Brake system and braking method for rail vehicles

Abstract

The invention relates to a device and a method for braking rail vehicles and relates in particular to such a device and such a method for electromechanically braking rail vehicles. Disclosed is a brake system for a rail vehicle, comprising a brake control unit configured to provide braking functions and output a force manipulated variable, an actuator control unit configured to provide functions for generating a frictional braking force on the basis of the force manipulated variable and to output an actuation variable, a braking force unit configured to provide functions for generating a frictional braking force on the basis of the actuation variable, a first braking path from functions that are active between control inputs by the brake system and the generation of a braking force, and a second braking path from functions that are active between control inputs by the brake system and the generation of a braking force.

Description

[0001] DESCRIPTION

[0002] Braking system and braking method for rail vehicles

[0003] The invention relates to a device and a method for braking rail vehicles and particularly relates to such a device and such a method for electromechanical braking of rail vehicles.

[0004] Decelerating rail vehicles with pneumatic braking systems is well known in the art and has become the dominant method for decelerating rail vehicles. In many areas, these systems are even mandatory. Depending on the design, excess pressure in a compressor-fed compressed air reservoir is used to move a static braking element, such as a brake disc, brake shoe, or brake block, against a moving braking element, such as a brake disc, road wheel, or wheel axle, and to press or release it. The friction generated by this pressure converts kinetic energy into thermal energy, thereby decelerating the rail vehicle. Due to over a hundred years of experience with such pneumatic braking systems, especially pneumatic friction brakes, they are considered sophisticated and reliable.Such braking systems provide highly available, systematically stable, and virtually unlosable deceleration capability, independent of the state of other systems or environmental influences on the vehicle. However, such braking systems require additional systems for operation. These include, in particular, compressors and pneumatic supply infrastructure such as lines and pipes. These components are heavy and place considerable demands on installation space. Furthermore, these braking systems have relatively cumbersome control characteristics and are inflexible. Typically, only adjustments of the braking pressure are realized in relation to the load and speed of the rail vehicle, and even then, usually only in discrete steps.For example, DE 10 2009 051 019 A1 describes a speed-dependent, stepped emergency braking device of a rail vehicle with a hierarchical sequence, wherein emergency braking is carried out by a regenerative brake or an electro-pneumatic brake in a brake force-controlled and speed-dependent manner, and DE 10 2011 110 047 A1 discloses, for example, an emergency braking device for a rail vehicle with an emergency brake control valve device for providing an emergency brake control pressure and an emergency brake adjustment device for adjusting the provided emergency brake control pressure depending on a load value and a speed value of the rail vehicle.

[0005] Alternatively, there are state-of-the-art braking systems based on other technological principles, such as electrodynamic braking systems, which utilize the electromagnetic induction effect to convert kinetic energy into electrical energy and thus make it available for storage or use. This has particular advantages with regard to the overall energy efficiency of rail vehicle operation. However, the dissipation of braking energy, the generation of electrical power, and the functionality depend on the operating status of all involved electrical and electronic subsystems as well as the condition of the vehicle. Since these components are usually not themselves highly available, such braking systems are not considered highly available either.

[0006] The IEC 61508 standard and, specifically for the rail transport sector, the DIN EN 50126-2:2017 standard "Railway Applications - Specification and Demonstration of Reliability, Availability, Maintainability, and Safety (RAMS) - Part 2: System-Related Safety Methodology" define safety integrity levels (SIL) that define the assessment of electrical, electronic, or programmable electronic systems with regard to the reliability of safety functions. The targeted level determines the safety-related design principles that must be adhered to in order to reduce the risk of malfunction to a specific level.Four safety integrity levels are defined here, with the first safety integrity level (SIL 1) having the lowest requirements, and the fourth safety integrity level (SIL 4) having the highest requirements, ascending through the second and third. Components categorized according to SIL 1 may have a failure probability per hour of 10'. 5 - 10 -6 , components categorised according to SIL 4 have a failure probability per hour of 10' 8 - 10' 9 have.

[0007] Publication WO 2021 / 198994 A1 discloses an electromechanical module that actuates the brake shoes of a friction brake via a linkage mechanism. A preloaded spring assembly and a brake force sensor are provided in this mechanical braking path. A first service brake control unit handles service and emergency braking operations and controls the electric motor of the electromechanical module accordingly. A safety unit uses the sensor to check whether the emergency braking force is applied in an emergency braking situation. If this is not the case, for example, if the electric motor or the service brake control unit fails, the preloaded spring assembly is released, thus applying the emergency braking force. Furthermore, an electromechanical module is disclosed that actuates the brake shoes of a friction brake via a linkage mechanism. A brake force sensor is also provided in this mechanical braking path.A first service brake control unit handles service and emergency braking operations and controls the electromechanical module's electric motor accordingly. A safety unit uses the sensor to check whether emergency braking force is applied in the event of an emergency braking situation. If this is not the case, for example, if the service brake control unit fails, a switch is activated and the electric motor is controlled via an electronic emergency braking unit with its own battery buffer and motor control, thus applying the emergency braking force. This involves a strict separation of service brake function groups and safety brake function groups, with a hierarchically superior safety unit controlling whether conventional service brake function groups or safety brake function groups are used for braking control.This separation into service and safety brake function groups and service and safety brake function components is inflexible and prone to a complete system failure if, for example, the safety unit fails. Furthermore, the functionality of the service brake control unit must either be completely mirrored or would not be available in the safety braking process. Therefore, the object of the invention is to provide a braking system and braking method that solves the problems of the prior art. In particular, the object of the invention is to provide a braking system that meets the necessary safety requirements and high availability, while placing lower demands on the system integrity of the rail vehicle.

[0008] This problem is solved according to the subject matter of the independent claims. Advantageous further developments are the subject matter of the dependent claims.

[0009] A braking system for a rail vehicle is disclosed, comprising a brake control unit configured to provide braking functions and output a force control variable or an actuation variable, a braking force unit configured to provide functions for generating friction braking force based on the force control variable or actuation variable, a first braking path with braking functions active between control inputs of the braking system and the generation of braking force, and a second braking path with braking functions active between control inputs of the braking system or when predetermined braking system state variables are present and the generation of braking force. The term "braking path" refers to the set of all functions active between the control inputs of the braking system and the generation of the friction braking force, and which establish the system-wide braking functions.This allows the provision of functions of a first braking path, for example a service braking path with a low level of safety integrity, and a second braking path, for example a safety braking path with a higher level of safety integrity, in both the brake control unit and the brake force unit. This creates the prerequisites for switching from the service braking path to the safety braking path in the event of a fault, as required, either in the brake control unit or in the brake force unit, or in the brake control and brake force unit. It also creates the prerequisites for the functions of the safety braking path to access functions of the service braking path, for example wheel slide protection functions. Furthermore, it creates the prerequisites for fallback on functions of the service braking path as a redundancy control in the event of a failure of functions of the safety braking path.

[0010] It is advantageous if the first braking path is configured to provide braking functions with low safety integrity, and the second braking path is configured to provide braking functions with high safety integrity, and the low safety integrity is lower than the high safety integrity. Braking functions with high safety integrity can have a higher safety integrity level than braking functions with low safety integrity.

[0011] It is advantageous if the braking system further comprises a first group of split functional parts that are part of the first braking path and part of the second braking path. These functions are preferably configured to generate a frictional force such that the rail vehicle is decelerated. The joint use of such highly reliable functional parts, which perform the actual mechanical braking function, makes it possible to provide a compact braking system.

[0012] It is advantageous if the brake control unit is configured to provide braking functions of the first braking path or the second braking path and the braking force unit is configured to provide braking functions of the first braking path or the second braking path.

[0013] It is advantageous if the brake control unit is configured to provide braking functions of the first braking path and the second braking path and the braking force unit is configured to provide braking functions of the first braking path and the second braking path.

[0014] It is advantageous if the brake control unit is configured to receive a control input with a braking command and to determine and output an actuation variable or a force control variable therefrom. It is advantageous if the brake control unit is configured to receive vehicle state variable inputs or brake system state variable inputs and to determine and output the actuation variable or the force control variable therefrom.

[0015] It is advantageous if the brake control unit is configured to receive a switching signal and, upon receipt of a switching signal, to switch from the first braking path to the second braking path, or to switch from the second braking path to the first braking path.

[0016] It is advantageous if the brake control device is configured to determine a switching state and to output a switching signal when a switching state is determined.

[0017] It is advantageous if the braking force unit is configured to receive a force control variable or an actuation variable and to control the group of functional parts in such a way that the rail vehicle is decelerated.

[0018] It is advantageous if the brake control unit or the brake force unit is configured to receive a switching signal and, upon receipt of a switching signal, to switch from the first braking path to the second braking path, or to switch from the second to the first braking path.

[0019] It is advantageous if the brake control unit or the brake force unit is configured to determine a switching state and to output a switching signal.

[0020] It is advantageous if the braking system, in particular the braking force unit, has an energy supply unit, in particular alternatively or optionally additionally an internal energy supply unit.

[0021] It is advantageous if the power supply unit is configured to determine a switching state and output a switching signal. A rail vehicle with a braking system according to the invention is disclosed.

[0022] Furthermore, a braking method for a rail vehicle is disclosed, comprising the steps of: a) providing braking functions by a brake control unit, b) outputting a force control variable or an actuation variable by the brake control unit, c) providing functions for generating braking force, preferably friction braking force, by a braking force unit based on the actuation variable from step b), d) providing a first braking path having functions that are active between control inputs of a braking system and the generation of braking force, and e) providing a second braking path having functions that are active between control inputs of the braking system and the generation of braking force.

[0023] It is advantageous if the first braking path from step d) is configured to provide braking functions with low safety integrity and the second braking path from step e) is configured to provide braking functions with high safety integrity.

[0024] It is advantageous if step a) comprises the steps: aa) providing braking functions of the first braking path, or ab) providing braking functions of the second braking path, and step c) comprises the steps: ca) providing braking functions of the first braking path, or cb) providing braking functions of the second braking path,

[0025] It is advantageous if step a) comprises the steps: aa) providing braking functions of the first braking path, and ab) providing braking functions of the second braking path, and step b) comprises the steps: ba) providing braking functions of the first braking path, and bb) providing braking functions of the second braking path.

[0026] It is advantageous if the method further comprises the following steps: f) receiving a control input with a braking command by the brake control unit, g) determining an actuation variable or a force control variable by the brake control unit from the control input, h) outputting the actuation variable or the force control variable by the brake control unit.

[0027] It is advantageous if the method further comprises the following steps: i) receiving a vehicle state variable input or a brake system state variable input by the brake control unit, j) determining an actuation variable or a force control variable by the brake control unit from the vehicle state variable input or a brake system state variable input, k) outputting the actuation variable or the force control variable by the brake control unit.

[0028] It is advantageous if the method further comprises the following steps: I) receiving a switching signal by the brake control unit or the brake force unit, m) switching from the first braking path to the second braking path or from the second braking path to the first braking path in the brake control unit, the brake force unit or the energy supply unit.

[0029] It is advantageous if the method further comprises the following steps: n) determining a switching state by the brake control unit, the braking force unit, or the energy supply unit o) outputting a switching signal by the brake control unit, the braking force unit, or the energy supply unit when the switching state is determined.

[0030] It is advantageous if the method further comprises the following steps: p) obtaining a force control variable or an actuation variable by the braking force unit, q) controlling a group of common functional parts by the braking force unit so that the rail vehicle is decelerated.

[0031] Disclosed is a braking system for a rail vehicle, comprising a braking control unit configured to provide braking functions and output a force control variable, an actuator control unit configured to provide functions for generating friction braking force based on the force control variable and output an actuation variable, a braking force unit configured to provide functions for generating friction braking force based on the actuation variable, a first braking path having functions active between control inputs of the braking system and the generation of braking force, and a second braking path having functions active between control inputs of the braking system or when predetermined braking system state variables are present and the generation of braking force.Furthermore, the functions of the second braking path do not have to be activated by a control input of the braking system, but they can also be activated when predetermined braking system state variables are present, for example in the event of an impending power supply failure without a control input of the braking system.

[0032] It is advantageous if the first braking path is configured to provide braking functions with low safety integrity, while the second braking path is configured to provide braking functions with high safety integrity, and the low safety integrity is lower than the high safety integrity. Braking functions with high safety integrity can have a higher safety integrity level than braking functions with low safety integrity.

[0033] It is advantageous if the braking system further comprises a first group of divided functional parts that are part of the first braking path and part of the second braking path and are configured to generate a frictional force such that the rail vehicle is decelerated. They are preferably configured to generate a frictional force such that the rail vehicle is decelerated.

[0034] It is advantageous if the brake control unit is configured to provide braking functions of the first braking path and the second braking path, the actuator control unit is configured to provide braking functions of the first braking path and the second braking path, or the braking force unit is configured to provide braking functions of the first braking path and the second braking path. Here, the brake control unit provides braking functions, the actuator control unit provides actuator functions, and the braking force unit provides force control functions. It is advantageous if the brake control unit is configured to provide braking functions of the first braking path or the second braking path, the actuator control unit is configured to provide braking functions of the first braking path or the second braking path, and the braking force unit is configured to provide braking functions of the first braking path or the second braking path.

[0035] It is advantageous if the braking system further comprises an energy supply unit which is configured to supply the braking system with energy, in particular electrical energy for braking operation.

[0036] It is advantageous if the brake control unit, the actuator control unit, the power supply unit, or the braking force unit is configured to receive a switching signal and, upon receipt of a switching signal, to switch from the first braking path to the second braking path, or from the second braking path to the first braking path. In this case, the braking functions located on the respective units switch between the functions assigned to the first braking path and the functions assigned to the second braking path, or vice versa.

[0037] It is advantageous if the braking system is set up to perform a safety function.

[0038] It is advantageous if the safety function is one from the group of safety functions with the elements brake path monitor, actuator monitor, supply monitor, decision maker and data storage function.

