Braking system and method for rail vehicles

Abstract

The present invention relates to an apparatus and method for braking of rail vehicles, in particular such an apparatus and such a method for electromechanical braking of rail vehicles. A braking system (400) for a rail vehicle (1) is disclosed, the braking system comprising a brake control (480), an actuator (482), a first brake path from a function active between at least one control input of the braking system and generation of a brake force, and a second brake path from a brake function active between at least one control input of the braking system and generation of the brake force, the brake control having a first brake control unit (486) configured to provide a brake function (334) and to output a force modulation amount, a first actuator control unit (488) configured to provide a function of generating a friction brake force based on the force modulation amount and to output a manipulated variable (494), the actuator having a second brake control unit (490) configured to provide a brake function and to output a force modulation amount, a second actuator control unit (492) configured to provide a function of generating a friction brake force based on the force modulation amount and to output a manipulated variable, and a brake force unit (458) configured to provide a function of generating a friction brake force based on the manipulated variable.

Description

[Technical field]

[0001] The present invention relates to an apparatus and method for braking of a rail vehicle, in particular such an apparatus and such a method for electromechanical braking of a rail vehicle.

[0002] Slowing down rail vehicles with pneumatic braking systems is known in the prior art and has developed as the main methodology for slowing down rail vehicles and is specified in many fields. In this case, the overpressure present in a compressed air reservoir, supplied by a compressor depending on the configuration, is used by means of a pneumatic cylinder to move, press or release a static braking element, such as a brake disk, brake shoe or brake pad, against a movable braking element, such as a brake disk, wheel or axle. Due to the friction generated during pressing, kinetic energy is converted into thermal energy, whereby the rail vehicle is slowed down. Based on more than 100 years of experience with such pneumatic braking systems, in particular with pneumatic friction brakes, they are considered sophisticated and reliable. Such braking systems provide a highly available, systematically stable and almost unlossable deceleration function that is not dependent on the state of other systems or on the environmental influences on the vehicle. However, such braking systems require additional systems for operation. These are in particular pneumatic compressors and supply infrastructure, such as tracks and pipelines. These components are heavy and place high demands on the structural space. Furthermore, these braking systems have a relatively sluggish drive control characteristic and are not flexible. Usually, only an adaptation of the brake pressure to the load and speed of the rail vehicle is realized, which is usually only realized in discrete steps. Thus, for example, DE 102009051019 A1 describes a speed-dependently graded emergency braking device for rail vehicles with a hierarchical flow, in which the braking force of the emergency braking is adjusted by regenerative braking or electro-pneumatic braking, and the emergency braking is performed speed-dependently, and for example, DE 102011110047 A1 discloses an emergency braking device for rail vehicles with an emergency brake control valve device for providing an emergency brake control pressure and an emergency brake setting device for setting the provided emergency brake control pressure depending on the load value and the speed value of the rail vehicle.

[0003] Alternatively, the prior art also includes braking systems based on other technical principles of action, such as electrodynamic braking systems, which utilize the electromagnetic induction effect to convert kinetic energy into electrical energy, which can then be stored or utilized. This has advantages, in particular, regarding the overall energy efficiency of rail vehicle operation. However, the delivery of braking energy, the generation of electrical power and the functionality here depend entirely on the operating state of all involved electrical and electronic subsystems, as well as on the state of the vehicle. These components are often not themselves highly available, so that such braking systems, as a whole, cannot be considered to be highly available either.

[0004] The standard IEC 61508 and, in particular for the rail-related traffic area, the standard DIN EN 50126-2:2017 “Bahnanwendungen - Specialization and Reliability of Construction, Installation and Maintenance (RAMS) - Part 2: System behavior safety methods” define safety requirement stages / security integrity levels (SILs) that define the assessment of electrical, electronic or programmable electronic systems with regard to the reliability of their safety functions. The targeted levels result in a safety-oriented construction principle that must be observed in order to be able to reduce the risk of functional failure to a certain value. Four safety integrity levels are defined here, with the first safety integrity level (SIL 1) having the lowest requirements and the fourth safety integrity level (SIL 4), which exceeds the second and third safety integrity levels, having the highest requirements. Therefore, components classified as SIL 1 are designed to have a probability of failure of 10 per hour. -5 ~10 -6 A component classified as SIL 4 is one that has a probability of failure of 10 per hour. -8 ~10 -9 It is permitted that.

[0005] WO 2021 / 198994 discloses an electromechanical module which operates the brake shoes of a friction brake via a linkage. A preloaded spring set and a brake force sensor are provided in this mechanical brake path. A first service brake control unit processes the service and emergency braking processes and controls the electric motor of the electromechanical module accordingly. A safety unit checks via a sensor whether an emergency braking force is applied in the emergency brake case. If this is not the case, for example in the event of a failure of the electric motor or the service brake control unit, the preloaded spring set is released, whereby an emergency braking force is applied. Furthermore, an electromechanical module is disclosed which operates the brake shoes of a friction brake via a linkage. A brake force sensor is also provided in this mechanical brake path. A first service brake control unit processes the service and emergency braking processes and controls the electric motor of the electromechanical module accordingly. A safety unit checks via a sensor whether an emergency braking force is applied in the emergency brake case. If this is not the case, for example in the event of a failure of the service brake control unit, a switch is operated and the electric motor is controlled via an electronic emergency brake unit with its own accumulator buffer and its own motor control, thereby applying an emergency braking force. Here, there is a strict separation of the service brake function group and the safety brake function group, where a hierarchically higher safety unit controls whether the conventional service brake function group or the safety brake function group is used for the brake control. This decoupling in the service brake function group and the safety brake function group as well as in the service brake function component and the safety brake function component is inflexible and vulnerable to failure of the entire system in the event of, for example, a failure of the safety unit. Furthermore, the functionality of the service brake control unit must either be fully reflected or it is not available for the safe braking process.

[0006] It is therefore an object of the present invention to provide a braking system and a braking method which overcomes the problems of the prior art, in particular to provide a braking system which provides the required safety requirements and high availability, but which places relatively low demands on the system integrity of the rail vehicle.

[0007] The above-mentioned object is achieved by the subject matter of the independent claims. Advantageous developments are the subject matter of the dependent claims.

[0008] A braking system for a rail vehicle is disclosed, which comprises a brake control unit configured to provide a braking function and to output a force modulation or actuation variable, a brake force unit configured to provide a function of generating a friction brake force based on the force modulation or actuation variable, a first brake path with a braking function active between a control input of the braking system and the generation of the brake force, and a second brake path with a braking function active between the control input of the braking system and the generation of the brake force or active in the presence of a predetermined brake system state variable and during the generation of the brake force. In the present application, the term brake path refers to the set of all functions active between the control input of the braking system and the generation of the friction brake force and forming the braking function of the entire system. This allows to provide the functions of a first brake path, e.g. a service brake path with a low safety integrity, and a second brake path, e.g. a safety brake path with a higher safety integrity, both in the brake control unit and in the brake force unit. This provides a prerequisite for a switchover from the service brake path to the safety brake path in an error case, if necessary, either in the brake control unit, or in the brake force unit, or in the brake control unit and the brake force unit. It also provides the prerequisite that the function of the safe brake path has access to the function of the service brake path, e.g. the anti-skid function, and that in the event of a failure of the function of the safe brake path, the function of the service brake path can be used as a redundant and redundant regulator.

[0009] Advantageously, the first brake path is configured to provide a braking function having a low safety integrity and the second brake path is configured to provide a braking function having a high safety integrity, the low safety integrity being lower than the high safety integrity. The braking function having the high safety integrity may have a higher safety integrity level than the braking function having the low safety integrity.

[0010] Advantageously, the braking system further comprises a first group of divided functional parts that are part of the first brake path and part of the second brake path, these functions being preferably arranged to generate friction forces so that the rail vehicle is slowed down. The joint use of such highly reliable functional parts which produce the actual mechanical braking functions allows the provision of a compact braking system.

[0011] Advantageously, the brake control unit is configured to provide a braking function of the first brake path or the second brake path, and the brake force unit is configured to provide a braking function of the first brake path or the second brake path.

[0012] Advantageously, the brake control unit is configured to provide braking functions for the first brake path and for the second brake path, and the brake force unit is configured to provide braking functions for the first brake path and for the second brake path.

[0013] Advantageously, the brake control unit is adapted to receive a control input with a braking command and to determine therefrom and output an actuation variable or a force adjustment variable.

[0014] Advantageously, the brake control unit is configured to receive vehicle state variable inputs or brake system state variable inputs, determine therefrom an actuation variable or a force regulation variable, and output the actuation variable or force regulation variable.

[0015] Advantageously, the brake control unit is configured to receive a switching signal and, upon receipt of the switching signal, to effect a switch from the first brake path to the second brake path or a switch from the second brake path to the first brake path.

[0016] Advantageously, the brake control device is arranged to determine a switching state and to output a switching signal if a switching state is determined.

[0017] Advantageously, the brake force unit is adapted to obtain a force regulation or actuation variable and to control the functional subgroups such that the rail vehicle is decelerated.

[0018] Advantageously, the brake control unit or the brake force unit is configured to receive a switching signal and, upon receipt of the switching signal, to effect a switch from the first brake path to the second brake path or a switch from the second brake path to the first brake path.

[0019] Advantageously, the brake control unit or the brake force unit is arranged to determine the switching state and to output a switching signal.

[0020] Advantageously, the braking system, in particular the braking force unit, comprises an energy supply unit, in particular an internal energy supply unit alternatively or optionally additionally.

[0021] Advantageously, the energy supply unit is adapted to determine the switching state and to output a switching signal.

[0022] A rail vehicle including a braking system according to the present invention is disclosed.

[0023] Further disclosed is a braking method for a railway vehicle, the braking method comprising the steps of: a) providing a braking function by a brake control unit; b) outputting a force adjustment or actuation variable by the brake control unit; c) providing a function of generating a braking force, preferably a friction braking force, by a brake force unit based on the actuation variable from step b); d) providing a first brake path having a function active between a control input of the braking system and the generation of the brake force; and e) providing a second brake path having a function active between a control input of the braking system and the generation of the brake force.

[0024] Advantageously, the first brake path from step d) is configured to provide a brake function with low safety integrity and the second brake path from step e) is configured to provide a brake function with high safety integrity.

[0025] Advantageously, step a) comprises the step aa) of providing a braking function of a first brake path or the step ab) of providing a braking function of a second brake path, and step c) comprises the step ca) of providing a braking function of the first brake path or the step cb) of providing a braking function of the second brake path.

[0026] Advantageously, step a) comprises the steps aa) of providing a braking function of a first brake path and ab) of providing a braking function of a second brake path, and step b) comprises the steps ba) of providing a braking function of the first brake path and bb) of providing a braking function of the second brake path.

[0027] Advantageously, the method further comprises the steps of: f) obtaining a control input with a braking command by the brake control unit; g) determining, by the brake control unit, an actuation variable or a force adjustment variable from the control input; and h) outputting, by the brake control unit, the actuation variable or the force adjustment variable.

[0028] Advantageously, the method further comprises the steps of: i) obtaining a vehicle state variable input or a brake system state variable input by the brake control unit; j) determining an actuation variable or a force adjustment variable from the vehicle state variable input or the brake system state variable input by the brake control unit; and k) outputting the actuation variable or the force adjustment variable by the brake control unit.

[0029] Advantageously, the method further comprises the steps of: l) receiving a switching signal by the brake control unit or the brake force unit; and m) performing a switching from the first brake path to the second brake path or from the second brake path to the first brake path in the brake control unit, the brake force unit or the energy supply unit.

[0030] Advantageously, the method further comprises the steps of n) determining a switching state by the brake control unit, the braking force unit or the energy supply unit, and o) outputting a switching signal by the brake control unit, the braking force unit or the energy supply unit when the switching state has been determined.

[0031] Advantageously, the method further comprises the steps of p) obtaining a force adjustment or actuation variable by means of the brake force unit, and q) controlling a common functional subgroup by means of the brake force unit, thereby slowing down the rail vehicle.

[0032] A braking system for a rail vehicle is disclosed, comprising a brake control unit configured to provide a braking function and to output a force modulation quantity, an actuator control unit configured to provide a function of generating a friction brake force based on the force modulation quantity and to output a manipulation quantity, a brake force unit configured to provide a function of generating a friction brake force based on the manipulation quantity, a first brake path having a function active between a control input of the braking system and the generation of the brake force, and a second brake path having a function active between the control input of the braking system or active in the presence of a predetermined braking system state quantity and in the generation of the brake force. Furthermore, the function of the second brake path does not have to be activated by a control input of the braking system, but can be active without a control input of the braking system even in the presence of a predetermined braking system state quantity, e.g. in the case of an impending interruption of the energy supply.

[0033] Advantageously, the first brake path is configured to provide a braking function having a low safety integrity and the second brake path is configured to provide a braking function having a high safety integrity, the low safety integrity being lower than the high safety integrity. The braking function having the high safety integrity may have a higher safety integrity level than the braking function having the low safety integrity.

[0034] Advantageously, the braking system further comprises a first group of divided functional parts which are part of the first brake path and part of the second brake path and which are configured to generate a friction force such that the rail vehicle is decelerated. Preferably, this is configured to generate a friction force such that the rail vehicle is decelerated.

[0035] Advantageously, the brake control unit is configured to provide a braking function for the first brake path and for the second brake path, the actuator control unit is configured to provide a braking function for the first brake path and for the second brake path, or the brake force unit is configured to provide a braking function for the first brake path and for the second brake path. In the present application, the brake control unit provides a braking function, the actuator control unit provides an actuator function and the brake force unit provides a force modulation function.

