Control device, drive train having such control device, motor vehicle having such drive train, and method for operating such control device

Abstract

The invention relates to a control device (5) having a first control module (9) which can be operatively connected to a controlled device (2), the first control module (9) being configured to check whether the controlled device (2) is in a predetermined safety state as a function of a safety signal (13) and to determine whether the controlled device (2) is in the predetermined safety state as a function of the safety signal (13). And if the checking shows that the controlled device (2) is not in the predetermined safety state, taking at least one safety measure in order to bring the controlled device (2) into the predetermined safety state.

Description

Field of the Invention

[0001] The invention relates to a control device, a drive train having such a control device, a motor vehicle having such a drive train, and a method for operating such a control device. Background Art

[0002] In safety-critical areas or environments, especially with regard to drive technology and very particularly with regard to rail drives, there are situations where, in terms of safety, it must be ensured that certain controlled devices, such as drive devices with a transmission, are in a certain safe state, such as in a neutral position. For example, in the case of the rail drive of a rail vehicle, it must be ensured that in the event of an emergency brake or also in a stationary state, for example at a railway station, no torque is introduced into the drive wheels, which torque can act against the established braking and thus reduce its braking force or cause the rail vehicle to move or even roll undesirably. To rule out this danger in any case, typically, the electrical power supply to the control module of the controlled device to be brought into the safe state is interrupted according to a safety signal, whereupon, when the power supply is interrupted, the control module and thus also the controlled device reach the safe state or a predefined safe state according to the regulations. However, the disadvantage is that the power supply is interrupted unpreparedly, so that the operating values or faults of the controlled device cannot be saved. Therefore, when the controlled device is switched on again, it may cause faults, especially in the control module of the controlled device, but in particular it may also cause incorrect system responses of other components effectively connected to the controlled device in the system components. This can in turn have an impact not only on the expected service life of the controlled device but also on the expected service life of other components. Summary of the Invention

[0003] Therefore, the invention is based on the task of providing a control device, a drive train having such a control device, a motor vehicle having such a drive train, and a method for operating such a control device, wherein the mentioned disadvantages are at least reduced, preferably avoided.

[0004] This task is solved in that current technical teachings are provided, in particular the teachings of the independent claims and the preferred embodiments disclosed in the dependent claims and the description.

[0005] The task is solved in particular by providing a control device having a first control module, wherein the first control module is effectively connectable, in particular effectively connected, to the device to be controlled (in particular a drive device). The first control module is configured to check, based on a safety signal, whether the device to be controlled is in a predefined safe state, and to take at least one safety measure to bring the device to be controlled into the predefined safe state when the check reveals that the device to be controlled is not in the predefined safe state. The reception of the safety signal in particular signals the requirement that the device to be controlled must be in the predefined safe state or must be brought into the predefined safe state. By checking, via the first control module, whether the device to be controlled is in the predefined safe state, it is now advantageously possible, in particular, to stop or at least postpone further more drastic safety measures (such as, in particular, interrupting the power supply to a second control module for the device to be controlled or disconnecting the device to be controlled) when the device to be controlled is already in the predefined safe state, since in that case the safety requirements are already met without such drastic measures. This advantageously also enables operating values and / or faults to be stored for the device to be controlled, in particular its second control module, so that a functional restart can take place after a possible subsequent disconnection. This advantageously affects not only the expected service life of the device to be controlled, but in particular also the expected service life of other components effectively connected to the device to be controlled in the system components.

[0006] The safety signal is in particular a signal that corresponds to the state of the control device, wherein the device to be controlled must be in a predefined safe state or must be brought into the predefined safe state.

[0007] In one embodiment, the first control module is configured to receive the safety signal. Here, the safety signal can in particular be received from other areas or modules of the control device or from outside the control device. In one embodiment, the first control module has an interface that is configured to receive the safety signal; alternatively or additionally, the control device has an interface that is configured to receive the safety signal. In other embodiments, the safety signal can be generated by the first control module itself, in particular in response to the internal state of the control device or in response to other signals received from outside the control device. In one embodiment, the first control module and / or the control device has an interface that is configured to receive other signals from outside the control device.

