Electromechanical brake actuators and braking systems for vehicles, particularly for at least one rail vehicle.

Abstract

An electromechanical brake actuator (400) for vehicles, particularly railway vehicles, is described, comprising a safety unit (401) configured to: receive an electrical position signal (221) whose value indicates the position of a braking force application device (217) along a translation axis (Xt); determine the instantaneous position of the braking force application device (217) based on the value of the electrical position signal (221); and prevent a braking force control signal (204) or a power supply signal (405) from the service brake control unit (202) from reaching the electromechanical module (201) by a first interruption device (403) when: a) the safety unit (401) determines that the braking force application device (217) is in a position between a maintenance position and a stationary position; or b) the safety unit determines that the braking force application device (217) is moving from a stationary position to a maintenance position. A braking system is also described.

Description

Technical Field

[0001] This invention generally belongs to the field of braking systems; specifically, this invention relates to an electromechanical braking actuator and braking system for vehicles, particularly for at least one type of rail vehicle. Background Technology

[0002] In the following description, reference will be made to the following European standards, based on the latest version available as of April 1, 2020:

[0003] -EN50126 [“Railway applications - Specifications and justifications for reliability, availability, maintainability and safety (RAMS)”]

[0004] -EN50128 ["Railway applications - Communication, signaling and processing systems - Software for railway control and protection systems"];

[0005] -EN50129 ["Railway applications - Communication, signaling and processing systems - Safety-related electronic systems for signaling"].

[0006] -EN50159 ["Railway applications - Communication, signaling and processing systems - Security-related communication in transmission systems"].

[0007] Specifically, the EN50126 standard defines a method for assigning safety levels SIL0 / 1 / 2 / 3 / 4 (with SIL4 representing the highest safety level) to the subsystems that make up the relevant system based on the results of a safety analysis. The EN50128 and EN50129 standards define the SIL levels assigned based on the above safety analysis results, which are applied to the design standards of software and hardware components, respectively.

[0008] It is known from existing technology that:

[0009] - Safety calculations related to emergency braking functions performed according to European standard EN50126 systematically assign a Safety Integrity Level (SIL) of ≥3 to the emergency braking function, and therefore typically assign a Safety Integrity Level of ≥3 to the subsystem that implements the emergency braking function.

[0010] - Safety calculations related to service braking functions performed according to European standard EN50126 typically assign a safety integrity level (SIL) ≤ 2 to the service braking function, and therefore typically assign a safety integrity level (SIL) ≤ 2 to the subsystem implementing the service braking function.

[0011] Based on EN50128 and EN50129, the design, verification, and certification costs involved in developing control units (typically microprocessor-based or FPGA-based control units) based on a safety integrity level of SIL ≥ 3 are approximately an order of magnitude higher than those based on a safety integrity level of SIL ≤ 2.

[0012] Regarding the last point above, it is clear that it is worthwhile to keep the functionality developed based on a SIL≥3 security level extremely limited and simple.

[0013] Figure 1 shows a pneumatic brake actuator 100 according to current technology. The mechanical component 101 is a slack adjuster known to those skilled in the art.

[0014] As braking continues, the brake pads and discs wear down over time. Consequently, the idle stroke of the brake actuator increases over time, thus increasing the delay when braking is applied.

[0015] The purpose of a tension adjuster is to maintain a constant stationary distance between the brake pad surface and the brake disc surface when the thickness of the brake pads and brake disc continuously decreases due to wear caused by braking, in a non-braking state. In this way, the braking application delay caused by the lever's free-spinning travel remains constant over time, allowing for precise calculation of the vehicle's or train's braking time or stopping distance, especially in emergency braking situations.

[0016] As is well known to those skilled in the art, the free-spinning stroke of the brake actuator rod at the connection point between the rod and the brake cylinder is defined as “dimension A”, hereinafter referred to as distance “A”.

[0017] For reference only, dimension A is typically 2 mm in the case of a disc actuator and 6 mm in the case of a wheel actuator.

[0018] In the case of a shoe-type braking system, the same brake shoes and wheel wear adjustment mechanism are used.

[0019] The functional complexity of mechanical component 101, the resulting complexity of assembly and testing, and the ultimate cost are all readily apparent.

[0020] Disadvantageously, in known brake actuators, the procedure for resetting the initial distance A is performed manually by the operator responsible for replacing the friction device each time the friction device of the braking force application device 217 is replaced, and requires special care and tools.

[0021] Figure 2 illustrates a functional block diagram of an electromechanical brake actuator 200 according to the prior art.

[0022] The electromechanical module 201 includes at least one motor and a possible speed reducer, i.e., a torque multiplier, and a force transmission member (i.e., arm 206) that can extend or retract and is connected to the emergency braking module 207.

[0023] The emergency braking module 207 includes an emergency braking energy storage device 208, such as a mechanical storage element for mechanical potential energy or kinetic energy.

[0024] Essentially, the emergency braking module 207 is controlled by the electrical signal 210 and is configured to present a first state in which, when the emergency braking request signal 210 does not indicate a need for emergency braking, the emergency braking component 207 does not release stored energy to perform emergency braking. Furthermore, the emergency braking module 207, controlled by the electrical signal 210, is configured to present a second state in which, when the emergency braking request signal 210 indicates the presence of an emergency braking request and therefore requires emergency braking, the emergency braking component 207 releases stored energy to perform emergency braking.

[0025] For the purposes of this invention, it is not necessary to provide a more detailed description of the operation of the emergency braking module 207.

[0026] Another force transmission member (i.e., arm 211) is connected to a force sensor device 212, which is configured to generate a braking force indication electrical signal 213, the value of which indicates the mechanical force applied between the force transmission member 211 and the other force transmission member (i.e., arm 216).

[0027] The braking force indication signal 213 is input to the service brake control unit 202.

[0028] Arm 216 is connected to force sensor device 212 and braking force application device 217.

[0029] Braking force application device 217 is illustrated, for example, by invoking a braking device / actuator with brake shoes on the wheel; however, braking force application device 217 may take other forms, such as a lever braking device / actuator with brake pads on the brake disc.

[0030] The service brake control unit 202 is electronic in nature and can receive a power signal 205 at its input, which transmits a power supply voltage that is not entirely derived from the vehicle's battery.

[0031] The service brake control unit 202 is configured to regulate the power supply voltage to control the motor included in the electromechanical module 201 via at least one electric braking force control signal 204.

[0032] The service brake control unit 202 receives at least one angular position signal 219 as input, which does not fully indicate the angular position and rotation direction of the rotating component present in the electromechanical module 201.

[0033] In a possible non-exclusive embodiment, at least one angular position signal 219 includes an angular position signal generated by a Hall sensor belonging to a BLDC type motor.

[0034] By using a counting and integration method executed by the service brake control unit 202, the service brake control device 202 continuously obtains the instantaneous extension value of the arm 206 over time, i.e. the position of the braking force application device 217.

[0035] In another possible embodiment, the position sensor device 220 (e.g., a position sensor) continuously reads the translational position of the arm 206, which indicates its instantaneous extension value, to the service brake control unit 202 over time via an electrical position signal 221 (i.e., indicating the position of the braking force application device 217).

[0036] Figure 3 The diagram shows the relationship between the position P of arm 206 and the force F applied by braking force application device 217.

[0037] Assuming the initial position of arm 206 corresponds to the horizontal coordinate value P = -A, that is, the rest position corresponding to the distance A, the applied force F has a zero value for the entire distance covered by arm 206. The horizontal coordinate value -A and the value 0 correspond to the initial contact point between the braking force application device 217 and the braking force receiving device (dissipation device), that is, the brake disc in the case of disc brakes, or the wheel in the case of wheel brakes.

[0038] The positive position value P corresponds to the positive force value F applied by the braking force application device 217.

[0039] The angle factor in segment E represents the elasticity of the braking force application device 217. The greater the elasticity, the smaller the angle factor. Now, assuming the actuator has applied braking force F' corresponding to position P', when requesting cancellation of braking force, the service brake control unit 202 commands the electromechanical module 201 to retract the arm 206 at a predetermined speed.

[0040] Simultaneously, the service brake control unit 202 receives the position value of the arm 206 via the position signal 221, that is, it counts and integrates the number of rotations of the rotating component of the electromechanical module 201 via at least one angular position signal 219. When the braking force indication signal 213, which indicates the applied force value F, reaches zero, the service brake control unit 202 continues to command the electromechanical module 201 to retract the arm 206 until it reaches position A.

[0041] In this way, the wear on the brake shoes and wheels is compensated for with each braking action.

[0042] The dimensional resolution recovered by the above method corresponds to the measurement resolution at arm position 206.

[0043] The described solution advantageously eliminates the complex mechanical component 101 called the slack adjuster, with a simple software program executed by the service brake control unit 202 each time the service brake is released.