[0036] Advantageously, the brake control unit is configured to provide a braking function of the first brake path or the second brake path, the actuator control unit is configured to provide a braking function of the first brake path or the second brake path, and the brake force unit is configured to provide a braking function of the first brake path or the second brake path.

[0037] Advantageously, the braking system further comprises an energy supply unit arranged to supply the braking system with energy, in particular electrical energy for the braking operation.

[0038] Advantageously, the brake control unit, the actuator control unit, the energy supply unit or the brake force unit is configured to receive a switching signal and to effect a switching from the first brake path to the second brake path or vice versa upon reception of the switching signal, whereby a switching between functions assigned to the first brake path and functions assigned to the second brake path or vice versa is effected by means of brake functions respectively localized in the corresponding unit.

[0039] Advantageously, the braking system is adapted to perform a safety function.

[0040] Advantageously, the safety function is a safety function from a safety function group which comprises the elements brake path monitor, actuator monitor, supply monitor, decision unit and data storage function.

[0041] Advantageously, a distributed allocation of safety functions to the brake control units, the actuator control units, the energy supply units or the brake force units is obtained, the distributed safety functions being executed by the assigned units.

[0042] Advantageously, the brake control unit, the actuator control unit, the optionally included energy supply unit or the brake force unit has a change-over switch and is configured to determine a change-over state and to output a change-over signal when the change-over state is determined.

[0043] Advantageously, the brake force unit is adapted to obtain a force regulation or actuation variable and to control the functional subgroups such that the rail vehicle is decelerated.

[0044] Advantageously, the braking system, in particular the brake control unit, the actuator control unit or the brake force unit, comprises an energy supply unit, preferably alternatively or optionally additionally an internal energy supply unit.

[0045] Further disclosed is a rail vehicle equipped with the above-mentioned braking system.

[0046] Further disclosed is a braking method for a railway vehicle, the braking method comprising the steps of: a) providing a braking function by a brake control unit; b) outputting a force adjustment amount by the brake control unit; c) providing a braking function of generating a friction braking force by an actuator control unit based on the force adjustment amount from step b); d) providing a braking function of generating a friction braking force by a brake force unit based on the actuation amount from step c); e) providing a first brake path having a function of being active between a control input of the braking system and generation of a brake force; and f) providing a second brake path having a function of being active between a control input of the braking system or active in the presence of a predetermined braking system state amount and generation of a brake force.

[0047] Advantageously, the first brake path from step e) is configured to provide a brake function with low safety integrity and the second brake path from step f) is configured to provide a brake function with high safety integrity.

[0048] Advantageously, step a) comprises the step of aa) providing a braking function of a first brake path or the step of ab) providing a braking function of a second brake path, step c) comprises the step of ca) providing a braking function of the first brake path or the step of cb) providing a braking function of the second brake path, and step d) comprises the step of da) providing a braking function of the first brake path or the step of db) providing a braking function of the second brake path.

[0049] Advantageously, step a) comprises the step of aa) providing a braking function of a first brake path or the step of ab) providing a braking function of a second brake path, step c) comprises the step of ca) providing a braking function of the first brake path or the step of cb) providing a braking function of the second brake path, and step d) comprises the step of da) providing a braking function of the first brake path or the step of db) providing a braking function of the second brake path.

[0050] Advantageously, step a) comprises the steps aa) of providing a braking function of a first brake path and ab) of providing a braking function of a second brake path, step c) comprises the steps ca) of providing a braking function of the first brake path and cb) of providing a braking function of the second brake path, and step d) comprises the steps da) of providing a braking function of the first brake path and db) of providing a braking function of the second brake path.

[0051] Advantageously, furthermore the step of g) executing a safety function by the brake control unit, the actuator control unit or the brake force unit is carried out.

[0052] Advantageously, the safety function is one of a safety function group comprising the elements brake path monitor, actuator monitor, supply monitor, decision unit and data storage function.

[0053] Advantageously, the method further comprises the steps of: h) receiving a switching signal by the brake control unit, the actuator control unit, the energy supply unit or the brake force unit; and i) performing a switching from the first brake path to the second brake path or a switching from the second brake path to the first brake path in the brake control unit, the actuator control unit, the energy supply unit or the brake force unit.

[0054] Advantageously, the method further comprises the steps of n) determining a switching state by the brake control unit, the actuator control unit or the braking force unit, in particular by means of a safety function distributed thereto, and o) outputting a switching signal by the brake control unit, the actuator control unit or the braking force unit when the switching state has been determined.

[0055] A braking system for a rail vehicle is disclosed, the braking system having a brake control, an actuator, a first brake path from a function active between at least one control input of the braking system and generation of a brake force, and a second brake path from a function active between at least one control input of the braking system and generation of the brake force, the brake control having a first brake control unit configured to provide a brake function and to output a force adjustment amount, a first actuator control unit configured to provide a function of generating a friction brake force based on the force adjustment amount and to output an actuation amount, the actuator having a second brake control unit configured to provide a brake function and to output a force adjustment amount, a second actuator control unit configured to provide a function of indirectly generating a friction brake force based on the force adjustment amount and to output an actuation amount, and a brake force unit configured to provide a function of generating a friction brake force based on the actuation amount.

[0056] Advantageously, the first brake path is configured to provide a braking function having a low safety integrity and the second brake path is configured to provide a braking function having a high safety integrity, the braking function having a high safety integrity having a higher safety integrity level than the braking function having a low safety integrity.

[0057] Advantageously, the braking system further comprises a first group of divided functional parts that are part of the first brake path and part of the second brake path and that are configured to generate a friction force such that the rail vehicle is slowed down.

[0058] Advantageously, the brake control is configured to provide a braking function for the first brake path or the second brake path, and the actuator is configured to provide a braking function for the first brake path or the second brake path.

[0059] Advantageously, the first brake control unit and the second brake control unit are configured to provide a braking function of the first brake path or the second brake path, the first actuator control unit and the second actuator control unit are configured to provide a braking function of the first brake path or the second brake path, and the brake force unit is configured to provide a braking function of the first brake path or the second brake path.

[0060] Advantageously, the first brake control unit and the first actuator control unit are configured to provide a braking function for a first brake path, the second brake control unit and the second actuator control unit are configured to provide a braking function for a second brake path, and the brake force unit is configured to provide a braking function for the first brake path and the second brake path.

[0061] Advantageously, the first brake control unit is configured to provide a braking function of the first brake path or the second brake path, the first actuator control unit is configured to provide a braking function of the first brake path, the second brake control unit and the second actuator control unit are configured to provide a braking function of the second brake path, and the brake force unit is configured to provide a braking function of the first brake path and the second brake path.

[0062] Advantageously, the braking system further comprises an energy supply unit which is arranged to supply the components of the braking system with electrical energy for the operation of the braking system.

[0063] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the brake force unit is configured to receive a switching signal and to switch from the first brake path to the second brake path or to switch from the second brake path to the first brake path upon reception of the switching signal.

[0064] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit has a switching unit and is configured to determine a switching state and to output a switching signal if the switching state is determined.

[0065] Advantageously, the braking system is arranged to perform a safety function.

[0066] Advantageously, the safety function is a safety function from a safety function group which comprises the elements brake path monitor, actuator monitor, supply monitor, decision unit and data storage function.

[0067] Advantageously, the energy supply unit is configured to perform the safety functions of a supply monitor and the second brake control unit is configured to perform the safety functions of a brake path monitor, an actuator monitor, a data storage function and a decision making part.

[0068] Advantageously, the energy supply unit is configured to perform the safety functions of a supply monitor, the first brake control unit is configured to perform the safety functions of a brake path monitor and an actuator monitor, and the second brake control unit is configured to perform the safety functions of a decision unit and a data storage function.

[0069] Advantageously, the brake force unit is adapted to obtain a force regulation or actuation variable and to control the functional subgroups such that the rail vehicle is decelerated.

[0070] Advantageously, the braking system, in particular the brake control or actuator, comprises an energy supply unit, in particular and optionally or additionally an internal energy supply unit.

[0071] A rail vehicle is disclosed that includes the braking system described above.

[0072] A braking method for a rail vehicle is disclosed comprising the steps of: a) providing a braking function by a first brake control unit at a brake control; b) outputting a force adjustment amount by the first brake control unit; c) providing a braking function of generating a friction braking force by a first actuator control unit at the brake control based on the force adjustment amount from step b); d) outputting an actuation amount by the first actuator control unit; e) providing a braking function by a second brake control unit at an actuator; f) outputting a force adjustment amount by the second brake control unit; g) providing a braking function of generating a friction braking force by a second actuator control unit at an actuator based on the force adjustment amount from step f); h) outputting an actuation amount by the second actuator control unit; i) providing a braking function of generating a friction braking force by a brake force unit based on the actuation amount from step d) or step h); j) providing a first brake path having a function active between a control input of a braking system and a generation of a brake force; and k) providing a second brake path having a function active between a control input of a braking system and a generation of a brake force.

[0073] Advantageously, the first brake path from step j) is configured to provide a brake function with low safety integrity and the second brake path from step k) is configured to provide a brake function with high safety integrity.

[0074] Advantageously, step a), step c), step e), step g) or step i) comprises the steps aa) providing a braking function of a first brake path and ab) providing a braking function of a second brake path.

[0075] Advantageously, steps a), c), e), g) and i) comprise the step ac) of providing a braking function of the first brake path or ad) of providing a braking function of the second brake path.

[0076] Advantageously, furthermore the step l) of executing a safety function by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit is carried out.

[0077] Advantageously, the safety function is one of a safety function group comprising the elements brake path monitor, actuator monitor, supply monitor, decision unit and data storage function.

[0078] Advantageously, the method further comprises the steps of m) obtaining a switching signal by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit, and n) performing a switching from the first brake path to the second brake path or a switching from the second brake path to the first brake path in the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit.

[0079] Advantageously, the method further comprises the steps of o) determining a switching state by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit, and p) outputting a switching signal by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit if the switching state has been determined.

[0080] A braking system for a railway vehicle is disclosed, the braking system having a brake control, an actuator, a first brake path from a function active between a control input of the braking system and generation of a brake force, and a second brake path from a function active between a control input of the braking system and generation of a brake force, the brake control having a first brake control unit configured to provide a brake function and to output a force adjustment amount, the actuator having a second brake control unit configured to provide a brake function and to output a force adjustment amount, a first actuator control unit configured to provide a function of generating a friction brake force based on the force adjustment amount and to output an actuation amount, a second actuator control unit configured to provide a function of generating a friction brake force based on the force adjustment amount and to output an actuation amount, and a brake force unit configured to provide a function of generating a friction brake force based on the actuation amount.

[0081] Advantageously, the first brake path is configured to provide a braking function having a low safety integrity and the second brake path is configured to provide a braking function having a high safety integrity, the low safety integrity being lower than the high safety integrity. The braking function having the high safety integrity may have a higher safety integrity level than the braking function having the low safety integrity.

[0082] Advantageously, the braking system, in particular the brake force unit, further comprises a first group of divided functional parts which are part of the first brake path and part of the second brake path and which are configured to generate a friction force such that the rail vehicle is slowed down.

[0083] Advantageously, the brake control is configured to provide braking functions for the first brake path and the second brake path, or the actuator is configured to provide braking functions for the first brake path and the second brake path.

[0084] Advantageously, the brake control is configured to provide braking functions for the first brake path and the second brake path, or the brake control is configured to provide braking functions for the first brake path and the actuator is configured to provide braking functions for the first brake path or the second brake path.

[0085] Advantageously, the first brake control unit and the first actuator control unit are configured to provide a braking function of a first brake path, the second brake control unit and the second actuator control unit are configured to provide a braking function of a second brake path, and the brake force unit is configured to provide a braking function of the first brake path or the second brake path.

[0086] Advantageously, the first brake control unit is configured to provide a braking function of the first brake path or the second brake path, the first actuator control unit is configured to provide a braking function of the first brake path, the second brake control unit and the second actuator control unit are configured to provide a braking function of the second brake path, and the brake force unit is configured to provide a braking function of the first brake path and the second brake path.

[0087] Advantageously, the first brake control unit is configured to provide braking functions for the first brake path and the second brake path, or the first actuator control unit is configured to provide braking functions for the first brake path and the second brake path, the second brake control unit and the second actuator control unit are configured to provide braking functions for the second brake path, and the brake force unit is configured to provide braking functions for the first brake path and the second brake path.

[0088] Advantageously, the first brake control unit is configured to provide a braking function of the first brake path, the second brake control unit is configured to provide a braking function of the first brake path or the second brake path, the second actuator control unit is configured to provide a braking function of the second brake path, and the brake force unit is configured to provide a braking function of the first brake path or the second brake path.

[0089] Advantageously, the braking system further comprises an energy supply unit which is arranged to supply the components of the braking system with electrical energy for the operation of the braking system.

[0090] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit is configured to receive a switching signal and to switch from the first brake path to the second brake path or to switch from the second brake path to the first brake path upon reception of the switching signal.

[0091] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit has a switching unit and is configured to determine a switching state and to output a switching signal if the switching state is determined.

[0092] Advantageously, the braking system is adapted to perform a safety function.

[0093] Advantageously, the safety function is a safety function from a safety function group which comprises the elements brake path monitor, actuator monitor, supply monitor, decision unit and data storage function.

[0094] Advantageously, the energy supply unit is configured to perform the safety functions of a supply monitor and the second brake control unit is configured to perform the safety functions of a brake path monitor, an actuator monitor, a decision unit and a data storage function.

