Functional unit having standby operating mode for brake system of rail vehicle

Abstract

Disclosed is a functional unit (10) for a brake system of a rail vehicle, which is designed to provide a function of a brake path of the brake system or to provide a function in a part of the brake path of the brake system. The invention further relates to a brake system, to a rail vehicle and to a method.

Description

TECHNICAL FIELD

[0001] The invention relates to a functional unit for a brake system of a rail vehicle according to claim 1, which improves the availability of the brake system by its design. Furthermore, the invention relates to a brake system comprising such a functional unit and to a rail vehicle comprising such a brake system. The invention also relates to a method for operating such a functional unit, such a brake system and / or such a rail vehicle. BACKGROUND

[0002] Different brakes and brake systems are used in rail vehicles. These brakes and brake systems are designed according to different physical action principles. On the one hand, hereinafter mention is made of wear-free brakes, such as motors which work in a recuperation mode, which derive energy from the forward movement of the rail vehicle, which energy can then be delivered to a storage for subsequent use, or which energy can be converted into heat by means of a brake resistance. Another wear-free brake is the eddy current brake. Furthermore, there are also brakes which wear. These include, inter alia, friction brakes which can be designed differently. Basically, here a pair is composed of at least two friction assemblies, so that a friction force arises, which causes the braking action. Inter alia, among these are electromechanical, pneumatic and electro-pneumatic brakes. But also magnetic rail brakes belong to the wear-free brakes.

[0003] These brakes or brake systems are subjected to different boundary conditions and are partially equipped with a safety integrity level (SIL) based on the components and / or subsystems used by the function of the brake system. Furthermore, the actuation of the brakes takes place by means of control inputs, which actuate the corresponding brake by means of a brake path, wherein the corresponding brake path has intermediate connected units, which units themselves have different SILs. Usually, the unit with the lowest SIL also determines the SIL of the entire brake path. The lower the SIL, the higher the failure probability of the corresponding unit and thus of the entire brake path. The reliability of the observed units is thus reduced. SUMMARY

[0004] It is therefore the task of the present invention to provide a possibility with which the availability of a unit and, if necessary, of the entire brake path or of the entire brake system can be improved.

[0005] This task is solved by the subject matter of the independent claims. Advantageous further refinements are the subject matter of the dependent claims.

[0006] Preferably, a functional unit for a brake system of a rail vehicle is provided. The functional unit is configured for providing a function of a brake path of the brake system or for providing a function in a part of a brake path of the brake system, wherein the functional unit comprises the following:

[0007] an input interface configured to receive at least one input variable;

[0008] an output interface configured to output at least one output variable;

[0009] a first processing unit configured to generate at least one first intermediate variable on the basis of the at least one input variable;

[0010] a second processing unit configured to generate at least one second intermediate variable;

[0011] an output unit configured to generate the at least one output variable from the at least one first intermediate variable and the at least one second intermediate variable and to transmit the at least one output variable to the output interface.

[0012] The functional unit is preferably configured to change from a first operating mode into a second operating mode in accordance with a changeover instruction, in which second operating mode the output unit generates the at least one output variable independently of the at least one first intermediate variable.

[0013] Preferably, the output unit is configured to generate the at least one output variable in the first operating mode exclusively from the at least one first intermediate variable. Alternatively, it can also be provided that the output unit is configured to generate the at least one output variable in the first operating mode from the at least one first intermediate variable and from at least one further intermediate variable. The at least one further intermediate variable can be provided by the second processing unit and / or by a further processing unit of the functional unit.

[0014] Advantageously, the functional unit changes the operating mode in response to a fault of the functional unit itself or of the brake system in order to be able to continue to implement the function provision.

[0015] The changeover instruction itself can be generated by the functional unit itself and in particular by a monitoring unit, such as the first monitoring unit described later. Alternatively or additionally, the changeover instruction can also be generated by an external source, such as an external monitoring unit. The control unit of the brake system in which the functional unit is arranged can also provide the changeover instruction.

[0016] Preferably, the functional unit is configured to generate the changeover instruction from an input status message. The input status message will be specified in more detail further below.

[0017] The function implemented by the functional unit is essentially implemented by outputting or providing the at least one output quantity. The output quantity is provided to the brake system or to a further functional unit of the brake system by means of an output interface. Here, the function is constituted in the first operating mode in such a way that the functional unit generates the at least one output quantity from the at least one input quantity and by using, preferably by using exclusively, the first processing unit. In the second operating mode, the functional unit continues to provide the at least one output quantity, but without using the first processing unit.

[0018] The second processing unit can generate a second intermediate quantity on the basis of the at least one input quantity, the first processing unit also processing the at least one input quantity. Alternatively, however, it can also be provided that the second processing unit generates the second intermediate quantity using other input quantities or without using input quantities. This is advantageous in the case where the input quantities used by the first processing unit to generate the first intermediate quantity are faulty or are not present on the basis of a failure of a unit in the brake system. If the second processing unit and / or the further processing unit do not use input quantities, this processing unit can, for example, be constituted to output a predetermined value as the corresponding intermediate quantity. This value can, for example, be regarded as a replacement value for the first intermediate quantity.

[0019] Preferably, the functional unit can be an electrical or electronic functional unit which assumes the corresponding function in a part or the entire brake path. This should not, however, exclude other designs of the functional unit, for example using the most reliable functional components (for example mechanical devices, hydraulic devices, pneumatic devices, etc.).

[0020] The functional unit processes the at least one input quantity into corresponding intermediate quantities by means of the first and second processing units, wherein the output unit generates the at least one output quantity on the basis of these intermediate quantities, which is then output to the output interface.

[0021] In addition to the first and second processing units, the functional unit can have at least one further processing unit which likewise generates one or more corresponding intermediate quantities from the at least one input quantity.

[0022] The changeover from the first operating mode into the second operating mode is triggered, inter alia, by means of an input status message by fulfilling a predetermined changeover condition. The input status message and the changeover condition associated therewith will be discussed further below.

[0023] In the first operating mode, only the first processing unit can be active, while the second processing unit and / or the further processing unit are deactivated. This means that the second processing unit and / or the further processing unit do not output the corresponding intermediate quantity. In this way, the functional unit is operated as efficiently as possible.

[0024] But it can also be provided that the second processing unit and / or the further processing unit is active in the first operating mode. Here, these processing units can generate the corresponding intermediate variables and preferably transmit these intermediate variables to the output unit. But it can also be provided that the intermediate variables which are still generated are not transmitted in this first operating mode. If the second processing unit is active in the first operating mode, this has the advantage that a transition as seamless as possible is achieved by the functionality provided by the functional unit, since the generation of the intermediate variables of the second processing unit and / or of the further processing unit already takes place at the time of the changeover of the operating mode.

[0025] The output unit can be configured differently. The output unit can be a mere pass-through unit in which the intermediate variables transmitted by the processing units to the output unit are simply passed through unaltered, i.e. transmitted unaltered to the output interface, wherein the transmitted intermediate variables here act as the at least one output variable unaltered. It is advantageous here that the other processing units are deactivated, the intermediate variables of which should not be passed through or at least the intermediate variables generated by this processing unit are not transmitted to the output unit. The output unit can for example be configured such that the output unit no longer uses the intermediate variables of the first processing unit as output variables in the second operating mode.

[0026] But the output unit can also be configured as a selection unit, wherein the selection unit actively selects which intermediate variable is used depending on the operating mode or depending on the input status message. The output unit can for example be configured such that the output unit blocks the intermediate variables of the first processing unit in the second operating mode and only uses the intermediate variables of the second processing unit and / or of the further processing unit. The selection can for example also be made on the basis of the values of the corresponding intermediate variables, such that for example always the larger value is selected as the output variable. Alternatively or additionally, the selection can also be made on the basis of the diagnostic messages or diagnostic data of the processing units or on the basis of external sources, such as other functional units or an external monitoring unit.

[0027] But the output unit can also be configured as a superposition unit in which a superposition of the intermediate variables generated by the processing units takes place. In this way, for example, an addition of the generated intermediate variables can take place.

[0028] For changing the operating mode, the functional unit can generate a changeover instruction, which is preferably generated by a decision maker which processes the input status message and on the basis of this decides whether the operating mode should be maintained or changed.