[0044] European Patent EP3346155 claims protection for a method similar to the prior art described to date.

[0045] In the prior art, the service brake control unit 202 is typically developed according to safety level SIL <= 2 (regarding standards EN50128 and EN50129).

[0046] In this case, a failure of the software function controlling the recovery distance A may occur with a specific probability of SIL security level <= 2.

[0047] Since the software on all brake actuators on the train is identical, this software must be considered a common-mode fault source, meaning that faults on the entire train may occur simultaneously.

[0048] A malfunction in the software function controlling distance A adjustment may manifest as a failure to... Figure 3 Stop at point A in the diagram and continue retracting arm 206 to maintenance position B (end of stroke position), corresponding to the position required for maintenance of the braking force application device 217. For example, maintenance of the braking force application device 217 may require replacement of the friction device of the braking force application mechanism 217.

[0049] Position B can be tens of millimeters, which is an order of magnitude larger than position A.

[0050] In this situation, the braking application delay could reach several seconds.

[0051] If an emergency braking request is made after a software malfunction occurs on the entire train in common mode, and the typical speed of a regional train is 160 km / h, then for every second of delay, the stopping distance will be extended by approximately 44 meters.

[0052] This consideration led to the need for the software function controlling the recovery distance A and the hardware performing this function to be developed to the same safety level as emergency braking. In other words, according to EN50128 and EN50129 standards, the service brake control unit 202 must be fully developed to SIL level >= 3.

[0053] The downside is that this requirement has a significant impact on the development and production costs of the service brake control unit, which is already quite complex in current solutions that meet safety level SIL<=2. Summary of the Invention

[0054] Therefore, one object of the present invention is to provide an electromechanical brake actuator for vehicles, particularly for at least one railway vehicle, which can prevent improper operation of the braking force application device in a maintenance position.

[0055] Therefore, another object of the present invention is to provide an electromechanical brake actuator for vehicles, particularly for at least one railway vehicle, which is implemented at low cost through a software solution while maintaining all safety requirements compatible with state-of-the-art emergency braking. In some embodiments, the electromechanical brake actuator is capable of recovering distance A, i.e., the wear of the brake shoes and wheels or brake pads and brake discs.

[0056] Another object of the present invention is to provide an electromechanical brake actuator having a procedure for applying braking force for safety maintenance.

[0057] According to one aspect of the invention, the above and other objects and advantages are achieved by an electromechanical brake actuator for vehicles, particularly for at least one railway vehicle, as defined in this disclosure; and by a braking system as defined in this disclosure.

[0058] The present invention also defines preferred embodiments, the contents of which should be understood as an integral part of this description. Attached Figure Description

[0059] The functional and structural features of some preferred embodiments of an electromechanical brake actuator for vehicles, particularly for at least one railway vehicle according to the invention, will now be described. Referring to the accompanying drawings, in which:

[0060] Figure 1 shows a pneumatic brake actuator according to the prior art;

[0061] Figure 2 shows a non-exclusive example of a functional diagram of an electromechanical brake actuator according to the prior art;

[0062] Figure 3 A schematic diagram is shown that relates the braking force applied to the brake shoe (i.e., brake pad) to the linear stroke of one or more existing braking force transmission components;

[0063] Figure 4 An embodiment of the electromechanical brake actuator is shown;

[0064] Figure 5 An alternative embodiment of the electromechanical brake actuator is shown;

[0065] Figure 6 An embodiment of a braking system including multiple brake actuators is shown. Detailed Implementation

[0066] Before describing several embodiments of the present invention in detail, it should be noted that the application of the present invention is not limited to the construction details and component configurations shown in the following description or the accompanying drawings. The present invention may take other embodiments and may be implemented or constructed in different ways in practice. It should also be understood that the wording and terminology are for descriptive purposes and should not be construed as limiting. The use of “comprising” and “including” and variations thereof should be understood to include the elements listed below and their equivalents, as well as other elements and their equivalents.

[0067] In a first embodiment, the electromechanical brake actuator 400 according to the invention for at least one vehicle, particularly for at least one railway vehicle, includes a service brake control unit 202 configured to receive a braking force request electrical signal 203 and generate a braking force control signal 204, the value of which is a function of the braking force request electrical signal 203.

[0068] Furthermore, the electromechanical actuator 400 includes an electromechanical module 201, which is configured to receive a braking force control signal 204 generated by the service brake control unit 202 and generate a braking force whose value is a function of the braking force control signal 204. The electromechanical module 201 is also configured to receive electrical power through the braking force control signal 204. In this case, signal 204 can be considered as both a power supply and a braking force control signal.

[0069] Furthermore, the electromechanical actuator 400 includes at least one force transmission member 206, 211, 216, configured to transmit the braking force generated by the electromechanical module 201 to the braking force application device 217. The at least one force transmission member 206, 211, 216 is controlled by the electromechanical module 201 to translate along a translation axis Xt. Translation of at least one force transmission member 206, 211, 216 according to a first application direction results in an increase in the braking force applied by the braking force application device 217, and translation of at least one force transmission member 206, 211, 216 according to a second application direction opposite to the first application direction results in a decrease in the braking force applied by the braking force application device 217.

[0070] In addition, the electromechanical actuator 400 includes a safety unit 401, which is configured as follows:

[0071] - Receives an electrical position signal 221, the value of which indicates the position of the braking force application device 217 along the translation axis Xt;

[0072] - Determine the instantaneous position of the braking force application device 217 based on the electrical position signal 221; and

[0073] - The first interruption device 403 prevents the braking force control signal 204 issued by the service brake control unit 202 from reaching the electromechanical module 201 under the following circumstances:

[0074] a) Based on the value of the electrical position signal 221, the safety unit 401 determines that the braking force application device 217 is located along the force application axis Xb, which is between a working position at a first distance -B from the braking force receiving device and a stationary position at a second distance -A from the braking force receiving device 218, wherein the second distance -A is less than the first distance -B;

[0075] b) Based on the change in the value of the electrical position signal 221 over time, the safety unit determines that the braking force application device 217 is moving from the stationary position to the maintenance position.

[0076] It can be seen that the translation axis Xt and the braking force application axis Xb can coincide, be parallel, or be located in different planes.

[0077] Preferably, the safety unit 401 can be configured to receive a maintenance request signal 222, which is configured to take a first value indicating that the braking force application device 217 does not need to be brought into the maintenance position, and a second value indicating that the braking force application device 217 needs to be brought into the maintenance position. In this case, the safety unit 401 can be configured as follows:

[0078] The first interrupt device 403 prevents the braking force control signal 204 issued by the service brake control unit 202 from reaching the electromechanical module 201 under the following circumstances:

[0079] a) The maintenance request signal 222 takes its first value, and the safety unit 401 determines the position of the braking force application device 217 along the braking force application axis Xb between the maintenance position and the rest position based on the value of the electrical position signal 221.

[0080] b) Based on the change in the value of the electrical position signal 221 over time, the safety unit determines that the braking force application device 217 is moving from the stationary position to the maintenance position.

[0081] Preferably, the safety unit 401 is further configured to receive a maintenance verification signal 223, which is configured to take a first value indicating that permission to bring the braking force application device 217 into the maintenance position is not confirmed, and to take a second value indicating that permission to bring the braking force application device 217 into the maintenance position is confirmed. In this case, the safety unit 401 can be configured as follows:

[0082] - The first interruption device 403 prevents the braking force control signal 204 issued by the service brake control unit 202 from reaching the electromechanical module 201 under the following circumstances:

[0083] a) Both the maintenance request signal 222 and the maintenance verification signal 223 take their respective first values, and the safety unit 401 determines the position of the braking force application device 217 along the braking force application axis Xb between the maintenance position and the stationary position based on the value of the electrical position signal 221.

[0084] b) Based on the change in the value of the electrical position signal 221 over time, the safety unit determines that the braking force application device 217 is moving from the stationary position to the maintenance position.

[0085] Otherwise, or additionally, security element 401 may be configured as follows:

[0086] - When the maintenance request signal 222 and the maintenance verification signal 223 take different values ​​from each other (i.e., inconsistent values, for example, the maintenance request signal 222 takes its first value while the maintenance verification signal 223 does not take its first value, or the maintenance request signal 222 takes its second value while the maintenance verification signal 223 does not take its second value), the first interruption device 403 prevents the braking force control signal 204 issued by the service brake control unit 202 from reaching the electromechanical module 201, and the safety unit 401 determines the position of the braking force application device 217 along the braking force application axis Xb between the maintenance position and the stationary position based on the electrical position signal 221;

[0087] Alternatively, or additionally, the security unit 401 may also be configured as follows:

[0088] When both the maintenance request signal 222 and the maintenance verification signal 223 take their respective second values ​​and the safety unit 401 determines that the braking force application device 217 is in a stationary position based on the electrical position signal 221, the braking force control signal 204 issued by the service brake control unit 202 is allowed to reach the electromechanical module 201 by the first interrupt device 403.

