METHOD FOR ENSURING THE STOPPEDING OF A RAIL VEHICLE

Description

[0001] The invention relates to a method for ensuring the standstill of a rail vehicle, in particular a safety-oriented assurance of the standstill of the rail vehicle.

[0002] In the operation of rail vehicles, it must be ensured that they move exclusively on the basis of a corresponding driving command.

[0003] This driving command is initiated by the train driver, and the functionality of this command is classified as highly safety-critical. This is because an unjustified movement of the train could endanger people.

[0004] The issued movement command is implemented in the rail vehicle by software of the onboard electronic control system. Accordingly, it must be ensured that software errors do not lead to unauthorized movement of the rail vehicle via the control system. Therefore, the control system that implements the movement command is also classified as highly safety-critical.

[0005] Both the development and implementation of the control system, including the associated software, must be carried out with a corresponding focus on safety. This means that the system must be implemented in a way that... where both hardware and firmware are tested according to a series of standards, where a development cycle or life cycle includes verifications and validations, where a program that is as simple as possible and therefore robust with regard to faults is developed and used via modular and structured programming, where functional testing is provided during commissioning and operation, and / or where suitable testing activities are provided after changes, etc.

[0006] Furthermore, as an additional safety measure, it is assumed that in the event of a malfunction, the train driver will bring the rail vehicle to a safe standstill by activating an emergency stop switch or an emergency stop button.

[0007] This safety measure is no longer applicable once the train driver leaves the train. In this case, the train driver must manually ensure that the train is "decommissioned," meaning that at least one high-voltage piece of equipment is switched off.

[0008] For a planned "autonomous operation" of the rail vehicle, which is carried out without a train driver, no suitable procedure is known to ensure the safety-oriented standstill of the rail vehicle.

[0009] From publication DE 10 2008 007 940 A1, a safety device (10) for an electrically controlled parking brake (12) of a vehicle (14) is known. With the aid of a control unit, rolling away of a parked vehicle with the ignition (30) switched off is detected.

[0010] From publication EP 2 511 146 B1, a device with a pneumatic module is known that monitors the air pressure of a brake system by means of pressure sensors. A control module controls one or more brake systems, and the control module receives position data from a vehicle. The brake system consists of a compressed air brake and a spring-applied brake. The pneumatic module includes pressure sensors for detecting the pressure of the brake systems and the pressure of a main air line.

[0011] The object of the present invention is to provide a method for ensuring the safety-oriented standstill of a rail vehicle operating autonomously.

[0012] This problem is solved by the features of claim 1. Advantageous further developments are specified in the dependent claims.

[0013] In the inventive method for ensuring the standstill of a rail vehicle, the rail vehicle uses a vehicle control system with electronic control technology to implement driving commands and standstill commands in the rail vehicle.

[0014] In addition, a monitoring instance independent of the control system is used, which detects a movement of the rail vehicle, compares the detected movement with a valid driving command of the vehicle control system and, in the event of a deviation, initiates braking independently of the control system (and thus independently of the valid driving command) in order to bring the rail vehicle to a standstill.

[0015] Alternatively, in the event of a deviation, a drive system of the rail vehicle is also deactivated, whereby this deactivation also takes place independently of the control technology.

[0016] In an advantageous further development, the vehicle control, the control technology and the monitoring instance are implemented in the rail vehicle or are operated in an integrated manner within the rail vehicle.

[0017] According to the invention, the rail vehicle is operated autonomously and without the intervention of a train driver.

[0018] According to the invention, the driving commands and stop commands in the rail vehicle are given by a land-based operations control center or operations control point.

[0019] In an advantageous further development, the land-based operations control center transmits the driving command to the rail vehicle via a secure radio connection and / or with the help of secure data transmission.

[0020] In an advantageous further development, if the driving command is missing and movement of the rail vehicle is detected at the same time, the monitoring instance deactivates the drive of the rail vehicle independently of the control technology and also initiates the braking of the rail vehicle independently of the control technology.

[0021] In an advantageous further development, to bring the vehicle to a standstill by bypassing the electronic control system, a direct intervention is made in the drive and braking systems of the rail vehicle.

[0022] In an advantageous further development, to bring the train to a standstill by bypassing the electronic control system, a direct intervention is made in a main power supply of the rail vehicle in order to switch it off.

[0023] In an advantageous further training process, information about the detected movement, along with a position indication of the rail vehicle, is transmitted to the land-based operations control center.

[0024] In an advantageous further training course, the position information is determined satellite-based on the rail vehicle.

[0025] In an advantageous further development, the land-based operations control center of the rail vehicle initiates the drive shutdown and braking as soon as an unjustified movement of the rail vehicle is detected.

[0026] According to the invention, sensors are used for motion detection which are arranged on at least one axle of the rail vehicle, wherein the sensors are operated electrically independently of the vehicle control system.

[0027] According to the invention, a sensor is used that detects a building-up pulling force on a bogie axle of the rail vehicle.