[0029] The at least one input variable and at least one output variable can comprise electronic signal variables and / or physical flow variables (for example electrical power flow, mechanical torque).

[0030] The function of the functional unit provides a functionality which can be realized overall by means of the at least one output variable.

[0031] Depending on the activated operating mode, the processing unit or the functional unit itself can output a message to the brake system or to other functional units by means of a status message or an output status message.

[0032] OK: The unit is working in normal operating mode;

[0033] AKUT-OK: The unit is working in normal operating mode, but this normal operating mode will end within a foreseeable time;

[0034] BACKUP: The unit is in emergency operating mode;

[0035] AKUT-BACKUP: The unit is working in emergency operating mode, but this emergency operating mode will end within a foreseeable time;

[0036] NOK: The unit is failed, the functionality is no longer provided.

[0037] The second operating mode of the functional unit can be an emergency operating mode. In addition to the states OK and NOK, the further states AKUT-OK, BACKUP and AKUT-BACKUP should be considered optional. The first operating mode of the functional unit can be considered a normal operating mode. Via input status messages, the functional unit can also receive status messages of other, in particular upstream, functional units and respond accordingly thereto.

[0038] Preferably, the first processing unit is in a state which is not affected by the reverse in the second operating mode with respect to the output unit and / or with respect to the second processing unit and / or with respect to the further processing unit. In this way, it is avoided that intermediate variables on which the output variable generated by the processing unit is based are influenced by the first processing unit in this operating mode. The first processing unit thus neither influences one of the intermediate variables nor influences the processing units whose intermediate variables are used in this operating mode for generating the output variable. The output unit itself is also not influenced by the first processing unit. Alternatively, it can also be provided that the output unit does not take the first intermediate variable into account when generating the output variable.

[0039] In this way, the functionality implemented by the functional unit can be provided without using the first processing unit.

[0040] Preferably, the functional unit has a limited functional range or the same functional range in the second operating mode compared to the first operating mode. If the second operating mode is activated or the functional unit is operated in the second operating mode, the output variable is independent of the intermediate variable of the first processing unit and generally independent of the first processing unit as a whole. If now the second processing unit and / or the at least one further processing unit, which influences the output variable of the functional unit and thus finally assumes the function provision in the second operating mode, is reduced in its functional range compared to the first processing unit, this also acts on the functional unit as a whole. If, for example, the first processing unit is configured for calculating an intermediate variable which is dependent on the at least one input variable, the second processing unit may, for example, not be configured for obtaining the same input variable as the first processing unit. Instead, the second processing unit and / or the at least one further processing unit can be configured for receiving only a part of the input variable of the first processing unit, other input variables than the input variable of the first processing unit or no input variable. In each case, the second processing unit and / or the at least one further processing unit can be configured such that its output has an intermediate variable with a smaller dynamic or a reduced value. If the corresponding processing unit is configured such that it only outputs a predetermined alternative value, this alternative value has no dynamic, since it does not change. In another case, the input variable required for performing the functionality, i.e. for generating the corresponding intermediate variable and / or output variable, is no longer provided. An alternative value can also be employed in this case. The alternative value can also be limited in its size or value. Thereby an output variable and thus a functionality results which also corresponds to the relevant intermediate variable in the second operating mode with a reduced dynamic and / or a reduced value compared to the first operating mode. If the functional unit has the same functional range in the second operating mode compared to the first operating mode, this can mean that the dynamic and size of the at least one output variable remains unchanged compared to the first operating mode. This can be achieved, for example, by a second processing unit and / or further processing unit which is configured identically to the first processing unit.

[0041] The functional range can generally be understood as the dynamic and / or size / value of the maximum value of a variable which is generated by the functionality on the basis of specific boundary conditions such as operating mode and / or input variable.

[0042] It can generally be provided that, in the event of a failure or a shutdown of the first processing unit, the remaining functioning second processing unit and / or at least one further processing unit increases or maintains its dynamics or its functional range in the second operating mode on the basis of a planned backup. As a result, the functional unit can have an unchanged dynamics in the generation of the at least one output variable in comparison to the first operating mode when the dynamics of the corresponding processing unit is increased. But the dynamics of the functional unit can alternatively, in particular when the intermediate variable is superimposed by the output unit, still be reduced. The increase in dynamics or functional range can generally represent a partial or complete compensation for the reduced dynamics or reduced functional range in the second operating mode. It can of course be provided that the increase in dynamics or functional range of the processing unit or processing units participating in the second operating mode is limited in time in order not to damage the corresponding processing unit. This can be, for example, a required current which the processing unit participating in the second operating mode outputs as an intermediate variable. This current can be increased in time. Associated therewith is an overload operation. This overload operation ends after a predetermined time. Such an end and the associated change in the function in the functional unit can be announced to the brake system and / or other functions and / or monitoring units by means of an output status message of the functional unit.

[0043] If the functional unit is in a brake path with two functional units, including a functional unit connected upstream, in which the functional unit connected upstream has output the at least one output variable with reduced dynamics and / or reduced functional range and has forwarded information about this to the functional unit connected downstream by means of an input status message, the functional unit connected downstream can respond thereto in order not to overload the functional unit connected upstream and to change itself into an operating mode, such as the second operating mode, in which the functional unit connected downstream has reduced dynamics and / or reduced functional range. As an example, a functional unit connected upstream can be mentioned which outputs a current as an output variable. At this time, a functional unit connected downstream with respect to this functional unit can be mentioned which processes the current, such as a brake actuator of an electromechanical brake. This brake actuator, although having all normal processing units, that is to say here no failure is faced, can change the operating mode in order to place less demands on the dynamics and / or functional range of the functional unit upstream.

[0044] Generally, it can be specified that, in response to an input status message from an upstream functional unit—specifically, information regarding a reduced dynamic and / or reduced functional range of that upstream functional unit—the downstream functional unit provides at least one of its output parameters as said at least one input parameter, and the downstream functional unit transitions to an operating mode in which it itself has reduced dynamics and / or reduced functional range to reduce the load on the upstream functional unit. This operating mode can be a second operating mode. The operating mode—in which the downstream functional unit transitions—can be an emergency operating mode. The upstream functional unit may have reduced dynamics and / or reduced functional range based on the failure of some units of the upstream functional unit. The downstream functional unit itself can also operate fault-free in this case, i.e., each unit of the downstream functional unit is fault-free.

[0045] Preferably, the functional unit in the second operating mode has a defined function provision, particularly a defined remaining duration of function provision or a defined number of function implementations. The remaining duration of function provision can be based on time, for example, so that function provision in the second operating mode is set after a predetermined implementation time has elapsed. Alternatively, function provision in the second operating mode can be set after a predetermined number of function implementations have been reached.

[0046] Generally, the function unit can be cut off or continue to run in the third operating mode after the second operating mode ends.

[0047] Preferably, in general applications, in the provision of a function with a limited remaining duration, the reliable state of the functional unit is occupied before the function provision ends, in such a way that the reliable state is established by the output parameters of the last output. For example, this could be the braking of a rail vehicle or the disconnection of a functional unit.

[0048] It is also conceivable that a predetermined response could be implemented, for example, in the presence or absence of additional diagnostic messages or input status messages, by pressing the clamping components of the friction brake and subsequently cutting off the functional unit. However, in this case, it could also be specified that the clamping components of each friction brake disengage and the functional unit is subsequently cut off. In this case, the brake actuator controlled by the functional unit or brake path is exempt from additional braking, thus preventing malfunctions in the brake path.

[0049] In principle, the following safety responses that a functional unit can implement are possible: When a diagnostic message / input status message, especially an external one, or a transition instruction exists: Implement a safety response: "Disengage before failure" or "Apply before failure". When such a diagnostic message / input status message or such a transition instruction does not exist: "Apply before failure" or "Disengage before failure".

[0050] Preferably, the first operating mode is the normal operating mode of the functional unit. This means that if, for example, no reason is given for switching to the second operating mode via an input status message, the functional unit will always operate in the first operating mode.