[0089] Furthermore, the safety unit 401 can be configured to prevent the braking force control signal 204 issued by the service brake control unit 202 from reaching the electromechanical module 201 via the first interruption device 403 in the following situations:

[0090] - Both maintenance request signal 222 and maintenance verification signal 223 take their respective second values; and

[0091] - Safety unit 401 determines that the braking force application device 217 is in the maintenance position based on the electrical position signal 221.

[0092] Preferably, the electromechanical brake actuator 400 may include a force sensor device, such as a force sensor, configured to generate a braking force indication electrical signal 213, the value of which indicates the value of the braking force generated by the electromechanical module 201. In embodiments where only the maintenance request signal 222 exists, the service brake control unit 202 may be configured to receive the braking force indication electrical signal 213, and when the braking force application device 217 is in the maintenance position and the maintenance request signal 220 presents its first value:

[0093] - Safety unit 401 can be configured to allow the braking force control signal 204 issued by the service brake control unit 202 to reach the electromechanical module 201 again via the first interrupt device 403;

[0094] - The service brake control unit 202 can be configured to bring the brake force application device 217 into a braking application position that contacts the brake force receiving device 218 via the brake force control signal 204. In this position, the service brake control unit 202 is configured to determine that the brake force application device 217 has reached the braking application position when the brake force indication electrical signal 213 takes a non-zero value after taking a zero value (i.e., changes from a zero value to a non-zero value).

[0095] - When the braking force application device 217 reaches the braking application position that contacts the braking force receiving device 218, the service brake control unit 202 is configured to bring the braking force application device 217 into a new stationary position through the braking force control signal 204, which again has the second distance -A with the determined braking application position.

[0096] In embodiments where both maintenance request signal 222 and maintenance verification signal 223 are present, when the braking force application device 217 is in the maintenance position, and both maintenance request signal 224 and maintenance verification signal 223 take their respective first values:

[0097] - Safety unit 401 can be configured to allow the braking force control signal 204 issued by the service brake control unit 202 to reach the electromechanical module 201 again via the first interrupt device 403;

[0098] - The service brake control unit 202 can be configured to bring the brake force application device 217 into a braking application position that contacts the brake force receiving device 218 via the brake force control signal 204. In this position, the service brake control unit 202 is configured to determine that the braking application position is consistent with the position of the brake force application device 217 when the brake force indication signal 213 takes a non-zero value after taking a zero value (i.e., changes from a zero value to a non-zero value).

[0099] - When the braking force application device 217 reaches the braking application position that contacts the braking force receiving device 218, the service brake control unit 202 is configured to bring the braking force application device 217 into a new stationary position through the braking force control signal 204, which again has the second distance -A with the determined braking application position.

[0100] Furthermore, when the braking force indication signal 213 takes a non-zero value and then takes a zero value again (i.e., changes from a non-zero value to a zero value), the service brake control unit 202 can be set to determine the brake release position, in which the braking force application device 217 is no longer in contact with the braking force receiving device 218.

[0101] The service brake control unit 202 can be configured to bring the brake force application device 217 into a new stationary position via the brake force control signal 204, which again has the second distance-A from the determined brake release position.

[0102] In the second embodiment, the electromechanical module 201 of the electromechanical brake actuator 400 for vehicles, particularly for at least one railway vehicle, receives power not through the braking force control signal 204, but through a special power supply signal 405.

[0103] In the aforementioned case, the safety unit 401 will be configured to prevent the power signal 405 from reaching the electromechanical module 201 via the first interrupt device 403':

[0104] a) Based on the value of the electrical position signal 221, the safety unit 401 determines that the braking force application device 217 is located at a position along the braking force application axis Xt, which is between a working position at a first distance -B from the braking force receiving device and a stationary position at a second distance -A from the braking force receiving device, wherein the second distance -A is less than the first distance -B;

[0105] b) Based on the change in the value of the electrical position signal 221 over time, the safety unit determines that the braking force application device 217 is moving from the stationary position to the maintenance position.

[0106] Preferably, in this second embodiment, the safety unit 401 can also receive the maintenance request signal 222. In this case, the safety unit 401 can be configured to prevent the power signal 405 from reaching the electromechanical module 201 via the first interrupt device 403':

[0107] a) Safety unit 401 determines the position of braking force application device 217 along the braking force application axis Xt between the maintenance position and the stationary position based on the value of electrical position signal 221;

[0108] b) Based on the change in the value of the electrical position signal 221 over time, the safety unit determines that the braking force application device 217 is moving from the stationary position to the maintenance position.

[0109] Preferably, in this second embodiment, the safety unit 401 can also be configured to receive the maintenance verification signal 223. In this case, the safety unit 401 can be configured to prevent the power signal 405 from reaching the electromechanical module 201 via the first interrupt device 403':

[0110] a) Both the maintenance request signal 222 and the maintenance verification signal 223 take their respective first values, and the safety unit 401 determines the position of the braking force application device 217 along the braking force application axis Xb between the maintenance position and the stationary position based on the value of the electrical position signal 221.

[0111] b) Based on the change in the value of the electrical position signal 221 over time, the safety unit determines that the braking force application device 217 is moving from the stationary position to the maintenance position.

[0112] Otherwise, or additionally, security element 401 may be configured as follows:

[0113] - When the maintenance request signal 222 and the maintenance verification signal 223 take different values ​​from each other (i.e., inconsistent values, for example, the maintenance request signal 222 takes its first value while the maintenance verification signal 223 does not take its first value, or the maintenance request signal 222 takes its second value while the maintenance verification signal 223 does not take its second value), the first interrupt device 403 prevents the power signal 405 from reaching the electromechanical module 201, and the safety unit 401 determines the position of the braking force application device 217 along the braking force application axis Xb between the maintenance position and the rest position based on the electrical position signal 221;

[0114] Alternatively, or additionally, the security unit 401 may also be configured as follows:

[0115] When both the maintenance request signal 222 and the maintenance verification signal 223 take their respective second values ​​and the safety unit 401 determines that the braking force application device 217 is in a stationary position based on the electrical position signal 221, the power signal 405 is allowed to reach the electromechanical module 201 through the first interrupt device 403.

[0116] Preferably, referring to the second embodiment, when the safety unit prevents the power signal 405 from reaching the electromechanical module 201 through the first interrupt device 403', the safety unit 401 can be further configured to prevent the braking force control signal 204 issued by the service brake control unit 202 from reaching the electromechanical module 201 through the second interrupt device 406.

[0117] Also in this second embodiment, the electromechanical actuator 400 may include a force sensor device 212 configured to generate a braking force indication signal 213, the value of which indicates the value of the braking force generated by the electromechanical module 201. The service brake control unit may be configured to receive the braking force indication signal 213.

[0118] In the case where only maintenance request signal 222 is present, when the braking force application device 217 is in the maintenance position and maintenance request signal 22 takes its first value:

[0119] - The safety unit 401 can be configured to allow the power signal 405 to reach the electromechanical module 201 again via the first interrupt device 403';

[0120] - The service brake control unit 202 can be configured to bring the brake force application device 217 into the brake application position that contacts the brake force receiving device 218 via the brake force control signal 204, wherein the service brake control unit 202 is configured to determine that the brake force application device 217 has reached the brake application position when the brake force indication electrical signal 213 takes a non-zero value after taking a zero value.

[0121] - When the braking force application device 217 reaches the braking application position that contacts the braking force receiving device 218, the service brake control unit 202 is configured to bring the braking force application device 217 into a new stationary position through the braking force control signal 204, which again has the second distance -A with the determined braking application position.

[0122] When both maintenance request signal 222 and maintenance verification signal 223 are present, and the braking force application device 217 is in the maintenance position, and both maintenance request signal 224 and maintenance verification signal 223 take their respective first values:

[0123] - The safety unit 401 can be configured to allow the power signal 405 to reach the electromechanical module 201 again via the first interrupt device 403';

[0124] - The service brake control unit 202 can be configured to bring the brake force application device 217 into a braking application position that contacts the brake force receiving device 218 via the brake force control signal 204, wherein the service brake control unit 202 is configured to determine that the braking application position is consistent with the position of the brake force application device 217 when the brake force indication electrical signal 213 takes a non-zero value after taking a zero value (i.e., changes from a zero value to a non-zero value);

[0125] - When the braking force application device 217 reaches the braking application position that contacts the braking force receiving device 218, the service brake control unit 202 is configured to bring the braking force application device 217 into a new stationary position through the braking force control signal 204, which again has the second distance -A with the determined braking application position.