[0039] It is advantageous if there is a distributed assignment of safety functions to the brake control unit, actuator control unit, energy supply unit or brake force unit and the distributed safety functions are executed by the assigned units.

[0040] It is advantageous if the brake control unit, the actuator control unit, an optionally included energy supply unit or the braking force unit has a changeover switch and is configured to determine a changeover state and to output a changeover signal when a changeover state is determined.

[0041] It is advantageous if the braking force unit is configured to receive a force control variable or an actuation variable and to control the group of functional parts in such a way that the rail vehicle is decelerated.

[0042] It is advantageous if the braking system, in particular the brake control unit, the actuator control unit or the braking force unit, has an energy supply unit, preferably alternatively or optionally additionally an internal energy supply unit.

[0043] Furthermore, a rail vehicle with the above braking system is disclosed.

[0044] Furthermore, a braking method for a rail vehicle is disclosed, comprising the steps of: a) providing braking functions by a brake control unit, b) outputting a force control variable by the brake control unit, c) providing braking functions for generating frictional braking force by an actuator control unit based on the force control variable from step b), d) providing braking functions for generating frictional braking force by a braking force unit based on the actuation variable from step c), e) providing a first braking path having functions that are active between control inputs of a braking system and the generation of braking force, and f) providing a second braking path having functions that are active between control inputs of the braking system or when predetermined braking system state variables are present and the generation of braking force.

[0045] It is advantageous if the first braking path from step e) is configured to provide braking functions with low safety integrity and the second braking path from step f) is configured to provide braking functions with high safety integrity. It is advantageous if step a) comprises the steps: aa) providing braking functions of the first braking path, or ab) providing braking functions of the second braking path, and step c) comprises the steps: ca) providing braking functions of the first braking path, or cb) providing braking functions of the second braking path, and step d) comprises the steps: da) providing braking functions of the first braking path, or db) providing braking functions of the second braking path,

[0046] It is advantageous if step a) comprises the steps: aa) providing braking functions of the first braking path, or ab) providing braking functions of the second braking path, and step c) comprises the steps: ca) providing braking functions of the first braking path, or cb) providing braking functions of the second braking path, and step d) comprises the steps: da) providing braking functions of the first braking path, or db) providing braking functions of the second braking path.

[0047] It is advantageous if step a) comprises the steps: aa) providing braking functions of the first braking path, and ab) providing braking functions of the second braking path, and step c) comprises the steps: ca) providing braking functions of the first braking path, and cb) providing braking functions of the second braking path, and step d) comprises the steps: da) providing braking functions of the first braking path, and db) providing braking functions of the second braking path. — 2.18

[0048] It is advantageous if the following step is also carried out: g) Execution of a safety function by the brake control unit, the actuator control unit or the braking force unit.

[0049] It is advantageous if the safety function is one of the group of safety functions comprising the elements brake path monitor, actuator monitor, power supply monitor, decision maker, and data storage function. It is advantageous if the method further comprises the following steps: h) receiving a switching signal by the brake control unit, the actuator control unit, the energy supply unit, or the braking force unit, i) switching from the first braking path to the second braking path or from the second braking path to the first braking path in the brake control unit, the actuator control unit, the energy supply unit, or the braking force unit.

[0050] It is advantageous if the method further comprises the following steps: n) Determining a switching state by the brake control unit, the actuator control unit or the braking force unit, in particular by safety functions distributed therebetween o) Outputting a switching signal by the brake control unit, the actuator control unit or the braking force unit when the switching state is determined.

[0051] A braking system for a rail vehicle is disclosed, comprising a braking control system comprising: a first brake control unit configured to provide braking functions and output a force control variable, a first actuator control unit configured to provide functions for generating friction braking force based on the force control variable and output an actuation variable, and an actuator comprising a second brake control unit configured to provide braking functions and output a force control variable, a second actuator control unit configured to provide functions for indirectly generating friction braking force based on the force control variable and output an actuation variable, and a braking force unit configured to provide functions for generating friction braking force based on the actuation variable, and a first braking path comprising functions,which are active between at least one control input of the braking system and the generation of braking force, and a second braking path consisting of functions which are active between at least one control input of the braking system and the generation of braking force.

[0052] It is advantageous if the first braking path is configured to provide braking functions with low safety integrity and the second braking path is configured to provide braking functions with high safety integrity. Braking functions with high safety integrity can have a higher safety integrity level than braking functions with low safety integrity.

[0053] It is advantageous if the braking system further comprises a first group of divided functional parts which are part of the first braking path and part of the second braking path and are configured to generate a friction force such that the rail vehicle is decelerated.

[0054] It is advantageous if the brake control is configured to provide braking functions of the first braking path or the second braking path, and the actuator is configured to provide braking functions of the first braking path or the second braking path.

[0055] It is advantageous if the first brake control unit and the second brake control unit are configured to provide braking functions of the first braking path or the second braking path, the first actuator control unit and the second actuator control unit are configured to provide braking functions of the first braking path or the second braking path, and the braking force unit is configured to provide braking functions of the first braking path or the second braking path.

[0056] It is advantageous if the first brake control unit and the first actuator control unit are configured to provide braking functions of the first braking path, the second brake control unit and the second actuator control unit are configured to provide braking functions of the second braking path, and the braking force unit is configured to provide braking functions of the first braking path and the second braking path.

[0057] It is advantageous if the first brake control unit is configured to provide braking functions of the first braking path or the second braking path, the first actuator control unit is configured to provide braking functions of the first braking path, the second brake control unit and the second actuator control unit are configured to provide braking functions of the second braking path, and the braking force unit is configured to provide braking functions of the first braking path and the second braking path.

[0058] It is advantageous if the braking system further comprises an energy supply unit which is configured to supply the components of the braking system with electrical energy for their operation.

[0059] It is advantageous if the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the braking force unit is configured to receive a switching signal and, upon receipt of the switching signal, to switch from the first braking path to the second braking path, or to switch from the second braking path to the first braking path.

[0060] It is advantageous if the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit has a switching unit and is configured to determine a switching state and to output a switching signal when a switching state is determined.

[0061] It is advantageous if the braking system is set up to perform a safety function.

[0062] It is advantageous if the safety function is one from the group of safety functions with the elements brake path monitor, actuator monitor, supply monitor, decision maker and data storage function.

[0063] It is advantageous if the power supply unit is configured to execute the safety function of the supply monitor, and the second brake control unit is configured to execute the safety functions of the brake path monitor, the actuator monitor, the data storage function, and the decision maker. It is advantageous if the power supply unit is configured to execute the safety function of the supply monitor, the first brake control unit is configured to execute the safety function of the brake path monitor and the actuator monitor, and the second brake control unit is configured to execute the safety functions of the decision maker and the data storage function.

[0064] It is advantageous if the braking force unit is configured to receive a force control variable or an actuation variable and to control the group of functional parts in such a way that the rail vehicle is decelerated.

[0065] It is advantageous if the braking system, in particular the braking control or the actuator, has an energy supply unit, in particular and optionally or additionally an internal energy supply unit.

[0066] A rail vehicle with the above braking system is disclosed.

[0067] A braking method for a rail vehicle is disclosed, comprising the steps: a) providing braking functions by a first brake control unit in a brake control system, b) outputting a force control variable by the first brake control unit, c) providing braking functions for generating frictional braking force by a first actuator control unit in the brake control system based on the force control variable from step b), d) outputting an actuation variable by the first actuator control unit, e) providing braking functions by a second brake control unit in an actuator, f) outputting a force control variable by the second brake control unit, g) providing braking functions for generating frictional braking force by a second actuator control unit in the actuator based on the force control variable from step f), h) outputting an actuation variable by the second actuator control unit,i) providing braking functions for generating friction braking force by a braking force unit based on the actuation variable from step d) or h), j) providing a first braking path having functions active between control inputs of the braking system and the generation of braking force, and k) providing a second braking path having functions active between control inputs of the braking system and the generation of braking force.

[0068] It is advantageous if: the first braking path from step j) is set up to provide braking functions with low safety integrity and the second braking path from step k) is set up to provide braking functions with high safety integrity.

[0069] It is advantageous if step a), step c), step e), step g) or step i) comprises the steps: aa) providing braking functions of the first braking path, and ab) providing braking functions of the second braking path.

[0070] It is advantageous if step a), step c), step e), step g) and step i) comprise the steps: ac) providing braking functions of the first braking path, or ad) providing braking functions of the second braking path.

[0071] It is advantageous if the following step is further carried out: I) Execution of a safety function by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit.

[0072] It is advantageous if the safety function is one of the group of safety functions with the elements brake path monitor, actuator monitor, supply monitor, decision maker and data storage function.

[0073] It is advantageous if the method further comprises the following steps: m) receiving a switching signal by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit, n) switching from the first braking path to the second braking path or from the second braking path to the first braking path in the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit.It is advantageous if the method further comprises the following steps: o) determining a switching state by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit, p) outputting a switching signal by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit when the switching state is determined.

[0074] Disclosed is a braking system for a rail vehicle, comprising a brake control system, which comprises: a first brake control unit, which is configured to provide braking functions and to output a force control variable, and an actuator, which comprises a second brake control unit, which is configured to provide braking functions and to output a force control variable, a first actuator control unit, which is configured to provide functions for generating friction braking force based on the force control variable and to output an actuation variable, and a second actuator control unit, which is configured to provide functions for generating friction braking force based on the force control variable and to output an actuation variable, and a braking force unit, which is configured to provide functions for generating friction braking force based on the actuation variable, and a first braking path, comprising functions,which are active between a control input of the braking system and the generation of braking force, and a second braking path consisting of functions which are active between control inputs of the braking system and the generation of braking force.

[0075] It is advantageous if the first braking path is configured to provide braking functions with low safety integrity, the second braking path is configured to provide braking functions with high safety integrity, and the low safety integrity is lower than the high safety integrity. Braking functions with high safety integrity can have a higher safety integrity level than braking functions with low safety integrity. It is advantageous if the braking system, in particular the braking force unit, further comprises a first group of divided functional parts that are part of the first braking path and part of the second braking path and are configured to generate a friction force such that the rail vehicle is decelerated.

[0076] It is advantageous if the brake control is configured to provide braking functions of the first braking path and the second braking path, or the actuator is configured to provide braking functions of the first braking path and the second braking path.

[0077] It is advantageous if the brake control is configured to provide braking functions of the first braking path and the second braking path, or the brake control is configured to provide braking functions of the first braking path, and the actuator is configured to provide braking functions of the first braking path or the second braking path.

[0078] It is advantageous if the first brake control unit and the first actuator control unit are configured to provide braking functions of the first braking path, the second brake control unit and the second actuator control unit are configured to provide braking functions of the second braking path, and the braking force unit is configured to provide braking functions of the first braking path or the second braking path.

[0079] It is advantageous if the first brake control unit is configured to provide braking functions of the first braking path or the second braking path, the first actuator control unit is configured to provide braking functions of the first braking path, the second brake control unit and the second actuator control unit are configured to provide braking functions of the second braking path, and the braking force unit is configured to provide braking functions of the first braking path and the second braking path.It is advantageous if the first brake control unit is configured to provide braking functions of the first braking path and the second braking path, or the first actuator control unit is configured to provide braking functions of the first braking path and the second braking path, the second brake control unit and the second actuator control unit are configured to provide braking functions of the second braking path, and the braking force unit is configured to provide braking functions of the first braking path and the second braking path.

[0080] It is advantageous if the first brake control unit is configured to provide braking functions of the first braking path, the second brake control unit is configured to provide braking functions of the first braking path or the second braking path, the second actuator control unit is configured to provide the braking function of the second braking path, and the braking force unit is configured to provide braking functions of the first braking path or the second braking path.

[0081] It is advantageous if the braking system further comprises an energy supply unit which is configured to supply the components of the braking system with electrical energy for their operation.

[0082] It is advantageous if the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit is configured to receive a switching signal and, upon receipt of the switching signal, to switch from the first braking path to the second braking path, or to switch from the second braking path to the first braking path.

[0083] It is advantageous if the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, or the braking force unit has a switching unit and is configured to determine a switching state and output a switching signal when a switching state is determined. It is advantageous if the braking system is configured to perform a safety function.

[0084] It is advantageous if the safety function is one from the group of safety functions with the elements brake path monitor, actuator monitor, supply monitor, decision maker and data storage function.

[0085] It is advantageous if the energy supply unit is configured to execute the safety function of the supply monitor and the second brake control unit is configured to execute the safety functions of the brake path monitor, the actuator monitor, the decision maker and the data storage function.

[0086] It is advantageous if the energy supply unit is configured to execute the safety function of the supply monitor, and the second brake control unit is configured to execute the safety functions of the brake path monitor, the actuator monitor, the decision maker and the data storage function.

[0087] It is advantageous if the braking force unit is configured to receive a force control variable or an actuation variable.

[0088] It is advantageous if the braking system, in particular the braking control or the actuator, has a power supply unit, preferably an optional additional internal power supply unit.

[0089] Furthermore, a rail vehicle with the above braking system is disclosed.

[0090] Furthermore, a braking method for a rail vehicle is disclosed, comprising the steps: a) providing braking functions by a first brake control unit in a brake control, b) outputting a force control variable by the first brake control unit, c) providing braking functions for generating frictional braking force by a first actuator control unit in an actuator based on the force control variable from step b), d) outputting an actuation variable by the first actuator control unit, e) providing braking functions by a second brake control unit in the actuator, f) outputting a force control variable by the second brake control unit, g) providing braking functions for generating frictional braking force by a second actuator control unit in the actuator based on the force control variable from step f), h) outputting an actuation variable by the second actuator control unit,i) providing braking functions for generating friction braking force by a braking force unit based on the actuation variable from step d) or h), j) providing a first braking path having functions active between control inputs of the braking system and the generation of braking force, and k) providing a second braking path having functions active between control inputs of the braking system and the generation of braking force.

[0091] It is advantageous if the first braking path from step j) is configured to provide braking functions with low safety integrity and the second braking path from step k) is configured to provide braking functions with high safety integrity.

