Emergency braking method and braking control system

Abstract

This application relates to an emergency braking method and braking control system. The method includes a first control chip acquiring a first emergency braking signal and a second control chip acquiring a second emergency braking signal. When at least one of the first and second control chips fails to acquire a valid emergency braking trigger signal, the emergency inflation solenoid valve and the emergency deflation solenoid valve in the emergency control branch are maintained under normal power supply. When both the first and second control chips acquire valid emergency braking trigger signals, the first control chip calculates the target pressure value for emergency braking, and the second control chip determines whether the measured pressure is less than the target pressure value. If it is less, the second control chip controls the power supply to the emergency inflation solenoid valve and the emergency deflation solenoid valve to force the emergency control branch into a forced inflation state. If it is not less, the first control chip performs emergency braking pressure regulation control. This achieves heterogeneous dual-chip division of labor and control, improving the redundancy and operational safety of emergency braking.

Description

Technical Field

[0001] This application relates to the field of vehicle braking, and in particular to an emergency braking method and braking control system. Background Technology

[0002] The braking system of rail transit vehicles is one of the core systems ensuring train operation safety. Among them, the emergency braking function, as a safety function with the highest safety integrity level (SIL4), directly determines whether the train can stop safely and reliably in an emergency. With the continuous increase in the operating speed of rail transit vehicles and the increasing complexity of the operating environment, higher requirements are placed on the reliability and safety redundancy design of the emergency braking function.

[0003] In existing technologies, emergency braking control of rail vehicle braking systems typically employs a single control chip. Specifically, the acquisition of emergency braking hard-wired commands and the closed-loop pressure regulation control of emergency braking are both performed by the same control chip, and the emergency braking hard-wired commands usually utilize a single-channel acquisition circuit. However, this approach suffers from the following problems: because the emergency braking hard-wired commands are acquired using a single-channel acquisition circuit, if the acquisition circuit fails, the emergency braking command cannot be confirmed through redundant acquisition circuits, potentially leading to emergency braking failure and failing to meet the SIL4 safety integrity level requirements.

[0004] Currently, no effective solutions have been proposed for the technical problems in related technologies, such as the use of single-channel acquisition for emergency braking hard-wired commands, insufficient reliability of emergency braking functions, and lack of safety redundancy design. Summary of the Invention

[0005] This application provides an emergency braking method and braking control system to at least solve the technical problems in related technologies, such as the use of single-channel acquisition for emergency braking hard-wired commands, insufficient reliability of emergency braking functions, and lack of safety redundancy design.

[0006] In a first aspect, embodiments of this application provide an emergency braking method applied to a brake control unit, the brake control unit including a first control chip and a second control chip, the control method including: The second control chip receives the message and life signal transmitted by the first control chip. When the message is verified and the life signal is normal, the first control chip collects the first emergency braking signal and the second control chip collects the second emergency braking signal. Determine whether the first control chip has acquired a valid emergency braking trigger signal, and whether the second control chip has simultaneously acquired a valid emergency braking trigger signal; If at least one of the first control chip and the second control chip fails to acquire a valid emergency braking trigger signal, the emergency inflation solenoid valve and the emergency deflation solenoid valve in the emergency control branch shall be kept powered normally. When both the first control chip and the second control chip acquire a valid emergency braking trigger signal, the first control chip calculates the target pressure value for emergency braking, while the second control chip acquires the measured pressure from the valid pressure sensor. The system determines whether the measured pressure is less than the target pressure value. If the measured pressure is less than the target pressure value, the second control chip controls the power supply to the emergency inflation solenoid valve and the emergency deflation solenoid valve to cut off the power supply, so that the emergency control branch enters the forced inflation state. If the measured pressure is not less than the target pressure value, the first control chip performs emergency braking pressure regulation control.

[0007] In some embodiments, the braking method further includes: When there are two or more brake control units, the brake control unit sends the emergency braking application status information of its own brake control unit to other brake control units in the whole train through the train-level network; When the target braking control unit receives information that any other braking control unit in the entire train has applied emergency braking, and the target braking control unit has not collected a valid emergency braking trigger signal, the first control chip in the target braking control unit applies braking force through the common control branch. The condition for determining the emergency braking application status information is as follows: both the first control chip and the second control chip have acquired a valid emergency braking trigger signal, and the actual measured pressure of the sensor is greater than the set pressure value.

[0008] In some embodiments, the first control chip performs emergency braking voltage regulation control, including: The first control chip determines whether the emergency pre-control pressure sensor, the emergency inflation solenoid valve, and the emergency exhaust solenoid valve are all fault-free; If there are no faults, the first control chip adjusts the pressure value output by the emergency control branch to the target pressure value based on the deviation between the target pressure value and the pressure value collected by the emergency pre-control pressure sensor. If any one of the emergency pre-control pressure sensor, the emergency inflation solenoid valve, and the emergency exhaust solenoid valve malfunctions, the first control chip determines whether the total pre-control pressure sensor, the emergency inflation solenoid valve, and the emergency exhaust solenoid valve are all functioning correctly. When the total pre-control pressure sensor, the emergency inflation solenoid valve, and the emergency deflation solenoid valve are all functioning properly, the first control chip adjusts the pressure value output by the total pre-control branch to the target pressure value based on the deviation between the target pressure value and the pressure value collected by the total pre-control pressure sensor. If any one of the main pre-control pressure sensor, the emergency inflation solenoid valve, and the emergency deflation solenoid valve malfunctions, the first control chip controls the emergency inflation solenoid valve and the emergency deflation solenoid valve to perform inflation, causing the emergency control branch to output an inflation state and apply emergency braking force.