[0126] Furthermore, when the braking force indication signal 213 returns to zero after taking a non-zero value, the service brake control unit 202 can be configured to determine a brake release position where the braking force application device 217 is no longer in contact with the braking force receiving device 218. The service brake control unit 202 can be configured to bring the braking force application device 217 to a new stationary position via the braking force control signal 204, which again has the second distance -A from the determined brake release position.

[0127] Referring again to all the embodiments described above, the electrical position signal 221 may be generated by a position sensor device 220 configured to measure the position of at least one force transmission member 206, 211, 216 along the translation axis Xt. Alternatively, the electromechanical module 201 may include at least one rotating mechanical member, and the electrical position signal 221 may be generated by an angular position sensor device configured to measure the angular position and direction of rotation of at least one rotating member of the electromechanical module 201.

[0128] Referring again to all the above embodiments, the electromechanical actuator 400 may include an emergency braking module 207, which includes an emergency braking energy storage device 208 configured to store energy for at least one emergency braking operation. In this case, the emergency braking module 207 may be configured to receive an emergency braking request signal 210 and present a first state in which the emergency braking module 207 does not release the energy stored in the emergency braking storage device 208 when the emergency braking request signal 210 does not indicate that emergency braking is required; and a second state in which the emergency braking module 207 releases the energy stored in the emergency braking storage device 208 when the emergency braking request signal 210 indicates that emergency braking is required.

[0129] Referring again to all the above embodiments, safety unit 401 can be developed based on a higher safety integrity level (SIL) than that used in the development of the service brake control unit 202. Furthermore, safety unit 401 can be developed based on a safety integrity level (SIL) >= 3. Additionally, safety unit 401 may include a microprocessor and / or an FPGA.

[0130] In the following text, see references Figure 4In other words, referring to an embodiment where the electromechanical module 201 receives power via the braking force control signal 204, the operation of the brake actuator 400 is described in detail.

[0131] In this first exemplary embodiment, an electromechanical brake actuator 400 is provided for service braking and emergency braking.

[0132] The electromechanical brake actuator 400 includes an electromechanical module 201 for generating a first braking force, the electromechanical module 201 being configured to receive a braking force control signal 204 and generate a braking force, the value of which is a function of the braking force control signal 204.

[0133] The electromechanical module 201 may include, for example, a motor 230 non-exclusively connected to a mechanical reducer 231. Furthermore, the electromechanical module 201 may include a mechanical conversion member for converting rotational motion to translational motion 232. This mechanical conversion member 232 may be directly driven by the motor 230 or possibly by the mechanical reducer 231. The mechanical conversion member 232 may be configured to transmit braking force to a plurality of force transmission members 206, 211, 216, which are configured to transmit braking force from the electromechanical module 201 to a braking force application device 217. The braking force application device 217 may be at least one braking force application device 217.

[0134] Along the mechanical force transmission chain, there may be an emergency braking module 207, which includes an emergency braking energy storage device 208, such as a mechanical potential energy storage element or a kinetic energy storage element.

[0135] Basically, the emergency braking module 207 can be controlled by the electric emergency braking request signal 210 and can be configured to have a first state in which the emergency braking module 207 does not release the energy stored in the emergency braking energy storage device 208 for emergency braking when the emergency braking request signal 210 does not indicate an emergency braking request, and a second state in which the emergency braking module 207 releases the energy stored in the emergency braking energy storage device 208 to apply emergency braking when the emergency braking request signal 210 indicates an emergency braking request.

[0136] The electromechanical module 201 can be configured to generate at least an angular position signal 219, which indicates the angular position value of one of the rotating elements included in the electromechanical module.

[0137] If the motor 230 is a BLDC type motor, then at least one angular position signal 219 indicating the angular position value may, non-exclusively, include a signal generated by the Hall sensor of the BLDC type motor 230.

[0138] Alternatively, and not exclusively, at least one angular position signal 219 indicating the angular position value of one of the rotating elements included in the electromechanical module 201 may include a signal generated by a magnetic sensor indicating the amount and direction of rotation of a rotating mechanical element included in the electromechanical module 202.

[0139] Still referencing Figure 4 The electromechanical brake actuator 400 may further include a force sensor device 212 configured to measure the braking force generated by the electromechanical module 201 and generate a braking force indication signal 213. The value of the braking force indication signal 213 indicates the value of the first braking force. The force sensor device may be, for example, a force sensor of the type of a weighing sensor.

[0140] Furthermore, the electromechanical brake actuator 400 may include, but is not limited to, a position sensor device 220 configured to measure the translational position of force transmission members 206, 211, and 216, which are configured to transmit braking force from the electromechanical module 201 to the braking force application device 217. The position sensor device 220 is also configured to generate an electrical position signal 221.

[0141] The value of the electrical position signal 221 indicates the translational position of the braking force application device 217.

[0142] The position sensor device 220 may be, for example, an optical linear position sensor, an LVDT linear transformer, or a magnetic linear position sensor.

[0143] In addition, the electromechanical brake actuator 400 may include a first service brake control unit 202, which is configured to receive at least:

[0144] - Vehicle braking force request signal 203;

[0145] - Power supply 205;

[0146] - Braking force indication electrical signal 213;

[0147] - Electrical position signal 221, which indicates the translational position of braking force application device 217;

[0148] - An angular position electrical signal 219 indicates the angular position of one of the rotating components constituting the electromechanical module 201;

[0149] - Maintenance request signal 222 indicates that the friction device of the braking force application device 217 needs to be replaced. It has a first state in which it does not make a request to bring the braking force application device 217 into maintenance position-B, and a second state in which it makes a request to bring the braking force application device 217 into maintenance position-B to facilitate maintenance of the braking force application device.

[0150] - Maintenance verification signal 223, which indicates that the verification of the need to replace the braking force application device 217 is required, has a first state in which it does not confirm that the braking force application device 217 is allowed to be brought into maintenance position-B, and a second state in which it confirms that the braking force application device 217 is allowed to be brought into maintenance position-B.

[0151] The service brake control unit 202 can also be configured to control the electromechanical module 201 via the braking force control signal 204 to generate braking force, thereby having a value corresponding to the value of the service brake force request signal 203, that is, the value is a function of the value of the service brake force request signal 203.

[0152] In addition, the service brake control unit 202 can be configured to perform an integral calculation of the angular position change indicated by the angular position signal 219 and convert it into a translational position value of the force transmission devices 206, 211, 212, which are configured to transmit braking force from the electromechanical module 201 to the braking force application device 217.

[0153] If the service brake control unit 202 receives a request to reset the service brake force during the application of service brake, the service brake control device 202 reduces the braking force by continuously monitoring the force value indicated by the braking force indication electrical signal 213.

[0154] At the instant when the braking force indicator signal 213 indicates zero braking force, the service brake control unit 202 is set to:

[0155] - Store the translational position value of the braking force application device 217 as a "zero" reference point for measuring the stationary distance-A;

[0156] - By using at least one braking force control signal 204, the electromechanical module 201 is commanded to maintain the rotation direction of the motor at a predetermined rotation speed;

[0157] - Continuously monitor the change in translational position of the braking force application device 217, which is obtained by an electrical position signal 221 indicating the translational position of the braking force application device 217. Alternatively, the translational position can be obtained by performing an integral operation on the angular position change indicated by an angular position signal 219 associated with one of the rotating mechanical components included in the electromechanical module 201, and converting the angular position change into a translational position value of the braking force application device 217.

[0158] - When the translational position of the braking force application device 217 has reached distance -A, within a specific predetermined tolerance range relative to the "zero" reference point stored in the first step, the electromechanical module 201 is commanded to stop rotating, having reached the desired stationary position, i.e., distance -A.

[0159] Furthermore, when the translational position of the braking force application device 217 has reached distance -A, the service brake control unit 202 is set to:

[0160] - Continuously monitor the status of maintenance request signal 222 and maintenance verification signal 223;

[0161] - When the maintenance request signal 222 is in the first state where it has not made a request to bring the brake force application device 217 into the maintenance position-B, or when the maintenance verification signal 223 is in the first state where it has not confirmed permission to bring the brake force application device 217 into the maintenance position-B, the service brake control unit 202 does not perform any action until a new brake force request is received via signal 203.

[0162] - When the maintenance request signal 222 presents a second state that requests to bring the brake force application device 217 into maintenance position-B, and the maintenance verification signal 223 presents a second state that confirms that it is permissible to bring the brake force application device 217 into maintenance position-B, the service brake control unit 202 commands the electromechanical module 201 to bring the brake force application device 217 into maintenance position-B, thereby allowing the operator responsible for maintaining the brake force application mechanism to replace, for example, the friction device of the brake force application device.

