 211.

[0042] In addition, the emergency circuit 220 can be connected to the brake control unit 211. When the signal 220 indicates an emergency braking request, that is, in the absence of an electrical signal, the actuation of the two pneumatic solenoid valves 204 and 205 is released so that the pressure at the outlet 214 of the relay valve 212 reaches 0 bar, that is, the brake line is further discharged through the relay valve.

[0043] Furthermore, the emergency circuit 220 can be used to activate contact 223 when power is available, or to disable the contact when power is not available. Thus, when signal 220 is de-energized, contact 223 is in the open state, thereby releasing the actuation of the two pneumatic solenoid valves 204 and 205, so that the pressure at the outlet 214 of relay valve 212 reaches 0 bar, that is, the brake pipe is further discharged through the relay valve, which has a redundancy relationship with the action simultaneously performed by pneumatic solenoid valve 219.

[0044] The action of bringing the pressure of the brake pipe 105 to the rated value of 0 bar means that the maximum braking pressure corresponding to 3.8 bar is applied to the brake unit 108.

[0045] As mentioned earlier, the emergency braking function needs to be developed according to safety level SIL4.

[0046] In the prior art, the integrated component group including the pneumatic solenoid valve 219, signal 220, one or more devices 221, one or more corresponding contacts 222, contacts 223, and all the above-mentioned components constituting the emergency braking application function is developed according to the SIL4 safety level that conforms to applicable European standards.

[0047] Braking application actions performed by the integration of a group of components including a pneumatic solenoid valve 219, a signal 220, one or more devices 221, one or more corresponding contacts 222 and 223 take precedence over any actions performed by the brake control unit 211: this solution allows the development of the brake control unit 211 to not exceed the safety level SIL2 according to the standards EN50128 and EN50129.

[0048] Pressure switch 231 is pneumatically connected to brake pipe 105 and is arranged to generate electrical command signal 233 connected to traction control unit 232.

[0049] When the pressure in the brake pipe 105 is greater than 3.5 bar, the pressure switch 231 supplies power to the command signal 233. When the pressure in the brake pipe 105 is equal to or less than 3.5 bar, the pressure switch 231 stops supplying power to the command signal 233.

[0050] Appropriate circuitry 234 within the traction control unit 232 monitors the presence of electricity on the command signal 233: when tension is detected on the command signal 233, the circuitry 234 allows the traction control unit 232 to supply power to the traction motor (not shown), and when no tension is detected on the command signal 233, the circuitry 234 prevents the traction control unit 232 from supplying power to the traction motor (not shown).

[0051] This solution prevents the traction control system from supplying power to the motor when an emergency braking request is received, thus preventing the traction of train 100.

[0052] In the prior art, the integrated component group including pressure switch 231, command signal 233, appropriate circuit 234, and all the aforementioned components constituting the traction suppression function during emergency braking is developed according to the SIL4 safety level conforming to applicable European standards.

[0053] The growing demand for increased railway freight capacity requires more traction. If a single locomotive 101 cannot provide the necessary power, one or more locomotives will be added to the train 100.

[0054] exist Figure 4 In this example, as a non-exclusive one, a second locomotive 402 is added at the middle position of train 400. An additional locomotive 403 can be added at the end of train 400 as a replacement for locomotive 402 or as an addition to locomotive 402; more locomotives can be added to train 400. The additional locomotives 402 and 403 also have their own unit 103 for generating, filtering, and storing compressed air, which is arranged to supply air to their own brake control unit 104 and connected to the brake pipe 105.

[0055] Additional locomotives 402 and 403, defined as subordinate locomotives, must be synchronized with the lead locomotive 101, defined as the main locomotive, in order to correctly replicate the traction or braking actions performed by the main locomotive 101. For this purpose, the main locomotive 101 and one or more subordinate locomotives 402 and 403 communicate with each other via radio communication channel 404 or wired serial communication channel 405. Inside the main locomotive and subordinate locomotives, transceiver devices 230 are arranged to transmit and receive on communication channels 404 and 405. Inside the main locomotive and subordinate locomotives, transceiver devices 230 communicate with the traction control unit 232 and the braking control unit 211 via internal communication devices 235, including but not limited to serial communication channels.

[0056] WO2017025895 describes in detail the communication system between the main locomotive and one or more subordinate locomotives, and the procedures for handling the loss of radio channels. Figure 4 The impact on train operation safety is illustrated, and a method for mitigating risks in degraded modes is requested.

[0057] The non-exclusivity of the degraded mode manifests as follows: the main locomotive 101 applies emergency braking and simultaneously sends a request to apply emergency braking to one or more subordinate locomotives 402 and 403, while one or more subordinate locomotives 402 and 403 are currently in a non-braking state and have not received the request to apply emergency braking. In this case, the following series of events occur:

[0058] - Near the main vehicle 101, the pressure in brake line 105 drops to 0 bar;

[0059] - The pressure in brake pipe 105 is maintained at 5 bar near one or more subordinate locomotives 402, 403;

[0060] - This pressure difference causes air to flow from one or more slave locomotives 402, 403 to the main locomotive 101, resulting in a pressure drop along the brake pipe 105, thereby producing a pressure value ranging from a rated value of 5 bar near the first slave locomotive 402 to a rated value of 0 bar near the main locomotive 101.

[0061] - All carriages with brake line pressure below the rated value of 3.5 bar will periodically apply the maximum braking pressure value;

[0062] - All carriages with brake line pressure between 3.5 bar and 5 bar will be handled according to... Figure 3 Apply pressure to the block diagram in the middle;

[0063] -In particular, the pressure in the brake pipe 105 of the car near the first slave locomotive 402 and the car between the second slave locomotive 402 and the possible additional slave locomotive 403 will be greater than or equal to the rated value of 5 bar, and no braking will be applied.