[0028] In a preferred advanced training, the rail vehicle is operated autonomously, whereby a predetermined or stored timetable is processed fully automatically, on the basis of which corresponding applicable driving commands are generated.

[0029] The method according to the invention enables normal operation of a rail vehicle and autonomous operation of the rail vehicle, which takes place without the involvement of a train driver.

[0030] The method according to the invention makes it possible to dispense with monitoring the standstill of a dismantled rail vehicle.

[0031] The method according to the invention can be carried out without the involvement of trackside equipment.

[0032] The method according to the invention can be integrated into a rail vehicle with minimal effort. Rail vehicles already in operation can be easily retrofitted.

[0033] The method according to the invention can be easily integrated without having to fundamentally change the existing control technology of the rail vehicle.

[0034] The method according to the invention advantageously uses a secure data connection, such as that described, for example, in the description of the patent application with the application number DE 10 2022 206 426.7, filed on 27.06.2022.

[0035] The invention is explained in more detail below with the aid of a drawing. The drawing shows: FIG 1 a basic overview of the method according to the invention, FIG 2 with reference to FIG 1 a more detailed, exemplary description of motion detection using the in FIG 1 Unit 3.1 shown, and FIG 3 with reference to FIG 1 and FIG 2 An overview provides details on the independent shutdown of the drive and the triggering of the braking process.

[0036] FIG 1shows a basic overview of the method according to the invention in a block diagram.

[0037] The term "unit" is used below. This term refers to a functionality that is ensured through assemblies, components, etc.

[0038] The method according to the invention uses a command unit 1.1 with which a driving command FB for starting the rail vehicle can be generated.

[0039] The absence of the driving command FB is interpreted as a driving ban for the rail vehicle, which must then come to a standstill.

[0040] For example, a land-based operations control center is used as command unit 1.1, which transmits the driving command FB to the rail vehicle via a secure radio connection or with the help of secure data transmission.

[0041] Alternatively, a command unit 1.1 is used, which is installed and operated locally on the rail vehicle.

[0042] In a preferred advanced training, during autonomous operation of the rail vehicle with the participation of the command unit 1.1, a predetermined or stored timetable is processed fully automatically, on the basis of which a valid driving command is generated.

[0043] The driving command FB is transmitted from the command unit 1.1 to a (regular, previously known) control system or vehicle control system 2.1, which processes the driving command FB according to its specification and controls the drive and braking equipment of the rail vehicle via a unit 2.2.

[0044] In parallel, a monitoring authority UÜW, independent of the driving command FB, is provided.

[0045] This unit is designed to be self-contained and is capable of detecting any movement of the rail vehicle, even a movement that is just beginning, comparing the detected movement with the applicable driving command FB, and in the event of a deviation, independently of the control technology (and thus independently of the applicable driving command FB), deactivating the drive of the rail vehicle or initiating braking of the rail vehicle via unit 2.2.

[0046] The independent monitoring authority UÜW uses a Unit 3.1 for motion detection, the motion detection of which is described in more detail below.

[0047] The independent monitoring authority UÜW uses a unit 3.2 following unit 3.1, with which the detected movement is compared with the applicable driving command FB.

[0048] A deviation is detected as an error by unit 3.2, which accordingly initiates a shutdown of the drive and a braking of the rail vehicle independent of the control system via unit 2.2.

[0049] This is preferably achieved by unit 3.2 blocking the drive via a direct electrical intervention.

[0050] Alternatively or additionally, a main power supply to the rail vehicle is switched off by direct electrical intervention.

[0051] For example a connection from a contact wire to the rail vehicle is interrupted, or a connection between a diesel generator located there and an internal main power supply is interrupted in the rail vehicle, or a connection between a main accumulator (on-board battery) located there and an internal main power supply is interrupted in the rail vehicle, etc.

[0052] Alternatively or additionally, braking can be activated by direct intervention in a pneumatic main brake line of the rail vehicle or, if necessary, on other braking devices.

[0053] In parallel, the unit 3.1 for motion detection continuously transmits information about the movement or the beginning of the movement, preferably together with location information, to a land-based operations control center 4.1.

[0054] The Operations Control Center 4.1 also optionally has the capability to initiate braking of the rail vehicle as soon as an unjustified movement of the rail vehicle is detected.

[0055] This allows the operations control center 4.1 to compare this information with its own timetable information. If it concludes that the vehicle movement is unauthorized, it can transmit a command via the same data connection to unit 3.2 to shut down, thus forcing the vehicle to stop.

[0056] This intervention is optional and should be understood as an additional safety measure. It is particularly useful when information about timetables or necessary vehicle movements becomes available on the land side at short notice, information which is not yet available on the vehicle.

[0057] FIG 2 shows with reference to FIG 1A more detailed, exemplary description of motion detection using unit 3.1.

[0058] The unit 3.1 for motion detection preferably uses several independent sensors, for example one or more speed sensors DZG, which are arranged on one or more axles of the rail vehicle.

[0059] The corresponding measured values ​​are sent to a unit 3.1.1, which records the measured values ​​and then transmits them to unit 3.1 for motion detection.