[0163] - From the previous state, i.e., the brake force application device 217 is in maintenance position-B, when the maintenance request signal 222 has shown a first state that it does not request to bring the brake force application device 217 into maintenance position-B, and the maintenance verification signal 223 has shown a first state that it does not confirm permission to bring the brake force application device 217 into maintenance position-B, the service brake control unit 202 commands the electromechanical module 201 to make the brake force application device 217 contact the brake disc in the case of disc brakes, or contact the wheel in the case of wheel brakes.

[0164] At the instant when the braking force indicator signal 213 indicates that the braking force value is greater than zero, that is, when the braking force application device 217 has contacted the brake disc in the case of disc brakes, or the wheel in the case of wheel brakes, the service brake control unit 202 performs the above check again to reach the stationary position-A.

[0165] Therefore, after maintaining the braking force application device 217, the electromechanical actuator 400 has correctly reset the position of the braking force application device 217.

[0166] The electromechanical brake actuator 400 also includes a safety unit 401, which is configured to receive at least:

[0167] - Braking force indication electrical signal 213;

[0168] - Electrical position signal 221 indicating translation position, which indicates the translation position of braking force application device 217;

[0169] - Angular position electrical signal 219, which indicates the angular position of one of the rotating components of electromechanical module 201;

[0170] - Maintenance request signal 222, for maintenance request of the friction device of the braking force application device 217;

[0171] - Maintenance verification signal 223.

[0172] The service brake control unit 202 is configured to perform an integral calculation of the angular position change indicated by the angular position signal 219 and convert it into a translational position value of the force transmission members 206, 211, 212, which are configured to transmit braking force from the electromechanical module 201 to the braking force application device 217.

[0173] exist Figure 4 In the example, safety unit 401 is configured to generate control signal 402 to control first interrupt device 403 (e.g., an interrupt device such as a controlled switch, relay, etc.) to interrupt or not interrupt braking force control signal 204 that also provides power.

[0174] When both power signal 405 and braking force control signal 204 are present, see Figure 5 In the example, safety unit 401 may be configured to generate control signal 402 for controlling a first interrupt device 403' to interrupt or not interrupt power signal 405, and / or a second interrupt device 406 (e.g., an interrupt device such as a controlled switch, relay, etc.) for controlling interrupt or not interrupt braking force control signal 204.

[0175] When the braking force control signal 204 supplies power to the electromechanical module 201, and when the control signal 402 does not command the interruption of control and power supply to the electromechanical module 201, the first interruption device 403 is configured to allow the service brake control unit to supply power to and control the electromechanical module 201 via at least one braking force control signal 204. Furthermore, when the control signal 402 commands the interruption of control and power to the electromechanical module 201, the first interruption device 403 is configured to prevent the service brake control unit from supplying power to and controlling the electromechanical module 201 via at least one control signal 204 by forcing the transmission member 206 to remain in its current position at the instant at which at least one control signal 204 is interrupted.

[0176] When power signal 405 is present, see, for example, see Figure 5 Instead, the first interruption device 403' is configured to supply power to the electromechanical module 201 via the power signal 405 when the first control signal 402 does not command the interruption of the power supply to the electromechanical module 201, and to interrupt the power supply to the electromechanical module 201 from the power signal 405 when the first control signal 402 commands the interruption of the power supply to the electromechanical module 201, thereby forcing the electromechanical module 201 to hold the transmission arm 206 in the current position at the moment when at least one control and power signal 204 is interrupted.

[0177] In other words, through control signal 402, safety unit 401 can allow or prevent service brake control unit 202 from controlling electromechanical module 201.

[0178] Safety unit 401 can continuously monitor braking force indication signal 213. At the instant the braking force indication signal 213 changes from a force value greater than zero to a braking force value equal to zero, safety unit 401 performs the following steps:

[0179] - Store the translational position value of the braking force application device 217 as a "zero" reference point for measuring the stationary distance-A;

[0180] - Continuously monitor the change in translational position of the braking force application device 217, which is obtained by an electrical position signal 221 indicating the translational position of the braking force application device 217. Alternatively, the translational position can be obtained by performing an integral operation on an angular position change indicated by an angular position signal 219 associated with one of the rotating mechanical components included in the electromechanical module 201, and converting the angular position change into a translational position value of the braking force application device 217.

[0181] - Continuously monitor the status of maintenance request signal 222 and maintenance verification signal 223;

[0182] When the translational position of the braking force application device 217 has reached distance-A and subsequently exceeds its absolute value by advancing to distance-B, if at this time the maintenance request signal 222 is in a first state where it has not made a request to bring the braking force application device 217 to distance-B, or if at this time the maintenance verification signal 223 is in a first state where it has not confirmed permission to bring the braking force application device 217 to position-B, then the safety unit 401 acts on signal 402 to switch the first interruption devices 403' to a state where they interrupt the control signal 204 of the electromechanical module 201 (in an embodiment where the braking force control signal 204 supplies power to the electromechanical module 201), or to a state where they interrupt the power signal 405 for the electromechanical module 201 (in an embodiment where the power signal 405 supplies power to the electromechanical module 201), forcing the electromechanical module 201 to hold the drive arm 206 in a position close to distance-A, but in preparation for emergency braking application. Furthermore, the safety unit 401 sends an error indication via error signal 404;

[0183] When the translational position of the braking force application device 217 has reached the maintenance position-A and subsequently exceeds its absolute value by traveling to a distance-B, if the maintenance request signal 222 has simultaneously presented a second state requesting the braking force application device 217 to be brought to the distance-B, and the maintenance verification signal 223 has simultaneously presented a second state confirming that the braking force application device 217 is allowed to be brought to the maintenance position-B, then the safety unit 401 does not perform any action, allowing the service brake control unit 202 to command the total translation of the braking force application device 217 to reach the maintenance position-B required for the maintenance of the braking force application device 217, such as replacing the friction device of the braking force application device 217. When the maintenance position-B is reached, safety unit 401 acts on signal 402 to switch the first interruption devices to the state of interrupting the braking control signal 204 of electromechanical module 201 (in the embodiment where the braking force control signal 204 supplies power to electromechanical module 201), or the state of the power signal 405 of electromechanical module 201 (in the embodiment where the power signal 405 supplies power to electromechanical module 201), forcing electromechanical module 201 to hold drive arm 206 in maintenance position-B, allowing the maintenance operator to operate safely and preventing sudden improper movement of braking force application device 217;

[0184] From the previous state, when the maintenance request signal 222 has presented a first state in which it does not request to bring the braking force application device 217 into maintenance position-B, and the maintenance verification signal 223 has presented a first state in which it does not confirm permission to bring the braking force application device 217 into maintenance position-B, the safety unit 401 acts on signal 402 to switch the first interruption device 403 to a state in which they do not interrupt the control and power signal 204 of the electromechanical module 201 (in the embodiment where the braking force control signal 204 supplies power to the electromechanical module 201), or a state in which they do not interrupt the power signal 405 of the electromechanical module 201 (in the embodiment where the power signal 405 supplies power to the electromechanical module 201), allowing the driving braking force control module 202 to return to the stationary position-A according to the above control.

[0185] When the power signal 405 supplies power to the electromechanical module 201, a second interrupt device 406 can also be provided, which interrupts the braking force control signal 204 when the power signal 405 is interrupted.

[0186] Clearly, safety unit 401 performs simple monitoring, interruption, and alarm functions, and is therefore much simpler to implement than service brake control unit 202.

[0187] Therefore, the expedient measure is to develop the safety unit 401 to a higher SIL level than the service brake control unit 202, that is, a SIL level consistent with the application of emergency braking, and to meet the safety requirements required to allow maintenance operators to safely operate the actuator to maintain the brake force application device 217 (e.g., to replace the friction device of the brake force application device 217).

[0188] As mentioned above, it is known from the prior art that safety analysis based on standard EN50126 recommends applying a safety level of SIL<=2 to the development of HW-SW control units for railway vehicle service braking.

[0189] Due to the consumption of friction material, developing the safety unit to SIL>=3 level advantageously provides full clearance recovery function and maintains the friction material at the same SIL>=3 level, with development costs much lower than developing a complete service brake control unit based on the SIL>=3 safety level.

[0190] To maintain the integrity of the security level path, it is recommended that maintenance verification signal 223 be designed to the same SIL security level as when security unit 401 was developed.

[0191] refer to Figure 6On the other hand, the present invention relates to a braking system comprising a plurality of brake actuators 400 according to any of the above embodiments. The braking system includes a control unit 500, which is connected to the plurality of brake actuators 400 via a communication device 501, such as a wired or wireless communication network. The control unit is configured to receive:

[0192] - Parking brake signal (502), the value of which indicates whether the parking brake is applied;

[0193] - At least one speed signal 503, which indicates the vehicle speed;

[0194] - Maintenance signal 504, the value of which indicates whether the braking system requests a maintenance cycle.