[0064] - In addition, if one or more subordinate locomotives 402, 403 are in active traction state before the communication channel 404 is lost, they will continue to apply traction force because the pressure of pressure switch 231 will not drop below 3.5 bar, thereby preventing pressure switch 231 from inhibiting traction control unit 232.

[0065] The overall result is that train 100 is in an emergency braking state, but only the front part of the train can actually implement emergency braking, while the part of the train close to one or more subordinate locomotives 402 and 403 is still in the released state, and one or more subordinate locomotives 402 and 403 continue to push the train, resulting in a high risk of train 400 derailing.

[0066] WO2017025895 proposes that if communication channel 404 is lost, relay valves 212 belonging to one or more subordinate locomotives 402, 403 should be prevented from supplying power to pipeline 405. This would allow the pressure across the entire train to drop to 0 bar over time, thus preventing the aforementioned dangerous situation.

[0067] WO2017025895 neither describes nor advocates what level of security the equipment and related software responsible for risk mitigation actions must meet.

[0068] As can be seen from the above description, the equipment and related software responsible for risk mitigation operations, especially those related to emergency braking, must be developed according to the SIL≥3 level in accordance with the EN50128 and EN50129 standards.

[0069] In this case, the brake control unit 211, which is responsible for controlling the relay valve 212 and the pneumatic solenoid valves 209 and 215, must be developed according to the SIL≥3 level in accordance with the standards of EN50128 and EN50129.

[0070] Considering the functional complexity, hardware, and software of the brake control unit 211, for the reasons mentioned above, the development of the brake control unit 211 according to the SIL≥3 level of the EN50128 and EN50129 standards is very complex and uneconomical. Summary of the Invention

[0071] Therefore, the purpose of this invention is to provide a simpler solution with lower development costs.

[0072] Another objective is to provide a solution in which, in the event of emergency braking, not only the front of the train is subjected to emergency braking, thereby correspondingly reducing the risk of the train itself derailing.

[0073] According to one aspect of the invention, the above and other objects and advantages are achieved by a control system for a railway fleet, specifically for freight transport, having the features defined in embodiment 1. Preferred embodiments of the invention are described in detail in other embodiments, the contents of which should be understood as an integral part of this specification. Attached Figure Description

[0074] The functional and structural features of some preferred embodiments of the control system for a railway fleet according to the present invention will now be described. Please refer to the accompanying drawings, in which:

[0075] Figure 1 A known configuration of a train used for transporting goods is shown;

[0076] Figure 2 A simplified embodiment of a brake control unit according to the prior art is shown;

[0077] Figure 3 The transfer function of the braking unit as specified in the UIC standard is shown;

[0078] Figure 4 The train is shown, with a second locomotive added in the middle of the train;

[0079] Figure 5 This is an exemplary embodiment of the control system for a railway fleet according to the present invention; and

[0080] Figure 6 A possible solution for suppressing pressure changes in the brake line caused by the relay valve is shown. Detailed Implementation

[0081] Before explaining the various embodiments of the present invention in detail, it should be clarified that the invention is not limited in application to the design details and configurations of the components presented in the following description or illustrated in the drawings. The invention can be implemented in practice in other embodiments and can be practiced or constructed in different ways. It should also be understood that these terms and expressions are descriptive in nature and should not be construed as limiting. The use of “comprising” and “including” and variations thereof should be understood to include the elements listed below and their equivalents, as well as additional elements and their equivalents.

[0082] Figure 5 Copy already in Figure 2The braking control system 104 shown in the figure and previously described includes a new safety unit 501 added to the subordinate locomotives 402, 403 to monitor and enhance safety functions.

[0083] The following describes a first embodiment of a control system for a railway convoy 400, specifically for freight transport, comprising a plurality of carriages 102, a main locomotive 101 placed at the head of the train 400, and at least one subordinate locomotive 402, 403 distributed throughout the railway convoy 400.

[0084] The railway convoy 400 includes a brake pipe 105 for service and emergency pneumatic braking of the railway convoy 400, the brake pipe 105 extending along the entire railway convoy 400.

[0085] The main locomotive 101 is configured to control the pressure in the brake pipe 105 and to send traction and / or braking commands to at least one subordinate locomotive 402, 403 via radio or wired communication channels 404, 405.

[0086] At least one subordinate locomotive 402, 403 includes a transceiver device 230 arranged to receive traction and / or braking commands transmitted by the main locomotive 101 via communication channels 404, 405. The transceiver device 230 is also arranged to retransmit the traction and / or braking commands to the traction control unit 232 and the braking control unit 211 of at least one subordinate locomotive 402, 403 to control the pressure in the brake pipe 105.

[0087] A transceiver device can be a transceiver equipment, a transceiver system, or a transceiver unit, etc.

[0088] Traction and / or braking commands are retransmitted via a communication device 235 inside at least one subordinate locomotive 402, 403.

[0089] The brake control unit 211 is arranged to control the pressure in the brake pipe 105 by acting on a first pneumatic solenoid valve 204 and a second pneumatic solenoid valve 205. The first pneumatic solenoid valve 204 is arranged to increase the pressure in the pilot chamber 213 of the relay valve 212, and the second pneumatic solenoid valve 205 is arranged to decrease the pressure in the pilot chamber 213 of the relay valve 212.

[0090] The inlet of the relay valve 212 is supplied by the main pipeline 201, and the outlet of the relay valve 212 is connected to the brake pipe 105.