[0051] Preferably, the second operating mode is the emergency operating mode of the functional unit. This means that the functional unit transitions to the emergency operating mode triggered by an input status message. This can be the case when a fault exists in the functional unit itself, particularly in the first processing unit, rendering the functional unit unable to perform its function. In this case, the transition to the second operating mode is a possibility to continue providing functionality within limitations when necessary. However, another reason for transitioning to the second operating mode can also be given alternatively or additionally as follows: the at least one input parameter is unavailable or erroneous, and the first processing unit requires the at least one input parameter to generate the first intermediate parameter. In this case, the cause or fault for the transition is not within the functional unit, which is always able to provide the at least one output parameter required to perform the function, provided that the input parameter is present in full and correctly. Instead, this is no longer possible because the corresponding input parameter does not exist. In this case, the transition to the second operating mode as the emergency operating mode is also meaningful.

[0052] Preferably, the functional unit has a first monitoring unit configured to construct input status messages. The first monitoring unit may be part of a first processing unit, a second processing unit, and / or at least one other processing unit. However, the first monitoring unit may also be constructed independently.

[0053] Preferably, the first monitoring unit is configured to construct input status messages and / or conversion instructions based on at least one of the following data:

[0054] - Diagnostic data from the first processing unit;

[0055] - Diagnostic data from the second processing unit;

[0056] -External control input;

[0057] - Regulations for other functional units or higher-level monitoring units;

[0058] Diagnostic or instruction-based security response for other functional units or higher-level monitoring units.

[0059] When using diagnostic data from the first processing unit, data constructed by the first processing unit itself within the scope of self-diagnosis may be involved. If a fault exists in the first processing unit that prevents further functionality from being provided when the first processing unit is included, this can be reported to the first monitoring unit, which then generates an input status message and, based on this input status message, transitions to the second operating mode.

[0060] When using diagnostic data from the second processing unit, data constructed by the second processing unit itself within the scope of self-diagnosis may be involved. If a fault exists in the second processing unit that prevents further functional provision when the second processing unit is included, this can be reported to the first monitoring unit, which then generates an input status message. Based on this input status message, if possible, if the first operating mode can operate without the second processing unit, a transition to the first operating mode is performed; or based on the input status message, if possible, a transition to the third operating mode is performed, or the functional unit is deactivated. The third operating mode can be used in particular when the functional unit cannot operate in either the first or second operating mode.

[0061] Alternatively or additionally, the use of diagnostic data from the second processing unit may also refer to data constructed by the second processing unit within the scope of the diagnostics of the first processing unit. If a fault exists in the first processing unit that prevents further functional provision from being achieved with the first processing unit included, this can be reported to the first monitoring unit, which then generates an input status message, based on which, if possible, a transition to a second operating mode is performed. The first monitoring unit may, in particular, be part of the second processing unit. It may also be specified that both the first and second processing units have monitoring units, wherein these monitoring units then diagnose and monitor their own processing units and / or also diagnose and monitor the other processing unit.

[0062] External control inputs can come from users, particularly rail vehicle drivers. For example, the user can provide control inputs that, in turn, trigger corresponding changes in the operating mode of the functional unit by being transformed into input status messages.

[0063] Furthermore, there is the possibility of specifying the monitoring unit for handling other functional units. This is particularly true for the output status messages of these functional units. The output status messages will be further elaborated below.

[0064] In addition, the regulations can also come from other or higher levels, such as those that function as decision makers or higher-level monitoring units in the braking system, which monitor multiple functional units.

[0065] Preferably, the input status message may include information about the upstream functional unit or its processing unit being in a soon-to-end normal operation mode, and at least one of the at least one input parameter being related to the upstream functional unit or its processing unit. This information may, for example, come from the output status message of the upstream functional unit or its corresponding processing unit. This message notifies the functional unit that one or more input parameters may change after the normal operation mode of the upstream functional unit or its processing unit ends, the functional unit receiving the input parameters through an input interface, and the input parameters being directly or indirectly affected by the upstream functional unit or its processing unit. For example, if it indicates that the corresponding input parameter is no longer available or not available with the required quality, granularity, or dynamics—especially those required by the first processing unit of the functional unit—as the normal operation mode of the upstream functional unit or its processing unit ends, then the functional unit can take measures upon receiving this information to continue operating in a second operating mode, i.e., independently of the first processing unit, once the upstream functional unit or its processing unit ends its normal operation mode. In other words, in this case, a seamless transition from the first operating mode to the second operating mode is possible without triggering a sudden and unannounced termination of the normal operating mode of the upstream functional unit or the processing unit connected to the upstream functional unit only at the end. If the second processing unit and / or another processing unit that provides intermediate parameters related to the at least one output parameter in the second operating mode should be disconnected in the first operating mode, the corresponding processing unit can be activated after receiving this information and before the normal operation of the upstream functional unit or the processing unit connected to the upstream functional unit ends, in order to reduce the response time during operating mode transitions and thus improve the availability of the functional unit.

[0066] Preferably, the input status message may include information about the upstream functional unit being in an emergency operation mode, where at least one of the at least one input parameter is related to the upstream functional unit. In this case, the normal operation mode of the upstream functional unit has ended. The functional unit is preferably configured to interpret whether the emergency operation mode of the upstream functional unit now affects at least one of its input parameters such that the functional unit itself must switch to a second operation mode. If the upstream functional unit, for example, no longer provides the corresponding input parameter, then a switch to the second operation mode is performed if the first processing unit is forcibly instructed to that input parameter. If the required input parameter is still available, but the upstream functional unit has a reduced range of functions (e.g., the upstream functional unit only outputs a constant substitute value), then the functional unit is configured to determine whether it remains in the first operation mode or switches to the second operation mode. Here, the determination can be made as follows: the functional unit evaluates the corresponding input parameter of the upstream functional unit in relation to the situation (e.g., by comparing the change of the input parameter with respect to time), or the functional unit automatically switches to the second operating mode regardless of whether the emergency operation mode is activated in the upstream functional unit.

[0067] Preferably, the input status message may include information regarding the following: the upstream functional unit or its processing unit is faulty, disconnected, or no longer available; at least one of the at least one input parameter is related to the upstream functional unit or its processing unit. In this case, the upstream functional unit or its processing unit no longer provides input parameters. Preferably, the functional unit then switches to a second operating mode, in which it provides functionality independent of the corresponding input parameter.

[0068] Preferably, the input status message may include information regarding the following: the upstream functional unit or its processing unit is in a normal operating mode that will not immediately terminate; and at least one of the at least one input parameter is related to the upstream functional unit or its processing unit. In this case, the functional unit preferably remains in the first operating mode, or the message preferably does not trigger a transition to a second operating mode for the functional unit.

[0069] Preferably, the functional unit has an output status message interface, wherein the functional unit is configured to output an output status message through the output status message interface. The output status message may be a message that the functional unit outputs to notify other functional units of the braking system and / or the braking system itself of the status of the functional unit.

[0070] Preferably, the functional unit is configured to construct, in particular, output status messages via the second monitoring unit.

[0071] Preferably, the output status message is constructed based on at least one of the following data:

[0072] - Diagnostic data from the first processing unit;

[0073] - Diagnostic data from the second processing unit;

[0074] -External control input;

[0075] - Regulations for other functional units or higher-level monitoring units;

[0076] - The operating mode of the functional unit.

[0077] When using diagnostic data from the first processing unit, data constructed by the first processing unit itself within the scope of self-diagnosis may be involved. If a fault exists in the first processing unit that prevents further functionality from being provided when the first processing unit is included, this may be reported to the first and / or second monitoring unit, which then generates an output status message.

[0078] When using diagnostic data from the second processing unit, data constructed by the second processing unit itself within the scope of self-diagnosis may be involved. If a fault exists in the second processing unit that prevents further functionality from being provided when the second processing unit is included, this may be reported to the first and / or second monitoring unit, which then generates an output status message.

[0079] However, alternatively or additionally, the use of diagnostic data from the second processing unit may also refer to data constructed by the second processing unit within the scope of the diagnostics of the first processing unit. If a fault exists in the first processing unit that prevents further functional provision from being achieved with the first processing unit included, this can be reported to the first and / or second monitoring unit, which thereby generates an input status message.

[0080] Preferably, the diagnostic data of the first processing unit is generated by the first processing unit, and the diagnostic data of the second processing unit is generated by the second processing unit. Therefore, the corresponding processing unit preferably has a correspondingly constructed monitoring unit. However, it may also be specified that the processing units, i.e., at least the first and second processing units, monitor and / or diagnose each other. Therefore, the corresponding processing unit preferably has a correspondingly constructed monitoring unit.