[0195] Control unit 500 is also configured as follows:

[0196] - When maintenance signal 504 takes a value indicating a maintenance request, parking brake signal 502 takes a value indicating the application of the parking brake, and speed signal 503 takes a value indicating that the vehicle speed is zero, a maintenance request signal 222 with a second value is generated, which is then transmitted via the communication device 501 to at least one of the electromechanical actuators 400; and

[0197] - When at least one of the following occurs, a maintenance request signal 222 with a first value is generated and sent to a plurality of electromechanical actuators 400 via the communication device 501: maintenance signal 504 takes a value that does not indicate a maintenance request; parking brake signal 502 takes a value that indicates that the parking brake is not applied; speed signal 503 takes a value that indicates a non-zero vehicle speed.

[0198] Each of the electromechanical actuators 400 may include a user interface device 503 through which an operator involved in maintaining the braking force application device 217 causes the maintenance verification signal 223 to take its second value to bring the braking force application device 217 into a maintenance position, and causes the maintenance verification signal 223 to take its first value to bring the braking force application device 217 into a stationary position when maintenance of the braking force application device 217 is completed, for example, when the friction device of the braking force application device 217 is replaced.

[0199] In other words, observation Figure 6 The braking system may include multiple actuators 400 as described above, managed by a centralized braking control unit 500 for safely implementing maintenance cycles of the friction material.

[0200] Multiple electromechanical actuators 400 can be connected to the braking system control unit 500 via the communication device 501. The braking system control unit 500 can be configured to receive a signal 502 indicating the application of parking brake, at least one signal 503 indicating vehicle speed, and a signal 504 indicating a request for a maintenance cycle of the braking system.

[0201] When the brake system maintenance request signal 504, indicating a request to perform a maintenance cycle for the system brakes, presents a state indicating a request to perform a brake system maintenance cycle, and the parking brake signal 502, indicating the application of a parking brake, indicates the application of a parking brake to the train, and the vehicle speed signal 503 indicates zero speed, the brake system control unit 500 is configured to generate a maintenance request signal 222 to request maintenance on the friction device of the brake force application device 217, which is in a second state, in which it proposes to bring the brake force application device 217 into the maintenance position. B is for the purpose of facilitating the replacement of the friction device.

[0202] Each electromechanical actuator 400 may include a user interface 503 through which an operator assigned to perform maintenance (e.g., replace the friction device) on the braking force application device 217 may cause the maintenance verification signal 223 to enter its second state, in which it confirms that the braking force application device 217 is permitted to be brought into the maintenance position. B.

[0203] User interface 503 may include, but is not limited to, an interface for a computing device. In the presence of a predetermined security code, this interface is configured to bring maintenance verification signal 223 into its second state, in which it confirms that the braking force application device 217 is permitted to be brought into the maintenance position. B.

[0204] The braking system control unit 500 is configured to generate a maintenance request signal 222 in its second state, in which it requests only one electromechanical actuator 400 at a time to bring the braking force application device 217 into the maintenance position. B's request.

[0205] In this way, the system ensures that the braking system control unit 500 can only activate one actuator 400 to maintenance state at a time (e.g., to replace the friction material of the brake force application device 217), and that a single electromechanical actuator 400 sent for maintenance can only be explicitly brought into the state that puts the brake force application device 217 into maintenance position-B by the operator through local consent via the local user interface 503.

[0206] Furthermore, once maintenance position-B is reached, only the operator's action of removing the key from user interface 505 allows the actuator 400 in maintenance state to bring the braking force application device 217 closer to the brake disc or wheel, thereby ensuring that the operator can operate safely.

[0207] The content described above in the field of railway vehicles or railway trains can also be found in other sectors, such as general vehicles, rubber-tired vehicles, or rubber-tired transportation.

[0208] Various aspects and embodiments of electromechanical brake actuators and braking systems for vehicles, particularly for at least one railway vehicle according to the invention, have been described. It should be understood that each embodiment can be combined with any other embodiment. Furthermore, the invention is not limited to the described embodiments, but can be varied within the scope defined by the appended claims.

Claims

1. An electromechanical brake actuator (400) for a vehicle, comprising: - Service brake control unit (202), which is configured to receive service brake force request electrical signal (203) and generate brake force control signal (204), the value of which is a function of the service brake force request electrical signal (203); - An electromechanical module (201) is configured to receive a braking force control signal (204) generated by the service brake control unit (202) and generate a braking force, the value of which is a function of the braking force control signal (204), wherein the electromechanical module (201) is also configured to receive power through the braking force control signal (204); - At least one force transmission member (206, 211, 216) is configured to transmit the braking force generated by the electromechanical module (201) to the braking force application device (217), wherein the at least one force transmission member (206, 211, 216) is configured to be controlled by the electromechanical module (201) to translate along a translation axis (Xt), wherein the translation of the at least one force transmission member (206, 211, 216) according to a first application direction involves increasing the braking force applied by the braking force application device (217), and the translation of the at least one force transmission member (206, 211, 216) according to a second application direction opposite to the first application direction involves decreasing the braking force applied by the braking force application device (217); The electromechanical brake actuator (400) is characterized in that it includes a safety unit (401), which is configured as follows: - Receive an electrical position signal (221), the value of which indicates the position of the braking force application device (217) along the translation axis (Xt); - Based on the value of the electrical position signal (221), determine the instantaneous position of the braking force application device (217); and - In the following situations, the first interruption device (403) prevents the braking force control signal (204) issued by the service brake control unit (202) from reaching the electromechanical module (201): a) Based on the value of the electrical position signal (221), the safety unit (401) determines the position of the braking force application device (217) along the force application axis (Xb), the position being between a maintenance position at a first distance (-B) from the braking force receiving device (218) and a rest position at a second distance (-A) from the braking force receiving device (218), the second distance (-A) being less than the first distance (-B); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position.

2. The electromechanical brake actuator (400) of claim 1, wherein, The safety unit (401) is configured to receive a maintenance request signal (222), the maintenance request signal being configured to take a first value, the first value indicating that the braking force application device (217) does not need to be brought into the maintenance position, and a second value, the second value indicating that the braking force application device (217) needs to be brought into the maintenance position; The security unit (401) is also configured as follows: - The first interrupt device (403) prevents the braking force control signal (204) issued by the service brake control unit (202) from reaching the electromechanical module (201) in the following situations: a) The maintenance request signal (222) takes its first value, and the safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position.

3. The electromechanical brake actuator (400) of claim 2, wherein, The safety unit (401) is configured to further receive a maintenance verification signal (223), the maintenance verification signal being configured to take a first value, the first value of which indicates that permission to bring the braking force application device (217) into the maintenance position is not confirmed, and to take a second value, the second value of which indicates that permission to bring the braking force application device (217) into the maintenance position is confirmed. The security unit (401) is configured as follows: - The first interrupt device (403) prevents the braking force control signal (204) issued by the service brake control unit (202) from reaching the electromechanical module (201) in the following situations: a) The maintenance request signal (222) and the maintenance verification signal (223) both take their respective first values, and the safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position; And / or the security unit (401) is configured as follows: - The first interrupt device (403) prevents the braking force control signal (204) issued by the service brake control unit (202) from reaching the electromechanical module (201) in the following situations: a) When the maintenance request signal (222) takes its first value and the maintenance verification signal (223) does not take its first value, or when the maintenance request signal (222) takes its second value and the maintenance verification signal (223) does not take its second value; as well as b) The safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); And / or the security unit (401) is configured as follows: - When both the maintenance request signal (222) and the maintenance verification signal (223) take their respective second values, and the safety unit (401) determines based on the electrical position signal (221) that the braking force application device (217) is in the stationary position, the first interrupt device (403) allows the braking force control signal (204) issued by the service brake control unit (202) to reach the electromechanical module (201).

4. The electromechanical brake actuator (400) of claim 3, wherein, The safety unit (401) is configured to prevent the braking force control signal (204) issued by the service brake control unit (202) from reaching the electromechanical module (201) via the first interruption device (403) under the following conditions: - Both the maintenance request signal (222) and the maintenance verification signal (223) take their respective second values; and - The safety unit (401) determines that the braking force application device (217) is in the maintenance position based on the value of the electrical position signal (221).

5. The electromechanical brake actuator (400) according to claim 1, comprising a force sensor device (212) configured to generate a braking force indication electrical signal (213), the value of which indicates the value of the braking force generated by the electromechanical module (201); The service brake control unit (202) is configured to receive the braking force indication electrical signal (213).