[0091] The control system for the railway fleet 400 includes a safety unit 501 associated with the brake control unit 211.

[0092] The safety unit 501 is configured to prevent the relay valve 212 from supplying the pneumatic brake tube 105 when at least one fault condition occurs in the control system used for the railway fleet 400.

[0093] At least one fault condition for the control system used in the railway fleet 400 may include:

[0094] - The communication channel is not permitted to send traction and / or braking commands to at least one subordinate locomotive 402, 403, or

[0095] - Transceiver device 230 is unable to receive traction and / or braking commands sent by the main locomotive 101 via the communication channel, or is unable to retransmit the traction and / or braking commands to the traction control unit 232 and the braking control unit 211 of at least one subordinate locomotive 402, 403, to control the pressure conditions in the brake pipe 105, or

[0096] - The condition that the communication device 235 inside at least one subordinate locomotive 402, 403 does not allow the traction and / or braking commands to be retransmitted to the traction control unit 232 and the braking control unit 211 of at least one subordinate locomotive 402, 403.

[0097] The above conditions can obviously occur simultaneously in any combination.

[0098] The brake control unit 211 can be developed according to the safety level of SIL≤2 according to the aforementioned standards EN50128 and EN50129. According to the invention, a safety unit 501 can be added, which is developed according to the SIL≤2 level of the standards EN50128 and EN50129.

[0099] In a first embodiment, the safety unit 501 may be arranged to receive a diagnostic signal 502 generated by the transceiver device 230. The diagnostic signal 502 may be arranged to have a first state in which it indicates that the transceiver device 230 is operating correctly and that communication with one or more additional locomotives belonging to the railway fleet 400 is considered to be established and operated by the transceiver device 230. The diagnostic signal 502 may also be arranged to have a second state in which it indicates that the transceiver device 230 is not operating correctly and that communication with one or more additional locomotives belonging to the railway fleet 400 is not considered to be established and operated by the transceiver device 230.

[0100] The main vehicle 101 sends a message in period T. In accordance with the recommendation of standard EN50159, the message sent by the main vehicle 101 includes a parameter indicating that the message is continuously updated by the main vehicle 101. This parameter is incremented by the main vehicle with each message in the form of a non-exclusive instance counter.

[0101] The information sent by the main vehicle 101 is received by the transceiver device 230 and immediately transmitted from there to the brake control unit 211 and the safety unit 501 via the communication device 235.

[0102] In summary, under at least one of the following circumstances:

[0103] - The safety unit 501 does not receive any information during a specified time interval T corresponding to the transmission cycle of the main vehicle 101, the time interval T having a predetermined tolerance ±ΔT necessary to tolerate physiological communication jitter.

[0104] -Security unit 501 detected that the parameter indicating that information is being continuously updated does not indicate that the currently received information is being updated;

[0105] - Diagnostic signal 502 presents a second state, indicating that transceiver device 230 is not operating correctly, or that communication with one or more subordinate locomotives belonging to train 100 is not considered to be established and operated by transceiver device 230.

[0106] Safety unit 501 believes that the global transmission channel, including the one from the main vehicle 101 to the local communication channel 235, has failed, and therefore safety unit 501 believes that the brake control unit 211 is unable to receive information from the main vehicle 101, including information containing an emergency braking application request.

[0107] In another embodiment, the control system for the railway convoy 400 used for transporting goods may further include a first pressure sensor component 236, which is arranged to be pneumatically connected to the pilot chamber 213 of the relay valve 212. The brake control unit, the first pneumatic solenoid valve 204, the second pneumatic solenoid valve 205, the relay valve 212, and the first pressure sensor component 236 are arranged to perform the function of controlling the pressure in the brake pipe 105 of the railway convoy 400.

[0108] This control function can be implemented based on a known control algorithm that is based on the presence of the brake control unit, the first pneumatic solenoid valve 204, the second pneumatic solenoid valve 205, the relay valve 212, and the first pressure sensor component 236.

[0109] In this scenario, at least one fault condition of the control system for the railway fleet 400 may include a condition in which at least one of the first electro-pneumatic valve 204, the second pneumatic solenoid valve 205, the relay valve 212, and the first pressure sensor component 236 malfunctions. In other words, when the safety unit detects that the pressure control function in the brake pipe 105 of the railway fleet 400 is malfunctioning, the safety unit 501 may also be configured to prevent the relay valve 212 from supplying power to the pneumatic brake pipe 105.

[0110] In a second embodiment, the safety unit 501 may be arranged to receive a diagnostic signal 503 generated by the brake control unit 211. This diagnostic signal 503 is arranged to have a first state, in which it indicates that the brake control unit 211 is operating correctly and is able to correctly control the pressure 214 at the outlet of the relay valve 212. The diagnostic signal 503 may also be arranged to have a second state, indicating that the brake control unit 211 is not operating correctly or is unable to correctly control the pressure 214 at the outlet of the relay valve 212.

[0111] In fact, diagnostic signal 503 can also indicate the health status of pneumatic solenoid valves 204, 205, first pressure sensor component 236, and relay valve 212. Other pressure sensors (not shown) connected to the brake control unit 211, for example, as a non-exclusive example, another pressure sensor component directly connected to the brake pipe 105, can provide the brake control unit 211 with further information about the function of the elements used to control the pressure in the brake pipe 105.

[0112] In another embodiment, the control system for a railway fleet may include a second pressure sensor component 506 pneumatically connected to the brake pipe 105 and electrically connected to the safety unit 501 via an electrical signal 507.