[0095] Advantageously, the energy supply unit is configured to perform the safety functions of a supply monitor and the second brake control unit is configured to perform the safety functions of a brake path monitor, an actuator monitor, a decision unit and a data storage function.

[0096] Advantageously, the braking force unit is designed to obtain a force adjustment or control variable.

[0097] Advantageously, the braking system, in particular the brake control or actuator, comprises an energy supply unit, preferably an optionally additional internal energy supply unit.

[0098] Further disclosed is a rail vehicle equipped with the above-mentioned braking system.

[0099] Further disclosed is a braking method for a railway vehicle, the braking method comprising the steps of: a) providing a braking function by a first brake control unit at a brake control; b) outputting a force adjustment amount by the first brake control unit; c) providing a braking function of generating a friction braking force by a first actuator control unit at an actuator based on the force adjustment amount from step b); d) outputting an actuation amount by the first actuator control unit; e) outputting a braking function by a second brake control unit at the actuator; f) outputting a force adjustment amount by the second brake control unit; g) providing a braking function of generating a friction braking force by a second actuator control unit at an actuator based on the force adjustment amount from step f); h) outputting an actuation amount by the second actuator control unit; i) providing a braking function of generating a friction braking force by a brake force unit based on the actuation amount from step d) or step h); j) providing a first brake path having a function active between a control input of the braking system and a generation of a brake force; and k) providing a second brake path having a function active between a control input of the braking system and a generation of a brake force.

[0100] Advantageously, the first brake path from step j) is configured to provide a brake function with low safety integrity and the second brake path from step k) is configured to provide a brake function with high safety integrity.

[0101] Advantageously, step a), step c), step e), step g) or step i) comprises the steps aa) providing a braking function of a first brake path and ab) providing a braking function of a second brake path.

[0102] Advantageously, steps a), c), e), g) and i) comprise the step ac) of providing a braking function of the first brake path or ad) of providing a braking function of the second brake path.

[0103] Advantageously, furthermore the step l) of executing a safety function by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit is carried out.

[0104] Advantageously, the safety function is one of a safety function group comprising the elements brake path monitor, actuator monitor, supply monitor, decision unit and data storage function.

[0105] Advantageously, the method further comprises the steps of m) obtaining a switching signal by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit, and n) performing a switching from the first brake path to the second brake path or a switching from the second brake path to the first brake path in the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit.

[0106] Advantageously, the method further comprises the steps of o) determining a switching state by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the brake force unit, and p) outputting a switching signal by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the brake force unit when the switching state has been determined.

[0107] A braking system for a railway vehicle is disclosed, the braking system having a brake control, an extended function carrier, an actuator, a first brake path from a function active between a control input of the braking system and generation of a brake force, and a second brake path from a function active between a control input of the braking system and generation of a brake force, the brake control having a first brake control unit configured to provide a brake function and to output a force adjustment amount, a first actuator control unit configured to provide a function of generating a friction brake force based on the force adjustment amount and to output an actuation amount, the actuator having a second brake control unit configured to provide a brake function and to output a force adjustment amount, a second actuator control unit configured to provide a function of generating a friction brake force based on the force adjustment amount and to output an actuation amount, and a brake force unit configured to provide a function of generating a friction brake force based on the actuation amount.

[0108] Advantageously, the first brake path is configured to provide a braking function having a low safety integrity and the second brake path is configured to provide a braking function having a high safety integrity, the braking function having a high safety integrity having a higher safety integrity level than the braking function having a low safety integrity.

[0109] Advantageously, the braking system, in particular the brake force unit, further comprises a first group of divided functional parts which are part of the first brake path and part of the second brake path and which are configured to generate a friction force such that the rail vehicle is slowed down.

[0110] Advantageously, the extended function carrier is configured to provide a braking function for the second brake path.

[0111] Advantageously, the extended function carrier is adapted to receive a sensor quantity or to output an extended function quantity.

[0112] Advantageously, the first brake control unit is configured to receive the extension amount and to output a force adjustment amount, the first actuator control unit is configured to receive the force adjustment amount and to output an actuation amount, the second brake control unit is configured to receive the force adjustment amount or the extension amount and to output a force adjustment amount or a switching command, the second actuator control unit is configured to receive the force adjustment amount or the switching command and to output an actuation amount or a switching command, or the brake force unit is configured to receive a switching command or an actuation amount.

[0113] Advantageously, the first brake control unit and the first actuator control unit are configured to provide a braking function of a first brake path, the second brake control and the second actuator control unit are configured to provide a braking function of a second brake path, and the brake force unit is configured to provide a braking function of the first brake path or the second brake path.

[0114] Advantageously, the braking system further comprises an energy supply unit which is arranged to supply the components of the braking system with electrical energy for the operation of the braking system.

[0115] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit is configured to receive a switching signal and to switch from the first brake path to the second brake path or to switch from the second brake path to the first brake path upon reception of the switching signal.

[0116] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the brake force unit has a switching unit and is configured to determine a switching state and to output a switching signal if the switching state is determined.

[0117] Advantageously, the braking system is adapted to perform a safety function.

[0118] Advantageously, the safety function is a safety function from a safety function group which comprises the elements brake path monitor, actuator monitor, supply monitor, decision unit and data storage function.

[0119] Advantageously, the energy supply unit is configured to perform the safety functions of a supply monitor and the second brake control unit is configured to perform the safety functions of a brake path monitor, an actuator monitor, a data storage function and a decision section.

[0120] Advantageously, the brake force unit is adapted to obtain a force regulation or actuation variable and to control the functional subgroups such that the rail vehicle is decelerated.

[0121] Advantageously, the braking system, in particular the brake control or the actuator, comprises an energy supply unit.

[0122] Further disclosed is a railway vehicle equipped with a braking system according to one of the preceding claims.

[0123] Further disclosed is a braking method for a railway vehicle, the braking method comprising the steps of: a) providing a braking function by a first brake control unit in a brake control section; b) outputting a force adjustment amount by the first brake control unit; c) providing a braking function of generating a friction braking force by a first actuator control unit in the brake control section based on the force adjustment amount from step b); d) outputting an actuation amount by the first actuator control unit; e) providing a braking function by an expansion unit in an expansion function carrier; f) providing a braking function by a second brake control unit in an actuator; g) outputting a force adjustment amount by the second brake control unit. h) providing a brake function of generating a friction brake force at an actuator by a second actuator control unit based on the force adjustment amount from step e); i) outputting an actuation amount by the first actuator control unit; j) providing a brake function of generating a friction brake force by a brake force unit based on the actuation amount from step d) or step h); k) providing a first brake path having a function active between a control input of the braking system and the generation of the brake force; and l) providing a second brake path having a function active between a control input of the braking system and the generation of the brake force.

[0124] Advantageously, the first brake path from step k) is configured to provide a brake function with low safety integrity and the second brake path from step l) is configured to provide a brake function with high safety integrity.

[0125] Advantageously, step a), step c), step e), step f), step h) or step j) comprises the steps aa) providing a braking function of a first brake path and ab) providing a braking function of a second brake path.

[0126] Advantageously, steps a), c), e), f), h) and j) comprise the step ac) of providing a braking function of a first brake path or ad) of providing a braking function of a second brake path.

[0127] Advantageously, the braking function from step e) is the braking function of the second brake path.

[0128] Advantageously, further steps m) receiving the sensor quantities by the extended function carrier, and n) processing the sensor quantities from step m) by the extended function carrier are shown.

[0129] Advantageously, the step of o) outputting an expansion amount by means of the expansion function carrier is further indicated.

[0130] Advantageously, at least one of the following steps is further indicated, namely: p) receiving an extension amount by the first brake control unit, q) outputting a force adjustment amount by the first brake control unit, r) receiving a force adjustment amount by the first actuator control unit, s) outputting an actuation amount by the first actuator control unit, t) receiving a force adjustment amount or an extension amount by the second brake control unit, u) outputting a force adjustment amount or a switching command by the second brake control unit, v) receiving a force adjustment amount or a switching command by the second actuator control unit, w) outputting an actuation amount or a switching command by the second actuator control unit or x) receiving a switching command or an actuation amount by the brake force unit.

[0131] The inventive idea disclosed herein has the objective of enabling the development of an alternative friction braking system based on an electromechanical principle of action with a safety function. The reasons and technical advantages of such a system may include one or more of the following points, without claiming to be exhaustive: Reducing the system weight based on avoiding peripheral additional systems for energy conversion like pneumatic compressors and supply infrastructure, which generally consist of pipe arrangements. · Design braking system functions using electronics and software methods to simplify modular systems, allowing functionality according to customer requirements, market demands or vehicle type. Based on electronics and software, it enables situation-dependent dynamic behavior of the system's operating time in order to improve braking quality, for example with regard to braking distance or braking comfort. Increasing the dynamics of the brake force change, i.e. the brake state change, in order to improve braking quality, e.g. in the anti-skid function. Based on additional sensor devices and associated evaluation electronics and evaluation software, improved maintenance, error detection and monitorability of subcomponents, for example based on detection of the state of the brake pads.

[0132] The task of establishing a braking system based on an electromechanical principle of action represents a paradigm shift and a departure from the principles of pneumatic friction brakes, whose basic functions can be realized using purely mechanical principles, without using the domains of software, electronics and electrical equipment. The invention provides for this purpose an apparatus and a method that allows for the validation and reliability of new forms of technology and for the modification of the associated standard status that allows the market introduction of such systems. For this purpose, the document first discloses a system architecture that includes basic safety functions and principles, so that such a braking system achieves at least the same fault and operating behavior as existing pneumatic brakes. The necessary principles and the proposed systematic functional structure are described below.

[0133] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [Brief description of the drawings]

[0134] [Figure 1] FIG. 1 shows a railway vehicle combination equipped with a braking system according to the invention; [Diagram 2] FIG. 1 illustrates a braking system according to the present invention. [Diagram 3] FIG. 1 is a block circuit diagram of a first embodiment of a braking system according to the present invention; [Figure 4] FIG. 4 is a block circuit diagram of a second embodiment of a braking system according to the present invention. [Diagram 5] FIG. 4 is a block circuit diagram of a third embodiment of a braking system according to the present invention. [Figure 6] FIG. 11 is a block circuit diagram of a fourth embodiment of a braking system according to the present invention. [Figure 7] FIG. 13 is a block circuit diagram of a first modified example of the fourth embodiment. [Figure 8] FIG. 13 is a block circuit diagram of a second modified example of the fourth embodiment. [Figure 9] FIG. 10 is a block circuit diagram of a fifth embodiment of a braking system according to the present invention. [Figure 10] FIG. 10 is a block circuit diagram of a sixth embodiment of a braking system according to the present invention. [Figure 11] FIG. 13 is a block circuit diagram of a seventh embodiment of a braking system according to the present invention. [Figure 12] FIG. 13 is a block circuit diagram of an eighth embodiment of a braking system according to the present invention. [Figure 13] FIG. 13 is a block circuit diagram of a ninth embodiment of a braking system according to the present invention. [Figure 14] FIG. 11 is a block diagram relating to the switching process in Examples 2 to 9.

[0135] A first embodiment of the present invention will be described with reference to FIG.

[0136] 1 discloses a railcar combination 1 with railcars 110, 150, 160. The railcar combination comprises a driven car 110, which is provided with drive means 112, implemented in this example by an electric motor. The drive force provided by the drive means 112 is transmitted via a driven axle 114 to a drive wheel 116. The drive wheel 116 runs on rails 118.

[0137] Furthermore, the driven vehicle 110 has a pantograph 120, and electric energy is supplied to the train coupler 1 via the pantograph 120 through the overhead wires 122 and the rails 118. Electric energy is temporarily stored via a storage battery 123.

[0138] The driven car 110 has a cab 124 in which the train combination can be controlled by a train operator (not shown).

[0139] A braking system 200 capable of slowing down the train coupler 1 will be described below with reference to FIG.

[0140] Via a hitch 140, the driven vehicle 110 is coupled to one or more towing vehicles 150. If there are multiple towing vehicles 150, the towing vehicles 150 are likewise coupled to one another by hitches 140. The towing vehicles 150 have non-driven axles 154 with non-driven wheels 156.

[0141] The towing vehicle 150 has a braking system 152 capable of slowing down the train combination 1. In this embodiment, the towing vehicle braking system 152 is configured identically to the driven vehicle braking system 200. For an explanation thereof, please refer to the explanation of the driven vehicle braking system 200.

[0142] The last towing car 160 of the train series 1 is configured as the last car. It is configured similarly to the towing car 150, but has its own cab 162 for running in the reverse direction.

[0143] Tensile and compressive forces are transmitted between the cars 110, 150, and 160 of the train coupler via the coupling unit 140. Furthermore, electrical energy is supplied to all the cars of the train coupler via the coupling unit 140, the power supply line 126, the driven car 110, and the pantograph 120. Furthermore, all the cars of the train coupler 1 are connected via the coupling unit 140 and the control line 128, so that data communication can be performed between the cars 110, 150, and 160 of the train coupler 1. In this embodiment, the control line is configured as a CAN bus that allows components in the cars 110, 150, and 160 to exchange sensor data and control data with each other.