[0008] A signal is generally understood in the context of the current state of the art as an electrical or electronic information that is machine-readable or evaluable by a machine, in particular automatically writable and readable, or as a description of a factual situation, a notification or an instruction. Here, it can relate to an analog signal, in particular a current or voltage value, a digital signal, or an information-theoretic state, in particular the value of a variable, in particular the value of a binary variable, in particular a so-called identifier, a bit or a bit sequence, in particular the state of a defined bit, or to the execution state of other hardware or software technologies. Here, the signal does not have to exist explicitly, but can also be implicitly derived from other hardware or software technology states. Transmitting a signal is also understood in particular as writing the corresponding electrical or electronic description. Receiving a signal is also understood in particular as reading the corresponding electrical or electronic description.

[0009] The expression "in accordance with a signal" in the context of the current state of the art particularly means "in response to a signal".

[0010] A module is generally particularly understood in the context of the current state of the art as a functionally unit that is defined or definable theoretically or physically and is set up to perform at least one defined function. Here, it can relate to a separate computing device, a part of a computing device, to a hardware structure, or to a software structure, which are set up and configured accordingly to fulfill at least one defined function. The functionality of the module can in particular be implemented in a control device in hardware technology and / or software technology. Here, the module does not have to relate in any case to a separate, physically or theoretically separable mechanism or structure.

[0011] According to a modification of the present invention, the first control module is effectively connectable to the second control module of the controlled device, in particular is effectively connected. The first control module is in particular set up to check whether the second control module is in a predefined safe state.

[0012] According to a modification of the present invention, the first control module is set up to detect at least one supply parameter of the electrical power supply of the controlled device and to check whether the controlled device is in a predefined safe state according to the at least one supply parameter. Advantageously, it is thus possible to determine in a very simple and rapid manner whether the controlled device is in a predefined safe state. Different states of the controlled device (including the predefined safe state) can in particular be clearly assigned to different values of at least one supply parameter or combinations of values of different supply parameters, so that by determining the current value of at least one supply parameter or the current combination of values of different supply parameters, it is possible to clearly determine exactly which state the controlled device is in, where in particular it is also possible to determine whether the controlled device is currently in a predefined safe state.

[0013] At least one supply parameter is selected in particular from the group consisting of the voltage and current of the electrical power supply. The supply parameter in particular characterizes the current power of the electrical power supply. It is known that the power consumption of the controlled device varies significantly depending on which state it is in. Therefore, the current power consumption can be clearly assigned to the current state of the controlled device. In particular, the current of the electrical power supply can be clearly assigned to the current state of the controlled device. Therefore, in one embodiment, at least one supply parameter is in particular the current of the electrical power supply.

[0014] In one embodiment, the first control module has a detection module which is set up to detect at least one supply parameter. In one design, the detection module can be a current measurement module which measures the current in the supply line for the electrical power supply of the controlled device, for example by measuring the magnetic field around the supply line.

[0015] In one embodiment, the control device, in particular the first control module, is set up to detect at least one supply parameter by means of at least one hardware component, in particular a hardware circuit. The detection module is in particular a hardware component, in particular a hardware circuit. In one embodiment, additionally, it is checked by means of at least one hardware component, in particular a hardware circuit, whether the controlled device is in a predefined safe state based on at least one supply parameter.

[0016] In one embodiment, in the control device, in particular in the first control module, a tabular assignment of the values of at least one supply parameter to the state of the controlled device is stored. In the context of checking whether the controlled device is in a predefined safe state, then in particular the current value of at least one supply parameter is detected, the state of the controlled device assigned to the detected current value is looked up or read out in the tabular assignment, and it is checked whether a predefined safe state is involved here. The tabular assignment can in particular be obtained on a test bench.