[0081] External control inputs can come from users, particularly rail vehicle drivers. For example, the user can provide control inputs that, in turn, trigger corresponding changes in the operating mode of the functional unit by being translated into input status messages.

[0082] Furthermore, there is the possibility of specifying the monitoring unit for handling other functional units. This is especially true for the output status messages of these functional units.

[0083] In addition, the regulations can also come from other or higher levels, such as those that function as decision makers or higher-level monitoring units in the braking system, which monitor multiple functional units.

[0084] Finally, the current operating mode of the functional unit can also be used as the basis for constructing the output status message.

[0085] Preferably, the output status message contains at least one piece of information about:

[0086] - The operating mode of the functional unit;

[0087] - The range of available functions for a functional unit;

[0088] -Limited functionality provided;

[0089] - The state of the first and / or second processing unit.

[0090] Using information about the operating mode, the functional unit can generally notify other functional units or the braking system of the current operating mode by sending output status messages. If the functional unit is in a second operating mode, the downstream functional unit can respond accordingly if at least one output parameter provided through the output interface or the associated function of the functional unit cannot be handled by the downstream functional unit without a response, such as in the event of a change in operating mode.

[0091] Information about the available functional range of a functional unit is used in a similar manner to information about the operating mode. If the functionality of at least one output parameter provided through the output interface, or the associated functional unit, cannot be processed by a downstream functional unit without a response, such as a change in operating mode, based on the currently reduced functional range, then the downstream functional unit can also respond accordingly. The functional range can be limited or the same as, particularly in the second operating mode, relative to the first operating mode, as already described above.

[0092] Information regarding the limited functionality provided can also be used by downstream functional units to prepare for the imminent failure of the functional unit or its processing unit. The limited functionality provided can be included in the output status message, in particular, by specifying the remaining duration of the limited or remaining time of the functionality provided, or by specifying the number or remaining number of functionality implementations.

[0093] In addition, information regarding the status of the first and / or second processing units or functional units may include the following:

[0094] Preferably, the output status message may include information about the functional unit or its processing unit being in a normal operation mode that is about to end. This message can notify downstream functional units that one or more input parameters used by the downstream functional units may change after the normal operation mode of the functional unit or its processing unit ends. The downstream functional units receive these input parameters through an input interface, and these input parameters are directly or indirectly affected by the functional unit or its processing unit.

[0095] Preferably, the output status message may include information about the functional unit being in emergency operation mode. In this case, the normal operation mode of the functional unit, especially the first operation mode, has ended.

[0096] Preferably, the output status message may include information about the following: the functional unit or its processing unit is faulty, disconnected, or no longer available. In this case, the functional unit or its processing unit no longer provides output parameters or intermediate parameters.

[0097] Preferably, the output status message may include information about the functional unit or its processing unit being in a normal operating mode that will not immediately terminate. In this case, the functional unit preferably remains in the first operating mode, or the message preferably does not trigger a transition to a second operating mode for the functional unit.

[0098] Preferably, the first and second monitoring units are implemented identically or by a single component. This component may be part of the first or second processing unit, or may be separately located within the functional unit.

[0099] Preferably, the first processing unit lacks security integrity or has a lower or equal level of security integrity compared to the second processing unit. This advantageously improves the availability of the second processing unit. The second processing unit can function as a backup to the first processing unit, wherein the functional scope of the first processing unit is typically greater than that of the second processing unit, and wherein the availability of the first processing unit is reduced relative to the second processing unit.

[0100] Preferably, the output unit has a security integrity as high as or higher than that of the second processing unit. This ensures that, when the first processing unit with a relatively low SIL no longer affects the output parameters in the second operating mode, the functional unit can also provide functionality with a relatively high SIL in the second operating mode.

[0101] The functional unit is preferably configured as a brake control unit, an actuator control unit, a braking force generation unit, or an energy supply unit.

[0102] A brake control unit can be understood as a set of functions that provide train-wide and / or partial functions within the braking path based on control inputs, vehicle state parameters, or brake system state parameters. An actuator control unit can be understood as a set of functions that provide force generation functions within the braking path based on force adjustment parameters. A brake force generation unit can be understood as a set of functions that generate frictional braking force based on actuation parameters. An energy supply unit can be understood as a set of functions that provide energy supply to the structural components of the braking system.

[0103] In another implementation of the functional unit, the processing unit can be chained upstream of the output unit, thereby creating a path for providing functional / output parameters. In this case, messages from the diagnostic / monitoring unit of the processing unit are provided to the monitor or first monitor / determiner of the preceding processing unit in the chain. The processing units thus form a chain or series of functional units with each other.

[0104] Preferably, the second processing unit has the same structure or the same function as the first processing unit, wherein the second processing unit is configured to generate the at least one second intermediate parameter based on the at least one input parameter. In this case, the second processing unit is configured to be identical to the first processing unit and / or provide the same function. The identical function means that the second intermediate parameter generated by the second processing unit from the at least one input parameter is identical in dynamic range and value range to the first intermediate parameter generated by the first processing unit from the at least one input parameter. The actual structure of the second processing unit may be identical to or different from the structure of the first processing unit. If the function of the second processing unit is identical to that of the first processing unit, then the generation of the at least one output parameter in the second operating mode is identical to the generation of the at least one output parameter in the first operating mode.

[0105] Only the first processing unit no longer affects the generation of the at least one output parameter in the second operating mode.

[0106] Preferably, a braking system for rail vehicles is provided, the braking system having a braking path in which the first functional unit as described above is arranged, or the braking path is formed by the first functional unit as described above.

[0107] Preferably, the braking system includes a braking system monitoring unit that monitors the first functional unit and is configured to generate input status messages and transmit these input status messages to the functional unit. The input status messages here originate from the braking system monitoring unit located outside the first functional unit.

[0108] Preferably, the braking system has at least one second functional unit disposed in the braking path or another braking path, wherein the braking system monitoring unit is configured to evaluate the output status messages of the first and second functional units and perform fault mode identification. When multiple functional units have the same fault or failure—either the functional unit changes to a second operating mode based on the fault or failure, or the functional unit is only still within a defined functional range or active in the normal operating mode for a defined period of time based on the fault or failure—the braking system monitoring unit can identify the cause of this and, if necessary, send an input status message to all functional units in the braking system that are expected to be involved in the cause, so that these functional units can implement corresponding measures, such as changing to the second operating mode.

[0109] It may be advantageous to occupy an operating mode designed to prevent the failure from continuing when a fault mode is identified. This could be a second operating mode. However, it is also possible to maintain the first operating mode and only limit functionality. For this purpose, the first processing unit can output intermediate parameters with small dynamic ranges, limited values, or limited provisioning.

[0110] It will be apparent to those skilled in the art that the foregoing description of the functional units, and in particular the foregoing interactions between the described functional units and upstream or downstream or otherwise described functional units, can be considered, in particular, the physical and / or functional design of the braking system described herein. Therefore, the foregoing description of the functional units can also be considered as a means of embodying and further expanding the braking system described herein.

[0111] The braking system, particularly the braking system monitoring unit or functional unit, can be configured to generate instructions or transition instructions based on the state of the processing unit or functional unit. Using these instructions or transition instructions, the braking system, the corresponding functional unit, or the processing unit transitions to a reliable state (safety response). This reliable state is preferably triggered or maintained when a specific operating mode deviating from the normal mode is foreseeably about to end (e.g., AKUT-BACKUP).

[0112] The functional unit or braking system is preferably configured to implement a safety response until the corresponding operating mode ends and the corresponding safety response can no longer be implemented.

[0113] Preferably, a rail vehicle is provided that includes the braking system described above.

[0114] A preferred method is provided. This method is suitable for operating the functional units described above, the braking systems described above, or the rail vehicles described above. The method includes the following steps:

[0115] - The functional unit runs in the first operating mode;

[0116] - Receive input status messages;

[0117] - When the input status message contains predetermined transformation conditions, switch to the second operating mode;

[0118] - The functional unit runs in the second operating mode.