[0009] In some embodiments, adjusting the pressure value output by the emergency control branch to the target pressure value based on the deviation between the target pressure value and the pressure value collected by the emergency pre-control pressure sensor includes: The first control chip compares the target pressure value with the pressure value collected by the emergency pre-control pressure sensor; When the pressure value collected by the emergency pre-control pressure sensor is less than the pressure target value, the first control chip controls the emergency inflation solenoid valve to be energized or de-energized, so that the emergency control branch is inflated until the deviation between the pressure value collected by the emergency pre-control pressure sensor and the pressure target value is within a preset range. When the pressure value collected by the emergency pre-control pressure sensor is greater than the pressure target value, the first control chip controls the emergency exhaust solenoid valve to be energized or de-energized, so that the emergency control branch exhausts air until the deviation between the pressure value collected by the emergency pre-control pressure sensor and the pressure target value is within a preset range.

[0010] In some embodiments, adjusting the pressure value output by the total pre-control branch to the pressure target value based on the deviation between the target pressure value and the pressure value collected by the total pre-control pressure sensor includes: The first control chip compares the target pressure value with the pressure value collected by the total pre-control pressure sensor; When the pressure value collected by the total pre-control pressure sensor is less than the pressure target value, the first control chip controls the emergency inflation solenoid valve to be energized or de-energized, so that the total pre-control branch is inflated until the deviation between the pressure value collected by the total pre-control pressure sensor and the pressure target value is within a preset range. When the pressure value collected by the total pre-control pressure sensor is greater than the pressure target value, the first control chip controls the emergency exhaust solenoid valve to be energized or de-energized, so that the total pre-control branch exhausts air until the deviation between the pressure value collected by the total pre-control pressure sensor and the pressure target value is within a preset range.

[0011] In some embodiments, the first control chip calculates the target pressure value based on the current bogie load, including: Calculate the target braking force required for this bogie based on the current bogie load; The base braking pressure is calculated based on the target braking force and the base braking pressure conversion coefficient. The target pressure value is calculated based on the conversion coefficient between the basic braking pressure and the brake shoe clearance pressure.

[0012] In some embodiments, the second control chip acquires the measured pressure from the effective pressure sensor, including: The second control chip determines whether the total pre-control pressure sensor is functioning properly; If the total pre-control pressure sensor is normal, the total pre-control pressure of the total pre-control pressure sensor is collected as the measured pressure; If the total pre-control pressure sensor is malfunctioning, then it is determined whether the emergency pre-control pressure sensor is malfunctioning. If the emergency pre-control pressure sensor is malfunctioning, then the emergency pre-control pressure of the emergency pre-control pressure sensor is collected as the measured pressure.

[0013] In some embodiments, both the first control chip and the second control chip acquire a valid emergency braking trigger signal, including: The first control chip acquires the first emergency braking signal through the first acquisition circuit and the second acquisition circuit in its acquisition circuit, respectively. If the acquisition result of either the first acquisition circuit or the second acquisition circuit is low, it is determined that the first control chip has acquired a valid emergency braking trigger signal. The second control chip acquires the second emergency braking signal through the first detection circuit and the second detection circuit in its detection circuit, respectively; If the acquisition result of either the first detection circuit or the second detection circuit is low, it is determined that the second control chip has acquired a valid emergency braking trigger signal.

[0014] In a second aspect, embodiments of this application also provide a braking control system for performing the braking method described in any of the first aspects above, the braking control system including at least one braking control unit; Each of the brake control units includes an air circuit control module and a control circuit module, and the control circuit module is electrically connected to the air circuit control module. The gas circuit control module includes an emergency control branch, a normal control branch, and a main pre-control branch; The emergency control branch is used to output emergency pre-control pressure under emergency braking conditions, and the emergency control branch is equipped with an emergency pre-control pressure sensor. The common control branch is used to output the common pre-control pressure under common braking conditions, and the common control branch is equipped with a common pressure sensor; The main pre-control branch includes an emergency solenoid valve and a main pre-control pressure sensor for switching between the emergency control branch and the normal control branch; The control circuit module includes a first control chip and a second control chip, and the first control chip and the second control chip are communicatively connected. The first control chip is connected to a data acquisition circuit, which is used to acquire the first emergency pre-control pressure signal output by the emergency pre-control pressure sensor, the common pre-control pressure signal output by the common pre-control pressure sensor, and the first total pre-control pressure signal output by the total pre-control pressure sensor. The second control chip is connected to a detection circuit, which is used to acquire the second emergency pre-control pressure signal output by the emergency pre-control pressure sensor and the second total pre-control pressure signal output by the total pre-control pressure sensor.

[0015] In some embodiments, the acquisition circuit includes a first acquisition circuit and a second acquisition circuit, which are connected to the first control chip via different pins; The detection circuit in the second control chip includes a first detection circuit and a second detection circuit, which are connected to the second control chip through different pins.

[0016] Compared to related technologies, the emergency braking method provided in this application embodiment uses a first control chip to handle the main pressure regulation control of emergency braking, while a second control chip independently and in parallel completes emergency braking signal acquisition, pressure monitoring, and hardware power failure fallback protection. The emergency braking trigger signal is synchronously verified by both chips, and the emergency braking pressure regulation process only begins when both chips recognize a valid braking command. When the main control pressure regulation output pressure is insufficient, the second control chip directly cuts off the power supply to the solenoid valve to achieve hardware forced inflation protection. This solves the technical problems in existing technologies, such as single-chip architecture coupling between main control and safety monitoring, poor reliability of braking command acquisition, lack of independent hardware fallback protection when main control pressure regulation fails, and susceptibility to missed emergency braking triggers and insufficient braking force output. It achieves dual verification of emergency braking commands, separates the main pressure regulation function from the safety monitoring fallback function, and can independently trigger hardware-level fault-oriented safety protection in the event of software pressure regulation failure, improving the redundancy and operational safety of emergency braking control and meeting the usage requirements of high-safety-level rail transit braking systems.