[0092] It is advantageous if step a), step c), step e), step g) or step i) comprises the steps: aa) providing braking functions of the first braking path, and ab) providing braking functions of the second braking path.

[0093] It is advantageous if step a), step c), step e), step g) and step i) comprise the steps: ac) providing braking functions of the first braking path, or ad) providing braking functions of the second braking path.

[0094] It is advantageous if the following step is further performed: I) Execution of a safety function by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, or the brake force unit. It is advantageous if the safety function is one of the group of safety functions comprising the elements brake path monitor, actuator monitor, supply monitor, decision maker, and data storage function.

[0095] It is advantageous if the method further comprises the following steps: m) receiving a switching signal by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit, n) switching from the first braking path to the second braking path or from the second braking path to the first braking path in the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit.

[0096] It is advantageous if the method further comprises the following steps: o) determining a switching state by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the braking force unit, p) outputting a switching signal by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the braking force unit when the switching state is determined.

[0097] A braking system for a rail vehicle is disclosed, comprising a brake control system, which comprises a first brake control unit configured to provide braking functions and output a force control variable, a first actuator control unit configured to provide functions for generating friction braking force based on the force control variable and output an actuation variable, an extension function carrier, and an actuator, which comprises a second brake control unit configured to provide braking functions and output a force control variable, a second actuator control unit configured to provide functions for generating friction braking force based on the force control variable and output an actuation variable, and a braking force unit configured to provide functions for generating friction braking force based on the actuation variable, and a first braking path, comprising functions,which are active between a control input of the braking system and the generation of braking force, and a second braking path consisting of functions which are active between control inputs of the braking system and the generation of braking force.

[0098] It is advantageous if the first braking path is configured to provide braking functions with low safety integrity and the second braking path is configured to provide braking functions with high safety integrity. Braking functions with high safety integrity can have a higher safety integrity level than braking functions with low safety integrity.

[0099] It is advantageous if the braking system, in particular the braking force unit, further comprises a first group of divided functional parts which are part of the first braking path and part of the second braking path and are configured to generate a friction force such that the rail vehicle is decelerated.

[0100] It is advantageous if the extension function carrier is designed to provide braking functions of the second braking path.

[0101] It is advantageous if the extension carrier is configured to receive sensor variables or output extension variables.

[0102] It is advantageous if the first brake control unit is configured to receive extension variables and output force control variables, the first actuator control unit is configured to receive force control variables and output actuation variables, the second brake control unit is configured to receive a force control variable or an extension variable and output a force control variable or a switching command, the second actuator control unit is configured to receive a force control variable or a switching command and output an actuation variable or a switching command, or the brake force unit is configured to receive a switching command or an actuation variable.It is advantageous if the first brake control unit and the first actuator control unit are configured to provide braking functions of the first braking path, the second brake control and the second actuator control unit are configured to provide braking functions of the second braking path, and the braking force unit is configured to provide braking functions of the first braking path or the second braking path.

[0103] It is advantageous if the braking system further comprises an energy supply unit which is configured to supply the components of the braking system with electrical energy for their operation.

[0104] It is advantageous if the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit is configured to receive a switching signal and, upon receipt of the switching signal, to switch from the first braking path to the second braking path, or to switch from the second braking path to the first braking path.

[0105] It is advantageous if the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit has a switching unit and is configured to determine a switching state and to output a switching signal when a switching state is determined.

[0106] It is advantageous if the braking system is set up to perform a safety function.

[0107] It is advantageous if the safety function is one of the safety functions comprising the elements brake path monitor, actuator monitor, power supply monitor, decision maker, and data storage function. It is advantageous if the power supply unit is configured to execute the safety function of the power supply monitor and the second brake control unit is configured to execute the safety functions of the brake path monitor, actuator monitor, data storage function, and decision maker.

[0108] It is advantageous if the braking force unit is configured to receive a force control variable or an actuation variable and to control the group of functional parts in such a way that the rail vehicle is decelerated.

[0109] It is advantageous if the braking system, in particular the braking control or the actuator, has an energy supply unit.

[0110] Also disclosed is a rail vehicle having a braking system according to one of the preceding claims.

[0111] Furthermore, a braking method for a rail vehicle is disclosed, comprising the steps: a) providing braking functions by a first brake control unit in a brake control system, b) outputting a force control variable by the first brake control unit, c) providing braking functions for generating frictional braking force by a first actuator control unit in the brake control system based on the force control variable from step b), d) outputting an actuation variable by the first actuator control unit, e) providing braking functions by an extension unit in an extension function carrier, f) providing braking functions by a second brake control unit in an actuator, g) outputting a force control variable by the second brake control unit, h) providing braking functions for generating frictional braking force by a second actuator control unit in the actuator based on the force control variable from step e),i) outputting an actuation variable by the first actuator control unit, j) providing braking functions for generating frictional braking force by a braking force unit based on the actuation variable from step d) or h), k) providing a first braking path having functions active between control inputs of the braking system and the generation of braking force, and i) providing a second braking path having functions active between control inputs of the braking system and the generation of braking force.

[0112] It is advantageous if the first braking path from step k) is configured to provide braking functions with low safety integrity and the second braking path from step l) is configured to provide braking functions with high safety integrity.

[0113] It is advantageous if step a), step c), step e), step f), step h) or step j) comprises the steps: aa) providing braking functions of the first braking path, and ab) providing braking functions of the second braking path.

[0114] It is advantageous if step a), step c), step e), step f), step h) and step j) comprise the steps: ac) providing braking functions of the first braking path, or ad) providing braking functions of the second braking path.

[0115] It is advantageous if the braking functions from step e) are those of the second braking path.

[0116] It is advantageous if the following steps are also included: m) reception of sensor variables by the extension function carrier, n) processing of the sensor variables from step m) by the extension function carrier.

[0117] It is advantageous if the following steps are also shown: o) Output of extension variables by the extension function carrier.

[0118] It is advantageous if at least one of the following steps is furthermore included: p) receiving an extension variable by the first brake control unit, q) outputting a force control variable by the first brake control unit, r) receiving a force control variable by the first actuator control unit, s) outputting an actuation variable by the first actuator control unit, t) receiving a force control variable or an extension variable by the second brake control unit, u) outputting a force control variable or a switching command by the second brake control unit, v) receiving a force control variable or a switching command by the second actuator control unit, w) outputting an actuation variable or a switching command by the second actuator control unit, or x) receiving a switching command or an actuation variable by the braking force unit.

[0119] The inventive concepts disclosed here aim to enable the development of an alternative friction braking system based on an electromechanical operating principle with the aid of safety functions. The reasons and technical advantages of such a system may include, without claiming to be exhaustive, one or more of the following points:

[0120] • Reduction of system weight due to the avoidance of peripheral additional systems for energy conversion such as compressors and the pneumatic supply infrastructure, which usually consists of an arrangement of pipes.

[0121] • Design of braking system functions using electronics and software methods to simplify modular systems and enable functions depending on customer requirements, market requirements or vehicle type.

[0122] • Enabling situation-dependent dynamic behavior during system operation based on electronics and software to increase braking quality, e.g. with regard to braking distance or braking comfort.

[0123] • Increasing the dynamics of the brake force variation, ie the change in state of the brake to improve the braking quality, for example in the anti-skid function.

[0124] • Improvements in maintenance, fault detection, and the ability to monitor subcomponents through additional sensors and associated evaluation electronics and software, for example, for recording the condition of the brake pad. The challenge of establishing a braking system based on an electromechanical operating principle is to achieve a paradigm shift and move away from the principles of the pneumatic friction brake, whose basic functions can be implemented without the domains of software, electronics, and electrical components, but using purely mechanical principles. The invention provides devices and methods that confirm the effectiveness and reliability of the new technology and allow a change in the associated standards that permit such systems for market launch.To this end, this document discloses a system architecture that initially includes fundamental safety functions and principles, enabling such a braking system to achieve failure and operational behavior at least equivalent to that of existing pneumatic brakes. A proposal for the principles and systematic functional structures required for this is described below.

[0125] In the following, the embodiments of the invention are described by means of the figures.

[0126] Figure 1 shows a rail vehicle combination with braking systems according to the invention.

[0127] Figure 2 shows a braking system according to the invention.

[0128] Figure 3 shows a block diagram of a first embodiment of a braking system according to the invention.

[0129] Figure 4 shows a block diagram of a second embodiment of a braking system according to the invention.

[0130] Figure 5 shows a block diagram of a third embodiment of a braking system according to the invention.

[0131] Figure 6 shows a block diagram of a fourth embodiment of a braking system according to the invention. Figure 7 shows a block diagram of a first modification of the fourth embodiment.

[0132] Figure 8 shows a block diagram of a second modification of the fourth embodiment.

[0133] Figure 9 shows a block diagram of a fifth embodiment of a braking system according to the invention.

[0134] Figure 10 shows a block diagram of a sixth embodiment of a braking system according to the invention.

[0135] Figure 11 shows a block diagram of a seventh embodiment of a braking system according to the invention.

[0136] Figure 12 shows a block diagram of an eighth embodiment of a braking system according to the invention.

[0137] Figure 13 shows a block diagram of a ninth embodiment of a braking system according to the invention.

[0138] Figure 14 shows a block diagram for a switching process for the embodiments 2 to 9.

[0139] A first embodiment of the invention is described with reference to Fig. 1.

[0140] Fig. 1 discloses a rail vehicle assembly 1 comprising rail vehicles 110, 150, 160. The rail vehicle assembly comprises a driven carriage 110, in which a drive means 112, implemented in the exemplary embodiment by an electric motor, is provided. The drive force provided by the drive means 112 is transmitted to drive wheels 116 via driven wheel axles 114. The drive wheels 116 run on rails 118. Furthermore, the driven carriage 110 comprises a pantograph 120, via which the train assembly 1 is supplied with electrical energy via an overhead line 122 and the rail 118. Electrical energy is temporarily stored via an accumulator 123.

[0141] The powered car 110 has a driver's cab 124. From this cab, the train can be controlled by a driver (not shown).

[0142] A braking system 200, via which the train 1 can be decelerated, will be described later with reference to Fig. 2.

[0143] The driven carriage 110 is connected to one or more towed carriages 150 via a coupling 140. If there are multiple towed carriages 150, these are also connected to each other via a coupling 140. The towed carriage 150 has non-driven wheel axles 154 with non-driven wheels 156.

[0144] The towed vehicle 150 has a braking system 152, which can be used to decelerate the train 1. In the exemplary embodiment, the braking system 152 of the towed vehicle is constructed identically to the braking system 200 of the driven vehicle. For a description of the braking system 200 of the driven vehicle, please refer to the description of the braking system 200 of the driven vehicle.

[0145] The last hauled car, 160, in train set 1 is configured as the end car. It is constructed like hauled car 150, but has its own driver's cab, 162, for reversing.

[0146] Tensile and compressive forces are transmitted between the respective cars 110, 150, and 160 of the train via the couplings 140. Furthermore, all cars of the train are supplied with electrical power via the couplings 140 via an electrical supply line 126 via the driven car 110 and the pantograph 120. Furthermore, all cars of the train 1 are connected via the couplings 140 via a control line 128, enabling data communication between the cars 110, 150, and 160 of the train 1. In the exemplary embodiment, the control line is configured as a CAN bus, via which components in the cars 110, 150, and 160 can exchange sensor and control data with each other.

[0147] The braking system 200 is described with reference to Fig. 2. The braking system 200 is an electromechanical braking system. The electromechanical braking system is a braking system that provides the capability of generating a deceleration braking force of a vehicle using electronic, electrical, and mechanical components. The braking system 200 has a power supply interface 202, which is connected to the electrical supply line 126 and via which the braking system is supplied with operating power. Furthermore, the braking system 200 has a control line interface 204, which is connected to the control line 128. The braking system 200 has a moving, in particular rotary, friction element in the form of a brake disc 206, which is connected in a rotationally fixed manner to one of the axles 114, 154 such that torque can be transmitted between the wheel axle 114, 154 and the brake disc 206.A brake caliper 208 is mounted in the carriage such that it does not move relative to the carriage and has static friction elements in the form of brake shoes 210, which are mounted in the brake caliper 208 such that they can be moved toward and away from the brake disc 206. Friction element drive means in the form of a brake actuator motor 212 and a spindle drive 214 can move the brake shoes 210 with a motion component perpendicular to the rotational axis of the brake disc 206, and friction can be generated between the brake shoes 210 and the brake disc 206, a torque can be transmitted between the brake caliper 208 and the brake disc, and the carriage can thus be decelerated.

[0148] The group of elements consisting of the brake disc 206, the brake caliper 208, the brake shoes 210, the brake actuator motor 212, and the spindle drive 214 are understood in this invention as highly reliable functional parts 126, as they are based on proven captive functional mechanisms and possess inherent safety properties. A safety architecture of a first embodiment of the braking system 200 is described with reference to Fig. 3.

[0149] The braking system 200 according to the first embodiment pursues the objective of generating a frictional braking force for decelerating the vehicle mass of the rail vehicle assembly 1, because with such a braking system it is possible to provide service braking functions and safety-relevant braking functions, such as emergency braking function, rapid braking function or parking braking function.

[0150] For this purpose, the braking system features a safety architecture with two different integrity levels for the operation of an electromechanical braking system in rail vehicles. A reactive fail-safe architecture is used to achieve the functional safety of the braking system, which is divided into a high-integrity safety braking path and a low-integrity service braking path.

[0151] The electromechanical braking system 200 receives control inputs 218 via the control line interface 204, for example a service braking function triggered by the train driver or an emergency braking function triggered by an emergency braking mechanism.

[0152] Furthermore, the electromechanical braking system 200 receives vehicle state variable inputs 220 via the control line interface 204, for example wheel speeds detected by sensors, vehicle weights detected by sensors or by manual input, etc.