[0113] In each embodiment, the first pressure sensor component 236 and the second pressure sensor component 506 may be pressure sensors, respectively.

[0114] In this case, the safety unit 501 can be arranged to:

[0115] - The pressure in the brake pipe 105 is monitored by the second pressure sensor component 506;

[0116] - Receive traction and / or braking commands sent by the main locomotive 101 to at least one subordinate locomotive via the communication device 235 and simultaneously at the brake control unit 211, the commands indicating the pressure value applied to the brake pipe 105.

[0117] For each traction and / or braking command received, compare whether the pressure value indicated by the respective traction and / or braking command falls within a threshold range, which includes the respective pressure values ​​measured by the second pressure sensor component 506.

[0118] Therefore, at least one fault condition of the control system for a railway fleet may include a condition in which the pressure value indicated by each traction and / or braking command does not fall within a threshold range, which includes the pressure values ​​measured by the second pressure sensor component 506.

[0119] In other words, if the pressure value read by the second pressure sensor component 506 matches the pressure value received in the information sent by the main vehicle 101 within a predetermined tolerance, the safety unit considers that the brake control unit 211 and the pneumatic chain consisting of solenoid valves 204, 205, relay valve 212 and the first pressure sensor 236 are operating correctly.

[0120] If the pressure value read by the second pressure sensor component 506 exceeds a predetermined tolerance value relative to the pressure value received in the information sent by the main vehicle 101, the safety unit considers that the brake control unit 211 and the pneumatic chain consisting of solenoid valves 204, 205, relay valve 212 and the first pressure sensor component 236 are not operating correctly.

[0121] In another embodiment, the security element 501 may be arranged to:

[0122] - The pressure in the brake pipe 105 is monitored by the second pressure sensor component 506;

[0123] - Receive traction and / or braking commands sent by the main locomotive 101 to at least one subordinate locomotive via the communication device 235 and simultaneously at the brake control unit 211, the commands indicating the pressure value applied to the brake pipe 105;

[0124] - For each traction and / or braking command received, compare whether the value measured by the second pressure sensor component 506 falls within a threshold range, which includes the respective pressure values ​​indicated by the respective traction and / or braking commands sent by the main locomotive 101 to at least one subordinate locomotive.

[0125] Therefore, at least one fault condition for the control system of a railway fleet may include a condition in which the value measured by the second pressure sensor component 506 does not fall within a threshold range, which includes the respective pressure values ​​indicated by the respective traction and / or braking commands sent by the main locomotive 101 to at least one subordinate locomotive.

[0126] In summary, the following conditions apply:

[0127] - Diagnostic signal 503 presents a second state, indicating that the brake control unit 211 is not operating correctly or is unable to properly control the pressure at the outlet 214 of the relay valve 212.

[0128] - The current pressure value at brake pipe 105 exceeds a predetermined tolerance value relative to the current pressure value received in the information sent by the main vehicle 101, or vice versa.

[0129] Safety unit 501 believes that the brake control unit 211, pneumatic solenoid valves 204 and 205, relay valve 212 and first pressure sensor component 236 have malfunctioned, that is, they cannot properly control the pressure at the outlet 214 of relay valve 212, especially during emergency braking requests.

[0130] In another embodiment, safety unit 501 may be arranged to prevent the relay valve 212 from supplying power to the brake line 105 via a pneumatic solenoid valve 209 disposed between the main pipe 201 and the pneumatic inlet of the relay valve 212. The pneumatic solenoid valve 209 may be arranged to present a first state that inhibits the propagation of pneumatic supply pressure from the main pipe 201 to the pneumatic inlet of the relay valve 212, and a second state that allows the propagation of pneumatic supply pressure from the main pipe 201 to the pneumatic inlet of the relay valve 212. Safety unit 501 may thus be arranged to actuate the pneumatic solenoid valve 209 to its first state when safety unit 501 must prevent the relay valve 212 from supplying power to the brake line 105.

[0131] In other words, safety unit 501 can be arranged to actuate the pneumatic solenoid valve 203 to open or close via electrical command signal 206. By actuating the pneumatic solenoid valve 203 to the open state, safety unit 501 allows the pneumatic solenoid valve 204 to increase the pressure in the pilot chamber 213, i.e., allows the relay valve 212 to increase the pressure in the brake pipe 105. By actuating the pneumatic solenoid valve 203 to the closed state, safety unit 501 prevents the pneumatic solenoid valve 204 from increasing the pressure in the pilot chamber 213, i.e., prevents the relay valve 212 from increasing the pressure in the brake pipe 105. Safety unit 501 is also arranged to actuate the pneumatic solenoid valve 209 to open or close via electrical command signal 210. By actuating the pneumatic solenoid valve 209 to the open state, safety unit 501 allows air to flow from the main pipe 201 to the relay valve 212, thereby allowing the relay valve 212 to increase the pressure in the brake pipe 105. By actuating the pneumatic solenoid valve 209 to the closed state, safety unit 501 prevents air flow from the main pipe 201 to the relay valve 212, thereby preventing the relay valve 212 from increasing the pressure in the brake pipe 105. Safety unit 501 is arranged to control the opening or closing state of the pneumatic solenoid valve 215 via an electrical command signal 218. By actuating the pneumatic solenoid valve 215 to the open state, safety unit 501 allows the relay valve 212 to operate normally when controlling the pressure in the brake pipe 105. By actuating the pneumatic solenoid valve 215 to the closed state, safety unit 501 isolates the relay valve 212, i.e., prevents the relay valve 212 from increasing or decreasing the pressure in the brake pipe 105.

[0132] Figure 6 Further solutions are shown that can prevent the relay valve 212 from causing pressure changes on the brake pipe 105.