[0017] According to a modification of the invention, the first control module is set up to compare the detected at least one supply parameter with a predefined threshold value and to determine based on this comparison whether the controlled device is in a predefined safe state. This represents a particularly simple form of the assignment of the state of the controlled device to the value of at least one supply parameter, where the state limit can in particular be characterized by a predefined threshold value. The tabular assignment can in particular include one predefined threshold value or multiple predefined threshold values.

[0018] In one embodiment, the comparison of the at least one detected supply parameter with a pre-determined threshold value is carried out by means of at least one hardware component, in particular a hardware circuit. The pre-determined threshold value is delimited in particular by the position or orientation of one or more jumpers, in particular by one jumper or a plurality of jumpers. Additionally, it is checked, in particular on the basis of at least one supply parameter by means of at least one hardware component, in particular a hardware circuit, whether the controlled device is in a pre-determined safe state.

[0019] According to a modification of the invention, the first control module is configured to detect at least one supply parameter regarding a supply line for the electrical power supply of the controlled device. Here, the detection of the supply parameter regarding the supply line is particularly direct and accurate. The supply parameter can in particular be measured directly in the supply line, or it can be taken at the supply line, for example in the case of current by measuring the magnetic field around the supply line.

[0020] Alternatively or additionally, the first control module is configured to interrupt the supply line or to connect it in a currentless manner, in particular to disconnect the controlled device. This advantageously enables the controlled device to be brought into a pre-determined safe state, in particular by being disconnected, when it is not already in the pre-determined safe state. In this way, a two-stage safety function is particularly advantageously provided, in which the existence of a pre-determined safe state is checked at a first stage, and in which, at a second stage, if the pre-determined safe state does not exist, the controlled device is brought into the pre-determined safe state, as it were compulsorily, in particular by interrupting the supply line.

[0021] In one embodiment, the control module has an interruption module which is configured to interrupt the electrical supply line. In one embodiment, the interruption module is constructed as a hardware module or a hardware component.

[0022] According to a modification of the invention, the at least one safety measure is selected from the group consisting of: disconnecting the controlled device, in particular disconnecting the electrical power supply of the controlled device, disconnecting the second control module, in particular disconnecting the electrical power supply of the second control module, and combinations thereof. In this way, the controlled device can in particular be brought into a pre-determined safe state as it were compulsorily.

[0023] The task is also solved in that a drive train for a motor vehicle is proposed, which drive train has a drive device and a control device according to the invention or a control device according to one or more of the previously described embodiments, wherein the control device is operatively connected to the drive device as the controlled device. The advantages previously described with respect to the control device in particular result for the drive train.

[0024] According to a modification of the present invention, the drive device is configured such that it has a drive component and a second control module for controlling the drive component. The second control module is in particular effectively connected to the drive component for controlling it.

[0025] According to a modification of the present invention, the second control module and the drive component have a common power supply line, wherein the first control module is configured to interrupt the common power supply line or connect it in a currentless manner, in particular to disconnect the drive device as the controlled device. Preferably, the second control module is supplied with electric power in particular via the power supply line, and the second control module itself supplies electric power to the drive component. As a result, thereby, the power supply line, but at least the electric power for supplying the drive component, seemingly forms a loop through the second control module.

[0026] According to a modification of the present invention, the drive component is configured to be hydraulically actuated, wherein the drive device furthermore has at least one pressure generating device for generating a hydraulic pressure for actuating the drive component, and the second control module and the at least one pressure generating device have a common power supply line. In particular, in this way, within the scope of the second level of the safety function described above, the pressure generating device is disconnected together with the second control module, so that there is no longer any pressure available for the operation of the drive component. The drive component is in particular designed such that it reaches a predefined safe state in a pressureless manner. This in particular requires an increased hydraulic pressure to transfer the drive component from the predefined safe state to other states, and the drive component automatically returns to the predefined safe state in particular based on mechanical preloading when the pressure decreases.