[0017] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0018] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart of an emergency braking method according to an embodiment of this application; Figure 2 This is a flowchart illustrating the emergency braking voltage regulation control performed by the first control chip according to an embodiment of this application; Figure 3 This is a control flowchart of the second control chip in the emergency braking method according to an embodiment of this application; Figure 4 This is a schematic diagram showing that the brake control unit according to an embodiment of this application has two or more connections. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0020] Obviously, the accompanying drawings described below are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar scenarios based on these drawings without any inventive effort. Furthermore, it is understood that although the efforts made in this development process may be complex and lengthy, for those skilled in the art related to the content disclosed in this application, any changes to design, manufacturing, or production based on the technical content disclosed in this application are merely conventional technical means and should not be construed as insufficient disclosure of the content of this application.

[0021] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0022] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms “a,” “an,” “an,” “the,” and similar words used in this application do not indicate quantity limitation and may indicate singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units not listed, or may include other steps or units inherent to these processes, methods, products, or devices. The terms “connected,” “linked,” “coupled,” and similar words used in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following objects are in an "or" relationship. The terms "first," "second," and "third" used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects.

[0023] In rail vehicle braking systems, emergency braking is the most critical safety function. In practical applications, the safety integrity level (SIL4) for emergency braking in rail vehicles is required to be the highest level, as its reliability directly affects whether the train can stop safely and reliably in an emergency. In existing technologies, emergency braking control in rail vehicle braking systems typically uses a single control chip to implement the emergency braking control scheme. The acquisition of emergency braking hard-wired commands and the closed-loop pressure regulation control of emergency braking are both completed by the same control chip, and the emergency braking hard-wired commands usually use a single acquisition circuit. When the acquisition circuit fails, the emergency braking command cannot be confirmed through redundant acquisition circuits, potentially leading to emergency braking failure and making it difficult to meet the SIL4 safety integrity level requirement.

[0024] Firstly, referring to Figure 4 This application provides a braking control system for executing the emergency braking method described in subsequent embodiments. The braking control system includes at least one braking control unit, each of which constitutes an independent BCU (Brake Control Unit). This embodiment uses a single braking control unit as an example, but those skilled in the art will understand that multiple braking control units can be installed throughout the train, and these units are interconnected via a train-level network.

[0025] like Figure 1As shown, each brake control unit includes an air circuit control module and a control circuit module, and the control circuit module and the air circuit control module are connected by electrical signals.

[0026] The pneumatic control module includes an emergency control branch, a normal control branch, and a main pre-control branch. The main air source is filtered and then connected to the input of a pressure reducing valve. The output of the pressure reducing valve is connected to the emergency control branch, the normal control branch, and the main pre-control branch. The outputs of the emergency control branch and the normal control branch are connected to different inputs of the emergency solenoid valve. The output of the emergency solenoid valve is connected to the input of the main pre-control branch. The output of the main pre-control branch is connected to the pre-control terminal of the relay valve. The output of the relay valve is connected to the brake cylinder.

[0027] Furthermore, the emergency control branch is used to output emergency pre-control pressure during emergency braking. The emergency control branch is equipped with an emergency pre-control pressure sensor. Specifically, the emergency control branch includes an emergency inflation solenoid valve, an emergency deflation solenoid valve, and an emergency pre-control pressure sensor. The emergency inflation solenoid valve is configured to inflate when de-energized and maintain pressure when energized; the emergency deflation solenoid valve is configured to maintain pressure when de-energized and deflate when energized. The emergency pre-control pressure sensor is used to collect the emergency pre-control pressure output by the emergency pre-control branch. The truth table of the emergency pre-control branch output is shown in the table below:

[0028] The common control branch is used to output the common pre-control pressure under common braking conditions. The common control branch is equipped with a common pressure sensor. Specifically, the common control branch includes a common inflation solenoid valve, a common deflation solenoid valve, and a common pre-control pressure sensor. The common inflation solenoid valve is configured to inflate when energized and maintain pressure when de-energized; the common deflation solenoid valve is configured to maintain pressure when energized and deflate when de-energized. The common pre-control pressure sensor is used to collect the common pre-control pressure output by the common pre-control branch. The truth table of the common pre-control branch output is shown in the table below:

[0029] It should be noted that simultaneous charging and discharging is an undesirable abnormal operating condition. In the control logic of this application, when the first control chip outputs the solenoid valve drive command, it performs mutual exclusion constraint to prohibit the output of such simultaneous charging and discharging drive combination, thereby avoiding the abnormal operating condition of simultaneous charging and discharging in the gas circuit.

[0030] The main pre-control branch includes an emergency solenoid valve for switching between the emergency control branch and the normal control branch, and a main pre-control pressure sensor. Specifically, the emergency solenoid valve is configured to switch to the emergency pre-control branch when de-energized and to switch to the normal pre-control branch when energized; the main pre-control pressure sensor is used to collect the main pre-control pressure output by the main pre-control branch. The truth table of the emergency valve output is shown in the table below:

[0031] It is understandable that "energized" refers to the solenoid valve coil being powered on, and the solenoid valve switching to the corresponding pneumatic circuit operating state; "de-energized" refers to the solenoid valve coil being de-energized, and the solenoid valve resetting to the default pneumatic circuit state under the action of the internal spring. Based on the above pneumatic circuit design and the solenoid valve control logic configured according to the above truth table, even if the train suddenly loses power while in motion, the emergency solenoid valve de-energizes and switches to the emergency pre-control branch output, and the emergency pre-control branch is in a pneumatic charging state, still ensuring that the braking system outputs emergency braking force to safely stop the train.

[0032] In this application, the control circuit module and the pneumatic control module are connected via electrical signals. The control circuit module includes a first control chip CPU1 and a second control chip CPU2, which are communicatively connected. The first control chip CPU1 is connected to a data acquisition circuit, which is used to acquire the first emergency pre-control pressure signal output by the emergency pre-control pressure sensor, the common pre-control pressure signal output by the common pre-control pressure sensor, and the first total pre-control pressure signal output by the total pre-control pressure sensor. The first control chip CPU1 is also connected to the control terminals of the emergency inflation solenoid valve, the emergency deflation solenoid valve, the common inflation solenoid valve, and the common deflation solenoid valve, for outputting solenoid valve control commands.