[0133] Safety unit 501 may preferably be arranged to prevent relay valve 212 from supplying power to brake pipe 105 via a first electro-pneumatic module 609. The first electro-pneumatic module 609 may include a first pneumatic inlet connected to main pipe 201, a second pneumatic inlet connected to brake pipe 105, and a pneumatic outlet connected to the inlet of relay valve 212. The first electro-pneumatic module may be arranged to:

[0134] - In the first state, the main pipe 201 is pneumatically connected to the inlet of the relay valve 212;

[0135] - In the second state, the brake pipe 105 is pneumatically connected to the inlet of the relay valve 212.

[0136] In this situation, when the safety unit must prevent the relay valve 212 from supplying and discharging the brake tube 105, the safety unit 501 can be arranged to drive the first electro-pneumatic module 609 to its second state.

[0137] In one implementation example, safety unit 501 may be arranged to control the state of first electro-pneumatic module 609 via electrical command signal 608. In a first state, electro-pneumatic module 609 may pneumatically connect the inlet of relay valve 212 to main pipe 201, thereby allowing relay valve 212 to increase the pressure at its outlet 214, i.e., brake pipe 105. In a second state, first electro-pneumatic module 609 may pneumatically connect the inlet of relay valve 212 to brake pipe 105, such that the supply inlet matches the outlet of relay valve 212, thereby preventing relay valve 212 from generating pressure changes at its outlet 214, i.e., brake pipe 105.

[0138] Preferably, in addition to or as a replacement for the first electro-pneumatic module 609, the safety unit 501 can be arranged to prevent the relay valve 212 from supplying and discharging the brake pipe 105 via the second electro-pneumatic module 610. The second electro-pneumatic module 610 may include a first pneumatic inlet, a second pneumatic inlet connected to the brake pipe 105, and a pneumatic outlet connected to the pilot chamber 213 of the relay valve 212. The first pneumatic inlet is connected downstream of the first pneumatic solenoid valve 204 and downstream of the second pneumatic solenoid valve 205. The first pneumatic solenoid valve 204 is arranged to increase the pressure in the pilot chamber 213 of the relay valve 212, and the second pneumatic solenoid valve 205 is arranged to decrease the pressure in the pilot chamber 213 of the relay valve 212. The second electro-pneumatic module can be arranged to:

[0139] - In the first state, the second electro-pneumatic module pneumatically connects the first pneumatic solenoid valve 204 and the second pneumatic solenoid valve 205 to the pilot chamber 213 of the relay valve 212. The first pneumatic solenoid valve 204 is arranged to increase the pressure in the pilot chamber 213 of the relay valve 212, and the second pneumatic solenoid valve 205 is arranged to decrease the pressure in the pilot chamber 213 of the relay valve 212.

[0140] - In the second state, the second electro-pneumatic module pneumatically connects the brake pipe 105 to the pilot chamber 213 of the relay valve 212.

[0141] In this situation, when the safety unit 501 must prevent the relay valve 212 from supplying and discharging to the brake pipe 105, the safety unit 501 can be arranged to drive the second electro-pneumatic module 610 to its second state.

[0142] In one implementation example, safety unit 501 can be arranged to control the state of second electro-pneumatic module 610 via electrical command signal 611. In a first state, second electro-pneumatic module 610 can pneumatically connect pilot chamber 213 to pneumatic solenoid valves 204, 205 and first pressure sensor component 236, thereby allowing brake control unit 211 to periodically control the pressure at outlet 214 of relay valve 212, i.e., at brake pipe 105. In a second state, second electro-pneumatic module 610 pneumatically connects pilot chamber 213 to brake pipe 105, aligning the control inlet with the outlet of relay valve 212, thereby preventing pressure changes in relay valve 212 at its outlet 214, i.e., at brake pipe 105.

[0143] In another aspect, safety unit 501 can be arranged to generate a command signal 508 for actuating contact 505. By actuating contact 505 to the closed position, safety unit 501 allows traction control unit 232 to operate according to electrical control signal 233 or the state presented by pressure switch 231, as described above. By actuating contact 505 to the open position, safety unit 501 causes the electrical control signal to enter a state that prevents the application of traction torque to traction control unit 501.

[0144] Safety unit 501 can be arranged to generate command signal 509 for controlling contact 504. By actuating contact 504 to the open position, safety unit 501 interrupts emergency circuit 220 by causing emergency pneumatic solenoid valve 219 to enter its state of connecting brake pipe 105 to the atmosphere, thereby reducing the pneumatic pressure in brake pipe 105 to 0 bar.

[0145] In addition, the emergency circuit interruption 220 opens the contact 223 by de-energizing the pneumatic solenoid valves 204 and 205, thereby forcing the relay valve 212 to reduce the pneumatic pressure in the brake pipe 105 to 0 bar, and its action is parallel to that of the emergency valve 219.

[0146] In another embodiment, safety unit 501 may be arranged to prevent the relay valve 212 from supplying and discharging into the brake pipe 105 via a pneumatic solenoid valve 215 located between the outlet 214 of the relay valve 212 and the brake pipe 105. The pneumatic solenoid valve 215 may be arranged in a first state that prevents a pneumatic connection between the outlet 214 of the relay valve 212 and the brake pipe 105. The pneumatic solenoid valve may also be arranged in a second state that allows a connection between the outlet 214 of the relay valve 212 and the brake pipe 105. Safety unit 501 may actuate the pneumatic solenoid valve 215 to its first state to prevent the relay valve 212 from supplying and discharging into the brake pipe 105.

