METHOD FOR PREVENTING THE DEACTIVATION OF AN UNLAWFUL NUMBER OF SIMILAR COMPONENTS OF A RAIL VEHICLE

Description

Technical area

[0001] The invention relates to a method for preventing the deactivation of an inadmissible number of similar components of a rail vehicle, as well as a corresponding control device. State of the art

[0002] Rail vehicles, particularly passenger rail vehicles, are equipped with a large number of components, whereby some types of components are similar and provided in multiples. For example, passenger entrances are typically designed in the same way and each have the same door drives, gap bridging devices, door controls, etc. Other similar components can be, for example, bogies which are equipped with similarly constructed drives or braking systems. In the event of a fault, if an individual component, e.g. a specific door drive, is defective, the component can be put out of operation and, for example, the affected door can be locked in the closed position. This is typically done manually by the driver. In fully automatic, driverless operation, this is not possible, so remote-controlled blocking of individual doors is provided.However, only a maximum number of doors on a train may be blocked, otherwise the evacuation of passengers in an emergency would be hindered.

[0003] Country- or operator-specific approval regulations specify the maximum number of simultaneously blocked doors that may not be exceeded during passenger operation. In staffed operation, this is not a problem, as the train crew is permitted to continue the journey with passengers if several doors fail. In fully automated operation, a defect in the vehicle control system could exceed this maximum number of simultaneously blocked doors and even block all doors of a train. If this cannot be rectified remotely, in extreme cases the door cannot be opened without causing damage, as passengers cannot open it from the inside, and there are no opening devices available from the outside.In particular, state-of-the-art solutions do not provide for checking the legitimacy of door-locking commands sent by a faulty vehicle control system and preventing their execution in the event of an error. It should also be noted that data communication between a vehicle control system and the door control systems takes place without any special data security or encryption measures; incorrectly sent data telegrams that nevertheless have the correct data format are recognized as valid. Similar cases can occur with other components, such as braking systems, so it is essential to prevent an impermissible number of components from being deactivated. Even with drives, only a certain number of drives on a multiple unit can be deactivated; otherwise, the possible acceleration will no longer reach the required minimum or gradients may no longer be negotiable.

[0004] The document WO 2007 014 735 A1 describes a method for deactivating defective doors of a rail vehicle. Description of the invention

[0005] The invention is therefore based on the object of being able to prevent the simultaneous deactivation of an inadmissible number of similar components of a rail vehicle.

[0006] The object is achieved by a method for preventing the deactivation of an inadmissible number of similar components in a rail vehicle having the features of claim 1 and a control device according to claim 5. Advantageous embodiments are the subject of subordinate claims.

[0007] According to the basic idea of ​​the invention, a method is described which is carried out in a control unit and which comprises the following method steps: Receiving a deactivation command, incrementing a counter if the deactivation command is addressed to another control unit, comparing the counter reading with a maximum value, ignoring the deactivation command if the counter reading corresponds to the maximum value, executing the deactivation command if the counter reading is less than the maximum value.

[0008] This has the advantage that no more than the maximum number of components can be blocked at any one time. A faulty vehicle control system that exceeds this maximum number and sends deactivation commands to more than this maximum number of control units cannot cause more than a predetermined number of components to be deactivated simultaneously. This ensures that even in the event of a malfunction in a vehicle control system, enough components remain in operation to ensure safe operation (e.g., by ensuring the possibility of evacuating passengers). For example, when deactivating passenger compartment doors, the maximum number of passenger compartment doors that can be locked simultaneously on a subway train with 18 passenger entrances can be 2.

[0009] According to the invention, all similar components of a rail vehicle or train assembly (e.g., a subway train) affected by the method are to be equipped with a control unit that executes the method according to the invention. This ensures that every deactivation command sent by a vehicle control system is registered in each control unit, even if the respective control unit is not affected by the deactivation command, i.e., the deactivation command is addressed to another control unit. Thus, the current number of deactivated similar components of the rail vehicle or train assembly is stored in each control unit at any time.

[0010] If another deactivation command is received, the affected control unit compares the current number of deactivated similar components stored in it and rejects the deactivation command if the current number of deactivated components equals the maximum number of components allowed to be deactivated simultaneously. If the current number of deactivated components is less than the maximum number of components allowed to be deactivated simultaneously, the affected control unit executes the blocking command.

[0011] If, in addition to the vehicle control system, one of the control units also becomes defective and does not carry out the method according to the invention or carries it out incorrectly, while still allowing deactivation of the associated component, in this very unlikely double fault case only one further component can be blocked, but under no circumstances all of the entire vehicle or train.

[0012] In further development of the procedure, it is recommended to provide an additional process step in which each control unit reports its respective status, i.e. whether the assigned component is activated or deactivated, to the vehicle control system. Brief description of the drawings

[0013] Examples include: Fig.1 Rail vehicle. Fig.2 Flow chart. Fig.3 Door control unit, block diagram. Implementation of the invention

[0014] In the following, the method according to the invention is illustrated using the example of its use on door controls of a passenger vehicle.