[0119] It will be apparent to those skilled in the art that the information described above in the description of functional units, braking systems, and rail vehicles can similarly be regarded as method features that can be used to embody the methods disclosed herein. Attached Figure Description

[0120] The invention will now be described with reference to the accompanying drawings, using preferred embodiments.

[0121] in:

[0122] Figure 1 A braking system comprising multiple functional units is shown;

[0123] Figure 2 This illustrates a first implementation of the functional unit;

[0124] Figure 3 This illustrates a second implementation of the functional unit;

[0125] Figure 4 This illustrates the specific implementation of the functional unit; and

[0126] Figure 5a and Figure 5b Two finite state automata are shown. Detailed Implementation

[0127] Figure 1 A braking system comprising multiple functional units is shown.

[0128] A braking system 1 is shown, which includes a braking control unit 2, an actuator control unit 3, a braking force generating unit 4, and an energy supply unit 5 as functional units.

[0129] The braking force generating unit 4 is further divided into a braking force unit 4a and a highly reliable functional component 4b.

[0130] In the accompanying diagram, input parameter 6 is passed from left to braking system 1. This may involve control inputs, vehicle state parameters, braking system state parameters, or energy supply parameters. These input parameters 6 are then transmitted as input parameters to functional units 2, 3, 4, and 5 as required. That is, vehicle state parameters such as speed, acceleration, etc., are transmitted, but not necessarily only to braking control unit 2. Control inputs, such as target deceleration or user braking or emergency braking expectations, are transmitted, but not necessarily only to braking control unit 2. Braking system state parameters such as clamping and squeezing forces, piston or braking pressure, braking torque, and speed are transmitted, but not necessarily only to braking control unit 2 and / or actuator control unit 3. Energy supply parameters such as the state of charge or temperature of the accumulator are transmitted, but not necessarily only to energy supply unit 5.

[0131] Functional units 2, 3, 4, and 5 then provide their functions based on the input parameters transmitted respectively, as described above.

[0132] In the accompanying drawings, the braking system 1 itself also forms a functional unit, as described above. This functional unit receives input parameter 6 as described. These input parameters are processed by the braking system 1, which then provides output parameter 7, in this case providing the squeezing or clamping force of the clamping component of the friction brake to achieve braking action. In this mode of observation, functional units 2, 3, 4, and 5 serve as sub-units of the higher-level functional unit "Braking System" 1.

[0133] Functional units 2, 3, 4, and 5 are further divided into additional processing units not shown here.

[0134] It is now specified that the functional units 2, 3, 4, 5 and / or the braking system 1 itself output status messages 8 (also referred to as "output status messages" in the description of the functional units). The status messages 8 of the various functional units 2, 3, 4, 5 of the braking system 1 may relate to the individual processing units, or be integrated into a single status of the processing unit.

[0135] For example, the following states can be envisioned for processing units and / or functional units:

[0136] -OK: The unit is operating in normal operating mode;

[0137] -AKUT-OK: The unit is operating in normal operating mode, however, this normal operating mode will end within a foreseeable time.

[0138] -BACKUP: The unit is in emergency operation mode;

[0139] -AKUT-BACKUP: The unit operates in emergency operation mode, however, this emergency operation mode will end within a foreseeable time.

[0140] -NOK: Unit invalid, functionality is no longer provided.

[0141] The second operating mode of functional units 2, 3, 4, and 5 can be an emergency operating mode. In addition to the states OK and NOK, the other states AKUT-OK, BACKUP, and AKUT-BACKUP should be considered optional.

[0142] The state of functional units 2, 3, 4, 5, or braking system 1 itself can be defined as follows: an integrated state is formed by the corresponding state messages of the lower-level units. That is, when observing braking system 1, a state of braking system 1 can be formed by the state messages of each functional unit 2, 3, 4, 5. These state messages can correspond to the state messages described above. It can be specified here that the state message of braking system 1 always corresponds to the worst state message (in the order from best to worst: OK, AKUT-OK, BACKUP, AKUT-BACKUP, and NOK). That is, if, for example, actuator control unit 3 is in the BACKUP state, while other functional units 2, 4, 5 are in the OK state, then the state message of braking system 1 can also be set to BACKUP.

[0143] Figure 2 The first embodiment of functional unit 10 is shown.

[0144] The first processing unit 11 and the second processing unit 12 are shown here. The first processing unit 11 and the second processing unit 12 process input parameters that are sent from the left through the input interface 13 to the processing units 11 and 12. For this purpose, the functional unit has processing functions 11a and 12a. Based on these input parameters, the first processing unit 11 generates a first intermediate parameter 14 and the second processing unit 12 generates a second intermediate parameter 15. These intermediate parameters 14 and 15 are sent to the output unit 16, which generates at least one output parameter 17 based on the obtained intermediate parameters 14 and 15. This output parameter is then output through the output interface 18 of the functional unit 10, thereby enabling the function to be provided to the braking system through the functional unit 10.

[0145] Processing units 11 and 12 also have diagnostic functions 11b and 12b, which can perform self-diagnosis and provide the diagnostic data obtained therefrom.

[0146] Functional unit 10 can operate in a first operating mode and a second operating mode. Here, output parameter 17 is generated by output unit 16 in the second operating mode, independent of the at least one first intermediate parameter 14.

[0147] In the example shown, output unit 16 is configured as a conversion unit. That is, the output unit directs the first intermediate parameter 14 to the output interface 18 in the first operating mode and the second intermediate parameter 15 in the second operating mode. That is, in the first operating mode, the first processing unit 11 implements the function of functional unit 10, and in the second operating mode, the second processing unit 12 implements the function of functional unit 10.

[0148] In the example shown, output unit 16 belongs to the second processing unit 12. Output unit 16 and the second processing unit 12 are constructed here with a higher SIL than the first processing unit 11. The first processing unit 11 is implemented with a lower SIL because its intermediate parameters affect the first operating mode of output parameter 17, but this is ensured to be achieved with a higher SIL and the associated higher security when switching to the second processing unit 12.

[0149] In the example shown, the first operating mode is the normal operating mode, while the second operating mode is the emergency operating mode.

[0150] A first monitoring unit 19 is further shown, which is configured to be associated with the second processing unit 12 in this embodiment of the functional unit. The first monitoring unit 19 receives diagnostic data from the diagnostic function 20 of the first processing unit 11 and the diagnostic function 21 of the second processing unit 12. Alternatively or additionally, the monitoring unit 19 may be configured to perform a comparison of target and actual values ​​for the first intermediate parameter 14 and / or the second intermediate parameter 15, in order to confirm that the function provision based on the input parameters is fault-free or faulty, or generally present or generally corresponds to the provision / quality / performance of the functional specification. The first monitoring unit 19 may be configured, in particular, to monitor the components of the first processing unit 11 and the second processing unit 12. If a corresponding component fails or is about to fail, the first monitoring unit 19 may be correspondingly configured to take preventative measures to continue maintaining the functional provision of the functional unit 10. The first monitoring unit 19 may generate a conversion instruction for this purpose, which causes the output parameter 17 constructed by the output unit 16 to no longer be related to the first processing unit 14.

[0151] Output unit 16 can be configured as a conversion unit or a selection unit, which converts or selects between a first intermediate parameter 14 and a second intermediate parameter 15 according to a conversion instruction, so that the output parameter 17 is only related to the selected intermediate parameters 14 and 15. However, output unit 16 can also be configured as a superposition unit, in which the intermediate parameters 14 and 15 generated by processing units 11 and 12 are superimposed. In this way, for example, the generated intermediate parameters 14 and 15 can be added together to form the output parameter 17, so that when processing unit 11 fails, only processing unit 12 provides a reliable minimum parameter.

[0152] Functional unit 10, particularly the first monitoring unit 19, can be further configured to construct input status messages, for example, from diagnostic data received by the first and second processing units 14, 15, and data from other levels 28 of the braking system where functional unit 10 is located. Alternatively, such input status messages can be specified to be sent to functional unit 10 from external sources, particularly from other levels 28. Higher or lower levels can be considered as hierarchies, functioning, for example, as decision makers or higher-level monitoring units 26 in the braking system and monitoring multiple functional units. Input status messages can contain evaluations from lower or higher system levels or from additional diagnostics or monitors along the functional chain of the braking path, which is below the observation unit. This informs functional unit 10 that reliable provision of functionality to upstream functional units is only possible for limited time intervals or functional ranges and optionally, therefore, failure response at higher levels is required to maintain a reliable state. This can ultimately lead to the construction of the aforementioned transition instructions, if ensuring that a reliable state or the required SIL is maintained.