[0027] According to a modification of the present invention, the drive component is configured as a transmission mechanism, in particular as a variable speed transmission mechanism, and the predefined safe state corresponds to the neutral position of the drive component configured as a transmission mechanism. In this design, the advantages already described are achieved in a particular way. By the transmission mechanism in the neutral position, in particular, the driving torque can no longer be transmitted, so that in particular in the case of an emergency brake or stop, no torque acting against the active brake can be introduced.

[0028] Therefore, when it is possible to ensure that the transmission mechanism is arranged in the neutral position, it is basically sufficient to meet the safety requirements without necessarily additionally interrupting the electrical power supply compulsorily. Only when the transmission mechanism is not placed in or is not in the neutral position due to a fault, for example, can the electrical power supply also be interrupted advantageously in the previously described second-stage approach and, as a result, the transmission mechanism can be compulsorily brought into the neutral position. The transmission mechanism is particularly configured such that it is connected by means of hydraulic pressure, wherein it returns to the neutral position automatically in a pressureless manner, particularly based on mechanical preloading, and thus returns to a predetermined safety state. In particular, an increased hydraulic pressure is required to transfer the transmission mechanism from the predetermined safety state to other states, particularly to engage a gear.

[0029] The second control module is particularly a transmission mechanism control module.

[0030] The task is also solved in such a way that a motor vehicle is proposed which has a powertrain according to the invention or a powertrain according to one or more of the previously described embodiments. In particular, with respect to the motor vehicle, the advantages that have been previously explained with respect to the control device or the powertrain are obtained.

[0031] According to a modification of the invention, the motor vehicle is configured as a rail vehicle. Here, in particular, with respect to emergency braking or stopping, particularly stopping at a railway station, the advantages that have been described are realized in a special way.

[0032] The motor vehicle is particularly configured as a locomotive, a power car, a multiple unit or a power car unit.

[0033] Finally, the task is also solved in such a way that a method for operating a control device is proposed, wherein it is checked according to a safety signal whether a controlled device effectively connected to the control device is in a predetermined safety state, and wherein when the check reveals that the controlled device is not in the predetermined safety state, at least one safety measure is taken to bring the controlled device into the predetermined safety state. In particular, with respect to the method, the advantages that have been previously explained with respect to the control device, the powertrain or the motor vehicle are obtained.

[0034] The control device according to the invention or a control device according to one or more of the previously described embodiments particularly operates within the scope of the method.

[0035] The method particularly includes at least one method step, particularly a combination of method steps, which have been explicitly or implicitly explained with respect to the control device, the powertrain or the motor vehicle.

[0036] According to a modification of the invention, when the check shows that the controlled device is not in a predefined safe state, as at least one safety measure, the controlled device is disconnected. Alternatively or additionally, as at least one safety measure, the second control module of the controlled device is disconnected. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In the following, the invention will be explained in more detail with reference to the drawings. Here,

[0038] Figure 1 A schematic illustration of an embodiment of a motor vehicle having an embodiment of a powertrain and an embodiment of a control device, and

[0039] Figure 2 Showing a schematic illustration of the operating principle of a control device according to Figure 1 . DETAILED DESCRIPTION OF THE INVENTION

[0040] Figure 1 A schematic illustration of an embodiment of a motor vehicle 1 having an embodiment of a powertrain 3 and an embodiment of a control device 5 is shown.

[0041] The motor vehicle 1 is in particular configured as a rail vehicle, in particular a locomotive, a power car, a multiple unit or a power car set.

[0042] The powertrain 3 has a control device 5 and, as a controlled device 2, in particular has a drive device 4. The drive device 4 in particular has a drive member 7, which is configured as a transmission 8, in particular as a variable-speed transmission, to which a neutral position is assigned as a predefined safe state. In the neutral position, the motor 10 of the motor vehicle 1 is in particular decoupled from the drive wheels 12, so that in particular in the event of an emergency brake or when parked at a railway station, no torque can be introduced from the motor 10 via the transmission 8 into the drive wheels 12, which torque could otherwise act contrary to the braking.