[0015] Fig.1shows an example and schematically a rail vehicle. It is shown in a highly abstract manner a passenger rail vehicle with similar components (passenger compartment doors) A, B, C, D, which are each equipped with a door drive and an associated control unit (door control unit) 2, 3, 4, 5. The design of the passenger compartment doors A, B, C, D is irrelevant; they can be any type commonly used in passenger vehicles, for example, double-leaf swing-sliding doors. The rail vehicle 1 comprises a vehicle control 6, which performs higher-level control tasks and is connected to the door controls 2, 3, 4, 5 via a data bus 7 and can transmit commands to the door controls 2, 3, 4, 5. The embodiment shown represents one carriage of a train set, but the vehicle control 6 can also be provided for an entire train set.This is particularly advantageous for train sets that are not separated during operation, for example on subways.

[0016] Fig.2shows, by way of example and schematically, a flow diagram of the method according to the invention as it is carried out in each of the control units (door control units) 2, 3, 4, 5. Each door control unit 2, 3, 4, 5 has its own identification number (ID), via which it can be uniquely addressed via the data bus 7. In a first method step 8, a blocking command is received by a door control unit. In a further method step 9, the identification number (ID) sent with the deactivation command is compared with that of the respective door control unit. If the door control unit is not addressed by this identification number, it increments a counter variable. Further method steps are not carried out, and the method continues from its starting point.If in method step 9, in which the identification number (ID) sent with the block command is compared with that of the respective door control unit, it is determined that the identification numbers are identical, i.e. the respective door control unit has been addressed by the vehicle control unit 6, the method continues. In a further method step 11, the counting variable is read out and compared with a specific value, the maximum number of simultaneously blocked doors. If both values ​​are the same, then the maximum permissible number of doors has already been blocked, and in a further method step 12 the blocking command is ignored and the affected door control unit leaves the door in its existing status. If the maximum number of simultaneously blocked doors has not yet been reached, i.e. the value of the counting variable is less than this maximum value, the blocking command is executed by the affected door control unit in a method step 13.

[0017] A reset, i.e., re-enabling the blocking of a door by the vehicle control system 6, can be provided. However, it is highly recommended that this be performed exclusively in a maintenance facility and never during passenger-occupied operation. This prevents the erroneous unblocking of faulty doors, which could potentially cause these doors to open during travel. Likewise, a reset of the counter variable to its default state, in which it is assigned the value zero, should preferably be performed in a maintenance facility. This is not a disadvantage, since extended driving with defective and thus blocked doors is not possible anyway, and maintenance is unavoidable.

[0018] Fig.3shows an exemplary and schematic block diagram of a control unit (door control unit). It shows a door control unit 2, which is identical in construction and used in all doors A, B, C, and D of a rail vehicle 1.

[0019] The door control unit 2 comprises a data interface 14 for data communication via a data bus 7. This data interface 14 is designed such that any communication via the data bus 7 can be detected via it, even if a specific data telegram is addressed to another door control unit. The door control unit 2 also comprises a computing means 15, for example a microprocessor, which carries out the method steps. Connected to this computing means 15 is a data memory 17 in which the counting variable and, if applicable, other data can be stored. Furthermore, the door control unit 2 comprises a control interface 16, which transmits the control commands 18 determined by the computing means 15 to other components of a passenger compartment door, for example a door drive. List of names

[0020] 1Rail vehicle 2Control unit of the 1st passenger compartment door 3Control unit of the 2nd passenger compartment door 4Control unit of the 3rd passenger compartment door 5Control unit of the 4th passenger compartment door 6Vehicle control 7Data bus 8Procedure step: Command reception 9Procedure step: Address check 10Procedure step: Increment counter variable 11Procedure step: Check counter variable 12Procedure step: Ignore blocking command 13Procedure step: Execute blocking command 14Data interface 15Calculation device 16Control interface 17Data memory 18Control output A1. Component B2. Component C3. Component D4. Component

Claims

1. Method for preventing the deactivation of an impermissible number of components (A, B, C, D) of a rail vehicle (1) of the same type with a plurality of components (A, B, C, D) of the same type, which are each equipped with an assigned control device (2, 3, 4, 5), with which the components (A, B, C, D) can be deactivated by a deactivation command (8), and wherein a vehicle controller (6) of the rail vehicle (1) is designed to transmit deactivation commands to the control devices (2, 3, 4, 5), wherein the method is executed by computing means (15) in each control device (2, 3, 4, 5) comprising a counter, having the following method steps: - receiving a deactivation command (8), - incrementing (10) a counter when the deactivation command is addressed to another control device, - comparing the state of the counter with a maximum value (11), - ignoring the deactivation command (12) when the counter state corresponds to the maximum value, - executing the deactivation command (13) when the counter state is smaller than the maximum value.

2. Method according to claim 1, wherein the components (A, B, C, D) are embodied as passenger compartment doors and the control devices (2, 3, 4, 5) are embodied as door control devices.

3. Method according to claim 1, wherein the components (A, B, C, D) are embodied as drives and the control devices (2, 3, 4, 5) are embodied as drive control devices.

4. Method according to claim 1, wherein the components (A, B, C, D) are embodied as brakes and the control devices (2, 3, 4, 5) are embodied as brake control devices.

5. Control device (2, 3, 4, 5) for a component (A, B, C, D) of a rail vehicle (1), comprising an interface for data communication (14), computing means (15), data memory (17) and a control interface (16), characterised in that the computing means (15) is designed to execute a method according to claim 1.