[0153] Furthermore, status messages 8 (output status messages) are shown in the accompanying drawings. These status messages are provided externally by the first processing unit 11 and the second processing unit 12. These status messages can be generated by an optional second monitoring unit (not shown) or by the first monitoring unit 19 and sent externally to other functional units, braking systems, or other levels or monitoring units. Their contents have been described above, therefore, reference should be made specifically to... Figure 1 and One The above explanation is a general description. In this embodiment, status messages 8 are issued from both processing units 11 and 12, and in particular, can notify about the status or condition of the respective processing units 11 and 12. However, it may also be specified that, alternatively or additionally, status messages are sent only centrally by functional unit 10 and not to processing units 11 and 12.

[0154] Figure 3 A second embodiment of functional unit 10 is shown.

[0155] The functional unit 10 shown here has a first processing unit 11 and a second processing unit 12. The two processing units 11 and 12 are relative to... Figure 2The implementation is constructed with the same SIL and, in particular, provides the same functionality within functional unit 10. Each processing unit is constructed equivalently in this case, and each processing unit provides a first intermediate parameter 14 and a second intermediate parameter 15 to output unit 16, which thereby generates output parameter 17 and transmits the output parameter to output interface 18 of functional unit 10. Intermediate parameters 14 and 15 are generated by corresponding processing functions 11a and 12a of processing units 11 and 12. To construct intermediate parameters 14 and 15, processing units 11 and 12 process input parameters, which are sent from the left through input interface 13 to processing units 11 and 12. These input parameters are already, in their entirety, already... Figure 1 As shown in the diagram, functional unit 10 obtains at least one selection or partial quantity of these input parameters.

[0156] The first processing unit 11 and the second processing unit 12 have a first monitoring unit 22 and a second monitoring unit 23.

[0157] The first processing unit 11 and the second processing unit 12 have a first cutting-off unit 24 and a second cutting-off unit 25. The first cutting-off unit and the second cutting-off unit may be part of the corresponding monitoring units 22, 23 or may be constructed separately as shown in the figures.

[0158] Monitoring units 22 and 23 can, in particular, determine the operating mode of functional unit 10 based on data from diagnostic and disconnection units 24 and 25 of the configured processing units 11 and 12 and external sources. This can especially involve input status messages from external sources, such as the external monitoring unit 26 shown. The content of the input status messages has been described above. For this purpose, please refer to the general description.

[0159] Functional unit 10, and in particular monitoring units 22 and 23, are configured to determine the operating mode of the functional unit based on received data and, in particular, input status messages. According to the second operating mode, output parameter 17 is generated by output unit 16 in the second operating mode regardless of or unaffected by the at least one first intermediate parameter 14. This can mean cutting off the first processing unit 11 by the corresponding response of cutoff unit 24 to a switching or cutting-off command, which may in particular come from one of monitoring units 22 and 23. However, it can also be specified that output unit 16, in constructing output parameter 17, does not further consider the first intermediate parameter 14 in response to a switching command.

[0160] In the example shown, the second operating mode is therefore equivalent to the first processing unit 11 no longer affecting the output parameter 17. However, since processing units 11 and 12 are constructed with the same SIL or with the same functionality, it can also be specified here that in the second operating mode, another processing unit, such as the second processing unit 12 or other processing units if necessary, is shut down, or its intermediate parameters have no effect on the output parameter 17, in such a way as correspondingly manipulating the output unit 16.

[0161] Generally, and regardless of this embodiment, for functional units comprising multiple processing units with the same or equivalent functions, it may be applicable in the second operating mode to disconnect one of these processing units and non-forcefully disconnect the first processing unit, or to output parameters that are independent of or unaffected by the corresponding intermediate parameters, in order to correspondingly manipulate or switch the output unit.

[0162] In the accompanying drawings, arrows connecting the cutting units 24, 25 and the monitoring units 22, 23 further indicate that switching commands and status messages can be exchanged, so that each monitoring unit 22, 23 can also recognize the switching status of the corresponding other cutting units 24, 25.

[0163] Output unit 16 can be configured here as a superposition unit or selection unit that correspondingly processes intermediate parameters 14 and 15.

[0164] Specifically, it can be specified that the first processing unit 11 and the second processing unit 12 operate simultaneously. In this case, it may be sufficient to disconnect the processing units 11 and 12 when switching to the second operating mode, so that these processing units no longer affect the output parameter 17. Typically, this is the first processing unit 11. However, this is not mandatory in this embodiment, because the first processing unit 11 and the second processing unit 12 are constructed identically. When the second processing unit 12 is disconnected, the functionality of the acquisition function unit 10 is also maintained.

[0165] Specifically, it can be stipulated that when multiple processing units 11 and 12 simultaneously provide conflicting intermediate parameters 14 and 15 to the output unit 16, the output unit has a decision mode to determine which intermediate parameter 14 or 15 to further process or to determine whether to end the provision of output parameter 17. In this case, it can be stipulated that the functional unit outputs an output status message NOK.

[0166] Functional unit 10 and, in particular, monitoring units 22, 23, can be further configured to construct input status messages from diagnostic data of other levels of the braking system, such as those set by the first and second processing units 14, 15, where functional unit 10 is located. Alternatively, such input status messages can be specified to be sent to functional unit 10 from external sources, particularly from other levels. Higher or lower levels can be considered as levels that function in the braking system, such as as a decision maker or an external monitoring unit 26 at a higher level, and monitor multiple functional units. Input status messages can contain evaluations from lower or higher system levels or from additional diagnostic or monitoring units along the functional chain of the braking path, which is below the observation unit. This informs functional unit 10 that reliable provision of functionality to upstream functional units is only possible for limited time intervals or functional ranges and therefore requires failure response at higher levels to maintain a reliable state for the braking system. This can ultimately lead to the construction of the aforementioned transition instructions, if ensuring that a reliable state or the required SIL is maintained. Alternatively, instructions for safety response or failure response can be constructed at a higher level, and functional unit 10 processes these instructions.

[0167] Furthermore, status messages 8 (output status messages) are shown in the accompanying drawings. These status messages are output by the first processing unit 11 and the second processing unit 12. These status messages can be generated by monitoring units 22 and 23 and sent to other functional units, braking systems, or other levels or monitoring units. Their contents have been described above, therefore, please refer to them, especially for… Figure 1 and One The above explanation is a general description. In this embodiment, status messages 8 are issued from both processing units 11 and 12, and in particular, can notify about the status or condition of the respective processing units 11 and 12. However, it may also be specified that, alternatively or additionally, status messages are sent only centrally by functional unit 10 and not to processing units 11 and 12.

[0168] exist Figure 3 In the implementation shown, the second operating mode of functional unit 10 can be an emergency operating mode.

[0169] Emergency operation mode can be characterized by the following: the features provided by the function are limited (dynamic, maximum value, remaining duration, remaining number of operations, etc.).

[0170] In emergency operation mode, it can be specified that the second processing unit 12 and / or other processing units use instructions to increase their dynamics or functional range through the corresponding monitor / determiner, with the aim of at least partially compensating for the dynamic loss or functional range loss of functional unit 10 due to processing unit failure.

[0171] Figure 4 The specific implementation of the functional unit is shown.

[0172] The implementation shown is for use in Figure 3 The implementation form shown in the figure.

[0173] Functional unit 10 is configured here as an actuator or braking force generating unit 4 (see reference). Figure 1 The purpose of functional unit 10 here is to control the reliable clamping force of the clamping component of the friction brake as the output parameter 16. To this end, functional unit 10 is divided into a brake force unit 4a that can be controlled and changed and a highly reliable functional component 4b, which ultimately provide the output parameter 18 in the required form.

[0174] Here, in functional unit 10, two independent processing units 11, 12 (“torque generating units”) for generating torque are connected to each other via a common rotor / stator (output unit 16) as a superposition unit to generate output torque on a mechanical shaft. This shaft drives transmission 27 or mechanical arrangement structure to convert torque into reliable clamping force of the clamping components of a friction brake.