[0153] Furthermore, the electromechanical braking system 200 receives braking system state variable inputs 222 via the control line interface 204, for example, friction element temperatures detected by sensors, the position of the friction element drive means 212 or the braking force unit, etc. The electromechanical braking system 200 is supplied with electrical energy via the power supply interface. The power supply serves, on the one hand, to supply electronic components with current so that the functions provided by the components, in particular control functions, can be provided. The power supply also serves, or alternatively, to generate the braking energy, which in the exemplary embodiment is the mechanical energy with which the brake shoes 210 are directly or indirectly pressed against the brake discs 206. In the present case, this energy is electrical energy for driving the brake actuator motor 212.Particularly for the safety braking case, the energy supply can also consist of mechanical energy, for example through a force generated by a pre-tensioned spring assembly that is triggered in the event of a safety braking case.

[0154] The electromechanical braking system 200 includes a brake control unit 224 as a functional assembly. This assembly provides a set of functions for providing train-wide and local braking and extension functions based on the control inputs 218, vehicle state variable inputs 220, or braking system state variable inputs 222. A first control path 226 is implemented in the brake control unit 224, wherein the first control path 226 is part of a service braking path 228 (dotted contour). The service braking path 228 is a braking path as a series of functions which, as a whole, implement a braking process with low safety integrity. A second control path 230 is implemented in the brake control unit 224, wherein the second control path 230 is part of a safety braking path 232 (dashed contour).The safety braking path 232 is a braking path as a series of functions, in particular safety braking functions, which as a whole implement a braking process with high safety integrity, ie implement at least one safety braking function.

[0155] The electromechanical braking system 200 includes a braking force unit 234 as a functional assembly. This assembly provides a set of functions for generating friction braking force based on the control inputs 218, vehicle state variable inputs 220, or braking system state variable inputs 222. A first functional part 236 is implemented in the braking force unit 234, wherein the first functional part 236 is part of the service braking path 228 and provides functions for generating braking force in the first path. A second functional part 238 is implemented in the braking force unit 234, wherein the second functional part 238 is part of a safety braking path 232 and provides functions for generating braking force in the second path.

[0156] The electromechanical braking system 200 comprises, as described above, the highly reliable functional parts 216. The highly reliable functional parts 216, in their entirety, form both a part of the service braking path 228 and a part of the safety braking path 232. A friction braking force 240 is generated by the highly reliable functional parts 216.

[0157] Safety-relevant braking functions (also safety braking functions) require a high level of safety integrity, i.e. a high level of effectiveness of the safety functions under required conditions. The functional reliability of the braking system 200 in electrical / electronic design depends on the complexity of the functional implementation and, in particular, can only be validated in accordance with this complexity. If the complexity of the software or electronics increases, there is a risk of a state space explosion that can no longer be handled with regard to safety validation. The provision of the safety functions or minimum functions of the safety functions with the highest level of integrity, which are available in all degraded states, i.e. in all states in which the braking system operates below its nominal functionality, is therefore achieved by means of an arrangement of as few elements as possible, which are simplified, static or.are either state-independent or dependent on a limited number of states. This design allows for simplified validation and verification, or even makes these possible in principle. These safety functions are therefore implemented in the safety braking path 232. Technically, this is implemented as an implementation of today's operating principles using electrical, electronic, or mechanical means, as well as combinations of these means. In this sense, the safety braking path 232 is also designed to be dominant to the service braking path 228 and will, depending on the situation, bridge it or deactivate it by activating switching processes. In this context, safety functions are also part of the path in order to assess the integrity of the overall system or its subcomponents and to provide the safety braking path with a basis for decisions on switching processes orto restore the necessary safety braking functions.

[0158] Since a braking system 200 based on an electromechanical principle opens up the possibility of implementing previously purely mechanical technical solutions using software functions, this results in an increased complexity of functions with regard to parameters and variants, depending on the project-specific application. Situation-dependent, dynamic and time-variant extension functions can also be implemented in the software of the braking system to increase the braking quality in such a system. This complex component, as a combination of electronics, electrical components and software, can therefore be provided as part of the brake control unit 224 and the first functional part 236 of the braking force unit 234, each with a low integrity, in order not to violate the integrity of the safety functions. The braking functions provided by this software are either supplementary to the safety-relevant braking functions (e.g.Emergency brake / rapid brake, parking brake) are not provided or are not entirely assigned to the safety-relevant braking functions and are therefore assigned to the service braking functions during normal operation of the rail vehicle 1. In the case of addition, however, these functions are non-reactive to the safety functions and are designed in such a way that they do not violate, prevent or impair the minimum functions with maximum availability in any technical condition.

[0159] To fulfill their functions, the service brake path 228 and the safety brake path 232 utilize the highly reliable functional components 216 of the brake force unit 234, which are not designed redundantly and for which permanent functional properties can be demonstrated. The highly reliable functional components 216 can comprise, for example, mechanical components (e.g., a brake caliper) or electric motors. The arrangement of the service brake path 228 and the safety brake path 232 is designed such that the provision of the safety brake path 232 and, in particular, its minimum functions is independent of the behavior of the service brake path 228. The service brake path 228 is also implemented, in particular, without any reaction to the safety brake path 232 and to the highly reliable functional components 216. It is ensured that no individual fault results in a failure in the safety brake path 232.

[0160] In the event of a failure of service brake functions or extended functions in the first functional part 236, depending on the brake function / type, switching is made to the safety brake path 232 and the requested function is implemented with at least the highest integrity minimum functions or an error reaction acceptable for the operating mode, the type of failure or the failure range is carried out.

[0161] A safety architecture of a second embodiment of a braking system 300 is described with reference to Fig. 4.

[0162] The braking system 300 corresponds to the braking system 200 of the first exemplary embodiment. For the description of the braking system and its components, reference is made to the first exemplary embodiment, unless the following description indicates any deviations.

[0163] The braking system 300 according to the second embodiment pursues the objective of generating a friction braking force for decelerating the vehicle mass of the rail vehicle assembly 1, because with such a braking system it is possible to provide service braking functions and safety-relevant braking functions, such as emergency braking function, rapid braking function or parking braking function.

[0164] For this purpose, the braking system 300 has a safety architecture with two different integrity levels for operating an electromechanical braking system in rail-bound vehicles. The electromechanical braking system 300 receives the control inputs 218 via the control line interface 204, for example, a service braking function triggered by the train driver or an emergency braking function triggered by an emergency braking mechanism.

[0165] Furthermore, the electromechanical braking system 300 receives the vehicle state variable inputs 220 via the control line interface 204, for example wheel speeds detected by sensors, vehicle weights detected by sensors or by manual input, etc.

[0166] Furthermore, the electromechanical brake system 300 receives the brake system state variable inputs 222 via the control line interface 204, for example friction element temperatures detected by sensors, position of the friction element drive means 212 or the brake force unit, etc.

[0167] The electromechanical braking system 300 is supplied with electrical energy via the energy supply interface 202 (energy supply 223).

[0168] The electromechanical braking system 300 comprises a brake control unit 324 as a functional assembly. This assembly provides a set of functions for providing train-wide and local braking and extension functions based on the control inputs 218, vehicle state variable inputs 220, or brake system state variable inputs 222. The brake control unit 324 is configured to generate at least one control or actuating signal of a force actuating variable 382 (e.g., application force, braking torque) and, in the presence of switching states, switch commands 380, wherein the control or actuating signal may be dependent on the control inputs 218, vehicle state variable inputs 220, or brake system state variable inputs 222.

[0169] A first functional group 334 is implemented in the brake control unit 324. The first functional group 334 is part of a service braking path 328 and provides, for example, braking functions and optionally extended functions. A second functional group 336 is implemented in the brake control unit 324. The second functional group 336 is part of a safety braking path 232 and provides safety braking functions or their minimum functions.

[0170] A third functional group 338 is implemented in the brake control unit 324, wherein the third functional group 338 implements safety functions 340. The existence of the third functional group 338 is optional. Safety functions are functions that monitor and diagnose the integrity of the other functions, in particular the braking paths, and, in the event of a switching condition, can perform a compensation process by means of switching processes in order to maintain or restore the safety braking functions.Safety functions 340 include, for example, a braking path monitor 341 that monitors the function of a braking path, an actuator monitor 342 that monitors the function of an actuator, a supply monitor 343 that monitors the energy supply, a decision maker 344 that determines whether a switching state exists, and a data storage function 345 by means of which state data can be logged or invariable control data can be retrieved and applied.

[0171] The brake path monitor 341 is a monitoring function of the brake path, including the service and safety braking functions, as well as the extended functions contained therein, up to and including the generation of the force control variable 382, ​​with the purpose of generating at least one switching command. The monitoring function includes at least the legally required monitoring of braking or extended functions (e.g., monitoring of the wheel slide protection function, see UIC 541-05 Chapter V4.1.5 "Safety Circuit of the Wheel Slide Protection" and DIN EN 15595 Chapter 5.1.3 "Safety Circuit (Safety Time)").

[0172] The actuator monitor 342 is a function for monitoring the fulfillment of this force control variable 382 by the actuator control unit 348 jointly with a braking force unit 358, as well as for monitoring the status of all functions of the braking force unit 358 with the purpose of protecting the safety braking path 232 and the highly reliable functional components 316 and generating a switching signal in a switching situation. The function can further include a range of functions that monitors the input signals through the first control path 350 of the actuator control unit 348 and, if necessary, concludes that they are implausible or faulty.

[0173] The supply monitor 343 is a monitoring function of a power supply unit 370, which in particular takes into account the state of a fourth switching unit 378, an external power supply 374 or a buffer memory 372 and generates a switching signal by means of an evaluation logic in the event of a switching.

[0174] A decision maker 344 is a fourth monitoring function that uses at least one of the previously mentioned monitoring functions as input variables and, in the event of a switchover, generates a switchover signal 380 for the purpose of controlling the switchover units 346, 356, 364, 378 of the brake control unit 324, the actuator control unit 348, or the brake force unit 358. This function optionally further evaluates the input variables (control inputs, vehicle state variables, brake system state variables) to determine a requested target state (e.g., request for a safety brake function by the train control lines) and to transfer the brake system 300 to this state or a defined safe state by generating commands to the functional units. Such a switchover signal can also be generated outside the brake system and transmitted to the brake system.

[0175] The data memory 345 is a data storage function which provides at least one substitute value for the force control variable 382 for at least one input variable of the decision maker 344 and thus permanently stores parameters of the safety brake functions and, in addition, calibration data or current or historical status data of the units and makes them available to the other functions.

[0176] The third functional group 338 is configured to generate a switching command for an actuator control unit or braking force unit, described later, in a switching state. The existence of the third functional group 338 is optional.

[0177] A first switching unit 346 is implemented in the brake control unit 324, which is configured to provide the control or actuating signal in the event of triggering by a safety function on the basis of the third functional group 338 of the safety braking path 232 and to form it additionally by adding or alternatively solely on the basis of the data storage function.

[0178] The electromechanical braking system 300 has an actuator control unit 348 as a functional assembly. This assembly provides a set of functions for providing force generation functions in the braking path based on force control variables 382 based on the control inputs 218, vehicle state variable inputs 220, or brake system state variable inputs 222. The actuator control unit 348 is designed to generate at least one actuation variable 384 as a control or control signal (e.g., an excitation variable for the principle of an electric machine) and, in the presence of a switchover state, a switchover command for at least one braking force unit which receives control inputs from the brake control unit 324, with the aim of implementing the force control variable 382.

[0179] A first control path 350 is implemented in the actuator control unit 348, wherein the first control path 350 is part of the service brake path 228. The first control path 350 is configured to calculate and evaluate state or process variables of the brake force unit (e.g., force measurement, position measurement) and to implement force adjustment processes as part of the service brake functions by providing actuation variables 384 with low safety integrity.

[0180] A second control path 352 is implemented in the actuator control unit 348, wherein the second control path 352 is part of the safety braking path 332. The second control path 352 is configured to calculate and evaluate state or process variables (e.g., force measurement, position measurement) of the braking force unit for implementing force adjustment processes as part of the safety braking functions (e.g., emergency brake, parking brake) by providing actuation variables 384 with high safety integrity.

[0181] A fourth functional group 354 is implemented in the actuator control unit 348, wherein the fourth functional group 354 implements one or more of the safety functions 340. The fourth functional group 354 is configured to generate a switching command for a braking force unit described later in a switching state. The existence of the fourth functional group 354 is optional.

[0182] A second switching unit 356 is implemented in the actuator control unit 348, which is configured to accept or bypass the control or actuating signal at any time and without feedback through a second control path (see below). For this purpose, the second switching unit 356 is configured to switch the first control path 350 without any effect.

[0183] The electromechanical braking system 300 includes a braking force unit 358 as a functional assembly. This assembly provides a set of functions for generating friction braking force based on the control inputs 218, vehicle state variable inputs 220, or braking system state variable inputs 222.

[0184] A first functional part 360 is implemented in the braking force unit 358, wherein the first functional part 360 is part of the service braking path 228. The first functional part 360 consists of a mechatronic control unit and electrical / electronic force-generating elements (e.g., the power electronics of an electric machine) with a low level of safety integrity. The first functional part 360 is optional.

[0185] A second functional part 362 is implemented in the braking force unit 358, wherein the second functional part 362 is part of a safety braking path 232. The second functional part 362 consists of a mechatronic control unit and electrical or electronic force-generating elements (e.g., power electronics of an electric machine) with a high level of safety integrity. A third switching unit 364 is implemented in the braking force unit 358, which is configured to enable the actuator control unit 348 or the brake control unit 324, by reading in switching commands 380, to select the service braking path 328 or the safety braking path 332 and to switch between the two paths without any reaction. For this purpose, the switching unit is designed such that it switches the non-active braking path without any effect.

[0186] The brake force unit 358 has highly reliable functional parts 316. The highly reliable functional parts 316, as a whole, form part of both the service braking path 328 and the safety braking path 332.

[0187] Optionally, the braking force unit 358 has further functional parts that can be used jointly by the first functional part 360 or the second functional part 362 and have permanent functional properties or are designed to be highly reliable (e.g., an electrical machine, mechanical brake attachments or sensor units).