[0144] Based on Fig. 2, the braking system 200 is described. The braking system 200 is an electromechanical braking system. An electromechanical braking system is a braking system that provides the ability to generate a deceleration / braking force for the vehicle using electronic, electrical and mechanical components. The braking system 200 comprises an energy supply interface 202 that is connected to the electrical supply line 126 and supplies the braking system with operating energy. Furthermore, the braking system 200 comprises a control line interface 204 that is connected to the control line 128. The braking system 200 comprises a movable, in particular rotating, friction element in the form of a brake disc 206 that is non-rotatably connected to one of the axles 114, 154, so that a torque can be transmitted between the axle 114, 154 and the brake disc 206. The brake caliper 208 is mounted within the vehicle such that it does not move relative to the vehicle and has a static friction element in the form of a brake shoe 210 that is supported within the brake caliper 208 for reciprocal movement relative to the brake disc 206. Through friction element drive means in the form of a brake actuator motor 212 and a spindle drive 214, the brake shoe 210 can be moved with a component of movement perpendicular to the axis of rotation of the brake disc 206, friction can be generated between the brake shoe 210 and the brake disc 206, and torque can be transmitted between the brake caliper 208 and the brake disc, thereby slowing the vehicle.

[0145] The group of elements consisting of the brake disc 206, the brake caliper 208, the brake shoe 210, the brake actuator motor 212 and the spindle drive 214 are understood in the present invention as highly reliable functional parts 216, since they are based on proven, non-failure functional mechanisms and have inherent safety properties.

[0146] Based on FIG. 3, the security architecture of a first embodiment of the braking system 200 will be described.

[0147] The braking system 200 according to the first embodiment pursues the objective of generating friction braking forces for decelerating the vehicle masses of the railway vehicle combination 1, since such a braking system can provide service braking functions as well as safety-related braking functions such as emergency braking functions, quick braking functions or parking braking functions.

[0148] For this purpose, the braking system has a security architecture with two different integrity classifications for operating electromechanical braking systems in rail-related vehicles, where a reactive (so-called reactive fail-safe) architecture for obtaining functional safety of the braking system is pursued, which is divided into a safe braking path with high integrity and a service braking path with low integrity.

[0149] The electromechanical braking system 200 receives a control input 218 via a control line interface 204, for example a service braking function initiated by the train operator or an emergency braking function initiated by an emergency braking mechanism.

[0150] Furthermore, the electromechanical braking system 200 receives vehicle state quantity inputs 220 via the control line interface 204, such as wheel rotation speed detected by means of sensors, vehicle weight detected by means of sensors or by means of manual input, etc.

[0151] Furthermore, the electromechanical braking system 200 receives braking system state inputs 222 via the control line interface 204, such as friction element temperatures detected by means of sensors, the position of the friction element actuators 212 or the brake force units, etc.

[0152] The electromechanical braking system 200 is supplied with electrical energy via an energy supply interface. The energy supply is used on the one hand to supply current to the electronic components so that the functions provided by the components, in particular the control functions, can be provided. On the other hand or alternatively, the energy supply is used to apply brake energy, which in this embodiment is mechanical energy that indirectly or directly presses the brake shoes 210 against the brake disc 206. This energy is in this case electrical energy that drives the brake actuator motor 212. In particular, in the case of a safety brake, the energy supply can also consist of mechanical energy, for example a force by a preloaded spring set that is triggered in the case of a safety brake.

[0153] The electromechanical braking system 200 has a brake control unit 224 as a functional assembly. This assembly provides a set of functions providing train-wide and local braking and extension functions based on the control inputs 218, the vehicle state inputs 220 or the brake system state inputs 222. A first control path 226 is implemented in the brake control unit 224, which is part of a service brake path 228 (dotted outline). The service brake path 228 is a brake path as a set of functions which realizes a braking process with a low overall safety integrity. A second control path 230 is implemented in the brake control unit 224, which is part of a safety brake path 232 (dashed outline). The safety brake path 232 is a brake path as a set of functions, in particular a set of safety brake functions, which realizes a braking process with a high overall safety integrity, i.e., implements at least one safety brake function.

[0154] The electromechanical braking system 200 comprises a brake force unit 234 as a functional assembly. This assembly provides a set of functions for generating a friction brake force based on the control input 218, the vehicle state input 220 or the brake system state input 222. A first functional part 236 is implemented in the brake force unit 234, which is part of the service brake path 228 and provides the functionality for the brake force generation in the first path. A second functional part 238 is implemented in the brake force unit 234, which is part of the safety brake path 232 and provides the functionality for the brake force generation in the second path.

[0155] The electromechanical braking system 200, as described above, includes a highly reliable functional portion 216. The highly reliable functional portion 216 generally forms part of the service brake path 228 as well as part of the safety brake path 232. The highly reliable functional portion 216 generates a friction brake force 240.

[0156] Safety-relevant braking functions (also referred to as safe braking functions) require a high safety integrity, i.e. a high effectiveness of the safety functions under the required conditions. The functional safety of the braking system 200 in an electrical / electronic configuration here depends on the complexity of the functional realization and, in particular, can only be validated depending on this complexity. With increasing software or electronics complexity, there is a risk of a state space explosion that can no longer be addressed from the point of view of safety validation. The provision of safety functions available in all demoted states, i.e. all states in which the braking system operates below its nominal functional capacity, or a highly integrated minimum functionality of the safety functions, is therefore achieved by an arrangement of as few elements as possible. These elements are simplified and configured statically or configured state-independently or dependent on a limited number of states. This configuration allows, or basically allows for the first time, simplified validation and verification. These safety functions are therefore implemented in the safe braking path 232. This is technically implemented as the realization of today's action principles by electrical, electronic or mechanical means, as well as from a combination of these means. In this sense, the safe brake path 232 is further configured to be dominant with respect to the service brake path 228, bypassing the service brake path 228 depending on the situation or deactivating it by activating a switching process. In this connection, the safety function is furthermore part of the path, whereby the integrity of the whole system or its subcomponents can be evaluated and provide the safe brake path with a basis for a decision for a switching process or for restoring a required safe brake function.

[0157] The braking system 200 based on electromechanical principles opens up the possibility of implementing technical solutions that have been implemented purely mechanically up until now with software functions, which increases the functional complexity with respect to parameters and variants depending on the project-specific application. Also in such a system, situation-dependent, dynamic and time-variable extensions can be implemented in the software of the braking system in order to improve the braking quality. This complexity can therefore be provided with low integrity as a combination of electronics, electrical equipment and software as part of the brake control unit 224 and from the first functional part 236 of the brake force unit 234, respectively, so that the integrity of the safety functions is not compromised. The braking functions provided by this software are either provided supplementary to the safety-related braking functions (e.g. emergency brake / quick brake, parking brake) or are not completely assigned to safety-related braking functions and are therefore assigned to the service braking functions during normal operation of the rail vehicle 1. However, in the case of supplementation, these functions are arranged in such a way that they do not impair, prevent or impair the minimum functionality with extremely high availability in any technical state, without adverse effects on the safety functions.

[0158] The service brake path 228 and the safety brake path 232 utilize highly reliable functional parts 216 of the brake force unit 234 for fulfillment of their functions, which highly reliable functional parts 216 are not configured redundantly and can be proven to have functional properties that cannot be lost. The highly reliable functional parts 216 can include, for example, mechanical parts (e.g., brake calipers) or electric motors.

[0159] The arrangement of the service brake path 228 and the safety brake path 232 is configured in such a way that the provision of the safety brake path 232, in particular its minimal function, is independent of the behavior of the service brake path 228. The service brake path 228 is also realized in particular without reaction on the safety brake path 232 and the highly reliable functional part 216. Here, it is guaranteed that an individual error does not lead to a failure in the safety brake path 232.

[0160] In the event of a service or extended function failure in the first functional part 236, depending on the brake function / brake type, a switchover to the safety brake path 232 is performed and the required function is realized with at least a highly integrated minimum functionality, or an error response that is acceptable for the operating mode, failure mode or failure range is implemented.

[0161] Based on FIG. 4, the security architecture of a second embodiment of the braking system 300 will now be described.

[0162] The braking system 300 corresponds to the braking system 200 of the first embodiment. For its description and the description of its components, reference is made to the first embodiment, unless deviations therefrom arise from the following description.

[0163] The braking system 300 according to the second embodiment pursues the objective of generating friction braking forces for decelerating the vehicle masses of the railway vehicle combination 1, since such a braking system can provide service braking functions as well as safety-related braking functions such as emergency braking functions, quick braking functions or parking braking functions.

[0164] To this end, the braking system 300 has a security architecture with two different integrity classifications for operating electromechanical braking systems in rail-related vehicles.

[0165] The electromechanical braking system 300 receives a control input 218 via a control line interface 204, for example a service braking function initiated by the train operator or an emergency braking function initiated by an emergency braking mechanism.

[0166] Furthermore, the electromechanical braking system 300 receives vehicle state quantity inputs 220 via the control line interface 204, such as wheel rotation speed detected by means of sensors, vehicle weight detected by means of sensors or by means of manual input, etc.

[0167] Furthermore, the electromechanical braking system 300 receives braking system state inputs 222 via the control line interface 204, such as friction element temperature sensed by means of sensors, the position of the friction element drive means 212 or the brake force unit, etc.

[0168] The electromechanical braking system 300 is supplied with electrical energy via the energy supply interface 202 (energy supply 223).

[0169] The electromechanical braking system 300 has as a functional assembly a brake control unit 324 which provides a set of functions providing train-wide and local braking and extension functions based on the control inputs 218, the vehicle state inputs 220 or the brake system state inputs 222. The brake control unit 324 is configured to generate at least one control or adjustment signal of a force adjustment quantity 382 (e.g. clamping force, braking torque) and to generate a switch command 380 when a switch condition exists, which may depend on the control inputs 218, the vehicle state inputs 220 or the brake system state inputs 222.

[0170] A first functional group 334 is implemented in the brake control unit 324, which is part of the service brake path 328 and provides, for example, braking functions and optionally extended functions.

[0171] A second functional group 336 is implemented in the brake control unit 324, which is part of the safe brake path 232 and provides a safe brake function or a minimum of a safe brake function.

[0172] A third functional group 338 is implemented in the brake control unit 324, which implements safety functions 340. The presence of the third functional group 338 is optional. The safety functions are functions which, among other functions, monitor and diagnose the integrity of the brake path and, if a switching condition exists, can carry out compensation processes by means of a switching process in order to maintain or restore a safe brake function. The safety functions 340 are, for example, a brake path monitor 341 which monitors the function of the brake path, an actuator monitor 342 which monitors the function of the actuator, a supply monitor 343 which monitors the energy supply, a decision unit 344 which identifies whether a switching condition exists and a data storage function 345 which can record status data or can call up and apply unaltered control data.

[0173] The brake path monitor 341 is an extension function including the operating function contained therein, the monitoring function of the brake path, including the safety braking function, as well as the generation of a force adjustment variable 382 with the aim of generating at least one switching command. The monitoring functions here include at least the legally prescribed monitoring of the brake or extension functions (e.g. monitoring of the anti-skid function, see UIC 541-05 Capitel V4.1.5 “Sicherheitsschaltung des Gleitschutzes” as well as DIN EN 15595 Capitel 5.1.3 “Sicherheitsschaltung (Sicherheitszeit)”).

[0174] The actuator monitor 342 is a function that monitors the fulfillment of this force adjustment amount 382 together with the brake force unit 358 by the actuator control unit 348, as well as a function that status monitors all functions of the brake force unit 358 with the aim of protecting the safe brake path 232 and the highly reliable functional part 316 and generating a switchover signal in a switchover situation. This function may further include a functional scope that monitors an input signal by the first control path 350 of the actuator control unit 348 and possibly concludes that this input signal is not valid or has an error.

[0175] The supply monitor 343 is a monitoring function of the energy supply unit 370 which takes into account, inter alia, the state of the fourth switching unit 378, the external energy supply 374 or the buffer memory 372 and, using an evaluation logic, generates a switching signal in a switching case.

[0176] The decision unit 344 is a fourth supervisory function that uses at least one of the above-mentioned supervisory functions as input variables and generates a switching signal 380 in a switching case, with the purpose of driving the switching units 346, 356, 364, 378 of the brake control unit 324, the actuator control unit 348 or the brake force unit 358. Furthermore, this function optionally evaluates input quantities (control inputs, vehicle state quantities, braking system state quantities) in order to determine a requested target state (e.g. request for a safe braking function by the train control line) and to move the braking system 300 into this state or into a defined safe state by generating commands to the functional units. Such switching signals can also be generated outside the braking system and transmitted to the braking system.

[0177] The data storage device 345 is a data storage function which provides at least one substitute value of the force adjustment quantity 382 for at least one input quantity of the decision unit 344, thereby non-destructively storing and supplying to other functions the parameters of the safety brake function and also calibration data or current or past state data of the unit.

[0178] The third functional group 338 is configured to generate, in a switching state, switching commands for the actuator control unit or the brake force unit, which will be explained later. The presence of the third functional group 338 is optional.

[0179] A first switching unit 346 is implemented in the brake control unit 324, which is configured to provide a control signal or adjustment signal in case of triggering by a safety function based on the third functional group 338 of the safety brake path 232 and to form the control signal or adjustment signal additionally by adding a data storage function or alternatively simply based on the data storage function.

[0180] The electromechanical braking system 300 has an actuator control unit 348 as a functional assembly. This assembly provides a set of functions that provide a force generation function in the brake path based on the control input 218, the vehicle state quantity input 220 or the braking system state quantity input 222, based on a force adjustment quantity 382. The actuator control unit 348 generates at least one manipulated variable 384 (e.g. an excitation quantity for the electromechanical principle) as a control or adjustment signal and generates a switching command with the purpose of realizing the force adjustment quantity 382 for at least one brake force unit that gets its control input from the brake control unit 324, if a switching condition exists.