[0175] In the event of a single failure in the first processing unit of the two processing units 11 and 12, the failure is identified by the corresponding internal monitoring units 22 and 23 of the respective processing units 11 and 12, and the function is reliably disconnected. The output status message 8 of this unit changes from OK to NOK. As a result, if necessary, torque function and final extrusion force can be further provided with limited functionality through the second processing unit or the undisconnected processing unit.

[0176] The second processing unit or the un-disconnected processing unit 12 (or its monitoring unit 23 or decision function) at least obtains the status of the disconnected unit 24 or another diagnostic device (e.g., monitoring unit 22) of the first processing unit 11 and, if necessary, can output a safety response for the second torque function or place it in an emergency operation state and, if necessary, balance (e.g., increase) the characteristics of the output torque, with the aim of at least partially compensating for the losses of the disconnected unit 12 for the characteristics of the functional unit 4. The emergency operation state can also be characterized by the operating mode of the protection system.

[0177] With the first processing unit 11 being disconnected, the shown functional unit 10 is in the second operating mode.

[0178] After the first functional constraint of the emergency operation state is met (the number of operations, time, temperature or other factors and combinations of these factors if necessary), the state 8 of the second processing unit 12 changes from OK to AKUT-OK, thereby indicating with a signal that the function provision of the second processing unit 12 or the operation of the second processing unit is about to be set.

[0179] The optional external monitoring unit 26, located above functional unit 10, can now utilize this message until the second constraint is reached, so that a command or appropriate safety response can be initiated from the overall diagnostic status of the system or multiple monitoring units. This could be, for example, a) opening and stopping the clamping component or b) closing or setting a specific force and stopping the clamping component.

[0180] Upon reaching the second constraint, the second processing unit 12 receives and accepts the final command directly from the superior monitoring unit 26 or, in a variant form, from monitoring unit 22 or monitoring unit 23, and then the second processing unit 12 transitions from the emergency operation state to the final predefined reliable state. Therefore, the output status message of the second processing unit 12 changes from AKUT-OK to NOK and the function provided by the functional unit 10 ends. This can also be done without an explicit command.

[0181] Figure 5a and Figure 5b Showing for example in Figures 2 to 4 The figure shows two finite state automata 100 and 200 for functional unit 10 (upper level) and processing units 11 and 12 (lower level). The state automata for functional unit 10 is labeled with reference numeral 100, and the state automata for processing units 11 and 12 are labeled with reference numeral 200.

[0182] The state automata used for processing units 11 and 12 are instantiated twice in the implementation scheme. From these automata, it can now be determined what specifications can be given from the outside (e.g., from a monitor / transition instructions) and how the two state automata interact. For example, a fault in the processing unit leads to an emergency operation mode of the functional unit, etc.

[0183] The following states are shown:

[0184] • Normal 101, 201

[0185] • Emergency Operations (=BACKUP) 102, 202

[0186] • Acute emergency run (AKUT-BACKUP) 103, 203

[0187] • Reliable state 1 (for NOK / Not OK failure direction) 104, 204

[0188] • Reliable state 2 (for NOK / Not OK failure direction) 105, 205

[0189] As can be seen in the accompanying drawings, after the corresponding units enter operation (reference numerals 106 and 206), the two state automata 100 and 200 obtain requirements and states from the left in the drawings. These requirements and states can originate from the monitoring units 19, 22, 23, 26 and / or other units or sources described above. In particular, requirement signals and state information (for automata 100 of the functional unit) or requirement signals (for automata 200 of the processing unit) from other processing units can also be transferred.

[0190] First, describe Figure 5b The state automaton 200 is in normal mode 201 if the corresponding processing unit is fault-free or there is no other requirement to occupy a reliable state. If a requirement to occupy an emergency operation is input from the left, the processing unit transitions to emergency operation mode 202 and outputs the corresponding state message 8, which can be generally processed by other functional units or the braking system. When a first constraint is met, the processing unit leaves state 202. This could be, for example, a pre-defined operating duration or a pre-defined number of function implementations. The state automaton 200 then transitions to state 203. Here, the emergency operation mode is acute, i.e., the emergency operation mode is about to end. This can again be achieved by outputting the corresponding state message 8. In both states 202 and 203, the functional range of the corresponding processing unit is limited relative to state 201. However, the functional range of both states 202 and 203 is the same. The only difference is that state 203 is time-limited. If the second constraint, which defines the end of state 203, is met at this point, the state automaton transitions to either reliable state 1, 204 (disconnect torque) or reliable state 2, 205 (set & fixed torque) according to the requirements from the left input state automaton. The two states 204 and 205 are situation-dependent and relate to the functionality of the processing unit. The states shown here involve... Figure 4 The implementation form is as follows. If, for example, the state cannot be affected by external specifications, then only the following reliable states exist, to which the state automaton 200 transitions. If the fault is directly identified by the processing unit on which the state automaton 200 is based, or if these faults or failures are identified by an external source, then the transition from normal mode 201 to reliable states 1, 204 or reliable states 2, 205 can be directly achieved using transition instructions. Each state occupied by the state automaton 200 and thus the corresponding processing unit can be output via the corresponding state message 8.

[0191] Figure 5a The state automaton 100 is configured as follows, which involves a functional unit having a processing unit.

[0192] The functional unit operates in normal mode 101. If information enters the state automaton 100 from the left, causing one of the processing units to no longer be in normal mode 201 (here now in reliable states 1, 204), while the other processing units are still in normal mode 201, then the state automaton 100 transitions to state 102 and is therefore in emergency operation mode 202 in relation to the processing unit that is no longer in normal mode 201. Once all processing units are back in normal mode 201, the functional unit can return from the emergency operation mode. If a processing unit still in normal mode 201 transitions to emergency operation mode or further to acute emergency operation mode 203 as described, then the state automaton 100 also transitions to the time-constrained acute emergency operation mode 103. The acute emergency operation mode ends when the last processing unit transitions from acute emergency operation mode 203 to state 204 or 205, for example, based on a transition instruction or because the constraints for state 203 are met. Correspondingly, the state automaton 100 transitions to reliable states 1 and 104 or reliable states 2 and 105. The state of the state automaton 100, or the state of the associated functional unit, can be communicated to other functional units or the braking system via the corresponding state message 8. If a fault in either processing unit is directly identified by the functional unit on which the state automaton 100 is based, or if the fault or failure is identified by an external source, the transition from normal mode 101 to reliable states 2 and 105 can also be directly achieved using transition instructions.

[0193] Furthermore, within the scope of this invention, the following terms may be understood in the meanings given below.

[0194] Electromechanical braking system: A braking system that provides the ability to generate deceleration / braking force for a vehicle using electronic, electrical, and mechanical components.

[0195] Electro-pneumatic braking system: A braking system that provides the ability to generate deceleration / braking force for a vehicle by means of electronic, electrical and pneumatic components.

[0196] Braking path: The sum of all the following functions, which are active between the control input of the braking system and the generation of friction braking force and establish system-wide braking function.

[0197] Safety Integrity Level (SIL): also known as the safety integrity level according to DIN EN61508-2:17.

[0198] Highest reliability functional components: (also known as shared functional components) Functions that are part of the braking path, based on proven non-lossable functional mechanisms (e.g., mechanical brake calipers) and possess inherent safety characteristics.

[0199] Decision Maker / Decision Function: Designed to receive status signals that appear in the system from the monitoring unit and then determine the fault response.

[0200] Braking control unit: A set of functions used to provide train-wide and / or partial functions in the braking path based on control inputs or vehicle state parameters or braking system state parameters.

[0201] Actuator control unit: A set of functions used to provide force generation functionality in the braking path based on force adjustment parameters.

[0202] Braking force generation unit: A set of functions used to generate frictional braking force based on actuation parameters.

[0203] Actuator: A structural component designed to perform the functions of the brake control unit, actuator control unit, and braking force unit.

[0204] Braking force unit: A set of functions used to generate frictional braking force based on actuation parameters.

[0205] Force adjustment parameters: Control or adjustment parameters that directly or indirectly describe the requirements of the braking path, i.e., generating force (e.g., cylinder force) in the coordinate system related to the brake adjuster, and taking into account related control or operating parameters when setting the force, such as reducing signals, adapting parameters for quality improvement, etc.