[0043] The drive device 4 furthermore has a second control module 11 for controlling the drive member 7, where the second control module 11 is in particular configured as a transmission control module for controlling the transmission 8.

[0044] The control device 5 has a first control module 9, which is effectively connected to the second control module 11.

[0045] The first control module 7 is configured to check, based on the safety signal 13, whether the controlled device 2 is in a predetermined safe state, that is, whether it is in the neutral position of the transmission mechanism 8 in this case, and to take at least one safety measure when the check shows that the controlled device 2 is not in the predetermined safe state to bring the controlled device 2 into the predetermined safe state. This particularly advantageously allows for stopping or at least postponing the interruption of the power supply to the second control module 11 when the controlled device 2 is already in the predetermined safe state, because the safety requirements are met even without interruption at that time. This in turn enables storing the operating values and / or faults back to the controlled device 2, in particular back to the second control module 11, so that the controlled device 2, in particular the second control module 11, can be restarted functionally after a possible subsequent interruption.

[0046] The at least one safety measure is particularly selected from the following group, which includes: disconnecting the controlled device 2, in particular disconnecting the power supply to the controlled device 2, disconnecting the second control module 11, in particular disconnecting the power supply to the second control module 11, and combinations thereof.

[0047] In the embodiment shown here, the first control module 9 receives the safety signal 13 particularly from a superior control device 15, in particular from a traction controller 17.

[0048] The first control module 9 is particularly configured to detect at least one supply parameter, which is particularly selected from the voltage and current of the controlled device 2, the power supply, and to check based on the at least one supply parameter whether the controlled device 2 is in a predetermined safe state.

[0049] Figure 2 Shows a schematic illustration of the operating principle of the control device 5 according to Figure 1 of.

[0050] Identical and functionally identical elements are provided with the same reference numerals in all figures, and thus reference is made accordingly to the previous description in this regard.

[0051] The first control module 9 is particularly configured to detect at least one supply parameter of the electrical supply line 19 for the power supply to the controlled device 2 (in particular the second control module 11 here). Alternatively or additionally, the first control module 9 is configured to interrupt or switch on the supply line 19 in a currentless manner.

[0052] The second control module 11 and the drive component 7 particularly have the electrical supply line 19 as a common electrical supply line 19. In addition, the second control module 11 is configured to control the drive component 7, which is schematically shown by the dashed arrow P here.

[0053] The drive component 7 is in particular configured to be hydraulically actuated. The drive device 4 has at least one pressure generating device 21 for generating a hydraulic pressure for actuating the drive component 7, in particular a hydraulic medium conveying device, in particular a pump. The second control module 11 and at least one pressure generating device 21 have an electrical supply line 19 as a common electrical supply line 19. If the first control module 9 thus interrupts the supply line 19, the pressure generating device 21 is also switched off simultaneously with the switching off of the second control module 11, whereby the hydraulic pressure in the drive component 7 is reduced. It thereby automatically reaches the neutral position, in particular based on mechanical preloading, and thus reaches a predefined safety state.

[0054] The first control module 9 in particular has a detection module 23 which is set up to detect at least one supply parameter. In one design, the detection module 23 can be a current measurement module which measures the current in the supply line 19, for example by measuring the magnetic field around the supply line 19.

[0055] Furthermore, the control module 9 preferably has an interruption module 25 which is set up to interrupt the electrical supply line 19 and thus in particular to prohibit the current supply to the second control module 11 and the pressure generating device 21.

[0056] In one design, the first control module 9 is set up to compare the at least one detected supply parameter with a predefined threshold value and to determine on the basis of this comparison whether the controlled device 2 is in a predefined safety state.