[0147] In another embodiment, safety unit 501 may be arranged to control a pneumatic emergency solenoid valve 219 pneumatically connected to brake pipe 105. Pneumatic emergency solenoid valve 219 may be arranged to present a first state that prevents pneumatic connection between brake pipe 105 and the atmosphere, and a second state that allows pneumatic connection between brake pipe 105 and the atmosphere. Safety unit 501 may be arranged to actuate pneumatic emergency solenoid valve 219 to its second state upon a request for emergency braking by the main vehicle 101.

[0148] In another embodiment, safety unit 501 may be arranged to control a pneumatic emergency solenoid valve 219 pneumatically connected to brake tube 105. Pneumatic emergency solenoid valve 219 may be arranged to present a first state preventing pneumatic connection between brake tube 105 and the atmosphere, and a second state allowing pneumatic connection between brake tube 105 and the atmosphere. Safety unit 501 may be arranged to actuate pneumatic emergency solenoid valve 219 to its second state when communication channels 404, 405 and communication device 235, i.e., global communication channels 404, 405, 230, 235, malfunction and / or when there is a pressure change in brake tube 105 indicating that emergency braking is in progress.

[0149] In view of the above embodiments and examples, in at least one of the following cases:

[0150] -Safety unit 501 determines that the global transmission channel, including the one from the main vehicle 101 to the local communication channel 235, has failed.

[0151] Safety unit 501 believes that brake control unit 211 is not properly controlling the pressure at outlet 214 of relay valve 212, especially during emergency braking requests.

[0152] Safety unit 501 can prevent the relay valve from increasing the pressure in brake line 105 by performing at least one of the following actions:

[0153] - The pneumatic solenoid valve 209 is actuated to the first state. In the first state, the pneumatic solenoid valve 209 prevents the transmission of supply pressure from the main pipeline 201 to the relay valve 212.

[0154] - The pneumatic solenoid valve 215 is actuated to the first state. In the first state, the pneumatic solenoid valve 215 prevents the pneumatic connection between the brake pipe 105 and the relay valve 212.

[0155] - The first electro-pneumatic module 609 is actuated to its second state. In the second state, the first electro-pneumatic module 609 pneumatically connects the inlet of the relay valve 212 to the brake pipe 105, so that the supply inlet matches the outlet of the relay valve 212.

[0156] - The second electro-pneumatic module 610 is actuated to its second state, in which the second electro-pneumatic module 610 pneumatically connects the pilot chamber 213 to the brake pipe 105, so that the control inlet matches the outlet of the relay valve 212.

[0157] If, for at least one of the above reasons, the brake control unit 211 associated with one or more subordinate locomotives is unable to replicate the braking command, particularly the emergency braking command, the above solution advantageously prevents one or more subordinate locomotives 402, 403 from hindering the main locomotive 101 from implementing braking, particularly the emergency braking along the railway convoy 400.

[0158] When the main vehicle 101 issues an emergency braking request, which is simultaneously received by the safety unit 501 and the brake control unit 211, the safety unit opens contact 504, de-energizing the emergency valve 219 and placing it in its second state, allowing a pneumatic connection between the brake pipe 105 and the atmosphere, thereby applying emergency braking. Furthermore, opening contact 504 de-energizes the pneumatic solenoid valves 204 and 205, which in turn releases air from the brake pipe 105 via relay valve 212.

[0159] If the global communication channel fails to transmit the emergency braking request from the main locomotive 101 to the brake control unit 211 or safety unit 501 associated with at least one subordinate locomotive 402, 403, the safety unit 501 can identify the application of emergency braking by observing the pressure change behavior in the brake pipe 105 through the second pressure sensor component 506 and using the appropriate algorithm described in WO2017025895.

[0160] When emergency braking is in progress, safety unit 501 can, for example, open contact 504 via signal 509 to locally replicate the emergency braking according to the procedure described above or according to the procedure described in WO2017025895.

[0161] Even when the communication channel is unable to transmit an emergency braking request to the brake control unit 211, or when the brake control unit 211 is unable to reduce the pressure in the brake pipe 105 via the relay valve 212, this scheme advantageously accelerates the application of emergency braking by promoting a rapid reduction in the pressure in the brake pipe 105.

[0162] When emergency braking is in progress, safety unit 501 can, for example, open contact 505 via signal 508, thereby preventing traction control unit 232 from supplying power to traction motor.

[0163] This solution advantageously accelerates the suppression of traction unit 232 before pressure switch 231 engages (engaging only when the pressure in the brake pipe drops below 3.5 bar), thereby reducing longitudinal stress on the railway convoy 400.

[0164] Compared to WO2017025895, the advantage of this invention is that it separates the functions of normal braking operation, communication with TCMS (Train Control and Monitoring System), and interface with the driver performed by the brake control unit 211 according to the prior art from the functions of monitoring and ensuring emergency braking assigned to the safety unit 501. This separation of functions makes it possible to keep the development of the brake control unit 211 at a safety level SIL≤2 and to position the development of the safety unit 501 at an appropriate safety level SIL≥2, thereby reducing the impact of development costs.

[0165] Another advantage of this invention is that it can update the technology of existing locomotives to achieve distributed traction functions, such as... Figure 4 As shown.

[0166] In fact, adding security unit 501 and appropriate transceiver device 230 to Figure 2 The existing braking system shown in the diagram, with limited modifications to the electrical components of the system, is sufficient, without the need for intervention in the pneumatic components as described in many previously reported solutions, nor for the need to redevelop the hardware and software components of the braking control unit 211 with a SIL ≥ 3 level.