[0033] In this application, the second control chip CPU2 is connected to a detection circuit, which is used to acquire the second emergency pre-control pressure signal output by the emergency pre-control pressure sensor and the second total pre-control pressure signal output by the total pre-control pressure sensor. The second control chip CPU2 is also connected to the power supply control terminals of the emergency inflation solenoid valve and the emergency deflation solenoid valve, and is used to cut off the power supply to the solenoid valves in case of an abnormality.

[0034] In some embodiments, the acquisition circuit includes a first acquisition circuit and a second acquisition circuit, which are connected to a first control chip via different pins. The detection circuit in the second control chip includes a first detection circuit and a second detection circuit, which are connected to the second control chip via different pins.

[0035] Specifically, the first and second acquisition circuits adopt a dual-channel heterogeneous design, as do the first and second detection circuits. It is understood that the dual-channel heterogeneous design includes two acquisition or detection circuits powered by independent power supplies, acquiring data from different pins of the same control chip. The acquisition circuit components can be from different manufacturers, and the software for the two acquisition circuits can use different acquisition algorithms. All acquisition algorithms used are those conventionally understood by those skilled in the art.

[0036] Furthermore, CPU1 and CPU2 can employ different processor core architectures and independent clock systems. They transmit information via a dual-redundant communication method with a security checksum. This dual-redundant communication method includes dual-channel SPI communication, dual-channel UART communication, or one SPI and one UART communication. The transmitted information includes: the acquisition results of the first and second acquisition circuits in CPU1, the current load value of the bogie, the life signal for communication between CPU1 and CPU2, and the security checksum (such as a CRC checksum) of the transmitted data.

[0037] This embodiment also provides an emergency braking method, referring to... Figure 1 This system is applied to the brake control unit, which includes a first control chip and a second control chip. The first control chip is responsible for the main pressure regulation control of emergency braking, while the second control chip independently and in parallel completes the emergency braking signal acquisition, pressure monitoring, and hardware power failure fallback protection. The emergency braking trigger signal is synchronously verified by both chips, and the emergency braking pressure regulation process is only initiated when both chips recognize a valid braking command. When the output pressure of the main control pressure regulation is insufficient, the second control chip directly cuts off the power supply to the solenoid valve to achieve hardware forced inflation protection.

[0038] Figure 1 This is a flowchart illustrating an emergency braking method according to an embodiment of this application, as shown below. Figure 1 As shown, the method includes the following steps: Step S100: The second control chip receives the message and life signal transmitted by the first control chip. When the message verification is qualified and the life signal is normal, the first control chip collects the first emergency braking signal and the second control chip collects the second emergency braking signal.

[0039] Specifically, the first control chip CPU1 and the second control chip CPU2 can transmit information using a dual-redundant communication method with a security check code. The dual-redundant communication method includes, but is not limited to, dual-channel SPI communication, dual-channel UART communication, or one SPI and one UART communication. The transmitted information includes: the acquisition results of the first and second acquisition circuits of the emergency braking signal in the emergency braking control circuit, the current load value of the bogie, the life signal communicated between the first and second control chips, and the security check code (such as a CRC check code) of the transmitted data.

[0040] The second control chip, CPU2, receives the message and emergency signal transmitted by CPU1, verifies the security check code in the message, and determines whether the emergency signal is normal. When the message verification is successful and the emergency signal is normal, it indicates that the communication link between CPU1 and CPU2 is reliable and both are in normal working condition. At this time, CPU1 acquires the first emergency braking signal through its acquisition circuit, and CPU2 acquires the second emergency braking signal through its detection circuit.

[0041] For example, to ensure that emergency braking can still be applied when the train is without power, the emergency braking signal is designed to be effective in the event of power failure. The emergency braking signal acquisition circuit collects the train line status of the emergency braking command, including a first acquisition circuit and a second acquisition circuit. To avoid failure of the emergency braking function due to the failure of a single acquisition circuit or a dual-circuit common-cause failure, the first acquisition circuit and the second acquisition circuit adopt a dual-circuit heterogeneous design.

[0042] For example, the first and second acquisition circuits of the emergency braking safety monitoring circuit also adopt a dual-channel heterogeneous design. In addition to meeting the design principles of the emergency braking signal acquisition circuit, the control chip CPU2 of the emergency braking safety monitoring circuit and the control chip CPU1 of the emergency braking control circuit must use different architecture processor cores and independent clock systems.

[0043] It should be noted that the first emergency braking signal and the second emergency braking signal are two independent emergency braking trigger signals. The first emergency braking signal is connected to the acquisition circuit corresponding to the first control chip, and the second emergency braking signal is connected to the acquisition circuit corresponding to the second control chip. The two signals originate from the vehicle's emergency braking hard-wired circuit and are sent to the two control chips for independent sampling. There is no sharing of signals or forwarding of sampled values ​​between chips.

[0044] Step S200: Determine whether the first control chip has acquired a valid emergency braking trigger signal and whether the second control chip has acquired a valid emergency braking trigger signal simultaneously.

[0045] Specifically, the first control chip CPU1 acquires the first emergency braking signal through its first acquisition circuit and second acquisition circuit. When either the first or second acquisition circuit outputs a low level, CPU1 determines that it has acquired a valid emergency braking trigger signal. The second control chip CPU2 acquires the second emergency braking signal through its first and second detection circuits. When either the first or second detection circuit outputs a low level, CPU2 determines that it has acquired a valid emergency braking trigger signal.

[0046] Step S300: If at least one of the first control chip and the second control chip fails to acquire a valid emergency braking trigger signal, then maintain normal power supply to the emergency inflation solenoid valve and the emergency exhaust solenoid valve in the emergency control branch.