[0057] Within the scope of the method for operating the control device 5, it is checked on the basis of the safety signal 13 whether the controlled device 2 is in a predefined safety state. When this check shows that the controlled device 2 is not in a predefined safety state, at least one safety measure is taken to bring the controlled device 2 into a predefined safety state. In this case, in particular the controlled device 2 is switched off. Alternatively or additionally, the second control module 11 is switched off.

Claims

1. Control device (5), which has - The first control module (9), which can be effectively connected to the controlled device (2), wherein, the first control module (9) is configured to - check whether the controlled device (2) is in a predetermined safe state according to a safety signal (13), and to - when the check shows that the controlled device (2) is not in the predetermined safe state, take at least one safety measure to bring the controlled device (2) into the predetermined safe state.

2. The control device (5) according to claim 1, wherein, The first control module (9) can be effectively connected to the second control module (11) of the controlled device (2) and is in particular configured to check whether the second control module (11) is in the predetermined safe state.

3. The control device (5) according to any one of the preceding claims, wherein, The first control module (9) is configured to detect at least one supply parameter of the electric power supply of the controlled device (2) and to check whether the controlled device (2) is in the predetermined safe state according to the at least one supply parameter.

4. The control device (5) according to claim 3, wherein, The first control module (9) is configured to compare the detected at least one supply parameter with a predetermined threshold value and to determine whether the controlled device (2) is in the predetermined safe state according to the comparison.

5. The control device (5) according to any one of claims 3 or 4, wherein, The first control module (9) is configured to detect at least one supply parameter of the supply line (19) for the electric power supply of the controlled device (2), and / or to interrupt or connect the supply line (19) in a currentless manner.

6. The control device (5) according to any one of the preceding claims, wherein, The at least one safety measure is selected from the following group, which includes: disconnecting the controlled device (2), in particular disconnecting the electric power supply of the controlled device (2), disconnecting the second control module (11), in particular disconnecting the electric power supply of the second control module (11), and combinations thereof.

7. A powertrain (3) for a motor vehicle (1), having a drive device (4) and a control device (5) according to any one of claims 1 to 6, wherein, The control device (5) is effectively connected to a drive device (4) that serves as the controlled device (2).

8. The drive train (3) according to claim 7, wherein, The drive device (4) has a drive component (7) and a second control module (11) for controlling the drive component (7).

9. The drive train (3) according to any one of claims 7 or 8, wherein The second control module (11) and the drive component (7) have a common power supply line (19), and wherein the first control module (9) is configured to interrupt or connect the common supply line (19) in a currentless manner.

10. The powertrain (3) according to claim 9, wherein, The drive component (7) is configured to be hydraulically actuated, wherein the drive device (4) furthermore has at least one pressure generating device (21) for generating hydraulic pressure for actuating the drive component (7), and wherein the second control module (11) and the at least one pressure generating device (21) have the common power supply line (19).

11. The drive train (3) according to any one of claims 7 to 10, wherein, The drive component (7) is configured as a transmission mechanism (8), wherein the predetermined safe state corresponds to the neutral position of the drive component (7) configured as a transmission mechanism (8).

12. A motor vehicle (1), which has a powertrain (3) according to any one of claims 7 to 11.

13. The motor vehicle (1) according to claim 12, wherein, The motor vehicle (1) is configured as a rail vehicle, in particular as a locomotive, power car, multiple unit or power car set.

14. A method for operating a control device (5), in particular the control device (5) according to any one of claims 1 to 6, wherein - a controlled device (2) effectively connected to the control device (5) is checked for a predetermined safe state based on a safety signal (13), and wherein - when the check reveals that the controlled device (2) is not in the predetermined safe state, at least one safety measure is taken to bring the controlled device (2) into the predetermined safe state.

15. The method according to claim 14, wherein, When the check reveals that the controlled device (2) is not in the predetermined safe state, as the at least one safety measure, the controlled device (2) and / or the second control module (11) of the controlled device (2) is disconnected.

Images