[0181] A first control path 350 is implemented in the actuator control unit 348, the first control path 350 being part of the service brake path 228. The first control path 350 is configured to realize a force modulation process as part of the service brake function by calculating and evaluating state or process quantities of the brake force unit (e.g. force measurement, position measurement) and providing an actuated quantity 384 with a low safety integrity.

[0182] A second control path 352 is implemented in the actuator control unit 348, which is part of the safe brake path 332. The second control path 352 is configured to calculate and evaluate state or process quantities of the brake force unit (e.g. force measurement, position measurement) in order to realize a force regulation process as part of a safe brake function (e.g. emergency brake, parking brake) with the provision of a manipulated variable 384 with high safety integrity.

[0183] A fourth functional group 354 is implemented in the actuator control unit 348, which implements one or more safety functions of the plurality of safety functions 340. The fourth functional group 354 is configured to generate, in a switching state, a switching command for a braking force unit, which will be described later. The presence of the fourth functional group 354 is optional.

[0184] A second switching unit 356 is implemented in the actuator control unit 348, which is configured in a switching case to take over or bypass the control signal or the regulating signal at any time by a second control path (see below) without reaction. To this end, the second switching unit 356 is configured to switch the first control path 350 without reaction.

[0185] The electromechanical braking system 300 includes a brake force unit 358 as a functional assembly that provides a set of functions to generate friction brake force based on the control inputs 218, the vehicle state inputs 220 or the brake system state inputs 222.

[0186] A first functional part 360 is implemented in the brake force unit 358, which is part of the service brake path 228. The first functional part 360 consists of a mechatronic control unit and electric / electronic force generating elements (e.g., power electronics of an electromechanical device) with low safety integrity. The first functional part 360 is optional.

[0187] A second functional part 362 is implemented in the braking force unit 358, which is part of the safe braking path 232. The second functional part 362 consists of a mechatronic control unit and electric or electronic force generating elements (e.g. power electronics of an electromechanical device) with high safety integrity.

[0188] A third switching unit 364 is implemented in the braking force unit 358, which is configured to enable the actuator control unit 348 or the brake control unit 324 to select the service brake path 328 or the safety brake path 332 by reading a switching command 380 and to switch between the two paths without reaction. For this purpose, the switching unit is configured to switch the inactive brake path without reaction.

[0189] The braking force unit 358 comprises a highly reliable functional part 316. The highly reliable functional part 316 forms part of the service brake path 328 as well as part of the safety brake path 332 as a whole.

[0190] Optionally, the braking force unit 358 has other functional parts (e.g., electromechanical, mechanical brake add-on parts or sensor units) that can be jointly used by the first functional part 360 or the second functional part 362 and that have functional properties that cannot be lost or are configured to be extremely reliable.

[0191] The braking force unit 358 further includes a sensor unit 366 that is utilized jointly or separately by the two control paths to determine the state of the braking force unit 358 (eg, current, force, position).

[0192] The electromechanical braking system 300 comprises as a functional assembly an energy supply unit 370. This assembly provides a set of functions for providing the energy supply of the assemblies of the braking system.

[0193] The energy supply unit 370 is implemented with a buffer memory 372. The buffer memory 372 is configured to supply the units of the braking system 300 with sufficient operating energy to allow a predefined amount of energy to maintain at least one of the plurality of safe braking functions or a minimum function thereof through at least one full operation.

[0194] The energy supply unit 370 comprises an external energy supply 374 via an energy supply interface 302. The external energy supply 374 provides the energy supply of the assemblies of the braking system 300 during normal operation.

[0195] A fifth functional group 376 is implemented in the energy supply unit 370, which implements one or more safety functions of the plurality of safety functions 340. The fifth functional group 376 is configured to generate, in a switching state, a switching command 380 for the brake control unit 324, the actuator control unit 348 or the brake force unit 358. The presence of the fifth functional group 376 is optional.

[0196] A fourth switching unit 378 is implemented in the energy supply unit 370, which in the event of a supply error or supply failure of the external energy supply switches the supply to all units of the braking system 300 to the buffer memory 372 and informs the functional group of the safety functions of its internal state.

[0197] Based on FIG. 5, the security architecture of a third embodiment of a braking system 400 will be described.

[0198] The braking system 400 corresponds to the braking system 300 of the second embodiment. For its description and the description of its components, reference is made to the second embodiment and to FIG. 4, unless deviations therefrom arise from the following description.

[0199] The braking system 400 according to the third embodiment pursues the objective of generating friction braking forces for decelerating the vehicle masses of the railway vehicle combination 1, since such a braking system can provide service braking functions as well as safety-related braking functions such as emergency braking functions, quick braking functions or parking braking functions.

[0200] To this end, the braking system 400 has a security architecture with two different integrity classifications for operating electromechanical braking systems in rail-related vehicles.

[0201] The electromechanical braking system 400 receives a control input 218 via a control line interface 204, for example a service braking function initiated by the train operator or an emergency braking function initiated by an emergency braking mechanism.

[0202] Furthermore, the electromechanical braking system 400 receives vehicle state quantity inputs 220 via the control line interface 204, such as wheel speed detected using sensors, vehicle weight detected via sensors or using manual input, etc.

[0203] Furthermore, the electromechanical braking system 400 receives braking system state inputs 222 via the control line interface 204, such as friction element temperatures detected by sensors, the position of the friction element actuators 212 or the brake force units, etc.

[0204] The electromechanical braking system 400 is supplied with electrical energy via the energy supply interface 202 (energy supply 223).

[0205] The electromechanical braking system 400 has a brake control 480 as a functional component that fulfills the brake control tasks. The brake control 480 is provided as a component with low safety integrity, is part of the service brake path 228 and is housed in the vehicle or vehicle body of the driven vehicle 110 or towing vehicle 150.

[0206] The electromechanical braking system 400 has an actuator 482 as a functional component that fulfills the brake modulation task. The actuator 482 is provided as a component with high safety integrity, is part of the safe brake path 232 and is housed in a bogie near the friction force generator.

[0207] The electromechanical braking system 400 has an energy supply 484 as a component that serves as a functional carrier for the realization of an energy supply unit. The energy supply 484 is provided as a component with high safety integrity, is part of the safety brake path 232 and is provided in the vehicle or in the vehicle body.

[0208] The brake control section 480 includes a first brake control unit 486 and a first actuator control unit 488. The first brake control unit 486 implements a portion of the brake control unit 324. The first brake control unit 486 implements the brake function of the brake control unit 324, which is part of the service brake path 228, and generates the force adjustment amount 382 (e.g., the target cylinder force and the reduction signal) for providing to the actuator 482 and the first actuator control unit 488. The first actuator control unit 488 implements a portion of the actuator control unit 348, which is part of the first service brake path 228. The first actuator control unit 488 provides a first manipulated variable 494 in the service brake path 228, which includes the first control path.

[0209] The actuator 482 comprises a second brake control unit 490 and a second actuator control unit 492. The second brake control unit 490 implements a part of the brake control unit 324. The second brake control unit 490 implements the second functional group 336 with the brake function of the brake control unit 324, which is part of the safe brake path 232, generates a force adjustment amount for implementing the safe brake function, and obtains a first actuated variable 494 for implementing the safety function, the service brake function, which includes the brake path monitor 341, the actuator monitor 342, the decision unit 344 and the data storage device 345. The second actuator control unit 492 implements a part of the actuator control unit 348, which is part of the safe brake path 232. The second actuator control unit 492 provides an actuated variable A 496 and an actuated variable B 497 in the safe brake path 432. The actuator 482 further comprises a brake force unit 458 which includes an actuated variable depending on the active brake path.

[0210] The energy supply section 484 includes an energy supply unit 470 .

[0211] The energy supply unit 470 includes a supply monitor 343 .

[0212] By designing a decision unit 344 regarding which target state of the railway vehicle is to be read in combination with a data storage function 345, safe braking functions (e.g. emergency braking, parking braking) can also be realized completely without brake control in error or degradation cases by the actuator 482 and the energy supply unit 484.

[0213] For this purpose, there is a real-time signal exchange with low safety integrity between the brake control unit 480 and the actuator 482, which allows the realization of the first control path of the actuator control unit, and in parallel there is a real-time signal exchange with low safety integrity between the energy supply unit 484 and the actuator 482, which allows the transmission of the switching command.

[0214] For this purpose, in the safe brake path 232, at least one force adjustment variable of the brake control unit 480 is supplied directly to the actuator 482 or for realization by a second control path, which force adjustment variable is protected by the function of the safe brake path 232 in the second brake control unit 490 in that a minimum function is guaranteed in error, failure or degradation scenarios.

[0215] Such a configuration allows, in particular, the function of the first control path of the brake control section 480 to be qualitatively distinctly characterized, allowing for extensions or technical improvement measures without adapting the actuator 482 and without compromising the integrity of the safe brake path.

[0216] If the brake control 480 is configured with a single channel and with low safety integrity, this configuration requires only a high integrity electronic unit in the actuator 482 to execute the safe braking function 340 including the second control path of the actuator control unit and the second control path of the brake force unit, which on the one hand results in a low-cost configuration and on the other hand a low train-wide failure rate of the safe braking functions or especially the minimum functions, since these are supplied per actuator.

[0217] To this end, in a particular variant, the second control path of the braking force unit is essentially only accessible to the second control path of the actuator control unit.

[0218] Based on FIG. 6, the security architecture of a fourth embodiment of a braking system 500 will be described.

[0219] The braking system 500 corresponds to the braking system 400 of the third embodiment. For its description and the description of its components, reference is made to the second embodiment and to FIG. 5, unless deviations therefrom arise from the following description.

[0220] The electromechanical braking system 500 comprises a brake control 580 as a functional carrier for fulfilling the brake control tasks. The brake control 580 is provided as a functional group with low safety integrity, is part of the service brake path 228 and is preferably accommodated in the vehicle or vehicle body of the driven vehicle 110 or the towing vehicle 150.

[0221] The electromechanical braking system 500 comprises an actuator 582 as a functional carrier for fulfilling the brake modulation task. The actuator 582 is provided as part of a functional group with high safety integrity, is part of the safe brake path 232 and is preferably housed in a carriage near the friction force generator.

[0222] The electromechanical braking system 500 has an energy supply 584 as a component part as a functional carrier for realizing an energy supply unit. The energy supply 584 is provided as a functional group with high safety integrity, is part of the safety brake path 232 and is preferably provided in the vehicle or in the vehicle body.

[0223] The brake control section 580 includes a first brake control unit 586 and a first actuator control unit 588. The first brake control unit 586 implements a portion of the brake control unit 324. The first brake control unit 586 implements the brake function of the brake control unit 324, which is part of the service brake path 228, and generates force adjustments 382 (e.g., target cylinder forces and reduction signals) for providing to the actuator 582 and the first actuator control unit 588. The first actuator control unit 588 implements a portion of the actuator control unit 348. The first actuator control unit 588 provides manipulated variables in the service brake path including the first control path.

[0224] The actuator 582 comprises a second brake control unit 590 and a second actuator control unit 592. The second brake control unit 590 implements part of the brake control unit 324. The second brake control unit 590 implements the brake function of the brake control unit 324, which is part of the safe brake path 232, generates a force adjustment variable 382 for realizing the safe brake function and obtains an actuation variable for realizing the service brake function. The second brake control unit 590 implements the brake path monitor 341, the actuator monitor 342, the decision unit 344 and the data storage device 345 of the safety function 340. The second actuator control unit 592 implements part of the actuator control unit 348. The second actuator control unit 592 provides an actuation variable in the safe brake path 232. The actuator 582 further comprises a brake force unit 558 for obtaining an actuation variable depending on the active brake path.

[0225] The energy supply unit 584 includes a supply monitor 343 .

[0226] Additionally, the electromechanical braking system 500 implements an extended functionality unit 594 with a third brake control unit 596 .

[0227] The fourth embodiment is an additional variant to the third embodiment with an extended function carrier 594, in which by means of a third brake control unit 596 a signal reading, processing or control function 597 is performed with high safety integrity which extends the brake control unit (e.g. information on the load of one or more parts of the bogie or vehicle or on the vehicle mass). In a further step, for this purpose either the original signal, the processed signal or the control / regulation signal is provided in safety integrity to a further control unit in the form of at least one extended quantity 597. This allows the following functional chain to be achieved: In the case of safe braking functions (e.g. emergency braking / quick braking), a highly integrated expansion quantity (e.g. load) with achieved safety integrity of the identification and transmission of the expansion function unit can be provided to the actuator and can be utilized by this actuator together with the functions present there (e.g. decision unit or data storage function) to perform the braking function or further expansion functions (e.g. load correction) in the safe braking path (e.g. correction of the braking force value).

[0228] In the case of a service braking function, the extension amount 598 can be provided to an extension function 597 in the brake control 580, whereby the extension function 597 is realized (eg load correction).

[0229] The extended function carrier 594 receives as input a sensor quantity 599. Alternatively or additionally, the extended function carrier 594 itself may contain a sensor from which the sensor data may be derived. The extended function unit outputs an extended quantity 598. The extended quantity 598 may consist either of the sensor data itself or of quantities derived from the sensor data.

[0230] By this extension of the first variant, an improvement of the safe braking function is achieved, while the complexity of the brake control is still kept at a low level of safety integrity and can be implemented at low cost. Furthermore, the existing second brake control unit 590 in the actuator 582 can be used to realize an extension function of the safe braking function with high integrity.

[0231] A first modification of the fourth embodiment will be described with reference to FIG.