[0167] Safety unit 501 can be developed based on a safety level higher than that of the associated brake control unit 211. For example, safety unit 501 can be developed based on a safety integrity level (SIL) ≥ 3.

[0168] The security unit 501 may be manufactured according to an architecture including one or more microprocessors, or according to an architecture including one or more programmable devices, or according to an architecture including one or more programmable devices and one or more microprocessors.

[0169] Various aspects and embodiments of the control system for a railway fleet according to the present invention have been described. It is understood that each embodiment can be combined with any other embodiment. Furthermore, the invention is not limited to the described embodiments, but can be varied within the scope defined by the appended claims.

Claims

1. A control system for a railway convoy (400), specifically for a railway convoy for freight transport, the control system comprising a plurality of carriages (102), a main locomotive (101) positioned at the head of the railway convoy (400), and at least one subordinate locomotive (402, 403) distributed in the railway convoy (400). The railway convoy (400) includes a brake pipe (105) for service and emergency pneumatic braking of the railway convoy (400), the brake pipe (105) extending along the entire railway convoy (400); in, The main locomotive (101) is arranged to control the pressure in the brake pipe (105) and to send traction and / or braking commands to at least one subordinate locomotive (402, 403) via radio or wired communication channels (404, 405). - The at least one subordinate locomotive (402, 403) includes a transceiver device (230) arranged to receive traction and / or braking commands sent by the main locomotive (101) through the communication channel (404, 405), and the transceiver device (230) is also arranged to retransmit the traction and / or braking commands to the traction control unit (232) and the braking control unit (211) of the at least one subordinate locomotive (402, 403) via a communication device (235) inside the at least one subordinate locomotive (402, 403) to control the pressure in the brake pipe (105); The brake control unit (211) is arranged to control the pressure in the brake pipe (105) by acting on a first pneumatic solenoid valve (204) and a second pneumatic solenoid valve (205), wherein the first pneumatic solenoid valve (204) is arranged to increase the pressure in the pilot chamber (213) of the relay valve (212), and the second pneumatic solenoid valve (205) is arranged to decrease the pressure in the pilot chamber (213) of the relay valve (212); The inlet of the relay valve (212) is supplied by the main pipeline (201), and the outlet of the relay valve (212) is connected to the brake pipe (105). The control system for the railway fleet (400) is characterized in that it includes a safety unit (501) associated with the brake control unit (211), the safety unit (501) being arranged to prevent the relay valve (212) from supplying the brake pipe (105) when at least one fault condition of the control system for the railway fleet (400) occurs.

2. The control system for a railway fleet (400) according to claim 1, wherein, At least one fault condition of the control system for the railway fleet (400) includes: - The communication channel no longer permits the transmission of traction and / or braking commands to the at least one subordinate locomotive (402, 403), or - The transceiver device (230) is no longer able to receive traction and / or braking commands sent by the main locomotive (101) through the communication channel, or is no longer able to retransmit traction and / or braking commands to the traction control unit (232) and the braking control unit (211) of the at least one subordinate locomotive (402, 403) to control the pressure conditions in the brake pipe (105), or The communication device (235) inside the at least one subordinate locomotive (402, 403) is not allowed to retransmit traction and / or braking commands to the traction control unit (232) and the braking control unit (211) of the at least one subordinate locomotive (402, 403).

3. The control system for a railway fleet (400) according to claim 1, comprising a first pressure sensor component (236) arranged to be pneumatically connected to the pilot chamber (213) of the relay valve (212); All the brake control units, the first pneumatic solenoid valve (204), the second pneumatic solenoid valve (205), the relay valve (212), and the first pressure sensor component (236) are arranged to perform the function of controlling the pressure in the brake pipe (105) of the railway convoy (400); in, At least one fault condition of the control system for the railway fleet (400) includes: - A condition in which at least one of the first pneumatic solenoid valve (204), the second pneumatic solenoid valve (205), the relay valve (212), and the first pressure sensor component (236) is not operating correctly.

4. The control system for a railway fleet (400) according to claim 1, comprising a second pressure sensor component (506) pneumatically connected to the brake tube (105) and electrically connected to the safety unit (501) via an electrical signal (507). The safety unit (501) is arranged for: - The pressure in the brake tube (105) is monitored by the second pressure sensor component (506); - Receive, via the communication device (235) and simultaneously at the brake control unit (211), traction and / or braking commands sent by the main locomotive (101) to the at least one subordinate locomotive, the traction and / or braking commands indicating the pressure value applied to the brake pipe (105); - For each traction and / or braking command received, compare whether the pressure value indicated by each traction and / or braking command falls within a threshold range, the threshold range including each pressure value measured by the second pressure sensor component (506); in, At least one fault condition of the control system for the railway fleet (400) includes: - A condition in which the pressure value indicated by each traction and / or braking command does not fall within the threshold range, the threshold range including the pressure values ​​measured by the second pressure sensor component (506).

5. The control system for a railway fleet (400) according to claim 1, comprising a second pressure sensor component (506) pneumatically connected to the brake tube (105) and electrically connected to the safety unit (501) via an electrical signal (507). The safety unit (501) is arranged for: - The pressure in the brake tube (105) is monitored by the second pressure sensor component (506); - Receive, via the communication device (235) and simultaneously at the brake control unit (211), traction and / or braking commands sent by the main locomotive (101) to the at least one subordinate locomotive, the traction and / or braking commands indicating the pressure value applied to the brake pipe (105); - For each traction and / or braking command received, compare whether the pressure value measured by the second pressure sensor component (506) falls within a threshold range, the threshold range including the pressure value indicated by each traction and / or braking command; in, At least one fault condition of the control system for the railway fleet (400) includes: - A condition in which the pressure value measured by the second pressure sensor component (506) does not fall within the threshold range, the threshold range including the pressure values ​​indicated by each traction and / or braking command.