6. The electromechanical brake actuator (400) of claim 1, wherein, The safety unit (401) is configured to receive a maintenance request signal (222), the maintenance request signal being configured to take a first value, the first value indicating that the braking force application device (217) does not need to be brought into the maintenance position, and a second value, the second value indicating that the braking force application device (217) needs to be brought into the maintenance position; The security unit (401) is also configured as follows: - The first interrupt device (403) prevents the braking force control signal (204) issued by the service brake control unit (202) from reaching the electromechanical module (201) in the following situations: a) The maintenance request signal (222) takes its first value, and the safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position. The electromechanical brake actuator (400) includes a force sensor device (212) configured to generate a braking force indication electrical signal (213), the value of which indicates the value of the braking force generated by the electromechanical module (201). The service brake control unit (202) is configured to receive the braking force indication electrical signal (213). Specifically, when the braking force application device (217) is in the maintenance position and the maintenance request signal (222) takes its first value: - The safety unit (401) is configured to allow the braking force control signal (204) issued by the service brake control unit (202) to reach the electromechanical module (201) again via the first interrupt device (403). - The service brake control unit (202) is configured to bring the brake force application device (217) into a braking application position that contacts the brake force receiving device (218) by means of the brake force control signal (204), wherein the service brake control unit (202) is configured to determine that the brake force application device (217) has reached the braking application position when the brake force indication electrical signal (213) takes a non-zero value after taking a zero value; - When the braking force application device (217) reaches the braking application position in contact with the braking force receiving device (218), the service brake control unit (202) is configured to bring the braking force application device (217) into a new stationary position by means of the braking force control signal (204), the new stationary position having the second distance (-A) again from the determined braking application position.

7. The electromechanical brake actuator (400) of claim 1, wherein, The safety unit (401) is configured to receive a maintenance request signal (222), the maintenance request signal being configured to take a first value, the first value indicating that the braking force application device (217) does not need to be brought into the maintenance position, and a second value, the second value indicating that the braking force application device (217) needs to be brought into the maintenance position; The security unit (401) is also configured as follows: - The first interrupt device (403) prevents the braking force control signal (204) issued by the service brake control unit (202) from reaching the electromechanical module (201) in the following situations: a) The maintenance request signal (222) takes its first value, and the safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position. The safety unit (401) is configured to further receive a maintenance verification signal (223), wherein the maintenance verification signal is configured to take a first value, wherein the first value of the maintenance verification signal indicates that it is not confirmed that the braking force application device (217) is allowed to be brought into the maintenance position, and to take a second value, wherein the second value of the maintenance verification signal indicates that it is confirmed that the braking force application device (217) is allowed to be brought into the maintenance position. The security unit (401) is configured as follows: - The first interrupt device (403) prevents the braking force control signal (204) issued by the service brake control unit (202) from reaching the electromechanical module (201) in the following situations: a) The maintenance request signal (222) and the maintenance verification signal (223) both take their respective first values, and the safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position; And / or the security unit (401) is configured as follows: - The first interrupt device (403) prevents the braking force control signal (204) issued by the service brake control unit (202) from reaching the electromechanical module (201) in the following situations: a) When the maintenance request signal (222) takes its first value, and the maintenance verification signal (223) does not take its first value, or when the maintenance request signal (222) takes its second value, and the maintenance verification signal (223) does not take its second value; and b) The safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); And / or the security unit (401) is configured as follows: When both the maintenance request signal (222) and the maintenance verification signal (223) take their respective second values, and the safety unit (401) determines based on the electrical position signal (221) that the braking force application device (217) is in the stationary position, the first interrupt device (403) allows the braking force control signal (204) issued by the service brake control unit (202) to reach the electromechanical module (201). Specifically, when the braking force application device (217) is in the maintenance position, and both the maintenance request signal (222) and the maintenance verification signal (223) take their respective first values: - The safety unit (401) is configured to allow the braking force control signal (204) issued by the service brake control unit (202) to reach the electromechanical module (201) again via the first interrupt device (403). - The service brake control unit (202) is configured to bring the brake force application device (217) into a braking application position that contacts the brake force receiving device (218) by means of the brake force control signal (204), wherein the service brake control unit (202) is configured to determine that the braking application position is consistent with the position of the brake force application device (217) when the brake force indication signal (213) takes a non-zero value after taking a zero value; - When the braking force application device (217) reaches the braking application position in contact with the braking force receiving device (218), the service brake control unit (202) is configured to bring the braking force application device (217) into a new stationary position by means of the braking force control signal (204), the new stationary position having the second distance (-A) again from the determined braking application position.

8. The electromechanical brake actuator (400) of claim 5, wherein, When the braking force indication signal (213) takes a non-zero value and then takes a zero value again, the service brake control unit (202) is set to determine the brake release position. In the brake release position, the braking force application device (217) no longer contacts the braking force receiving device (218). The service brake control unit (202) is configured to bring the brake force application device (217) into a new stationary position by means of the brake force control signal (204), the new stationary position having the second distance (-A) again from the determined brake release position.

9. The electromechanical brake actuator (400) of claim 1, wherein, The electromechanical module (201) includes at least one rotating mechanical component, and the electrical position signal (221) is generated by an angular position sensor device, which is configured to measure the angular position and rotation direction of the at least one rotating component of the electromechanical module (201).

10. The electromechanical brake actuator (400) according to claim 1, comprising an emergency braking module (207), the emergency braking module comprising an emergency braking storage device (208), the emergency braking storage device being configured to store energy for at least one emergency braking, wherein the emergency braking module (207) is configured to receive an emergency braking request signal (210) and present a first state in which, when the emergency braking request signal (210) does not take a value indicating that emergency braking needs to be performed, the emergency braking module does not release the energy stored in the emergency braking storage device (208), and a second state in which, when the emergency braking request signal (210) takes a value indicating that emergency braking needs to be performed, the emergency braking module releases the energy stored in the emergency braking storage device (208).

11. The electromechanical brake actuator (400) according to claim 1, wherein, The safety unit (401) is developed based on a higher safety integrity level (SIL) than that used in the development of the service brake control unit (202).

12. The electromechanical brake actuator (400) according to claim 1, wherein, The security unit (401) was developed based on a security integrity level (SIL) of 3 or higher.

13. The electromechanical brake actuator (400) according to claim 1, wherein, The security unit (401) includes a microprocessor.

14. The electromechanical brake actuator (400) according to claim 1, wherein the safety unit (401) includes an FPGA.

15. An electromechanical brake actuator (400) for a vehicle, comprising: - Service brake control unit (202), which is configured to receive service brake force request electrical signal (203) and generate brake force control signal (204), the value of which is a function of the service brake force request electrical signal (203); - An electromechanical module (201) is configured to receive a braking force control signal (204) generated by the service brake control unit (202) and generate a braking force, the value of which is a function of the braking force control signal (204), wherein the electromechanical module (201) is configured to receive power via a power signal (405); - At least one force transmission member (206, 211, 216) is configured to transmit the braking force generated by the electromechanical module (201) to the braking force application device (217), wherein the at least one force transmission member (206, 211, 216) is configured to be controlled by the electromechanical module (201) to translate along a translation axis (Xt), wherein the translation of the at least one force transmission member (206, 211, 216) according to a first application direction involves increasing the braking force applied by the braking force application device (217), and the translation of the at least one force transmission member (206, 211, 216) according to a second application direction opposite to the first application direction involves decreasing the braking force applied by the braking force application device (217); The electromechanical brake actuator (400) is characterized in that it includes a safety unit (401) configured to receive an electrical position signal (221), the value of which indicates the position of the braking force application device (217) along the translation axis (Xt); The security unit (401) is configured as follows: - Based on the value of the electrical position signal (221), determine the instantaneous position of the braking force application device (217); and - The power signal (405) is prevented from reaching the electromechanical module (201) by the first interrupt device (403') in the following situations: a) Based on the value of the electrical position signal (221), the safety unit (401) determines that the braking force application device (217) is located along the force application axis (Xb), the position being between a maintenance position at a first distance (-B) from the braking force receiving device (218) and a rest position at a second distance (-A) from the braking force receiving device (218), the second distance (-A) being less than the first distance (-B); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position.

16. The electromechanical brake actuator (400) according to claim 15, wherein, The safety unit (401) is also configured to receive a maintenance request signal (222), the maintenance request signal being configured to take a first value, the first value indicating that the braking force application device (217) does not need to be brought into the maintenance position, and take a second value, the second value indicating that the braking force application device (217) needs to be brought into the maintenance position; The security unit (401) is configured as follows: - The power signal (405) is prevented from reaching the electromechanical module (201) by the first interrupt device (403') in the following situations: a) The maintenance request signal (222) takes its first value, and the safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position.