[0232] The first variant of the fourth embodiment corresponds to the fourth embodiment, and for its description and the description of its components, reference is made to the fourth embodiment, unless deviations therefrom arise from the following description.

[0233] Unlike the fourth embodiment, in which a third brake control unit 596 is provided which carries the expansion function unit 594, in a first variant of the fourth embodiment, the expansion function units 594', 594'' are integrated into the first brake control unit, which here provide functional groups for the first and second brake paths respectively, and the expansion amount is output in the first and second brake paths and transmitted to the second brake control unit.

[0234] A second modification of the fourth embodiment will now be described with reference to FIG.

[0235] The second variant of the fourth embodiment corresponds to the fourth embodiment, and for its description and the description of its components, reference is made to the fourth embodiment, unless deviations therefrom arise from the following description.

[0236] Unlike the fourth embodiment, in which a third brake control unit 596 carrying the expansion function unit 594 is provided, in a second variant of the fourth embodiment the expansion function unit 594''' is integrated in the first brake control unit, which now provides a functional group for the first brake path, an expansion quantity being output in the first brake path and transmitted to the second brake control unit. In the second brake control unit the expansion quantity can be processed both in the first brake path and in the second brake path.

[0237] In the fourth embodiment and its variants, it is explained that the functions and extended functions of the first brake path can be accessed when the switching state is confirmed and the braking system is in the safe brake path. Thus, for example, it is possible to access anti-skid functionality from the service brake path in the safe brake path without having to newly implement this functionality in the safe brake path.

[0238] Based on FIG. 9, the security architecture of a fifth embodiment of a braking system 600 will be described.

[0239] The braking system 600 corresponds to the braking system 300 of the second embodiment. For its description and the description of its components, reference is made to the second embodiment and to FIG. 4, unless deviations therefrom arise from the following description.

[0240] The braking system 600 according to the fourth embodiment pursues the objective of generating friction braking forces for decelerating the vehicle masses of the railway vehicle combination 1, since such a braking system can provide service braking functions as well as safety-related braking functions such as emergency braking functions, quick braking functions or parking braking functions.

[0241] The electromechanical braking system 600 has a brake control 680 as a component part as a function carrier which fulfills the brake control tasks. The brake control 680 is provided as a functional group with high safety integrity, is part of the service brake path 228 and the safety brake path 232 and is preferably housed in the vehicle or vehicle body of the driven vehicle 110 or the towing vehicle 150.

[0242] The electromechanical braking system 600 has an actuator 682 as a functional carrier component that fulfills the brake modulation task. The actuator 682 is provided as a functional group with high safety integrity, is part of the safety brake path 232 and is preferably housed in a carriage near the friction force generator.

[0243] The electromechanical braking system 600 has an energy supply 684 as a functional carrier for realizing an energy supply unit. The energy supply 684 is provided as a functional group with high safety integrity, is part of the safety brake path 284 and is preferably provided in the vehicle or in the vehicle body.

[0244] The brake control section 680 includes a first brake control unit 686 and a first actuator control unit 688. The first brake control unit 686 implements a part of the brake control unit 324. The first brake control unit 686 implements the brake function of the brake control unit 324, which is part of the service brake path 228 and part of the safety brake path 232, and generates a force adjustment amount 382 (e.g., a target cylinder force and a reduction signal) for providing to the actuator 682 and the first actuator control unit 688. Furthermore, the first brake control unit 686 implements the brake path monitor 341 and the actuator monitor 342, which are safety functions 340. The first actuator control unit 688 implements a part of the actuator control unit 348, i.e., part of the service brake path 228. The first actuator control unit 688 provides a first manipulated variable 494 in the service brake path including the first control path.

[0245] The actuator 682 comprises a second brake control unit 690 and a second actuator control unit 692. The second brake control unit 690 implements a part of the brake control unit 324. The second brake control unit 690 implements the brake function of the brake control unit 324, which is part of the safe brake path 232, generates a force adjustment amount for realizing the safe brake function, and obtains an actuation amount for realizing the service brake function, and the second brake control unit 690 implements the decision unit 344 and the data storage unit 345 of the safety function 340. The second actuator control unit 692 implements a part of the actuator control unit 348. The second actuator control unit 692 provides an actuation amount in the safe brake path 232. The actuator 682 further comprises a brake force unit 658 which includes an actuation amount depending on the active brake path.

[0246] The energy supply 684 implements the energy supply unit 470 together with the supply monitor 343 .

[0247] Due to the basic realization of the high safety integrity functions of the central brake control, the safety functions can also be individualized, expanded or adapted, for example, on a project-specific basis, without the need to adapt existing actuator subsections.

[0248] For the purpose of transmitting the switching commands, for this purpose the subsections brake control and actuator must be provided with corresponding safety-related interfaces for communication transmission with high safety integrity.

[0249] This variation reduces software cost and complexity in the actuator subsection (operating in a critical / demanding environment).

[0250] Based on FIG. 10, the security architecture of a sixth embodiment of a braking system 700 will be described.

[0251] The braking system 700 corresponds to the braking system 300 of the second embodiment. For its description and the description of its components, reference is made to the second embodiment and to FIG. 4, unless deviations therefrom arise from the following description.

[0252] The braking system 700 according to the second embodiment pursues the objective of generating friction braking forces for decelerating the vehicle masses of the railway vehicle combination 1, since such a braking system can provide service braking functions as well as safety-related braking functions such as emergency braking functions, quick braking functions or parking braking functions.

[0253] The electromechanical braking system 700 has a brake control 780 as a component part as a function carrier which fulfills the brake control tasks. The brake control 780 is provided as a functional group with high safety integrity, is part of the service brake path 228 and the safety brake path 232 and is preferably accommodated in the vehicle or vehicle body of the driven vehicle 110 or the towing vehicle 150.

[0254] The electromechanical braking system 700 has an actuator 782 as a functional carrier for fulfilling the brake modulation task. The actuator 782 is provided as part of a functional group with high safety integrity, is part of the safety brake path 232 and the service brake path 228, and is preferably housed in a bogie near the friction force generator.

[0255] The electromechanical braking system 700 has an energy supply 784 as a functional carrier for realizing an energy supply unit. The energy supply 784 is provided as a functional group with high safety integrity, is part of the safety brake path 232 and is preferably provided in the vehicle or in the vehicle body.

[0256] The brake control section 780 includes a first brake control unit 786. The first brake control unit 786 implements a part of the brake control unit 324. The first brake control unit 786 implements the brake function of the brake control unit 324, which is part of the service brake path 228 or part of the safety brake path 232, and generates force adjustments (e.g., target cylinder force and reduction signals) for providing to the actuator 782 and the first actuator control unit 788. Furthermore, the first brake control unit 786 implements the brake path monitor 341, which is a safety function 340.

[0257] The actuator 782 comprises a second brake control unit 790, a first actuator control unit 788 and a second actuator control unit 792. The second brake control unit 790 implements a part of the brake control unit 324. The second brake control unit 790 implements the brake function of the brake control unit 324, which is a part of the safety brake path 232, generates a force adjustment amount to realize the safety brake function and obtains an operation amount to realize the service brake function. The second brake control unit 790 implements the first switching unit 346 and the safety function 340, which are the actuator monitor 342, the decision unit 344 and the data storage unit 345.

[0258] The first actuator control unit 788 implements part of the actuator control unit 348. The first actuator control unit 788 provides a manipulated variable in the service brake path that includes the first control path.

[0259] The second actuator control unit 792 implements part of the actuator control unit 348. By means of the second actuator control unit 792 an actuated variable is provided in the safe brake path 232. Furthermore, the second actuator control unit 792 implements the second switching unit 356. The actuator 782 further comprises a brake force unit 758 which includes an actuated variable depending on the active brake path.

[0260] The energy supply section 784 implements the energy supply unit 470 and includes the supply monitor 343 .

[0261] This embodiment, as a variant of the braking system described in the second embodiment ("Intelligent Power Regulator with Safe Brake Control"), consists of a function carrier for fulfilling the brake control task, a function carrier (actuator) for fulfilling the brake adjustment task as well as a function carrier for the energy supply. The first function carrier (brake control task) is in this variant also assigned a function with high safety integrity. The task of providing the actuation variables is now exclusively performed by the actuators in all operating functions. The brake control now only provides force adjustment variables for both operating paths.

[0262] In this embodiment, the domains brake control and actuator control are now each assigned closed to a dedicated function carrier, which results in a universal interface. In this variant, all functions with high real-time requirements for the actuator control domain are no longer transferred via a communication system between the function carriers, but are completely present in the actuator. This allows for a higher robustness and performance of the regulating functions.

[0263] The demands on the communication system between the brake control and the actuators in terms of real-time nature are reduced compared to Examples 4 and 5. This allows for a longer distance or information path to the actuators and also a structural arrangement of the brake control in which it communicates with the actuators only by a non-dedicated common communication medium.

[0264] In order to transmit the switching commands and the safety-relevant force adjustments, it is necessary for the subsections brake control and actuator to be provided with corresponding safety-relevant interfaces for communication transmission with high safety integrity.

[0265] However, the increased software complexity of the first control path of the actuator control unit increases the costs in the actuator function carrier, which must have a robust failure behavior with respect to ambient conditions.

[0266] Based on FIG. 11, the security architecture of a seventh embodiment of the braking system 800 will be described.

[0267] The braking system 800 corresponds to the braking system 300 of the second embodiment. For its description and the description of its components, reference is made to the second embodiment and to FIG. 4, unless deviations therefrom arise from the following description.

[0268] The braking system 800 according to the second embodiment pursues the objective of generating friction braking forces for decelerating the vehicle masses of the railway vehicle combination 1, since such a braking system can provide service braking functions as well as safety-related braking functions such as emergency braking functions, quick braking functions or parking braking functions.

[0269] The electromechanical braking system 800 has a brake control 880 as a functional carrier for fulfilling the brake control tasks. The brake control 880 is provided as a component part of a functional group with low safety integrity, is part of the service brake path 228 and the safety brake path 232 and is preferably accommodated at least once per vehicle or bogie in the vehicle or vehicle body of the driven vehicle 110 or the towing vehicle 150.

[0270] The electromechanical braking system 800 comprises an actuator 882 as a functional carrier for fulfilling the brake modulation task. The actuator 882 is provided as part of a functional group with high safety integrity, is part of the safety brake path 232 and the service brake path 228, and is preferably housed in a bogie near the friction force generator.

[0271] The electromechanical braking system 800 has an energy supply 884 as a functional carrier for realizing an energy supply unit. The energy supply 884 is provided as a component part of a functional group having high safety integrity, is part of the safe brake path 232 and is provided in the vehicle or in the vehicle body.

[0272] Brake control section 880 includes a first brake control unit 886. First brake control unit 886 implements a portion of brake control unit 324. First brake control unit 886 implements the braking function of brake control unit 324, is part of service brake path 228, and generates force adjustments 382 (e.g., target cylinder force and reduction signals) for providing to actuator 882 and first actuator control unit 888.

[0273] The actuator 882 includes a second brake control unit 890, a first actuator control unit 888 and a second actuator control unit 892. The second brake control unit 890 implements a part of the brake control unit 324. The second brake control unit 890 implements the brake function of the brake control unit 324, which is a part of the safety brake path 232, generates a force adjustment amount to realize the safety brake function, and obtains an operation amount to realize the service brake function. The second brake control unit 890 implements the first switching unit 346 and the brake path monitor 341, the actuator monitor 342, the decision unit 344 and the data storage unit 345, which are the safety function 340.

[0274] The first actuator control unit 888 implements part of the actuator control unit 348. The first actuator control unit 888 provides a manipulated variable in the service brake path that includes the first control path.

[0275] The second actuator control unit 892 implements part of the actuator control unit 348. The second actuator control unit 892 provides an actuation variable in the safety brake path. Furthermore, the second actuator control unit 892 implements the second switching unit 356.

[0276] The actuator 882 further includes a brake force unit 858 that includes a manipulated variable that is dependent on the active brake path.

[0277] The energy supply section 884 implements the energy supply unit 470 and includes the supply monitor 343 .

[0278] The seventh embodiment of the braking system ("Intelligent brake regulator with conventional brake control") consists of a function carrier for fulfilling the brake control task, a function carrier (actuator) for fulfilling the brake adjustment task as well as a function carrier for the energy supply. The task of providing the actuating variables is now performed solely by the actuators in all operating functions. The brake control now only provides the force adjustment variables for both operating paths.

[0279] This embodiment is similar to the sixth embodiment, whereby the domains brake control and actuator control are each assigned closed to their own function carrier, whereby a universal interface is obtained. The functional costs in the actuator now include the full range of all safety-relevant brake functions, which leads to increased costs that must be constantly adapted when functions change.

[0280] Between the subsection brake control and the actuator, in this case, it is no longer necessary to provide a safety-related interface for communication transfer with high safety integrity, which reduces costs.

[0281] Based on FIG. 12, the security architecture of an eighth embodiment of the braking system 900 will be described.

[0282] The electromechanical braking system 900 has as a component part as a function carrier for fulfilling the brake control tasks an optional brake control 980. The brake control 980 is provided as a functional group of low safety integrity, which is part of the service brake path 228 and is preferably accommodated at least once per vehicle or bogie in the vehicle or vehicle body of the driven vehicle 110 or the towing vehicle 150.

[0283] The electromechanical braking system 900 has an actuator 982 as a functional carrier component that fulfills the brake modulation task. The actuator 982 is provided as a functional group with high safety integrity, is part of the safety brake path 232 and the service brake path 228, and is preferably housed in a bogie near the friction force generator.