[0047] Specifically, when at least one of CPU1 and CPU2 fails to acquire a valid emergency braking trigger signal, it indicates that the emergency braking command has not been synchronously confirmed by the two chips. At this time, the emergency inflation solenoid valve and the emergency exhaust solenoid valve in the emergency control branch are kept powered normally, and the emergency braking pressure regulation control is not executed to avoid accidental triggering of emergency braking.

[0048] Step S400: When both the first control chip and the second control chip acquire a valid emergency braking trigger signal, the first control chip calculates the target pressure value for emergency braking, while the second control chip acquires the measured pressure from the valid pressure sensor.

[0049] Specifically, when both CPU1 and CPU2 acquire a valid emergency braking trigger signal, it indicates that the emergency braking command has been synchronously confirmed by both chips. At this time, CPU1 calculates the target pressure value for emergency braking based on the current bogie load, while CPU2 acquires the measured pressure from the valid pressure sensor.

[0050] In some embodiments, the first control chip calculates the target pressure value based on the current bogie load, including: calculating the target braking force required for the bogie based on the current bogie load; calculating the basic braking pressure based on the target braking force and the basic braking pressure conversion coefficient; and calculating the target pressure value based on the basic braking pressure and the brake shoe clearance pressure conversion coefficient.

[0051] For example, the formula for calculating the target braking force required for this bogie based on the current bogie load is as follows: F = k × M × a Where F is the target braking force in kN; k is the braking level, typically 1.2 m / s² for emergency braking; M is the dynamic load of the bogie in tons (t); and a is the free-run coefficient, the time coefficient between receiving the brake command and actually generating the braking force. The bogie's dynamic load can be collected in real time by load sensors mounted on the bogie to obtain the bogie's real-time dynamic load.

[0052] The formula for calculating the target pressure value is: P = Kf × F + Bf Where P is the target pressure value; Kf is the basic braking pressure conversion coefficient; and Bf is the brake shoe clearance pressure conversion coefficient.

[0053] In some of these embodiments, reference is made to Figure 2 and Figure 3Both the first control chip and the second control chip acquire a valid emergency braking trigger signal, including: the first control chip acquires a first emergency braking signal through a first acquisition circuit and a second acquisition circuit in its acquisition circuit; when the acquisition result of either the first acquisition circuit or the second acquisition circuit is low, it is determined that the first control chip has acquired a valid emergency braking trigger signal; the second control chip acquires a second emergency braking signal through a first detection circuit and a second detection circuit in its detection circuit; when the acquisition result of either the first detection circuit or the second detection circuit is low, it is determined that the second control chip has acquired a valid emergency braking trigger signal.

[0054] It should be noted that the emergency braking hardwire follows a fault, guidance, and safety negative logic. A low level indicates that the hardwire is de-energized, corresponding to a valid emergency braking trigger command; a high level indicates that the hardwire is energized, representing a normal relief state. The first and second acquisition circuits are two independent acquisition channels on the first control chip hardware; the first and second detection circuits are two independent detection channels on the second control chip hardware. The two channels use different hardware pins on the chip, and the hardware paths are isolated from each other; they do not copy the same sampling result in software.

[0055] By configuring two independent hardware acquisition channels with the first and second control chips respectively and using OR logic to judge the emergency braking trigger signal, it is possible to rely on the other channel to normally identify the low-level valid signal of the emergency braking hard line when a single hardware failure such as poor soldering or component damage occurs in a single acquisition channel, thus avoiding missed judgment of emergency braking commands. It also enables independent sampling and verification of the two chips, without relying on the forwarding of acquisition results between chips, reducing the risk of false triggering caused by the failure of a single chip. The multiple hardware redundancy design effectively improves the reliability of emergency braking trigger signal acquisition and adapts to the design requirements of the SIL4 high safety integrity level for emergency braking of rail vehicles.

[0056] In some of these embodiments, reference is made to Figure 3 The second control chip acquires the measured pressure from the effective pressure sensor, including: the second control chip determines whether the total pre-control pressure sensor is normal; if the total pre-control pressure sensor is normal, the total pre-control pressure of the total pre-control pressure sensor is acquired as the measured pressure; if the total pre-control pressure sensor is not normal, the second control chip determines whether the emergency pre-control pressure sensor is normal; if the emergency pre-control pressure sensor is normal, the emergency pre-control pressure of the emergency pre-control pressure sensor is acquired as the measured pressure.

[0057] It should be noted that the second control chip has an independent diagnostic logic for the fault diagnosis of the pressure sensor, which is independent of the sensor fault diagnosis of the first control chip. The second control chip directly reads the sensor output signal through the detection circuit and does not directly reuse the pressure sampling results transmitted from the first control chip, so as to avoid the monitoring side also receiving incorrect pressure data when the first control chip malfunctions.

[0058] The criteria for determining whether a sensor is functioning properly include, but are not limited to, at least one of the following: sensor signal disconnection, short circuit, signal exceeding reasonable physical range, and signal jump rate exceeding allowable range. If any one of these criteria is met, the sensor is determined to be malfunctioning.

[0059] Specifically, the second control chip judges the acquisition results of its first acquisition circuit and second acquisition circuit. If either acquisition result is low, it represents a valid emergency braking trigger signal and enters the pressure verification stage; if neither acquisition result is low, it does not enter the subsequent pressure judgment process.

[0060] After entering the pressure verification stage, the second control chip first diagnoses whether the total pre-control pressure sensor is normal: if the total pre-control pressure sensor is normal, the total pre-control pressure collected by the total pre-control pressure sensor is selected as the measured pressure for subsequent pressure comparison; if the total pre-control pressure sensor is abnormal, it further determines whether the emergency pre-control pressure sensor is normal; if the emergency pre-control pressure sensor is normal, the emergency pre-control pressure collected by the emergency pre-control pressure sensor is selected as the measured pressure; if the emergency pre-control pressure sensor is also abnormal, there is no valid pressure data source, and pressure comparison judgment is no longer performed.