[0206] Actuation parameters: Control or adjustment parameters that are provided to an existing electromechanical process or operating principle in order to identify and require specific motion, force, or positional states or similar state characteristics (e.g., parking brake).

[0207] Energy supply unit: A set of functions used to provide energy to the structural components of the braking system.

[0208] Processing unit: A set of functions within a functional unit that generates at least one intermediate parameter and can, when necessary, switch to at least one output parameter of the functional unit without adverse effects during the unit's operating mode.

[0209] List of reference numerals

[0210] 1 Braking System

[0211] 2 Brake Control Unit

[0212] 3 Actuator Control Unit

[0213] 4 Braking Force Generation Units

[0214] 4a Braking Unit

[0215] 4b Highest Reliability Functional Components

[0216] 5 energy supply units

[0217] 6 Input parameters

[0218] 7 Output Parameters

[0219] 8. Status Messages (Output Status Messages)

[0220] 10 functional units

[0221] 11 First Processing Unit

[0222] 11a processing function

[0223] 12b diagnostic function

[0224] 12 Second Processing Unit

[0225] 12a processing function

[0226] 12b diagnostic function

[0227] 13 input interfaces

[0228] 14 First Intermediate Parameter

[0229] 15 Second intermediate parameter

[0230] 16 output units

[0231] 17 Output Parameters

[0232] 18 output interfaces

[0233] 19 First Monitoring Unit

[0234] 22 monitoring units

[0235] 23 monitoring units

[0236] 24 Cut-off Units

[0237] 25 cutting units

[0238] 26 External Monitoring Units

[0239] 27 Transmission System

[0240] 28 Other levels

[0241] 100-state automaton

[0242] 101 Normal Mode

[0243] 102 Emergency Operation Mode

[0244] 103 Acute Emergency Operation Mode

[0245] 104 Reliable State 1

[0246] 105 Reliability Status 1

[0247] 106 connected

[0248] 200-state automaton

[0249] 201 Normal Mode

[0250] 202 Emergency Operation Mode

[0251] 203 Acute Emergency Operation Mode

[0252] 204 Reliability Status 1

[0253] 205 Reliability Status 2

[0254] 206 connected

Claims

1. A functional unit (10) for a braking system (1) of a rail vehicle, the functional unit being configured to provide a braking path of the braking system (1) or a function within a portion of the braking path of the braking system (1), the functional unit comprising: Input interface (13), the input interface being configured to receive at least one input parameter (6). Output interface (18), the output interface being configured to output at least one output parameter (17). A first processing unit (11) is configured to generate at least one first intermediate parameter (14) based on the at least one input parameter (6). The second processing unit (12) is configured to generate at least one second intermediate parameter (15). Output unit (16) is configured to generate at least one output parameter (17) from at least one first intermediate parameter (14) and at least one second intermediate parameter (15) and transmit the at least one output parameter to the output interface (18). The functional unit (10) is configured to switch from a first operating mode to a second operating mode according to a conversion instruction. In the second operating mode, the output unit (16) generates the at least one output parameter (17) independently of the at least one first intermediate parameter (14).

2. The functional unit (10) according to claim 1, wherein, The functional unit (10) is configured to generate the transition instruction from the input status message.

3. The functional unit (10) according to any one of the preceding claims, wherein, The first processing unit (11) is in a state of being unaffected by the output unit and the second processing unit (12) in the second operating mode, or the output unit (16) does not consider the at least one first intermediate parameter (14) when generating the output parameter (17) in the second operating mode.

4. The functional unit (10) according to any one of the preceding claims, wherein, The functional unit (10) has a limited or the same functional range in the second operating mode relative to the first operating mode.

5. The functional unit (10) according to any one of the preceding claims, wherein, The functional unit (10) has a limited function provision in the second operating mode, in particular a limited remaining duration or a limited number of function implementations of the function provision.

6. The functional unit (10) according to any one of the preceding claims, wherein, The first operating mode is the normal operating mode of the functional unit, while the second operating mode is the emergency operating mode of the functional unit (10).

7. The functional unit (10) according to any one of claims 2 to 6, wherein, The functional unit (10) has a first monitoring unit (19, 22, 23), which is configured to construct the input status message.

8. The functional unit (10) according to claim 7, wherein, The first monitoring unit (19, 22, 23) is configured to construct the input status message based on at least one of the following data: Diagnostic data of the first processing unit (11); Diagnostic data from the second processing unit (12); External control input; The provisions of the monitoring unit (26) of other functional units or higher-level (28) are specified.

9. The functional unit (10) according to any one of the preceding claims, wherein, The input status message can include one of the following information: The upstream functional unit or the processing unit of the upstream functional unit is in a normal operation mode that is about to end, and at least one of the at least one input parameter is related to the upstream functional unit or the processing unit of the upstream functional unit. The upstream functional unit is in emergency operation mode, and at least one of the at least one input parameter is related to the upstream functional unit; If the upstream functional unit or the processing unit of the upstream functional unit fails, is disconnected, or is no longer available, at least one of the at least one input parameter is related to the upstream functional unit or the processing unit of the upstream functional unit.

10. The functional unit (10) according to any one of the preceding claims, wherein the functional unit includes an output status message interface (18), wherein, The functional unit (10) is configured to output the output status message (8) through the output status message interface (18).

11. The functional unit (10) according to any one of the preceding claims, wherein, The functional unit (10) is configured to construct, in particular, the output status message (8) through the second monitoring unit.

12. The functional unit (10) according to claim 10 or 11, wherein, The output status message (8) is constructed based on at least one of the following data: Diagnostic data of the first processing unit (11); Diagnostic data from the second processing unit (12); External control input; The provisions of the monitoring unit (26) of other functional units or higher-level (28); The operating mode of the functional unit (10).

13. The functional unit (10) according to any one of claims 10 to 12, wherein, The output status message (8) contains at least one piece of information about the following: The operating mode of the functional unit (10); The range of available functions of the functional unit (10); Limited functionality is provided; The state of the first processing unit (11) and / or the second processing unit (12).

14. The functional unit (10) according to any one of claims 7 to 13, wherein, The first monitoring unit and the second monitoring unit are the same.

15. The functional unit (10) according to any one of the preceding claims, wherein, The first processing unit (11) has no security integrity or has a lower or the same level of security integrity as the second processing unit (12).

16. The functional unit (10) according to any one of the preceding claims, wherein, The output unit (16) has the same or higher security integrity as the second processing unit (12).

17. The functional unit (10) according to any one of the preceding claims, wherein, The functional unit (10) is a brake control unit (2), an actuator control unit (3), a braking force generation unit (4), or an energy supply unit (5).

18. The functional unit (10) according to any one of the preceding claims, wherein, The second processing unit (12) has the same structure or the same functional range as the first processing unit (11) and is configured to generate the at least one second intermediate parameter (14) based on the at least one input parameter.

19. A braking system (1) for a rail vehicle, the braking system comprising a braking path in which a first functional unit (10) is arranged, the first functional unit being a functional unit according to any one of claims 1 to 18, or the braking path being formed by the first functional unit (10), the first functional unit being a functional unit according to any one of claims 1 to 18.

20. The braking system (1) according to claim 19, the braking system comprising a braking system monitoring unit (26), the braking system monitoring unit monitoring the first functional unit (10) and configured to generate an input status message and transmit the input status message to the functional unit (10).

21. The braking system (1) according to claim 20, wherein, The braking system (1) has at least one second functional unit (10), the second functional unit being in particular a functional unit according to any one of claims 1 to 18, the second functional unit being disposed in the braking path or another braking path, wherein the braking system monitoring unit (26) is configured to evaluate the output status messages (8) of the first and second functional units (10) and to perform fault mode identification.

22. A rail vehicle comprising a braking system (1) according to any one of claims 19 to 21.

23. A method for operating a functional unit (10) according to any one of claims 1 to 18, a braking system (1) according to any one of claims 19 to 21, or a rail vehicle according to claim 22, the method comprising the following steps: The functional unit (10) is run in the first operating mode. Receive input status messages; When the input status message contains predetermined transformation conditions, the system switches to the second operating mode. The functional unit (10) is operated in the second operating mode.

Images