[0284] The electromechanical braking system 900 has an energy supply 984 as a component part as a functional carrier for realizing an energy supply unit. The energy supply 984 is provided as a functional group with high safety integrity, is part of the safety brake path 232 and is preferably provided in the vehicle or in the vehicle body.

[0285] Brake control section 980 includes a first brake control unit 986. First brake control unit 986 implements a portion of brake control unit 324. First brake control unit 986 implements the braking function of brake control unit 324, is part of service brake path 228, and generates force adjustments (e.g., target cylinder force and reduction signal) for providing to actuator 982 and first actuator control unit 988.

[0286] The actuator 982 includes a second brake control unit 990, a first actuator control unit 988 and a second actuator control unit 992. The second brake control unit 990 implements a part of the brake control unit 324. The second brake control unit 990 implements the brake function of the brake control unit 324, which is a part of the safety brake path 232 or the service brake path 228, and generates a force adjustment amount to realize the safety brake function and obtains an operation amount to realize the service brake function. The second brake control unit 990 implements the first switching unit 346 and the safety function 340 including the brake path monitor 341, the actuator monitor 342, the decision unit 344 and the data storage device 345, as well as the functions and extended functions of the safety brake path 232 (for the extended functions, see the fourth embodiment).

[0287] The first actuator control unit 988 implements a portion of the actuator control unit 348. The first actuator control unit 988 provides a manipulated variable in the service brake path 228, which includes the first control path 350.

[0288] The second actuator control unit 990 implements part of the actuator control unit 348. The second actuator control unit 990 provides an actuation variable in the safety brake path. Furthermore, the second actuator control unit 990 implements the second switching unit 356.

[0289] The actuator 982 further includes a brake force unit 958 that includes a manipulated variable that is dependent on the active brake path.

[0290] The energy supply section 984 implements the energy supply unit 470 and includes the supply monitor 343 .

[0291] An eighth embodiment of the braking system ("partially integrated / fully integrated intelligent brake regulator") consists of a function carrier for fulfilling the brake control task, a function carrier (actuator) for fulfilling the brake adjustment task as well as a function carrier for the energy supply. In this variant, the second function carrier (brake adjustment task) is also assigned the functions of the brake control domain. The task of providing the manipulated variables is now solely performed by the actuator in all operating functions.

[0292] An eighth embodiment is a brake control integrated in the actuator with local brake functions. This has the advantage that the brake control domain's adjustment function as well as the brake adjustment domain's adjustment function can act in a closed function carrier and are not dependent on the transmission paths and delays of the communication paths between the function carriers. This can improve the quality of the function fulfillment of the brake functions (e.g. anti-skid).

[0293] Furthermore, the function carrier brake control 980 is limited to even less functionality than in the fifth embodiment, so that it can be transferred entirely to a central control function carrier, thereby reducing the number of subsections overall.

[0294] This is countered by the significantly increased complexity of this variant in the actuators and the associated environmental conditions and failure requirements of the safety functions, which makes the process of project-specific adaptation of the software parts located in the actuators difficult, since they are now inseparably located with the safety functions on the function carrier.

[0295] Based on FIG. 13, the security architecture of the ninth embodiment of the braking system 1000 will be described.

[0296] The braking system 1000 corresponds to the braking system 300 of the second embodiment. For its description and the description of its components, reference is made to the second embodiment and to FIG. 4, unless deviations therefrom arise from the following description.

[0297] The braking system 1000 according to the ninth embodiment pursues the objective of generating friction braking forces for decelerating the vehicle masses of the railway vehicle combination 1, since such a braking system can provide service braking functions as well as safety-related braking functions such as emergency braking functions, quick braking functions or parking braking functions.

[0298] The electromechanical braking system 1000 has as its component part as a function carrier for fulfilling the brake control tasks an optional brake control 1080. The brake control 1080 is provided as a functional group of low safety integrity, is part of the service brake path 228 and is preferably accommodated at least once per vehicle or bogie in the vehicle or vehicle body of the driven vehicle 110 or the towing vehicle 150.

[0299] The electromechanical braking system 1000 comprises an actuator 1082 as a functional carrier component which fulfills the brake adjustment task. The actuator 1082 is provided as a functional group with high safety integrity, is part of the safety brake path 232 and the service brake path 228 and is housed in a bogie near the friction force generator. The actuator 1082 comprises an energy supply 1084.

[0300] The electromechanical braking system 1000 has an energy supply 1084 as a component part as a functional carrier for realizing an energy supply unit. The energy supply 1084 is provided as a functional group with high safety integrity, is part of a safe brake path 284 and is preferably provided in the vehicle or in the vehicle body.

[0301] The energy supply section 1084 implements the energy supply unit 470 and includes the supply monitor 343 .

[0302] An eighth embodiment of the braking system ("partially integrated / fully integrated intelligent brake regulator") consists of a function carrier for fulfilling the brake control task, a function carrier (actuator) for fulfilling the brake adjustment task as well as a function carrier for the energy supply. In this variant, the second function carrier (brake adjustment task) is also assigned the functions of the brake control domain. The task of providing the manipulated variables is now solely performed by the actuator in all operating functions.

[0303] A ninth embodiment is a brake control integrated in the actuator with local brake functions. This has the advantage that the brake control domain's adjustment function as well as the brake adjustment domain's adjustment function can act in a closed function carrier and are not dependent on the transmission path and delays of the communication paths between the function carriers. This can improve the quality of the function fulfillment of the brake functions (e.g. anti-skid).

[0304] Furthermore, the function carrier brake control unit 1080 is limited to even less functionality than in the fifth embodiment, so that it can be transferred entirely to a central control function carrier, thereby reducing the number of subsections overall.

[0305] This is countered by the significantly increased complexity of this variant in the actuators and the associated environmental conditions and failure requirements of the safety functions, which makes the process of project-specific adaptation of the software components located in the actuators difficult, since they are now inseparably located with the safety functions in the function carriers.

[0306] The switching process in Examples 2 to 9 will be described with reference to FIG.

[0307] The first brake control unit 1186 has a braking function for the service brake path and is optional. The first brake control unit 1186 takes the control input 1118 as an input and outputs the force adjustment amount 382.

[0308] The second brake control unit 1190 has the functionality of a safe brake path. Furthermore, the second brake control unit 1190 has the functionality of a first change-over switch 346. The first change-over switch 346 is configured to switch from the service brake path to the safe brake path or from the safe brake path to the service brake path in the second brake control unit 1190 upon receiving a change-over command. The second brake control unit 1190 further comprises a data store 345. The data store 345 is configured to provide a substitute value for forming the force adjustment quantity 382 in case of a failure or erroneous behavior of the first brake control unit 1186. The second brake control unit 1190 further comprises a brake path monitor 341, which is configured to identify an erroneous behavior in the brake function of the first brake control unit 1186 and to inform the decision unit 344 of this by means of a status signal 1196. The second brake control unit 1190 further comprises a decision unit 344. The second brake control unit 1190 receives as input the control input 1118 and the force adjustment amount 382 of the first brake control portion 1186 and outputs a force adjustment amount 382 .

[0309] The first actuator control unit 1188 has a braking function for the service brake path and is optional. The first actuator control unit 1188 takes as input the force adjustment amount of the first brake control unit 1186 and outputs a first manipulated variable 494.

[0310] The second actuator control unit 1192 has the functionality of a safe brake path. Furthermore, the second actuator control unit 1192 has the functionality of a second switching unit 356. The second switching unit 356 is configured to switch from the service brake path to the safe brake path or from the safe brake path to the service brake path in the second actuator control unit 1192 upon receiving a switching command 380. The second actuator control unit 1192 further includes an actuator monitor 342, which is configured to identify an erroneous behavior of the first actuator control unit 1188 or the second actuator control unit 1192 or the first braking force unit 1186 or the second braking force unit 1190 and to notify the same to the decision unit 346. The second actuator control unit 1192 receives as input the force adjustment amount 380 of the second brake control unit 1190 and outputs an actuator manipulated variable A 496 and an actuator manipulated variable B 497.

[0311] The first braking force unit 1158 has a braking function 360 of the service brake path and is optional. The first braking force unit 1158 takes as input an actuator operation quantity A 496 of a second actuator control unit 1192 and outputs a force production quantity 1195, which is an excitation quantity of the physical action principle of the braking force production, for example the phase current of an electric motor.

[0312] The second braking force unit 1194 has a function of a safety braking path. Furthermore, the second braking force unit 1194 has a function of a third changeover switch 364. The third changeover switch 364 is configured to switch from the service braking path to the safety braking path or from the safety braking path to the service braking path in the second braking force unit 1194 upon receiving a switching command 380. The second braking force unit 1194 receives an actuator operation amount B497 of the second actuator control unit 1192 as an input, and outputs a force generation amount.

[0313] A highly reliable functional part 316, for example an electric motor for braking, operates according to the force generation amount of the second braking force unit 1194, thereby generating a braking force.

[0314] The energy supply unit 1170 supplies electrical energy to the braking system and has a supply monitor 343 configured to identify erroneous behavior or error states of the energy supply unit 1170 and switching processes to its internal energy buffer and to inform the decision unit 344 of this or of the imminent (eventual) depletion of the energy supply of the integrated energy buffer by means of a status signal.

[0315] The decision unit 344 is configured to receive all status signals of the safety monitors 341, 342, 343 occurring in the system and accordingly determine error reactions and thereby transmit these error reactions by means of a switching command 380 to the first switching unit 346 of the brake control unit, the second switching unit 356 of the actuator control unit or the third switching unit 364 of the brake force unit, so as to switch from the first brake path to the second brake path or vice versa. In this way, in the entire braking system, the brake paths can either be switched between the service or safety brake paths or the brake paths can be switched in a targeted manner in the brake control unit, the actuator control unit or the brake force unit.

[0316] If the service brake path is active in the second brake control unit 1190, the force modulation of the first brake control unit 1186 is output to the first actuator control unit 1192. If the safe brake path is active in the second brake control unit 1190, the force modulation of the second brake control unit 1190 is output to the second actuator control unit 1192.

[0317] When the service brake path is active in the second actuator control unit 1192, the actuator manipulated variable of the first actuator control unit 1188 is output to the first brake force unit 1158 and the second brake force unit 1194. When the safety brake path is active in the second actuator control unit 1192, the actuator manipulated variable of the second actuator control unit 1192 is output to the first brake force unit 1158 and the second brake force unit 1194.

[0318] If the service brake path is active in the second brake force unit 1194, the force production adjustment of the first brake force unit 1158 is output to the highly reliable function 316. If the safe brake path is active in the second brake force unit 1194, the force production adjustment of the second brake force unit 1194 is output to the highly reliable function 1116.

[0319] If the optional first brake control unit 1186 is not provided, the first changeover switch 346 may be omitted. If the optional first actuator control unit 1188 is not provided, the second changeover switch 356 may be omitted. If the optional first brake force unit 1158 is not provided, the third changeover switch 364 may be omitted. If all optional components are omitted, the braking system may be implemented as a safety brake providing exclusively a safety brake path.

[0320] Here, the first changeover switch 346 is implemented in the function of the safe brake path of the second brake control unit 1190. Here, the force adjustment quantities or correctors calculated in the first brake control unit 1186 are used depending on the function or are switched off according to a changeover command of the decision part 344, so that a basic value for the force adjustment quantity is formed from the data storage device 345.

[0321] A second changeover switch 356 switches each one of two inputs to one of two outputs, as shown in the table below.

[0322] [Table 1]

[0323] There are three cases where this rule applies. A functional part / unit with low safety integrity must not have direct access to a function / functional group / unit with high integrity unless a switching unit isolates this.

[0324] The third changeover switch 1164 additionally switches between each of the force generating paths in the same manner as the second changeover switch 356. Thus, only the paths through which the manipulated variable A / B is actively supplied can access the highly reliable function portion 316.

[0325] The braking system is therefore configured such that the safety function of the decision unit receives all status signals of the further safety monitors occurring in the system and, accordingly, identifies error reactions and thereby transmits these error reactions to a switching unit of the brake control unit, the actuator control unit or the brake force unit by means of a switching command, whereby a switching from the first brake path to the second brake path or from the second brake path to the first brake path is performed.

[0326] This allows any combination of a first brake control unit from the first brake path, a second brake control unit from the second brake path, a first actuator control unit from the first brake path, a second actuator control unit from the second brake path, a first brake force unit from the first brake path, and a second brake force unit from the second brake path, respectively.

[0327] For example, even if a switching state is confirmed, the first changeover switch 346 can use the functions of the service brake path of the first brake control unit 1186 and remain in the service brake path insofar as these functions are still confirmed to be reliable or, in particular, an error state is confirmed in the data storage device 345. In particular, a mixed mode may exist. Insofar as an error is present in the safety brake path and thus a further safeguarding step is formed, the service brake path may consist of the first brake control unit 1186 as a fallback means.

[0328] Likewise, even if a switching state is confirmed, the second changeover switch 346 can use the functions of the service brake path of the first actuator control unit 1188 and remain in the service brake path insofar as these functions are still confirmed to be reliable or, in particular, if an error state is confirmed in the safety brake path of the second actuator control unit. In particular, a mixed mode may exist. Insofar as an error exists in the safety brake path and thus a further safeguarding step is formed, the service brake path may consist of the first actuator control unit 1188 as a fallback means.