[0061] When both the main pre-control pressure sensor and the emergency pre-control pressure sensor are determined to be abnormal, the second control chip cannot obtain a reliable measured pressure. At this time, the comparison between the pressure and the pressure target value is not performed. The normal power supply to the emergency inflation solenoid valve and the emergency exhaust solenoid valve is maintained, and the internal multi-level degraded pressure regulation logic is handed over to the first control chip.

[0062] Step S500: Determine whether the measured pressure is less than the pressure target value. If the measured pressure is less than the pressure target value, the second control chip controls the power supply to cut off the emergency inflation solenoid valve and the emergency deflation solenoid valve, so that the emergency control branch enters the forced inflation state. If the measured pressure is not less than the pressure target value, the first control chip executes emergency braking pressure regulation control.

[0063] Specifically, refer to Figure 3CPU2 compares the measured pressure collected with the target pressure value calculated by CPU1. If the measured pressure is less than the target pressure value, it indicates that the current emergency braking pressure is insufficient. At this time, CPU2 controls the power supply to cut off the emergency inflation solenoid valve and the emergency deflation solenoid valve. Since the emergency inflation solenoid valve is configured to inflate when de-energized and maintain pressure when energized, and the emergency deflation solenoid valve is configured to maintain pressure when de-energized and deflate when energized, cutting off the power supply causes the emergency inflation solenoid valve to de-energize and maintain pressure, putting the emergency control branch into a forced inflation state to ensure that the emergency braking pressure rises and emergency braking force is applied. If the measured pressure is not less than the target pressure value, it indicates that the current emergency braking pressure meets the requirements. At this time, CPU1 executes emergency braking pressure regulation control.

[0064] In some of these embodiments, reference is made to Figure 2 The first control chip performs emergency braking pressure regulation control, including: the first control chip determining whether the emergency pre-control pressure sensor, emergency inflation solenoid valve, and emergency exhaust solenoid valve are all fault-free; if all are fault-free, the first control chip adjusts the pressure value output by the emergency control branch to the pressure target value based on the deviation between the pressure target value and the pressure value collected by the emergency pre-control pressure sensor; if any one of the emergency pre-control pressure sensor, emergency inflation solenoid valve, and emergency exhaust solenoid valve malfunctions, the first control chip determines whether the main pre-control pressure sensor, emergency inflation solenoid valve, and emergency exhaust solenoid valve are all fault-free; if all of the main pre-control pressure sensor, emergency inflation solenoid valve, and emergency exhaust solenoid valve are fault-free, the first control chip adjusts the pressure value output by the main pre-control branch to the pressure target value based on the deviation between the pressure target value and the pressure value collected by the main pre-control pressure sensor; if any one of the main pre-control pressure sensor, emergency inflation solenoid valve, and emergency exhaust solenoid valve malfunctions, the first control chip controls the emergency inflation solenoid valve and emergency exhaust solenoid valve to perform inflation, so that the emergency control branch outputs an inflation state, applying emergency braking force.

[0065] It should be noted that the fault diagnosis logic of the first control chip is a graded and degraded voltage regulation strategy, which prioritizes the use of the emergency control branch for closed-loop pressure regulation. When there is a fault in the relevant device of the emergency control branch, it switches to the main pre-control branch as a backup closed-loop voltage regulation path. If both of the above closed-loop voltage regulation paths are unavailable, it enters the fixed inflation open-loop hard braking mode to forcibly apply emergency braking force, which meets the fault-oriented safety design principle.

[0066] During the closed-loop pressure regulation phase, the first control chip uses PID control to regulate the on / off duty cycle of the emergency inflation solenoid valve and the emergency deflation solenoid valve based on the pressure deviation, achieving dynamic tracking of the target pressure value. In open-loop inflation mode, it continuously drives the emergency inflation solenoid valve to open when energized and the emergency deflation solenoid valve to close when de-energized, continuously supplying air to the gas path to ensure reliable output of emergency braking force. Device faults are independently detected by the first control chip, based on sensor signals and solenoid valve drive feedback signals.

[0067] In some of these embodiments, reference is made to Figure 2 Based on the deviation between the pressure target value and the pressure value collected by the emergency pre-control pressure sensor, adjusting the pressure value output by the emergency control branch to the pressure target value includes: the first control chip comparing the pressure target value with the pressure value collected by the emergency pre-control pressure sensor; when the pressure value collected by the emergency pre-control pressure sensor is less than the pressure target value, the first control chip controls the emergency inflation solenoid valve to be energized or de-energized, causing the emergency control branch to inflate until the deviation between the pressure value collected by the emergency pre-control pressure sensor and the pressure target value is within a preset range; when the pressure value collected by the emergency pre-control pressure sensor is greater than the pressure target value, the first control chip controls the emergency exhaust solenoid valve to be energized or de-energized, causing the emergency control branch to exhaust until the deviation between the pressure value collected by the emergency pre-control pressure sensor and the pressure target value is within a preset range.

[0068] It should be noted that the preset range here is the allowable pressure control deviation range, which can be set to ±10kPa for example. This value is only for example and is not intended to limit the protection range. The first control chip uses the real-time pressure feedback from the emergency pre-control pressure sensor as the basis for closed-loop adjustment. Based on the pressure deviation, it controls the on / off state of the emergency inflation solenoid valve and the emergency deflation solenoid valve to complete the inflation and deflation actions. When the measured pressure falls within the preset deviation range, the inflation and deflation operations stop and the system enters a pressure holding state. This setting enables closed-loop precise adjustment of the pre-control pressure of the emergency control branch, allowing the actual output pressure to dynamically change with the pressure target value calculated by the load. This avoids excessive pressure causing wheel lock-up or insufficient pressure causing insufficient braking force, ensuring the control accuracy of the emergency braking output pressure and adapting to the braking requirements of the bogie under different passenger-carrying conditions.