17. The electromechanical brake actuator (400) according to claim 16, wherein, The safety unit (401) is also configured to receive a maintenance verification signal (223), which is configured to take a first value, the first value of which indicates that it is not confirmed that the braking force application device (217) can be brought into the maintenance position, and take a second value, the second value of which indicates that it is confirmed that the braking force application device (217) can be brought into the maintenance position. The security unit (401) is configured as follows: - The power signal (405) is prevented from reaching the electromechanical module (201) by the first interrupt device (403') in the following situations: a) The maintenance request signal (222) and the maintenance verification signal (223) both take their respective first values, and the safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position; And / or the security unit (401) is configured as follows: - The power signal (405) is prevented from reaching the electromechanical module (201) by the first interrupt device (403') in the following situations: a) When the maintenance request signal (222) takes its first value and the maintenance verification signal (223) does not take its first value, or when the maintenance request signal (222) takes its second value and the maintenance verification signal (223) does not take its second value; as well as b) The safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); And / or the security unit (401) is also configured as follows: - When the maintenance request signal (222) and the maintenance verification signal (223) both take their respective second values, and the safety unit (401) determines that the braking force application device (217) is in the stationary position based on the value of the electrical position signal (221), the power signal (405) is allowed to reach the electromechanical module (201) through the first interrupt device (403').

18. The electromechanical brake actuator (400) according to claim 15, wherein, The security unit (401) is also configured as follows: - When the safety unit prevents the power signal (405) from reaching the electromechanical module (201) through the first interrupt device (403'), it prevents the braking force control signal (204) issued by the service brake control unit (202) from reaching the electromechanical module (201) through the second interrupt device (406).

19. The electromechanical brake actuator (400) according to claim 17 or 18, wherein, The security unit (401) is also configured as follows: - When the maintenance request signal (222) and the maintenance verification signal (223) both take their respective second values, and the safety unit (401) determines that the braking force application device (217) is in the maintenance position based on the value of the electrical position signal (221), the first interrupt device (403') prevents the power signal (405) from reaching the electromechanical module (201).

20. The electromechanical brake actuator (400) according to claim 15, comprising a force sensor device (212) configured to generate a braking force indication electrical signal (213), the value of which indicates the value of the braking force generated by the electromechanical module (201); The service brake control unit (202) is configured to receive the braking force indication electrical signal (213).

21. The electromechanical brake actuator (400) according to claim 15, wherein, The safety unit (401) is also configured to receive a maintenance request signal (222), the maintenance request signal being configured to take a first value, the first value indicating that the braking force application device (217) does not need to be brought into the maintenance position, and take a second value, the second value indicating that the braking force application device (217) needs to be brought into the maintenance position; The security unit (401) is configured as follows: - The power signal (405) is prevented from reaching the electromechanical module (201) by the first interrupt device (403') in the following situations: a) The maintenance request signal (222) takes its first value, and the safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position. The electromechanical brake actuator (400) includes a force sensor device (212) configured to generate a braking force indication electrical signal (213), the value of which indicates the value of the braking force generated by the electromechanical module (201). The service brake control unit (202) is configured to receive the braking force indication electrical signal (213). Specifically, when the braking force application device (217) is in the maintenance position and the maintenance request signal (222) takes its first value: - The safety unit (401) is configured to allow the power signal (405) to reach the electromechanical module (201) again via the first interrupt device (403'); - The service brake control unit (202) is configured to bring the brake force application device (217) into a braking application position that contacts the brake force receiving device (218) by means of the brake force control signal (204), wherein the service brake control unit (202) is configured to determine that the brake force application device (217) has reached the braking application position when the brake force indication electrical signal (213) takes a non-zero value after taking a zero value; - When the braking force application device (217) reaches the braking application position in contact with the braking force receiving device (218), the service brake control unit (202) is configured to bring the braking force application device (217) into a new stationary position by means of the braking force control signal (204), the new stationary position having the second distance (-A) again from the determined braking application position.

22. The electromechanical brake actuator (400) according to claim 15. in, The safety unit (401) is also configured to receive a maintenance request signal (222), the maintenance request signal being configured to take a first value, the first value indicating that the braking force application device (217) does not need to be brought into the maintenance position, and take a second value, the second value indicating that the braking force application device (217) needs to be brought into the maintenance position; The security unit (401) is configured as follows: - The power signal (405) is prevented from reaching the electromechanical module (201) by the first interrupt device (403') in the following situations: a) The maintenance request signal (222) takes its first value, and the safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position. The safety unit (401) is also configured to receive a maintenance verification signal (223), which is configured to take a first value indicating that permission to bring the braking force application device (217) into the maintenance position is not confirmed, and to take a second value indicating that permission to bring the braking force application device (217) into the maintenance position is confirmed. The security unit (401) is configured as follows: - The power signal (405) is prevented from reaching the electromechanical module (201) by the first interrupt device (403') in the following situations: a) The maintenance request signal (222) and the maintenance verification signal (223) both take their respective first values, and the safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); b) Based on the change in the value of the electrical position signal (221) over time, the safety unit determines that the braking force application device (217) is moving from the stationary position to the maintenance position; And / or the security unit (401) is configured as follows: - The power signal (405) is prevented from reaching the electromechanical module (201) by the first interrupt device (403') in the following situations: a) When the maintenance request signal (222) takes its first value and the maintenance verification signal (223) does not take its first value, or when the maintenance request signal (222) takes its second value and the maintenance verification signal (223) does not take its second value; as well as b) The safety unit (401) determines the position of the braking force application device (217) along the braking force application axis (Xb) between the maintenance position and the stationary position based on the value of the electrical position signal (221); And / or the security unit (401) is also configured as follows: - When both the maintenance request signal (222) and the maintenance verification signal (223) take their respective second values, and the safety unit (401) determines that the braking force application device (217) is in the stationary position based on the value of the electrical position signal (221), the power signal (405) is allowed to reach the electromechanical module (201) through the first interrupt device (403'). The electromechanical brake actuator (400) includes a force sensor device (212) configured to generate a braking force indication electrical signal (213), the value of which indicates the value of the braking force generated by the electromechanical module (201). The service brake control unit (202) is configured to receive the braking force indication electrical signal (213). Specifically, when the braking force application device (217) is in the maintenance position, and both the maintenance request signal (222) and the maintenance verification signal (223) take their respective first values: - The safety unit (401) is configured to allow the braking force control signal (204) issued by the service brake control unit (202) to reach the electromechanical module (201) again via the first interrupt device (403'). - The service brake control unit (202) is configured to bring the brake force application device (217) into a braking application position that contacts the brake force receiving device (218) by means of the brake force control signal (204), wherein the service brake control unit (202) is configured to determine that the braking application position is consistent with the position of the brake force application device (217) when the brake force indication signal (213) takes a non-zero value after taking a zero value; - When the braking force application device (217) reaches the braking application position in contact with the braking force receiving device (218), the service brake control unit (202) is configured to bring the braking force application device (217) into a new stationary position by means of the braking force control signal (204), the new stationary position having the second distance (-A) again from the determined braking application position.

23. The electromechanical brake actuator (400) according to claim 20, wherein, When the braking force indication signal (213) takes a non-zero value and then takes a zero value again, the service brake control unit (202) is set to determine the brake release position. In the brake release position, the braking force application device (217) no longer contacts the braking force receiving device (218). The service brake control unit (202) is configured to bring the brake force application device (217) into a new stationary position by means of the brake force control signal (204), the new stationary position having the second distance (-A) again from the determined brake release position.

24. The electromechanical brake actuator (400) according to claim 15, wherein, The electrical position signal (221) is generated by a position sensor device (220) configured to measure the position of the at least one force transmission member (206, 211, 216) along the translation axis (Xt).

25. A braking system comprising a plurality of electromechanical brake actuators (400) according to claim 3. The braking system includes a control unit (500) configured to be connected to a plurality of the electromechanical brake actuators (400) via a communication device (501). The control unit (500) is configured to receive: - Parking brake signal (502), the value of which indicates whether the parking brake is applied; - At least one speed signal (503) indicating the speed of the vehicle; - Maintenance signal (504), which indicates a request to perform a maintenance cycle on the braking system; The control unit (500) is configured as follows: - When the maintenance signal (504) takes a value indicating a maintenance request and the parking brake signal (502) takes a value indicating the application of the parking brake, and the speed signal (503) takes a value indicating that the vehicle speed is zero, a maintenance request signal (222) with a second value is generated, which is then transmitted via the communication device (501) to at least one of the electromechanical brake actuators (400); and - When at least one of the following occurs, a maintenance request signal (222) with a first value is generated, which is sent via the communication device (501) to a plurality of the electromechanical brake actuators (400): the maintenance signal (504) takes a value that does not indicate a maintenance request; the parking brake signal (502) takes a value that indicates that the parking brake is not applied; the speed signal (503) takes a value that indicates a non-zero vehicle speed.

26. The braking system according to claim 25, wherein, Each of the electromechanical brake actuators (400) includes a user interface device through which an operator responsible for maintaining the brake force application device (217) causes the maintenance verification signal (223) to take its second value, and causes the maintenance verification signal (223) to take its first value at the end of maintenance of the brake force application device (217) to bring the brake force application device (217) to a stationary position.

Images