[0188] The braking force unit 358 further comprises sensor units 366 used jointly or separately by the two control paths for determining states of the braking force unit 358 (e.g. current, force, position).

[0189] The electromechanical braking system 300 includes a power supply unit 370 as a functional assembly. This assembly provides a set of functions for providing power to components of the braking system.

[0190] A buffer storage 372 is implemented in the energy supply unit 370. The buffer storage 372 is configured to allow a defined amount of energy to maintain at least one of the safety braking functions or their minimum functions with at least one complete actuation and to supply the units of the braking system 300 with sufficient operating energy. The energy supply unit 370 has an external energy supply 374 via the energy supply interface 302. The external energy supply 374 provides the energy supply to the components of the braking system 300 during normal operation.

[0191] A fifth functional group 376 is implemented in the power supply unit 370, wherein the fifth functional group 376 implements one or more of the safety functions 340. The fifth functional group 376 is configured to generate a switching command 380 for the brake control unit 324, the actuator control unit 348, or the braking force unit 358 in a switching state. The existence of the fifth functional group 376 is optional.

[0192] A fourth switching unit 378 is implemented in the energy supply unit 370, which, in the event of a supply error or failure of the external energy supply, switches the supply of all units of the braking system 300 to the buffer memory 372 and makes its internal state known to the functional group of the safety functions.

[0193] A safety architecture of a third embodiment of a braking system 400 is described with reference to Fig. 5.

[0194] The braking system 400 corresponds to the braking system 300 of the second exemplary embodiment. For a description of the braking system and its components, reference is made to the second exemplary embodiment and Fig. 4, unless the following description indicates any deviations.

[0195] The braking system 400 according to the third exemplary embodiment pursues the objective of generating a frictional braking force to decelerate the vehicle mass of the rail vehicle assembly 1. Such a braking system makes it possible to provide service braking functions and safety-relevant braking functions, such as emergency braking, rapid braking, or parking braking. For this purpose, the braking system 400 has a safety architecture with two different integrity ratings for operating an electromechanical braking system in rail-bound vehicles.

[0196] The electromechanical braking system 400 receives control inputs 218 via a control line interface 204, for example a service braking function triggered by the train driver or an emergency braking function triggered by an emergency braking mechanism.

[0197] Furthermore, the electromechanical braking system 400 receives vehicle state variable inputs 220 via the control line interface 204, for example wheel speeds detected by sensors, vehicle weights detected by sensors or by manual input, etc.

[0198] Furthermore, the electromechanical brake system 400 receives brake system state variable inputs 222 via the control line interface 204, for example friction element temperatures detected by sensors, position of friction element drive means 212 or the brake force unit, etc.

[0199] The electromechanical braking system 400 is controlled by the

[0200] The electromechanical braking system 400 includes a brake controller 480 as a component that functions to perform braking control tasks. The brake controller 480 is provided as a low-safety integrity component, is part of the service braking path 228, and is housed in the car or car body of the driven car 110 or the towed car 150.

[0201] The electromechanical braking system 400 includes an actuator 482 as a component serving as a functional carrier for performing braking tasks. The actuator 482 is provided as a component with high safety integrity, is part of the safety braking path 232, and is housed in the bogie near the friction force generation. The electromechanical braking system 400 includes a power supply 484 as a component serving as a functional carrier for implementing the power supply unit. The power supply 484 is provided as a component with high safety integrity, is part of the safety braking path 232, and is located in the car or car body.

[0202] The brake control 480 has a first brake control unit 486 and a first actuator control unit 488. The first brake control unit 486 implements parts of the brake control unit 324. The first brake control unit 486 implements the braking functions of the brake control unit 324 that are part of the service braking path 228 and generates the force control variable 382 (e.g., target cylinder force and reduction signal) for provision to the actuator 482 and to the first actuator control unit 488. The first actuator control unit 488 implements parts of the actuator control unit 348, namely those that are part of the first service braking path 228. The first actuator control unit 488 provides first actuation variables 494 in the service braking path 228, which contains the first control path.

[0203] The actuator 482 has a second brake control unit 490 and a second actuator control unit 492. The second brake control unit 490 implements parts of the brake control unit 324. The second brake control unit 490 implements the second functional group 336 with braking functions of the brake control unit 324, which are part of the safety braking path 232 and generates a force control variable for implementing the safety braking functions and receives the first actuation variables 494 for implementing the service braking functions, which include the safety functions brake path monitor 341, actuator monitor 342, decision maker 344, and data memory 345. The second actuator control unit 492 implements parts of the actuator control unit 348, namely those that are part of the safety braking path 232. The second actuator control unit 492 provides the actuation variables A 496 and actuation variables B 297 in the safety braking path 432.The actuator 482 further includes the braking force unit 458, which contains the actuation variables depending on the active braking path. The power supply 484 includes a power supply unit 470.

[0204] The power supply unit 470 contains the supply monitor 343.

[0205] By defining the decision maker 344 as to which target states of the rail vehicle are read in, in combination with the data storage function 345, the safety brake functions (e.g. emergency brake, parking brake) can be implemented by the actuator 482 and the power supply 484 in the event of a fault or degradation, even entirely without the brake control.

[0206] For this purpose, there is a real-time signal exchange with low safety integrity between the brake controller 480 and the actuator 482 to enable the implementation of the first control path of the actuator control unit, as well as between the power supply 484 and the actuator 482 to enable the transmission of the switching commands.

[0207] In the safety braking path 232, at least one force control variable of the brake control 480 is made available directly to the actuator 482 or for implementation by the second control path, which, however, are secured by the functions of the safety braking path 232 in the second brake control unit 490 in such a way that minimum functions are ensured in the error, failure or degradation scenario.

[0208] This design allows, in particular, the functions of the first control path of the brake control 480 to be of a high quality and enables extensions or technical improvement measures without adapting the actuator 482 and violating the integrity of the safety brake path.

[0209] If the brake control 480 is single-channel and designed with a low level of safety integrity, this design requires only one high-integrity electronic unit in the actuator 482 to execute the safety brake functions 340, which includes the second control path of the actuator control unit and the second control path of the brake force unit. This leads to a cost-effective design on the one hand, and to a low train-wide failure rate of the safety brake functions, or in particular the minimum functions, on the other, since these are available per actuator.

[0210] For this purpose, in a specific embodiment, the second control path of the brake force unit is generally only made accessible to the second control path of the actuator control unit

[0211] A safety architecture of a fourth embodiment of a braking system 500 is described with reference to Fig. 6.

[0212] The braking system 500 corresponds to the braking system 400 of the third exemplary embodiment. For a description of the braking system and its components, reference is made to the second exemplary embodiment and Fig. 5, unless the following description indicates any deviations.

[0213] The electromechanical braking system 500 includes a brake controller 580 as a functional unit for performing braking control tasks. The brake controller 580 is provided as a functional group with low safety integrity, is part of the service braking path 228, and is preferably housed in the car or car body of the driven car 110 or the towed car 150.

[0214] The electromechanical braking system 500 includes an actuator 582 as a functional unit for performing braking tasks. The actuator 582 is provided as a component as a functional group with high safety integrity, is part of the safety braking path 232, and is preferably located in the bogie near the friction force generation.

[0215] The electromechanical braking system 500 includes a power supply 584 as a component serving as a functional carrier for implementing the power supply unit. The power supply 584 is provided as a functional group with high safety integrity, is part of the safety braking path 232, and is preferably provided in the car or car body. The brake control 580 includes a first brake control unit 586 and a first actuator control unit 588. The first brake control unit 586 implements parts of the brake control unit 324. The first brake control unit 586 implements the braking functions of the brake control unit 324 that are part of the service braking path 228 and generates a force control variable 382 (e.g., target cylinder force and reduction signal) for provision to the actuator 582 and to the first actuator control unit 588. The first actuator control unit 588 implements parts of the actuator control unit 348.The first actuator control unit 588 provides actuation variables in the service brake path, which contains the first control path.

[0216] The actuator 582 has a second brake control unit 590 and a second actuator control unit 592. The second brake control unit 590 implements parts of the brake control unit 324. The second brake control unit 590 implements the braking functions of the brake control unit 324, which are part of the safety braking path 232 and generates a force control variable 382 for implementing the safety braking functions and receives the actuation variables for implementing the service braking functions. The second brake control unit 590 implements the safety functions 340, brake path monitor 341, actuator monitor 342, decision maker 344, and data memory 345. The second actuator control unit 592 implements parts of the actuator control unit 348. The second actuator control unit 592 provides actuation variables in the safety braking path 232.The actuator 582 further comprises the braking force unit 558, which receives the actuation variables depending on the active braking path.

[0217] The power supply 584 contains the supply monitor 343.

[0218] Furthermore, the electromechanical braking system 500 implements an expansion functional unit 594 with a third brake control unit 596.

[0219] The fourth embodiment is an additional variant of the third embodiment, which features the expansion function carrier 594, in which the third brake control unit 596 executes signal reading, signal processing, or control functions 597 that extend the brake control unit with a high level of safety integrity (example: information about the load or vehicle mass of one or more parts of a bogie or a vehicle). In a further step, either the original signal, a processed signal, or a control signal is provided to the other control units in the form of at least one expansion variable 597 with a high level of safety integrity. This allows the following functional chain to be achieved:

[0220] In the case of a safety braking function (e.g. emergency / rapid braking), a highly integrated extension variable (e.g. load) with the achieved safety integrity of the determination and transmission of the extension function unit can be provided to the actuator and used by the actuator to carry out braking or other extension functions in the safety braking path (e.g. load correction) together with the functions available there (e.g. the decision maker or the

[0221] data storage function) (e.g. correction of the braking force value).

[0222] In the case of service brake functions, the extension variables 598 can be made available to the extension functions 597 in the brake control 580 in order to implement them (e.g. load correction).

[0223] The extension function carrier 594 receives sensor variables 599 as input. Alternatively or additionally, the extension function carrier 594 can itself contain sensors and obtain the sensor data from them. The extension function unit outputs extension variables 598. These can either consist of the sensor data itself or of variables derived from it.

[0224] This expansion of the first variant achieves an improvement in the safety braking functions, while maintaining the complexity of the brake control at the low safety integrity level and allowing it to be implemented cost-effectively. Furthermore, the existing second brake control unit 590 in the high-integrity actuator 582 can be used to implement expanded functions of the safety braking functions. A first modification of the fourth embodiment is described with reference to Fig. 7.

[0225] The first modification of the fourth embodiment corresponds to the fourth embodiment. For the description of the fourth embodiment and its components, reference is made to the fourth embodiment, unless the following description indicates any deviations.

[0226] Unlike in the fourth embodiment, in which a third brake control unit 596 is provided, which carries the extension function unit 594, in the first modification of the fourth embodiment, the extension function unit 594', 594" is integrated in the first brake control unit and here provides function groups for the first braking path and the second braking path, wherein extension variables are output in the first braking path and the second braking path and transmitted to the second brake control unit.

[0227] A second modification of the fourth embodiment will be described with reference to Fig. 8.

[0228] The second modification of the fourth embodiment corresponds to the fourth embodiment. For the description of the fourth embodiment and its components, reference is made to the fourth embodiment, unless the following description indicates any deviations.

[0229] Unlike the fourth embodiment, in which a third brake control unit 596 is provided, which carries the extension function unit 594, in the second modification of the fourth embodiment, the extension function unit 594"' is integrated into the first brake control unit and provides function groups for the first braking path, with extension variables being output in the first braking path and transmitted to the second brake control unit. In the second brake control unit, the extension variables can be processed in both the first braking path and the second braking path. In the fourth embodiment and its modifications, it is described that when a switching state has been detected and the braking system is in the safety braking path, functions and extension functions of the first braking path can be accessed.For example, it is possible to access the functionality of a wheel slide protection from the service brake path in the safety brake path without having to implement it again in the safety brake path.

[0230] A safety architecture of a fifth embodiment of a braking system 600 is described with reference to Fig. 9.

[0231] The braking system 600 corresponds to the braking system 300 of the second exemplary embodiment. For a description of the braking system and its components, reference is made to the second exemplary embodiment and Fig. 4, unless the following description indicates any deviations.

[0232] The braking system 600 according to the fourth embodiment pursues the objective of generating a friction braking force for decelerating the vehicle mass of the rail vehicle assembly 1, because with such a braking system it is possible to provide service braking functions and safety-relevant braking functions, such as emergency braking function, rapid braking function or parking braking function.

[0233] The electromechanical braking system 600 includes a brake controller 680 as a component that serves as a functional carrier for performing brake control tasks. The brake controller 680 is provided as a functional group with high safety integrity, is part of the service braking path 228 and the safety braking path 232, and is preferably housed in the car or car body of the driven car 110 or the towed car 150.

[0234] The electromechanical braking system 600 includes an actuator 682 as a component serving as a functional carrier for performing braking tasks. The actuator 682 is provided as a functional group with high safety integrity, is part of the safety braking path 232, and is preferably located in the bogie near the friction force generation. The electromechanical braking system 600 includes a power supply 684 as a functional carrier for implementing the power supply units. The power supply 684 is provided as a functional group with high safety integrity, is part of the safety braking path 284, and is preferably located in the car or car body.

[0235] The brake control 680 has a first brake control unit 686 and a first actuator control unit 688. The first brake control unit 686 implements parts of the brake control unit 324. The first brake control unit 686 implements the braking functions of the brake control unit 324 that are part of the service braking path 228 and part of the safety braking path 232, and generates a force control variable 382 (e.g., target cylinder force and reduction signal) for provision to the actuator 682 and the first actuator control unit 688. Furthermore, the first brake control unit 686 implements the safety functions 340, braking path monitor 341, and actuator monitor 342. The first actuator control unit 688 implements parts of the actuator control unit 348, namely those of the service braking path 228.The first actuator control unit 688 provides the first actuation variables 494 in the service brake path, which contains the first control path.