[0069] In some embodiments, adjusting the pressure value output by the total pre-control branch to the pressure target value based on the deviation between the target pressure value and the pressure value collected by the total pre-control pressure sensor includes: The first control chip compares the target pressure value with the pressure value collected by the total pre-control pressure sensor; When the pressure value collected by the main pre-control pressure sensor is less than the pressure target value, the first control chip controls the emergency inflation solenoid valve to be energized or de-energized, so that the main pre-control branch is inflated until the deviation between the pressure value collected by the main pre-control pressure sensor and the pressure target value is within the preset range. When the pressure value collected by the main pre-control pressure sensor is greater than the pressure target value, the first control chip controls the emergency exhaust solenoid valve to be energized or de-energized, so that the main pre-control branch exhausts air until the deviation between the pressure value collected by the main pre-control pressure sensor and the pressure target value is within the preset range.

[0070] Specifically, refer to Figure 2 This step is the backup closed-loop pressure regulation logic after an emergency pre-control branch failure. The preset pressure deviation range is exemplarily ±10 kPa, and is for illustrative purposes only, not constituting a limitation on the protection range. When the emergency pre-control pressure sensor fails and cannot serve as a feedback source, the pressure feedback is switched to the main pre-control pressure sensor. The first control chip drives the emergency inflation solenoid valve and emergency deflation solenoid valve to perform inflation or deflation actions based on the deviation between the main pre-control pressure and the target pressure value. When the measured pressure falls within the preset deviation range, inflation and deflation stop, maintaining a pressure-holding state. With this setting, even when the pressure acquisition path of the emergency pre-control branch fails, the main pre-control branch can still be relied upon to complete closed-loop pressure regulation, ensuring the accuracy of emergency braking pressure control and achieving degraded closed-loop control under fault conditions. It avoids directly entering the open-loop mode of forced inflation, balancing the safety of braking control and the performance of pressure regulation control.

[0071] In some of these embodiments, reference is made to Figure 4 The braking method further includes: when there are two or more braking control units, the braking control unit sends its emergency braking application status information to other braking control units in the train through the train-level network; when the target braking control unit receives the status information that any other braking control unit in the train has applied emergency braking, and the target braking control unit has not collected a valid emergency braking trigger signal, the first control chip in the target braking control unit applies braking force through the common control branch; wherein, the judgment condition for the emergency braking application status information is: both the first control chip and the second control chip have collected a valid emergency braking trigger signal, and the measured pressure of the sensor is greater than the set pressure value.

[0072] Specifically, to further improve the reliability of the emergency braking function and ensure that emergency braking can still be applied under abnormal conditions, at the train-level control level, all BCUs in the train transmit their emergency braking application status information through the train-level network. The judgment condition for emergency braking application status information is: the first control chip and the second control chip detect that the emergency braking hardwire is de-energized and the applied braking force is greater than a certain value, such as 100 kPa, then it is considered that emergency braking has been applied. When each BCU receives the status information that any BCU in the train has applied emergency braking, even if a BCU fails to detect the emergency braking command due to an abnormal fault, it controls the service braking pre-control branch according to the truth table output by the service pre-control branch to control the service inflation and deflation solenoid valves, apply the backup redundant emergency braking force, and bring the train to a safe stop. In other words, the first control chip inside the target braking control unit drives the service inflation and deflation solenoid valves to operate according to the truth table output by the service pre-control branch, establishes pre-control pressure, and outputs the backup redundant braking force.

[0073] Thus, through the train-level emergency braking interlocking control strategy, once an emergency brake is applied to any single valve, even if no emergency braking command is received by the other frames in the train, the other frames in the train will apply emergency braking force through the backup of the commonly used pre-control branch, ensuring that the train can still apply emergency braking to stop safely in abnormal situations.

[0074] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0075] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An emergency braking method, characterized in that, Applied to a brake control unit, the brake control unit includes a first control chip and a second control chip, and the control method includes: The second control chip receives the message and life signal transmitted by the first control chip. When the message is verified and the life signal is normal, the first control chip collects the first emergency braking signal and the second control chip collects the second emergency braking signal. Determine whether the first control chip has acquired a valid emergency braking trigger signal, and whether the second control chip has simultaneously acquired a valid emergency braking trigger signal; If at least one of the first control chip and the second control chip fails to acquire a valid emergency braking trigger signal, the emergency inflation solenoid valve and the emergency deflation solenoid valve in the emergency control branch shall be kept powered normally. When both the first control chip and the second control chip acquire a valid emergency braking trigger signal, the first control chip calculates the target pressure value for emergency braking, while the second control chip acquires the measured pressure from the valid pressure sensor. The system determines whether the measured pressure is less than the target pressure value. If the measured pressure is less than the target pressure value, the second control chip controls the power supply to the emergency inflation solenoid valve and the emergency deflation solenoid valve to cut off the power supply, so that the emergency control branch enters the forced inflation state. If the measured pressure is not less than the target pressure value, the first control chip performs emergency braking pressure regulation control.

2. The braking method according to claim 1, characterized in that, The braking method further includes: When there are two or more brake control units, the brake control unit sends the emergency braking application status information of its own brake control unit to other brake control units in the whole train through the train-level network; When the target braking control unit receives information that any other braking control unit in the entire train has applied emergency braking, and the target braking control unit has not collected a valid emergency braking trigger signal, the first control chip in the target braking control unit applies braking force through the common control branch. The condition for determining the emergency braking application status information is as follows: both the first control chip and the second control chip have acquired a valid emergency braking trigger signal, and the actual measured pressure of the sensor is greater than the set pressure value.