[0060] Alternatively or additionally, sensors EF1 and EF2 are used to detect the accelerating tractive force on one or more of the bogie axles DG1 and DG2 of the rail vehicle. The corresponding measured values ​​are transmitted to a unit 3.1.2, which collects the measured values ​​and transmits them to unit 3.1.

[0061] Using a satellite-based GPS unit, changes in the position of the rail vehicle are monitored and detected. A change in position that falls outside a predefined tolerance indicates that the rail vehicle is beginning to move. This information is also transmitted to unit 3.1.

[0062] The described sensors are operated electrically independently of the vehicle control system 2.1.

[0063] Unit 3.1 for motion detection uses the transmitted measured values ​​or the associated information to determine whether a movement or an incipient movement of the rail vehicle has occurred or is beginning.

[0064] If an unauthorized movement is detected due to a deviation from the driving command FB, unit 3.1 transmits, as described above, a command to switch off the drive and a command to activate the brake to unit 3.2, which is described in more detail below. This command is independent of the control system.

[0065] In parallel, unit 3.2 continuously transmits information about the movement together with location information to the land-based operations control center 4.1 using a suitable radio link.

[0066] FIG 3 shows with reference to FIG 1 and FIG 2 An overview provides details on the independent shutdown of the drive and the triggering of the braking process.

[0067] Unit 2.2 is, as described above, coupled with the monitoring instance UÜW.

[0068] Unit 3.2 accesses unit 2.2 electrically and functionally independently of the control system or the train control technology of the rail vehicle.

[0069] More precisely, it acts directly on a unit 2.2.2 serving the drive and is able to electrically block the drive in every operating case, so that no drive force can be built up.

[0070] Furthermore, unit 3.2 acts directly on a braking unit 2.2.3 and is able to trigger pneumatic braking via this unit, whereby this is independent of an associated brake control system 2.2.1.

[0071] Optionally, access to other, non-pneumatic braking systems is provided; for example, a spring-applied brake can be triggered if necessary.

[0072] Furthermore, unit 3.2 acts directly on the main power supply 2.2.4 of the rail vehicle, which, depending on the vehicle type, includes a high-voltage device, a main battery, a diesel generator, etc. This enables an electrically independent blocking or isolation from the associated control system.

Claims

1. Method for ensuring the standstill of a rail vehicle, - in which the rail vehicle is operated autonomously and without the intervention of a train driver, - in which the rail vehicle uses a vehicle controller having an electronic control system (2.1) in order to implement driving commands (FB) and standstill commands in the rail vehicle, - in which the driving commands (FB) and standstill commands in the rail vehicle are issued by a landside operational control centre (4.1), - in which the rail vehicle uses a monitoring instance (UÜW) that is independent of the control system (2.1), - in which the monitoring instance (UÜW) detects a movement of the rail vehicle, compares the detected movement with a valid driving command (FB) of the vehicle controller and, in the event of a deviation, initiates a braking operation independently of the control system (2.1) in order to bring the rail vehicle to a standstill, - in which sensors (EF1,EF2) arranged on at least one axle (DG1,DG2) of the rail vehicle are used for the movement detection, and in which the sensors (EF1,EF2) are operated electrically independently of the vehicle control system (2.1), characterized in that - a sensor (EF1,EF2) which detects an increasing tractive force on a bogie axle (DG1,DG2) of the rail vehicle is used for the movement detection at the axle (DG1,DG2) of the rail vehicle.

2. Method according to Claim 1, in which, in the event of the deviation, a drive of the rail vehicle is additionally deactivated, wherein this deactivation is similarly performed independently of the control system (2.1).

3. Method according to Claim 1, in which the landside operational control centre (4.1) transmits the driving command (FB) to the rail vehicle via a secure radio link and / or by means of a secure data transmission.

4. Method according to Claim 1, in which, in the absence of the driving command (FB) with simultaneously detected movement of the rail vehicle, the monitoring instance (UÜW) deactivates the drive of the rail vehicle independently of the control system (2.1) and / or initiates the braking operation independently of the control system (2.1).

5. Method according to Claim 1, in which, in order to implement the standstill, a direct intervention in drive devices and in braking devices of the rail vehicle is performed, bypassing the electronic control system (2.1).

6. Method according to Claim 1, in which, in order to implement the standstill, a direct intervention in a main energy supply (2.2.4) of the rail vehicle is performed, bypassing the electronic control system (2.1), in order to shut down said main energy supply.

7. Method according to Claim 1, in which information relating to the detected movement is transmitted to a landside operational control centre (4.1) together with an indication of the position of the rail vehicle.

8. Method according to Claim 7, in which the position indication is determined in a satellite-based manner on the rail vehicle.

9. Method according to one of the preceding claims, in which the landside operational control centre (4.1) initiates the braking operation in the rail vehicle as soon as an unwarranted movement of the rail vehicle is detected.

10. Method according to Claim 1, in which a tachometer generator, which is arranged on an axle (DG1,DG2) of the rail vehicle, is used as a sensor (EF1,EF2).