[0236] The actuator 682 has a second brake control unit 690 and a second actuator control unit 692. The second brake control unit 690 implements parts of the brake control unit 324. The second brake control unit 690 implements the braking functions of the brake control unit 324, which are part of the safety braking path 232 and generates a force control variable for implementing the safety braking functions and receives the actuation variables for implementing the service braking functions. The second brake controller 690 implements the safety functions 340, decision maker 344, and data memory 345. The second actuator control unit 692 implements parts of the actuator control unit 348. The second actuator control unit 692 provides actuation variables in the safety braking path 232. The actuator 682 further has the braking force unit 658, which contains the actuation variables depending on the active braking path.

[0237] The power supply 684 implements the power supply unit 470 with the supply monitor 343.

[0238] The fundamental enabling of functions with high safety integrity of the central brake control means that safety functions can also be individualized, expanded or adapted on a project-specific basis without having to adapt the existing actuator system.

[0239] For the purpose of transmitting the switching commands, appropriate safety-relevant interfaces for communication transmission with high safety integrity must be provided on the brake control and actuator systems.

[0240] The software effort and complexity on the actuator system (which is operated in a critical / demanding environment) is reduced in this variant.

[0241] A safety architecture of a sixth embodiment of a braking system 700 is described with reference to Fig. 10.

[0242] The braking system 700 corresponds to the braking system 300 of the second exemplary embodiment. For a description of the braking system and its components, reference is made to the second exemplary embodiment and Fig. 4, unless the following description indicates any deviations.

[0243] The braking system 700 according to the second exemplary embodiment pursues the objective of generating a frictional braking force to decelerate the vehicle mass of the rail vehicle assembly 1. Such a braking system makes it possible to provide service braking functions and safety-relevant braking functions, such as emergency braking, rapid braking, or parking braking. The electromechanical braking system 700 includes a brake controller 780 as a component that functions as a functional carrier for fulfilling braking control tasks. The brake controller 780 is provided as a functional group with high safety integrity, is part of the service braking path 228 and the safety braking path 232, and is preferably housed in the car or car body of the driven car 110 or the towed car 150.

[0244] The electromechanical braking system 700 includes an actuator 782 as a functional unit for performing braking tasks. The actuator 782 is provided as a component as a functional group with high safety integrity, is part of the safety braking path 232 and the service braking path 228, and is preferably located in the bogie near the friction force generation.

[0245] The electromechanical braking system 700 includes a power supply 784 as a functional carrier for implementing the power supply units. The power supply 784 is provided as a functional group with high safety integrity, is part of the safety braking path 232, and is preferably located in the car or car body.

[0246] The brake control 780 has a first brake control unit 786. The first brake control unit 786 implements parts of the brake control unit 324. The first brake control unit 786 implements the braking functions of the brake control unit 324 that are part of the service braking path 228 or part of the safety braking path 232, and generates a force control variable (e.g., target cylinder force and reduction signal) for provision to the actuator 782 and to the first actuator control unit 788. Furthermore, the first brake control unit 786 implements the safety function 340, braking path monitor 341.

[0247] The actuator 782 has a second brake control unit 790, a first actuator control unit 788, and a second actuator control unit 792. The second brake control unit 790 implements parts of the brake control unit 324. The second brake control unit 790 implements the braking functions of the brake control unit 324, which are part of the safety braking path 232 and generates a force control variable for implementing the safety braking functions and receives the actuation variables for implementing the service braking functions. The second brake control unit 790 implements the first switching unit 346 and the safety functions 340, actuator monitor 342, decision maker 344, and data memory 345.

[0248] The first actuator control unit 788 implements parts of the actuator control unit 348. The first actuator control unit 788 provides actuation variables in the service brake path, which contains the first control path.

[0249] The second actuator control unit 792 implements parts of the actuator control unit 348. The second actuator control unit 792 provides actuation variables in the safety braking path 232. Furthermore, the second actuator control unit 792 implements the second switching unit 356. The actuator 782 further includes the braking force unit 758, which contains the actuation variables depending on the active braking path.

[0250] The power supply 784 implements the power supply unit 470 and contains the supply monitor 343.

[0251] This exemplary embodiment, as a variant (“intelligent force controller with safety brake control”) of the braking system described in the second exemplary embodiment, consists of a functional carrier for performing brake control tasks, a functional carrier for performing brake actuation tasks (actuator), and a functional carrier for the energy supply. In this variant, functions with high safety integrity are also assigned to the first functional carrier (brake control tasks). The task of providing the actuation variables is now performed solely by the actuator in all operating functions. The brake control now only provides force control variables for both operating paths. In this exemplary embodiment, the brake control and actuator control domains are now each assigned to the dedicated functional carriers, resulting in a generic interface.

[0252] In this variant, all functions with high real-time requirements that affect the actuator control domain are no longer transmitted via communication systems between the function carriers but are located entirely within the actuator. This enables greater robustness and performance of the control functions.

[0253] The requirements for the communication system between the brake controller and the actuator are reduced in terms of real-time capability compared to embodiments four and five. This also allows the brake controller to be designed in such a way that it can be located at a greater distance or information path from the actuator and communicates with the actuators only via a common, non-proprietary communication medium.

[0254] For the purpose of transmitting the switching commands and the safety-relevant force control variables, appropriate safety-relevant interfaces for communication transmission with high safety integrity must be provided on the brake control and actuator systems.

[0255] However, the increased complexity of the software of the first control pad of the actuator control unit results in increased effort in the actuator function carrier, which must have a robust failure behavior with respect to the environmental conditions.

[0256] A safety architecture of a seventh embodiment of a braking system 800 is described with reference to Fig. 11.

[0257] The braking system 800 corresponds to the braking system 300 of the second exemplary embodiment. For its description and description of its components, reference is made to the second exemplary embodiment and Fig. 4, unless otherwise indicated in the following description. The braking system 800 according to the second exemplary embodiment pursues the objective of generating a friction braking force to decelerate the vehicle mass of the rail vehicle assembly 1. Such a braking system makes it possible to provide service braking functions and safety-relevant braking functions, such as emergency braking, rapid braking, or parking braking.

[0258] The electromechanical braking system 800 includes a brake controller 880 as a functional unit for performing brake control tasks. The brake controller 880 is provided as a component as a functional group with low safety integrity, is part of the service braking path 228 and the safety braking path 232, and is preferably housed at least once per car or bogie in the car or car body of the driven car 110 or the towed car 150.

[0259] The electromechanical braking system 800 includes an actuator 882 as a functional unit for performing braking tasks. The actuator 882 is provided as a component as a functional group with high safety integrity, is part of the safety braking path 232 and the service braking path 228, and is preferably located in the bogie near the friction force generation.

[0260] The electromechanical braking system 800 includes a power supply 884 as a functional carrier for implementing the power supply units. The power supply 884 is provided as a component as a functional group with high safety integrity, is part of the safety braking path 232, and is located in the car or car body.

[0261] The brake control 880 has a first brake control unit 886. The first brake control unit 886 implements parts of the brake control unit 324. The first brake control unit 886 implements the braking functions of the brake control unit 324, which are part of the service braking path 228, and generates a force control variable 382 (e.g., target cylinder force and reduction signal) for provision to the actuator 882 and to a first actuator control unit 888. The actuator 882 has a second brake control unit 890, a first actuator control unit 888, and a second actuator control unit 892. The second brake control unit 890 implements parts of the brake control unit 324.The second brake control unit 890 implements the braking functions of the brake control unit 324, which are part of the safety braking path 232 and generates a force control variable for implementing the safety braking functions and receives the actuation variables for implementing the service braking functions. The second brake control unit 890 implements the first switching unit 346 and the safety functions 340, braking path monitor 341, actuator monitor 342, decision maker 344, and data memory 345.

[0262] The first actuator control unit 888 implements parts of the actuator control unit 348. The first actuator control unit 888 provides actuation variables in the service brake path, which contains the first control path.

[0263] The second actuator control unit 892 implements parts of the actuator control unit 348. The second actuator control unit 892 provides actuation variables in the safety braking path. Furthermore, the second actuator control unit 892 implements the second switching unit 356.

[0264] The actuator 882 further comprises the braking force unit 858, which contains the actuation variables depending on the active braking path.

[0265] The power supply 884 implements the power supply unit 470 and contains the supply monitor 343.

[0266] The seventh embodiment (“Intelligent brake actuator with conventional brake control”) of the braking system consists of a functional unit for performing brake control tasks, a functional unit for performing brake actuation tasks (actuator), and a functional unit for the power supply. The task of providing the actuation variables is now performed solely by the actuator in all operating functions. The brake control now only provides force control variables for both operating paths.

[0267] This embodiment is similar to the sixth embodiment, whereby the brake control and actuator control domains are each assigned to the dedicated functional units, resulting in a generic interface. The functional complexity in the actuator now fully encompasses all safety-relevant braking functions, which increases the complexity and requires constant adaptation when the function changes.

[0268] There is no longer any need to provide safety-relevant interfaces for communication transmission with high safety integrity between the brake control and actuator systems, which reduces the effort.

[0269] A safety architecture of an eighth embodiment of a braking system 900 is described with reference to Fig. 12.

[0270] The electromechanical braking system 900 includes an optional brake controller 980 as a component that serves as a functional carrier for performing brake control tasks. The brake controller 980 is provided as a low-safety integrity functional group, is part of the service braking path 228, and is preferably located at least once per car or bogie in the car or car body of the driven car 110 or the hauled car 150.

[0271] The electromechanical braking system 900 includes an actuator 982 as a component serving as a functional carrier for performing braking tasks. The actuator 982 is provided as a functional group with high safety integrity, is part of the safety braking path 232 and the service braking path 228, and is preferably located in the bogie near the friction force generation.

[0272] The electromechanical braking system 900 includes a power supply 984 as a component serving as a functional carrier for implementing the power supply units. The power supply 984 is provided as a functional group with high safety integrity, is part of the safety braking path 232, and is preferably provided in the car or car body.

[0273] The brake controller 980 includes a first brake control unit 986. The first brake control unit 986 implements parts of the brake control unit 324. The first brake control unit 986 implements the braking functions of the brake control unit 324, which are part of the service braking path 228, and generates a force control variable (e.g., target cylinder force and reduction signal) for provision to the actuator 982 and the first actuator control unit 988.

[0274] The actuator 982 has a second brake control unit 990, a first actuator control unit 988, and a second actuator control unit 992. The second brake control unit 990 implements parts of the brake control unit 324. The second brake control unit 990 implements the braking functions of the brake control unit 324, which are part of the safety braking path 232 or the service braking path 228, and generates a force control variable for implementing the safety braking functions and receives the actuation variables for implementing the service braking functions. The second brake control unit 990 implements the first switching unit 346 and the safety functions 340, brake path monitor 341, actuator monitor 342, decision maker 344, and data memory 345, as well as the functions of the safety braking path 232 and extended functions (for extended functions, see the fourth exemplary embodiment).

[0275] The first actuator control unit 988 implements parts of the actuator control unit 348. The first actuator control unit 988 provides actuation variables in the service brake path 228, which contains the first control path 350.

[0276] The second actuator control unit 990 implements parts of the actuator control unit 348. The second actuator control unit 990 provides actuation variables in the safety braking path. Furthermore, the second actuator control unit 990 implements the second switching unit 356. The actuator 982 further includes the braking force unit 958, which contains the actuation variables depending on the active braking path.

[0277] The power supply 984 implements the power supply unit 470 and contains the supply monitor 343.

[0278] The eighth embodiment (“partially integrated intelligent brake actuator”) of the braking system consists of a functional unit for performing brake control tasks, a functional unit for performing brake actuation tasks (actuator), and a functional unit for the power supply. In this variant, the second functional unit (brake actuation tasks) is also assigned functions from the brake control domain. The task of providing the actuation variables is now performed solely by the actuator in all operating functions.

[0279] The eighth embodiment represents a brake control system integrated into the actuator with local braking functions. This offers the advantage that, in addition to the control functions of the brake control domain, the control functions of the brake control domain can also operate within a closed functional unit and are not dependent on transmission paths and latencies of communication paths between functional units. This enables a higher quality of functional fulfillment of the braking functions (e.g., wheel slide protection).

[0280] Furthermore, the brake control function carrier 980 is limited to even less functionality than in the fifth embodiment, which is why it can be completely transferred into a central control function carrier, whereby an overall saving of trades can be achieved.

[0281] This contrasts with the considerable increase in complexity of this variant in the actuator and the associated environmental conditions and failure requirements of the safety functions. A process for project-specific adaptation of the software components located in the actuator is inseparably located with the safety functions on a functional carrier and is thus complicated. A safety architecture of a ninth embodiment of a braking system 1000 is described with reference to Fig. 13.

[0282] The braking system 1000 corresponds to the braking system 300 of the second exemplary embodiment. For a description of the braking system and its components, reference is made to the second exemplary embodiment and Fig. 4, unless the following description indicates any deviations.

[0283] The braking system 1000 according to the ninth embodiment pursues the objective of generating a friction braking force for decelerating the vehicle mass of the rail vehicle assembly 1, because with such a braking system it is possible to provide service braking functions and safety-relevant braking functions, such as emergency braking function, rapid braking function or parking braking function.

[0284] The electromechanical braking system 1000 includes an optional brake controller 1080 as a component serving as a functional carrier for performing brake control tasks. The brake controller 1080 is provided as a low safety integrity functional group, is part of the service braking path 228, and is preferably housed at least once per car or bogie in the car or car body of the driven car 110 or the hauled car 150.

[0285] The electromechanical braking system 1000 includes an actuator 1082 as a component serving as a functional carrier for performing braking tasks. The actuator 1082 is provided as a functional group with high safety integrity, is part of the safety braking path 232 and the service braking path 228, and is housed in the bogie near the friction force generation. The actuator 1082 includes a power supply 1084.

[0286] The electromechanical braking system 1000 includes a power supply 1084 as a component serving as a functional carrier for implementing the power supply units. The power supply 1084 is provided as a functional group with high safety integrity, is part of the safety braking path 284, and is preferably provided in the car or car body.