6. The control system for a railway fleet (400) according to claim 1, wherein, The safety unit (501) is arranged to prevent the relay valve (212) from supplying the brake tube (105) by means of a pneumatic solenoid valve (209) located between the main pipe (201) and the pneumatic inlet of the relay valve (212); The pneumatic solenoid valve (209) is arranged to present a first state that prevents the pneumatic supply pressure from the main pipe (201) to the pneumatic inlet of the relay valve (212), and a second state that allows the pneumatic supply pressure to propagate from the main pipe (201) to the pneumatic inlet of the relay valve (212). The safety unit (501) is arranged to drive the pneumatic solenoid valve (209) to a first state when the safety unit (501) must prevent the relay valve (212) from supplying the brake tube (105).

7. The control system for a railway fleet (400) according to claim 1, wherein, The safety unit (501) is arranged to prevent the relay valve (212) from supplying the brake tube (105) via the first electro-pneumatic module (609); The first electric pneumatic module (609) includes a first pneumatic inlet connected to the main pipe (201), a second pneumatic inlet connected to the brake pipe (105), and a pneumatic outlet connected to the inlet of the relay valve (212). The first electro-pneumatic module is arranged for: - Presenting a first state in which the main pipe (201) is pneumatically connected to the inlet of the relay valve (212); - Presenting a second state in which the brake tube (105) is pneumatically connected to the inlet of the relay valve (212); The safety unit (501) is arranged to drive the first electro-pneumatic module (609) to a second state when the safety unit (501) must prevent the relay valve (212) from supplying and discharging the brake tube (105).

8. The control system for a railway fleet (400) according to claim 1, wherein, The safety unit (501) is arranged to prevent the relay valve (212) from supplying and discharging the brake pipe (105) via the second electro-pneumatic module (610); The second electro-pneumatic module (610) includes a first pneumatic inlet, a second pneumatic inlet connected to the brake pipe (105), and a pneumatic outlet connected to the pilot chamber (213) of the relay valve (212). The first pneumatic inlet is connected downstream of the first pneumatic solenoid valve (204) and downstream of the second pneumatic solenoid valve (205). The first pneumatic solenoid valve (204) is arranged to increase the pressure in the pilot chamber (213) of the relay valve (212), and the second pneumatic solenoid valve (205) is arranged to decrease the pressure in the pilot chamber (213) of the relay valve (212). The second electro-pneumatic module is arranged for: - Presenting a first state in which the first pneumatic solenoid valve (204) and the second pneumatic solenoid valve (205) are pneumatically connected to the pilot chamber (213) of the relay valve (212), wherein the first pneumatic solenoid valve (204) is arranged to increase the pressure in the pilot chamber (213) of the relay valve (212), and the second pneumatic solenoid valve (205) is arranged to decrease the pressure in the pilot chamber (213) of the relay valve (212); - Presenting a second state in which the brake tube (105) is pneumatically connected to the pilot chamber (213) of the relay valve (212); The safety unit (501) is arranged to drive the second electro-pneumatic module (610) to a second state when the safety unit (501) must prevent the relay valve (212) from supplying and discharging the brake tube (105).

9. The control system for a railway fleet (400) according to claim 1, wherein, The safety unit (501) is arranged to control a pneumatic emergency solenoid valve (219) pneumatically connected to the brake tube. The pneumatic emergency solenoid valve (219) is arranged for: -Presents a first state that prevents the aerodynamic connection between the brake tube (105) and the atmosphere; - Presents a second state that allows for a pneumatic connection between the brake tube (105) and the atmosphere; The safety unit (501) is arranged for: - In the event that the main vehicle (101) applies an emergency braking request, the pneumatic emergency solenoid valve (219) is actuated to the second state; and / or - When there is a pressure change in the brake tube (105) indicating that emergency braking is in progress, and / or when at least one of the transceiver device (230), the communication channel (404, 405) and the communication device (235) is not operating correctly, the pneumatic emergency solenoid valve (219) is actuated to the second state.

10. The control system for a railway fleet (400) according to claim 1, wherein, The safety unit (501) is arranged to prevent the relay valve (212) from supplying and discharging the brake tube (105) via a pneumatic solenoid valve (215), the pneumatic solenoid valve (215) being arranged between the outlet (214) of the relay valve (212) and the brake tube (105). The pneumatic solenoid valve (215) is arranged for: -Presents a first state that prevents the pneumatic connection between the outlet (214) of the relay valve (212) and the brake tube (105); - Presents a second state that allows a pneumatic connection between the outlet (214) of the relay valve (212) and the brake tube (105); The safety unit (501) is arranged to drive the pneumatic solenoid valve (215) to a first state when the safety unit (501) must prevent the relay valve (212) from supplying and discharging the brake tube (105).

11. The control system for a railway fleet (400) according to claim 1, wherein, The safety unit (501) is developed according to a safety integrity level, wherein the safety integrity level of the safety unit (501) is higher than the safety integrity level of the associated brake control unit (211).

12. The control system for a railway fleet (400) according to claim 1, wherein, The security unit (501) is developed according to the security integrity level SIL≥3.

13. The control system for a railway fleet (400) according to claim 1, wherein, The security unit (501) is manufactured according to an architecture that includes one or more microprocessors.

14. The control system for a railway fleet (400) according to claim 1, wherein, The security unit (501) is manufactured according to an architecture that includes one or more programmable devices.

Images