3. The braking method according to claim 1, characterized in that, The first control chip performs emergency braking voltage regulation control, including: The first control chip determines whether the emergency pre-control pressure sensor, the emergency inflation solenoid valve, and the emergency exhaust solenoid valve are all fault-free; If there are no faults, the first control chip adjusts the pressure value output by the emergency control branch to the target pressure value based on the deviation between the target pressure value and the pressure value collected by the emergency pre-control pressure sensor. If any one of the emergency pre-control pressure sensor, the emergency inflation solenoid valve, and the emergency exhaust solenoid valve malfunctions, the first control chip determines whether the total pre-control pressure sensor, the emergency inflation solenoid valve, and the emergency exhaust solenoid valve are all functioning correctly. When the total pre-control pressure sensor, the emergency inflation solenoid valve, and the emergency deflation solenoid valve are all functioning properly, the first control chip adjusts the pressure value output by the total pre-control branch to the target pressure value based on the deviation between the target pressure value and the pressure value collected by the total pre-control pressure sensor. If any one of the main pre-control pressure sensor, the emergency inflation solenoid valve, and the emergency deflation solenoid valve malfunctions, the first control chip controls the emergency inflation solenoid valve and the emergency deflation solenoid valve to perform inflation, causing the emergency control branch to output an inflation state and apply emergency braking force.

4. The braking method according to claim 3, characterized in that, Based on the deviation between the target pressure value and the pressure value collected by the emergency pre-control pressure sensor, the pressure value output by the emergency control branch is adjusted to the target pressure value, including: The first control chip compares the target pressure value with the pressure value collected by the emergency pre-control pressure sensor; When the pressure value collected by the emergency pre-control pressure sensor is less than the pressure target value, the first control chip controls the emergency inflation solenoid valve to be energized or de-energized, so that the emergency control branch is inflated until the deviation between the pressure value collected by the emergency pre-control pressure sensor and the pressure target value is within a preset range. When the pressure value collected by the emergency pre-control pressure sensor is greater than the pressure target value, the first control chip controls the emergency exhaust solenoid valve to be energized or de-energized, so that the emergency control branch exhausts air until the deviation between the pressure value collected by the emergency pre-control pressure sensor and the pressure target value is within a preset range.

5. The braking method according to claim 3, characterized in that, Based on the deviation between the target pressure value and the pressure value collected by the total pre-control pressure sensor, the pressure value output by the total pre-control branch is adjusted to the target pressure value, including: The first control chip compares the target pressure value with the pressure value collected by the total pre-control pressure sensor; When the pressure value collected by the total pre-control pressure sensor is less than the pressure target value, the first control chip controls the emergency inflation solenoid valve to be energized or de-energized, so that the total pre-control branch is inflated until the deviation between the pressure value collected by the total pre-control pressure sensor and the pressure target value is within a preset range. When the pressure value collected by the total pre-control pressure sensor is greater than the pressure target value, the first control chip controls the emergency exhaust solenoid valve to be energized or de-energized, so that the total pre-control branch exhausts air until the deviation between the pressure value collected by the total pre-control pressure sensor and the pressure target value is within a preset range.

6. The braking method according to claim 1, characterized in that, The first control chip calculates the target pressure value based on the current bogie load, including: Calculate the target braking force required for this bogie based on the current bogie load; The base braking pressure is calculated based on the target braking force and the base braking pressure conversion coefficient. The target pressure value is calculated based on the conversion coefficient between the basic braking pressure and the brake shoe clearance pressure.

7. The braking method according to claim 1, characterized in that, The second control chip acquires the measured pressure from the effective pressure sensor, including: The second control chip determines whether the total pre-control pressure sensor is functioning properly; If the total pre-control pressure sensor is normal, the total pre-control pressure of the total pre-control pressure sensor is collected as the measured pressure; If the total pre-control pressure sensor is malfunctioning, then it is determined whether the emergency pre-control pressure sensor is malfunctioning. If the emergency pre-control pressure sensor is malfunctioning, then the emergency pre-control pressure of the emergency pre-control pressure sensor is collected as the measured pressure.

8. The braking method according to claim 1, characterized in that, Both the first control chip and the second control chip acquired a valid emergency braking trigger signal, including: The first control chip acquires the first emergency braking signal through the first acquisition circuit and the second acquisition circuit in its acquisition circuit, respectively. If the acquisition result of either the first acquisition circuit or the second acquisition circuit is low, it is determined that the first control chip has acquired a valid emergency braking trigger signal. The second control chip acquires the second emergency braking signal through the first detection circuit and the second detection circuit in its detection circuit, respectively; If the acquisition result of either the first detection circuit or the second detection circuit is low, it is determined that the second control chip has acquired a valid emergency braking trigger signal.

9. A braking control system, characterized in that, For performing the braking method according to any one of claims 1-8, the braking control system includes at least one braking control unit; Each of the brake control units includes an air circuit control module and a control circuit module, and the control circuit module is electrically connected to the air circuit control module. The gas circuit control module includes an emergency control branch, a normal control branch, and a main pre-control branch; The emergency control branch is used to output emergency pre-control pressure under emergency braking conditions, and the emergency control branch is equipped with an emergency pre-control pressure sensor. The common control branch is used to output the common pre-control pressure under common braking conditions, and the common control branch is equipped with a common pressure sensor; The main pre-control branch includes an emergency solenoid valve and a main pre-control pressure sensor for switching between the emergency control branch and the normal control branch; The control circuit module includes a first control chip and a second control chip, and the first control chip and the second control chip are communicatively connected. The first control chip is connected to a data acquisition circuit, which is used to acquire the first emergency pre-control pressure signal output by the emergency pre-control pressure sensor, the common pre-control pressure signal output by the common pre-control pressure sensor, and the first total pre-control pressure signal output by the total pre-control pressure sensor. The second control chip is connected to a detection circuit, which is used to acquire the second emergency pre-control pressure signal output by the emergency pre-control pressure sensor and the second total pre-control pressure signal output by the total pre-control pressure sensor.

10. The braking control system according to claim 9, characterized in that, The acquisition circuit includes a first acquisition circuit and a second acquisition circuit, and the first acquisition circuit and the second acquisition circuit are connected to the first control chip through different pins; The detection circuit in the second control chip includes a first detection circuit and a second detection circuit, which are connected to the second control chip through different pins.

Images