[0287] The power supply 1084 implements the power supply unit 470 and contains the supply monitor 343.

[0288] The eighth embodiment (“partially integrated intelligent brake actuator”) of the braking system consists of a functional unit for performing brake control tasks, a functional unit for performing brake actuation tasks (actuator), and a functional unit for the power supply. In this variant, the second functional unit (brake actuation tasks) is also assigned functions from the brake control domain. The task of providing the actuation variables is now performed solely by the actuator in all operating functions.

[0289] The ninth embodiment represents a brake control system with local braking functions integrated into the actuator. This offers the advantage that, in addition to the control functions of the brake actuation domain, the control functions of the brake control domain can also operate within a closed functional unit and are not dependent on transmission paths and latencies of communication paths between functional units. This enables a higher quality of functional fulfillment of the braking functions (e.g., wheel slide protection).

[0290] Furthermore, the brake control function carrier 1080 is limited to even less functionality than in the fifth embodiment, which is why it can be completely transferred into a central control function carrier, whereby an overall saving of trades can be achieved.

[0291] This contrasts with the considerable increase in complexity of this variant in the actuator and the associated environmental conditions and failure requirements of the safety functions. A process for project-specific adaptation of the software components located in the actuator is inseparably located with the safety functions on a functional carrier and is thus complicated. A switching process for the embodiments 2 to 9 is described using Fig. 14.

[0292] A first brake control unit 1186 has braking functions of the service brake path and is optional. The first brake control unit 1186 receives control inputs 1118 as input and outputs force control variables 382.

[0293] A second brake control unit 1190 has functions of the safety braking path. It also has the functions of a first changeover switch 346. The first changeover switch 346 is configured to switch from the service braking path to the safety braking path or from the safety braking path to the service braking path upon receipt of a switchover command in the second brake control unit 1190. The second brake control unit 1190 further contains a data memory 345. The data memory 345 is configured to provide substitute values ​​for forming the force control variable 382 in the event of a failure or malfunction of the first brake control unit 1186. The second brake control unit 1190 further contains a braking path monitor 341, which is configured to detect faulty behavior in the braking functions of the first brake control unit 1186 and to communicate this to a decision maker 344 by means of a status signal 1196.The second brake control unit 1190 further includes the decision maker 344. The second brake control unit 1190 receives as input control inputs 1118 and the force control variable 382 of the first brake control 1186 and outputs force control variables 382.

[0294] A first actuator control unit 1188 has braking functions of the service braking path and is optional. The first actuator control unit 1188 receives the force control variable of the first brake control unit 1186 as input and outputs first actuation variables 494.

[0295] A second actuator control unit 1192 has functions of the safety braking path. Furthermore, it has the functions of a second switching unit 356. The second switching unit 356 is configured to switch from the service braking path to the safety braking path or from the safety braking path to the service braking path upon receipt of a switching command 380 in the second actuator control unit 1192. The second actuator control unit 1192 further includes an actuator monitor 342 configured to detect faulty behavior of the first actuator control unit 1188 or second actuator control unit 1192 or the first braking force unit 1186 or second braking force unit 1190 and to communicate this to the decision-maker 346. The second actuator control unit 1192 receives as input the force control variables 380 of the second brake control unit 1190 and outputs actuator control variables A 496 and actuator control variables B 497.

[0296] A first braking force unit 1158 has braking functions 360 of the service braking path and is optional. The first braking force unit 1158 receives the actuator control variables A 496 of the second actuator control unit 1192 as input and outputs force generation variables 1195. These are excitation variables of the physical operating principle of braking force generation, for example, phase currents of an electric motor.

[0297] A second braking force unit 1194 has functions of the safety braking path. Furthermore, it has the functions of a third changeover switch 364. The third changeover switch 364 is configured to switch from the service braking path to the safety braking path or from the safety braking path to the service braking path upon receipt of a switching command 380 in the second braking force unit 1194. The second braking force unit 1194 receives the actuator control variables B 497 from the second actuator control unit 1192 as input and outputs force generation variables.

[0298] The highly reliable functional parts 316, for example an electric motor for brake actuation, are operated according to the force generation size of the second braking force unit 1194 and thus generate braking force.

[0299] An energy supply unit 1170 supplies the braking system with electrical

[0300] Energy and has the supply monitor 343, which is configured to detect faulty behavior or an error state of the energy supply unit 1170 and a switching process to its internal energy buffer and to communicate this or the impending (final) exhaustion of the energy supply of the integrated energy buffer to the decision maker 344 by means of a status signal.

[0301] The decision maker 344 is configured to receive all status signals from the safety monitors 341, 342, 343 occurring in the system, then determine an error response, and subsequently transmit this error response by means of switching commands 380 to the first switching unit 346 of the brake control unit, the second switching unit 356 of the actuator control unit, or the third switching unit 364 of the brake force unit in order to switch from the first to the second braking path or from the second to the first braking path. Thus, the braking path can be switched between the service braking path and the safety braking path either in the entire braking system, or the braking path can be switched specifically in the brake control units, actuator control units, or brake force units.

[0302] If the service braking path is active in the second brake control unit 1190, the force control variable of the first brake control unit 1186 is output to the first actuator control unit 1192. If the safety braking path is active in the second brake control unit 1190, the force control variable of the second brake control unit 1190 is output to the second actuator control unit 1192.

[0303] If the service braking path is active in the second actuator control unit 1192, the actuator control variable of the first actuator control unit 1188 is output to the first braking force unit 1158 and the second braking force unit 1194. If the safety braking path is active in the second actuator control unit 1192, the actuator control variable of the second actuator control unit 1192 is output to the first braking force unit 1158 and the second braking force unit 1194.

[0304] If the service braking path is active in the second braking force unit 1194, the force generation control variable of the first braking force unit 1158 is output to the highly reliable functional parts 316. If the safety braking path is active in the second braking force unit 1194, the force generation control variable of the second braking force unit 1194 is output to the highly reliable functional parts 1116.

[0305] If the optional first brake control unit 1186 is not present, the first switch 346 can be omitted. If the optional first actuator control unit 1188 is not present, the second switch 356 can be omitted. If the optional first brake force unit 1158 is not present, the third switch 364 can be omitted. If all optional components are omitted, the braking system can be implemented as a safety brake that exclusively provides the safety braking path.

[0306] In this case, the first switch 346 is implemented in the function of the safety braking path of the second brake control unit 1190. Depending on the function, force control variables or modifiers calculated in the first brake control unit 1186 are used or truncated after switching commands from the decision unit 344, thus forming a base value for the force control variables from the data memory 345.

[0307] The second switch 356 switches one of the two inputs to one of the two outputs as shown in the table below.

[0308] There are three cases that follow the rule:

[0309] The functional parts / units with low safety integrity must not have direct access to functions / functional groups / units with high integrity without a switching unit being able to cut them off. The third switch 1164 also switches between the respective force generation paths in a similar way to the second switch 356. Thus, only the path actively supplied with actuation variables A / B also has access to the highly reliable functional parts 316.

[0310] The braking system is thus designed in such a way that the safety function of the decision maker is designed to receive all status signals of the other safety monitors occurring in the system, then to determine an error reaction and consequently to transmit this by means of switching commands to the switching units of the brake control unit, the actuator control unit or the brake force unit in order to switch from the first to the second braking path or from the second to the first braking path.

[0311] This allows any combination of the first brake control unit from the first brake path, the second brake control from the second brake path, the first actuator control unit from the first brake path, the second actuator control from the second brake path, the first brake force unit from the first brake path and the second brake force unit from the second brake path.

[0312] For example, if a switching state is detected, the first switch 346 can still use the functions of the service brake path of the first brake control unit 1186 and remain in the service brake path if it is determined that these functions are still reliable or, in particular, if a fault condition is detected in the data memory 345. In particular, mixed operation may occur. In this respect, the service brake path from the first brake control unit 1186 can exist as a fallback option if a fault occurs in the safety brake path, thus forming an additional protection level.

[0313] Likewise, even when a switching state is detected, the second switchover switch 346 can still use the functions of the service brake path of the first actuator control unit 1188 and remain in the service brake path if it is determined that these functions are still reliable or, in particular, if a fault condition is detected in the safety brake path of the second actuator control unit. In particular, mixed operation can occur. In this respect, the service brake path from the first actuator control unit 1188 can exist as a fallback option if a fault exists in the safety brake path, thus forming an additional protection level.

[0314] Likewise, even when a switching state is detected, the third changeover switch 364 can still use the functions of the service brake path of the first brake force unit 1158 and thus remain in the service brake path if it is determined that these functions are still reliable or, in particular, if a fault condition is detected in the safety brake path of the second brake force unit 1194. In particular, mixed operation can occur. In this respect, the service brake path from the first brake force unit 1158 can exist as a fallback option if a fault occurs in the safety brake path, thus forming an additional protection level. The same applies to the power supply unit 1170.

[0315] This switchback to the service brake path can be performed in each switch independently of the other switches. In particular, the combinations of service brake path - safety brake path - safety brake path, safety brake path - safety brake path - safety brake path, or even service brake path - service brake path - service brake path of the brake control units, actuator control units, and brake force units are possible.

[0316] The invention has been described using exemplary embodiments. The exemplary embodiments are merely illustrative in nature and do not limit the invention as defined by the claims. Deviations from the exemplary embodiment are possible without departing from the scope of the claims, as will be apparent to those skilled in the art. In the exemplary embodiment, the train is implemented as an electric train that is supplied with electrical energy via an overhead line. Alternatively, the electrical energy can also be provided by a generator, such as a diesel generator, carried in the train, for example, in the driven car or in a towed car.

[0317] In the exemplary embodiment, the train assembly 1 is implemented as such with a driven carriage 110 as the lead carriage, with several towed carriages 150. Alternatively, several or all of the carriages can be driven, in particular instead of the lead carriage. Furthermore, alternatively or in addition to the lead carriage, one or more towed carriages can be equipped with a pantograph.

[0318] In the exemplary embodiment, control line 128 is configured as a digital data bus. Alternatively, analog control signals can be transmitted via control line 128. Furthermore, the control line can be implemented in multiple hierarchically structured communication systems. For example, there can be a cross-train communication means connected to car-specific communication means via gateway means. Furthermore, the communication means can be redundant.

[0319] In particular, it is possible to combine features from different embodiments. For example, it is possible to transfer the power supply unit integrated in the actuator to all other embodiments.

[0320] The brake control units are configured to receive a control input comprising a brake command, an extension variable, or a force control variable and to determine an actuation variable or a force control variable therefrom. Furthermore, they are configured to output the actuation variable or the force control variable to the actuator, a brake control unit, an actuator control unit, or the braking force unit.

[0321] The actuator control units are configured to receive a force control variable and to determine an actuation variable therefrom. Furthermore, they are configured to output the actuation variable to the actuator, a brake control unit, an actuator control unit, or the brake force unit.

[0322] The braking force unit is configured to receive an actuation variable and to carry out the mechanical braking process.

[0323] The brake control units, the actuation control units, the braking force unit and the energy supply unit are configured to determine a switching state and, in the event of a switching state, to output a switching signal or a switching command.

[0324] The brake control units, the actuation control units, the braking force unit and the energy supply unit are configured to receive a switching signal or a switching command and, upon receipt thereof, to switch from a first braking path to a second braking path or from a second braking path to a first braking path, in particular to switch from a service braking path to a safety braking path or from a safety braking path to a service braking path.

[0325] The connectives "and," "or," and "either ... or" are used in a sense similar to logical conjunction (logical AND), logical adjunction (logical OR, often "and / or"), and logical contravalence (logical exclusive OR), respectively. In particular, in contrast to "either ... or," the connective "or" can imply the simultaneous presence of both operands.

[0326] A list of process steps in the description and claims merely serves to enumerate the required process steps. It does not imply a necessary order or sequence of the process steps unless such an order or sequence is explicitly stated or is obvious to a person skilled in the art. Furthermore, such a list does not imply its completeness. The term "comprising" in the claims does not imply an exhaustive list; the presence of further elements and steps is possible.

[0327] The use of the indefinite article "ein" or "eine" does not exclude the presence of a plural, but is to be understood as "at least one" or "at least one", unless it is qualified as "exactly one" or "exactly one".

[0328] Furthermore, in the context of this invention, the following terms are understood in the meaning given below.

[0329] Electro-mechanical braking system - A braking system that provides the ability to generate a deceleration braking force of a vehicle using electronic, electrical and mechanical components.

[0330] Braking path - Sum of all functions that are active between the control inputs of the braking system and the generation of the friction braking force and that produce the system-wide braking functions.

[0331] Safety integrity level - also SIL, safety requirement level according to DIN EN 61508-2:17.

[0332] Safety braking functions - also braking functions with high safety integrity, local or train-wide functions of the braking system which have increased safety requirements (e.g. emergency brake, parking brake).

[0333] Safety braking functions are braking functions that have a higher safety integrity level than service braking functions.

[0334] Safety braking path - also second braking path, braking path as a series of functions which, as a whole, implement a braking process with high safety integrity, i.e., implement at least one safety braking function. (Highest integrity) minimum functions - functions as a component / subgroup of the safety braking functions which possess the highest safety integrity and cannot be influenced or manipulated by the other (braking) functions, in particular the extended functions, and are not dependent on them to fulfill their function. Highly reliable functional parts - (also shared functional parts) functions as a component of the braking path which are based on proven, captive functional mechanisms (e.g., mechanical brake calipers) and which possess inherent safety properties.

[0335] Service braking functions – also known as low-safety-integrity braking functions – are local or train-wide braking system functions that have a standard safety requirement and provide a conventional braking function, usually initiated and adaptable by the train driver. Service braking functions are braking functions that have a lower safety integrity level than safety braking functions.

[0336] Service braking path - also first braking path, braking path as a series of functions which as a whole implement a braking process with low safety integrity.

[0337] Extension functions - Local or train-wide functions of the braking system which extend the basic braking functions with quality-improving measures (e.g. wheel slide protection, load correction)

[0338] Safety functions - Functions that monitor and diagnose the integrity of other functions (especially the braking paths), and, if necessary, perform a compensation process using switching operations to maintain or restore the safety braking functions. These include the safety monitoring functions: brake path monitor, actuator monitor, and supply monitor, as well as the other safety functions: decision maker and data storage function. Decision maker - Safety function that is configured to receive all status signals from the safety monitoring functions occurring in the system, then determine an error response, and subsequently transmit this to at least one switching unit using a switching command.

[0339] Switching unit - Functional group in brake control unit, actuator control unit or brake force unit that switches from a service braking path to a safety braking path or from a safety braking path to a safety braking path upon receipt of a switching command.

[0340] Brake path monitor - Safety monitoring function that monitors safety-relevant physical parameters of the brake path and transmits status signals via the brake path to a decision-maker. In particular, the brake path monitor is designed to detect faulty behavior in the braking functions of the first brake control unit(s).

[0341] Actuator monitor - Safety monitoring function that monitors safety-relevant physical parameters of the actuator and transmits status signals via the actuator to a decision-maker. In particular, the actuator monitor is configured to detect faulty behavior of the first or second actuator control unit or the first or second brake force unit.

[0342] Supply monitor - Safety monitoring function that monitors safety-relevant physical parameters of the braking system's power supply and transmits status signals via the power supply to a decision-maker. Specifically, the supply monitor is designed to detect faulty behavior or a fault condition of the power supply unit and a switchover to its internal energy buffer, and to report this or the impending (final) depletion of the integrated energy buffer's power supply via the status signal to the decision-maker function.

[0343] Data storage function - remaining safety function which is designed to provide substitute values ​​for forming the force control variable in the event of failure / faulty behavior of the first brake control unit and to make them available as the actual values ​​for provision to the actuator control unit based on a switching signal from the decision maker.

[0344] Brake control unit - Set of functions for providing train-wide and local braking and augmentation functions in the braking path based on control inputs or vehicle state variables or braking system state variables.

[0345] Actuator control unit - set of functions for providing force generation functions in the braking path based on force control variables.

[0346] Braking force unit - set of functions for generating friction braking force based on actuation variables.

[0347] Brake control - assembly designed to perform the functions of the brake control unit and optionally additionally the actuator control unit.

[0348] Actuator - assembly configured to perform the functions of the brake control unit, the actuator control unit, and the brake force unit.

[0349] Extension function carrier - assembly that is designed to provide extended functions.

[0350] Force control variable - control or regulating variable which either directly or indirectly represents a requirement of the braking path to generate a force in a coordinate system relevant to the brake actuator (e.g. cylinder force), as well as associated control or manipulation variables such as reduction signals, adjustment variables for quality improvement, etc. to be taken into account when setting this force.

[0351] Actuation variable - Control or regulating variable which is provided for the present electromechanical process or the operating principle in order to achieve a clear movement, force or position state or similar

[0352] To define and request state properties (e.g. parking brake).

[0353] Power supply unit - set of functions for providing power to components of the braking system.

[0354] LIST OF REFERENCE SYMBOLS

[0355] 1 rail vehicle network

[0356] 110 powered cars

[0357] 112 Drive means, electric motor

[0358] 114 driven wheel axle

[0359] 116 Drive wheel

[0360] 118 Rail

[0361] 120 pantographs

[0362] 122 overhead line

[0363] 123 Accumulator

[0364] 124 Driver's cab of the powered car

[0365] 126 electrical supply line

[0366] 128 control line

[0367] 140 Clutch

[0368] 150 pulled wagon

[0369] 154 non-driven axles

[0370] 156 non-driven wheels

[0371] 160 end cars

[0372] 162 Driver's cab of the end car

[0373] 200 brake system (first embodiment)

[0374] 202 Power supply interface

[0375] 204 Control line interface

[0376] 206 moving friction element, rotary friction element, brake disc

[0377] 208 brake caliper

[0378] 210 static friction element, brake shoes

[0379] 212 Friction element drive means, brake actuator motor

[0380] 214 spindle drive

[0381] 216 highly reliable functional parts

[0382] 218 control entries

[0383] 220 vehicle state variable inputs

[0384] 222 Brake system state variable inputs

[0385] 223 Power supply 224 Brake control unit

[0386] 226 first control path

[0387] 228 Service braking path

[0388] 230 second control path

[0389] 232 Safety braking path

[0390] 234 Brake force unit

[0391] 236 first functional part, first path force generation

[0392] 238 second functional part, second path force generation

[0393] 239 Friction braking force, contact force

[0394] 300 braking system (second embodiment)

[0395] 316 highly reliable functional parts

[0396] 324 Brake control unit

[0397] 334 first functional group of the brake control unit for brake functions and

[0398] Extension functions

[0399] 336 second functional group of the brake control unit for

[0400] Safety braking functions

[0401] 338 third functional group of the brake control unit for safety functions

[0402] 340 security features

[0403] 341 Braking path monitor

[0404] 342 Actuator Monitor

[0405] 343 Supply Monitor

[0406] 344 decision-makers

[0407] 345 Data storage function

[0408] 346 first switching unit of the brake control unit

[0409] 348 Actuator control unit

[0410] 350 first control path

[0411] 352 second control path

[0412] 354 fourth functional group of the actuator control unit for

[0413] Security features

[0414] 356 second switching unit of the actuator control unit

[0415] 358 brake force unit

[0416] 360 first functional part

[0417] 362 second functional part 364 third switching unit of the braking force unit

[0418] 366 Sensor

[0419] 370 power supply unit

[0420] 372 buffer storage

[0421] 374 external power supply

[0422] 376 fifth functional group of the power supply unit for safety functions

[0423] 378 fourth switching unit of the power supply unit

[0424] 380 Shift command

[0425] 382 force control variables

[0426] 384 actuation variables

[0427] 386 Brake energy supply

[0428] 400 braking system (third embodiment)

[0429] 458 brake force unit

[0430] 470 power supply unit

[0431] 480 brake control

[0432] 482 Actuator

[0433] 484 Energy supply

[0434] 486 first brake control unit

[0435] 488 first actuator control unit

[0436] 490 second brake control unit

[0437] 492 second actuator control unit

[0438] 494 first actuation quantities

[0439] 495 second actuation quantities

[0440] 496 Actuation size A

[0441] 497 Actuation size B

[0442] 500 brake system (fourth embodiment)

[0443] 558 brake force unit

[0444] 580 brake control

[0445] 582 Actuator

[0446] 586 first brake control unit

[0447] 588 first actuator control unit

[0448] 590 second brake control unit 592 second actuator control unit

[0449] 594 extension function holders

[0450] 594' Extension functional unit (service braking path)

[0451] 594" extension function unit (safety braking path)

[0452] 594'“ Extension function unit (service brake path)

[0453] 596 third brake control unit

[0454] 597 extension functions

[0455] 598 expansion sizes

[0456] 599 sensor sizes

[0457] 600 braking system (fifth embodiment)

[0458] 658 brake force unit

[0459] 670 Power supply unit

[0460] 680 brake control

[0461] 682 Actuator

[0462] 684 Energy supply

[0463] 686 first brake control unit

[0464] 688 first actuator control unit

[0465] 690 second brake control unit

[0466] 692 second actuator control unit

[0467] 700 brake system (sixth embodiment)

[0468] 758 brake force unit

[0469] 780 brake control

[0470] 782 Actuator

[0471] 784 Energy supply

[0472] 786 first brake control unit

[0473] 788 first actuator control unit

[0474] 790 second brake control unit

[0475] 792 second actuator control unit

[0476] 800 brake system (seventh embodiment)

[0477] 858 brake force unit

[0478] 880 brake control

[0479] 882 Actuator

[0480] 884 Power supply 886 First brake control unit

[0481] 888 first actuator control unit

[0482] 890 second brake control unit

[0483] 892 second actuator control unit

[0484] 900 braking system (eighth embodiment)

[0485] 948 Actuator control unit

[0486] 980 brake control

[0487] 982 Actuator

[0488] 984 Energy supply

[0489] 986 first brake control unit

[0490] 988 first actuator control unit

[0491] 990 second brake control unit

[0492] 992 second actuator control unit

[0493] 1000 braking system (ninth embodiment)

[0494] 91080 Brake control

[0495] 1082 Actuator

[0496] 1084 Energy supply

[0497] 1118 control entries

[0498] 1158 first brake force unit

[0499] 1170 Power supply unit

[0500] 1186 first brake control unit

[0501] 1188 first actuator control unit

[0502] 1190 second brake control unit

[0503] 1192 second actuator control unit

[0504] 1194 second brake force unit

[0505] 1195 force generation quantities

Claims

PATENT CLAIMS 1. A braking system for a railway vehicle, comprising a brake control unit configured to provide braking functions and output a force control variable, an actuator control unit configured to provide functions for generating friction braking force based on the force control variable and output an actuation variable, a brake force unit configured to provide functions for generating friction braking force based on the actuation variable, a first brake path comprising functions that are active between control inputs of the brake system and the generation of braking force, and a second brake path comprising functions that are active between control inputs of the brake system or when predetermined brake system state variables are present and the generation of braking force.

2. The braking system according to the preceding claim, wherein the first braking path is configured to provide braking functions with low safety integrity, the second braking path is configured to provide braking functions with high safety integrity, and the low safety integrity is lower than the high safety integrity.

3. The braking system according to one of the preceding claims, wherein the braking system further comprises a first group of split functional parts which are part of the first braking path and part of the second braking path and are arranged to generate a frictional force such that the rail vehicle is decelerated.

4. The braking system according to the preceding claim, wherein the brake control unit is configured to provide braking functions of the first braking path or the second braking path, the actuator control unit is configured to provide braking functions of the first braking path or the second braking path, and the brake force unit is configured to provide braking functions of the first braking path or the second braking path.

5. The braking system according to one of claims 3 or 4, wherein the brake control unit is configured to provide a braking function of the second braking path, the actuator control unit is configured to provide a braking function of the second braking path, and the brake force unit is configured to provide a braking function of the second braking path.

6. The braking system according to one of the preceding claims, wherein the braking system further comprises a power supply unit which is configured to supply the braking system with energy, in particular electrical energy for braking operation.

7. The braking system according to one of the preceding claims, wherein the brake control unit, the actuator control unit, the brake force unit or the power supply unit is configured to receive a switching signal and, upon receiving a switching signal, to switch from the first braking path to the second braking path, or to switch from the second braking path to the first braking path.

8. The braking system according to one of the preceding claims, wherein the braking system is configured to perform a safety function.

9. The braking system according to the preceding claim, wherein the safety function is one of the group of safety functions comprising the elements brake path monitor, actuator monitor, supply monitor, decision-maker and data storage function.

10. The braking system according to one of the preceding claims, wherein a distributed allocation of safety functions to the brake control unit, actuator control unit, power supply unit or brake force unit is given and the distributed safety functions are performed by the allocated units.

11. The braking system according to any of the preceding claims, wherein the brake control unit, the actuator control unit, the power supply unit or the brake force unit has a changeover switch and is configured to detect a changeover state and output a changeover signal when a changeover state is detected.

12. The braking system according to any one of claims 3 to 9, wherein the braking force unit is configured to obtain a force control variable or an actuation variable and to control the group of functional parts such that the rail vehicle is decelerated.

13. The braking system according to any of the preceding claims, wherein the braking system, in particular the brake control unit, the actuator control unit or the brake force unit, comprises a power supply unit, preferably alternatively or optionally also has an internal power supply unit.

14. A rail vehicle with a braking system according to one of the preceding claims.

15. A braking method for a railway vehicle comprising the steps of: a) providing braking functions by a brake control unit, b) outputting a force control variable by the brake control unit, c) providing braking functions to generate friction braking force by an actuator control unit based on the force control variable from step b), d) providing braking functions to generate friction braking force by a brake force unit based on the actuation variable from step c), e) providing a first braking path comprising functions that are active between control inputs of a braking system and the generation of braking force, and f) providing a second braking path comprising functions that are active between control inputs of the braking system or when predetermined braking system state variables are present and the generation of braking force.

16. The braking procedure following the preceding braking procedure step, wherein: the first braking path from step e) is set up to provide braking functions with low safety integrity and the second braking path from step f) is set up to provide braking functions with high safety integrity.

17. The braking method according to one of the preceding braking method claims, wherein Step a) includes the steps: aa) providing braking functions of the first braking path, or ab) providing braking functions of the second braking path, and step c) includes the steps: ca) providing braking functions of the first braking path, or cb) providing braking functions of the second braking path, and step d) includes the steps: da) providing braking functions of the first braking path, or db) providing braking functions of the second braking path.

18. The braking method according to one of the preceding braking method claims, wherein Step a) comprises the steps: aa) providing braking functions of the first braking path, and ab) providing braking functions of the second braking path, and step c) comprises the steps: ca) providing braking functions of the first braking path, and cb) providing braking functions of the second braking path, and step d) comprises the steps: da) providing braking functions of the first braking path, and db) providing braking functions of the second braking path.

19. The braking procedure according to one of the preceding Braking method claims, further comprising the step of: g) performing a safety function by the brake control unit, the actuator control unit or the brake force unit.

20. The braking method according to the preceding braking method claim, wherein the safety function is one of the group of safety functions comprising the elements brake path monitor, actuator monitor, supply monitor, decision-maker and data storage function.

21. The braking method according to any of the preceding braking method claims, wherein the method further comprises the following steps: h) reception of a switching signal by the brake control unit, the actuator control unit, the power supply unit or the brake force unit, i) switching from the first braking path to the second braking path or from the second braking path to the first braking path in the brake control unit, the actuator control unit, the power supply unit or the brake force unit.

22. The braking method according to any of the preceding braking method claims, wherein the method further comprises the following steps: n) Determining a switching state by the brake control unit, the actuator control unit, the power supply unit or the brake force unit, o) Outputting a switching signal by the brake control unit, the actuator control unit, the power supply unit or the brake force unit when the switching state is determined.

Images