[0329] Likewise, even if a switching state is confirmed, the third changeover switch 364 can use the functions of the service brake path of the first brake force unit 1158 and remain in the service brake path insofar as it is confirmed that these functions are still reliable or, in particular, if an error state is identified in the safety brake path of the second brake force unit 1194. In particular, a mixed mode can exist. Insofar as an error exists in the safety brake path and thus a further safeguard step is formed, the service brake path can consist of the first brake force unit 1158 as a fallback measure. The same applies to the energy supply unit 1170.

[0330] This switching back to the service brake path can be performed at each changeover switch independently of the other changeover switches, in particular service brake path, safety brake path, combination of safety brake paths, safety brake path, combination of safety brake paths or service brake path, service brake path, service brake path combination of brake control units, actuator control units and brake force units are possible.

[0331] The invention has been described with the aid of examples, which are merely illustrative in nature and do not limit the invention as defined by the claims. As will be clear to those skilled in the art, deviations from the examples are possible without departing from the scope of protection of the claims.

[0332] In the present embodiment, the train couple is implemented as an electric train couple, which is supplied with electrical energy via overhead lines, however, as an alternative, electrical energy can also be provided to the train couple via generators, e.g. diesel generators, which are provided, for example, in the driving or traction vehicles.

[0333] In the present embodiment, the train coupler 1 is implemented as a train coupler 1 with a driven car 110, which is a guide car, with a number of traction cars 150. Alternatively, a number of cars or all cars can be driven, in particular instead of the guide car. Furthermore, instead of or in addition to the guide car, one or more traction cars can be equipped with a pantograph.

[0334] In the present embodiment, the control line 128 is configured as a digital data bus. Alternatively, analog control signals can be transmitted via the control line 128. Furthermore, the control line may be implemented in a hierarchically structured plurality of communication systems. For example, inter-train unit communication means may be provided, which are connected to the vehicle-specific communication means by means of gateway means. Furthermore, communication means may be provided redundantly.

[0335] In particular, features from the various different embodiments can be combined, thus for example an energy supply unit integrated in the actuator can be transferred to all other embodiments.

[0336] The brake control unit is configured to receive a control input with a braking command, an extension quantity or a force modulation quantity and determine therefrom a manipulation quantity or a force modulation quantity, and further configured to output the manipulation quantity or the force modulation quantity to an actuator, a brake control unit, an actuator control unit or a brake force unit.

[0337] The actuator control unit is configured to obtain a force adjustment amount and to determine a manipulation amount from the force adjustment amount. The actuator control unit is further configured to output the manipulation amount to the actuator, the brake control unit, the actuator control unit, or the brake force unit.

[0338] The braking force unit is configured to obtain a control variable and to perform a mechanical braking process.

[0339] The brake control unit, the actuator control unit, the braking force unit and the energy supply unit are arranged to determine a switching state and to output a switching signal or command in case of a switching state.

[0340] The brake control unit, the actuator control unit, the brake force unit and the energy supply unit are configured to receive a switching signal or a switching command and, in response to receiving the switching signal or the switching command, to switch from the first brake path to the second brake path or from the second brake path to the first brake path, in particular from the service brake path to the safety brake path or from the safety brake path to the service brake path.

[0341] The conjunctions "und", "oder" and "entweder…oder" are used in a way similar to a logical conjunction (logical AND), a logical disjunction (logical OR, often "und / oder") or an exclusive or (logical exclusive OR). In particular, unlike "entweder…oder", the conjunction "oder" may imply that the two operands are present together.

[0342] The enumeration of method steps in the specification and claims only serves the function of enumerating required method steps. The enumeration of method steps does not imply a required order or sequence of the method steps, unless such order or sequence is explicitly stated or would be apparent to one of ordinary skill in the art. Moreover, such enumerations do not imply that they are self-contained.

[0343] The term "Aufweisen" does not presuppose an exhaustive recitation in the claims, and additional elements and steps may be present.

[0344] The use of the indefinite article "ein" or "eine" does not exclude a plural presence and is to be understood as "mindestens ein" or "mindestens eine", unless restricted as "genau ein" or "genau eine".

[0345] Furthermore, in the present invention, the following terms are to be understood in the sense set forth below.

[0346] Electromechanical Braking System: A braking system that uses electronic, electrical and mechanical components to provide the capability to generate vehicle slowing / braking forces.

[0347] Brake Path: The collection of all functions active between the control inputs of a braking system and the generation of friction brake forces and which form the braking function of the entire system.

[0348] Safety Integrity Level: Also called SIL. Safety requirement level according to DIN EN61508-2:17.

[0349] Safe braking function: Also called braking function with high safety integrity. Local or train-wide functions of the braking system with high safety requirements (e.g. emergency brake, parking brake). A safe braking function is a braking function that has a higher safety integrity level than the service braking function.

[0350] Safe brake path: also called second brake path. A brake path as a set of functions which as a whole achieves a braking process with high safety integrity, i.e. implements at least one safe brake function.

[0351] (Highly integrated) Minimal Function: A function as a component / subgroup of a safe braking function that has a very high safety integrity, is not influenced or manipulated by other (braking) functions, especially extended functions, and does not depend on other (braking) functions, especially extended functions, for the fulfillment of its function.

[0352] Highly reliable functions: (also called split functions). Functions as part of the brake path, based on proven, non-failable functional mechanisms (e.g. mechanical brake calipers) and with inherent safety properties.

[0353] Service Brake Function: Also called brake function with low safety integrity. A local or train-wide function of the braking system that has general safety requirements and provides a conventional, usually train operator initiated, adaptable brake function. A service brake function is a brake function that has a lower safety integrity level than a safe brake function.

[0354] Service brake path: Also called the primary brake path. The brake path as a set of functions which, as a whole, achieves a braking process with low safety integrity.

[0355] Extension function: Extension of the basic braking function by measures that improve its quality (e.g. anti-skid, load correction), local or train-wide function of the braking system.

[0356] Safety Function: A function that monitors and diagnoses the integrity of other functions (especially the brake path) and possibly performs compensation procedures by means of switching procedures in order to maintain or restore a safe braking function. Among others there are the safety monitor functions brake path monitor, actuator monitor and supply monitor, as well as further safety functions decision making and data storage functions.

[0357] Decision unit: a safety function configured to receive all status signals of the safety monitoring functions occurring in the system and, accordingly, to identify error reactions and thereby to transmit these error reactions to at least one switching unit by means of a switching command.

[0358] Switching unit: A functional group which switches from the service brake path to the safety brake path or from the safety brake path to the service brake path in the brake control unit, actuator control unit or brake force unit on receiving a switching command.

[0359] Brake Path Monitor: A safety monitoring function that monitors safety-related physical parameters of the brake path and transmits a status signal via the brake path to a decision unit. In particular, the brake path monitor is configured to identify erroneous behavior in the brake function of the first brake control unit.

[0360] Actuator Monitor: A safety monitor function that monitors safety-related physical parameters of the actuator and transmits a status signal via the actuator to a decision unit. In particular, the actuator monitor is configured to identify erroneous behavior of the first or second actuator control unit or the first or second brake force unit.

[0361] Supply Monitor: A safety monitor function which monitors the safety-related physical parameters of the energy supply of the braking system and transmits a status signal via the energy supply to the decision function. In particular, the supply monitor is configured to identify erroneous behavior or error states of the energy supply unit and switching processes to its internal energy buffer and to inform the decision function of this or of the imminent (eventual) exhaustion of the energy supply of the integrated energy buffer by means of a status signal.

[0362] Data storage function: A remaining safety function configured to provide, in case of failure / incorrect behavior of the first brake control unit, a substitute value for forming the force adjustment quantity and based on the switching signal of the decision unit as an actual value for providing to the actuator control unit.

[0363] Brake Control Unit: A collection of functions that provides train-wide and local braking and extension functions in the braking path based on control inputs or vehicle or braking system states.

[0364] Actuator Control Unit: A collection of functions for providing a force generating function in the brake path based on a force adjustment amount.

[0365] Brake force unit: A set of functions for generating friction brake force based on the operation amount.

[0366] Brake Control Unit: An assembly configured to perform the functions of a brake control unit and, optionally additionally, the functions of an actuator control unit.

[0367] Actuator: An assembly configured to perform the functions of a brake control unit, an actuator control unit and a brake force unit.

[0368] Extended Function Carrier: An assembly configured to provide extended functionality.

[0369] Force adjustment quantity: Open-loop or closed-loop controlled quantity which either directly or indirectly represents the demands of the brake path for generating a force (e.g. cylinder force) in a coordinate system related to the brake regulator, as well as open-loop controlled or control quantities belonging to this, such as reduction signals to be taken into account when adjusting this force, adaptation quantities for improving quality, etc.

[0370] Manipulated variable: An open-loop or closed-loop controlled variable that is supplied to the electromechanical process or principle of action of the present application to define and request a unique motion, force or position state or similar state characteristic (e.g., a parking brake).

[0371] Energy Supply Unit: A collection of functions that provides energy supply to the assemblies of the braking system. [Explanation of symbols]

[0372] 1. Railway vehicle combination 110 Driven vehicles 112 Drive means, electric motor 114 Driven Axle 116 Drive Wheel 118 Rail 120 Pantograph 122 Overhead Line 123 Battery 124 Cab of driven vehicle 126 Electrical Supply Line 128 Control Line 140 Connection section 150 Towing vehicle 154 Non-driven axis 156 Non-driven wheels 160 Final car 162 Driver's cab of the last car 200 Braking system (first embodiment) 202 Energy Supply Interface 204 Control Line Interface 206 Movable friction elements, rotating friction elements, brake discs 208 Brake caliper 210 Static friction elements, brake shoes 212 Friction element drive means, brake actuator motor 214 Spindle drive unit 216 Highly reliable functional parts 218 Control Input 220 Vehicle state quantity input 222 Braking system state input 223 Energy Supply 224 Brake Control Unit 226 First control pathway 228 Regular brake path 230 Second control pathway 232 Safe Brake Path 234 Brake force unit 236 First functional part, first path Force generation 238 Second functional part, second path Force generation 239 Friction braking force, pressing force 300 Braking System (Second Example) 316 Highly reliable functional parts 324 Brake Control Unit 334 1st functional group of the brake control unit for braking and extended functions 336 Second function group of the brake control unit for safe braking functions 338 3rd functional group of the brake control unit for safety functions 340 Safety Features 341 Brake Path Monitor 342 Actuator Monitor 343 Supply Monitor 344 Decision Section 345 Data storage function 346 First switching unit of brake control unit 348 Actuator Control Unit 350 First control path 352 Second control pathway 354 4th function group of actuator control units for safety functions 356 Second switching unit of the actuator control unit 358 Brake Force Unit 360 First Functional Part 362 Second Functional Part 364 Third switching unit of brake force unit 366 Sensors 370 Energy Supply Unit 372 Buffer Memory 374 External Energy Supply 376 5th functional group of energy supply units for safety functions 378 Fourth switching unit of the energy supply unit 380 Switching Instructions 382 Force adjustment amount 384 Manipulated amount 386 Brake Energy Supply 400 Braking System (Third Example) 458 Brake Force Unit 470 Energy Supply Unit 480 Brake control unit 482 Actuator 484 Energy Supply Division 486 First Brake Control Unit 488 First Actuator Control Unit 490 Second Brake Control Unit 492 Second Actuator Control Unit 494 First Control Quantity 495 Second Operation Quantity 496 Manipulated amount A 497 Manipulated amount B 500 Braking System (Fourth Example) 558 Brake Force Unit 580 Brake control unit 582 Actuator 586 First Brake Control Unit 588 First Actuator Control Unit 590 Second Brake Control Unit 592 Second Actuator Control Unit 594 Extension Device Carrier 594' Expansion function unit (service brake path) 594'' Expansion Function Unit (Safety Brake Path) 594'' Expansion function unit (service brake path) 596 3rd Brake Control Unit 597 Extensions 598 Expansion Amount 599 Sensor Quantity 600 Braking System (Fifth Example) 658 Brake Force Unit 670 Energy Supply Unit 680 Brake control unit 682 Actuator 684 Energy Supply Division 686 First Brake Control Unit 688 First Actuator Control Unit 690 Second Brake Control Unit 692 Second Actuator Control Unit 700 Braking System (Sixth Example) 758 Brake Force Unit 780 Brake control unit 782 Actuator 784 Energy Supply Division 786 First Brake Control Unit 788 First Actuator Control Unit 790 Second Brake Control Unit 792 Second Actuator Control Unit 800 Braking System (7th embodiment) 858 Brake Force Unit 880 Brake control unit 882 Actuator 884 Energy Supply Division 886 First Brake Control Unit 888 First Actuator Control Unit 890 Second Brake Control Unit 892 Second Actuator Control Unit 900 Braking system (8th embodiment) 948 Actuator Control Unit 980 Brake control unit 982 Actuator 984 Energy Supply Division 986 First Brake Control Unit 988 First Actuator Control Unit 990 Second Brake Control Unit 992 Second Actuator Control Unit 1000 Braking system (ninth embodiment) 1080 Brake control unit 1082 Actuator 1084 Energy Supply Section 1118 Control Input 1158 First Brake Force Unit 1170 Energy Supply Unit 1186 First Brake Control Unit 1188 First Actuator Control Unit 1190 Second Brake Control Unit 1192 Second Actuator Control Unit 1194 Second Brake Force Unit 1195 Force generation amount

Claims

1. 1. A braking system for a rail vehicle, comprising: the braking system comprises a brake control, an actuator, a first brake path having a function active between at least one control input of the braking system and the generation of a brake force, and a second brake path having a brake function active between at least one control input of the braking system or active in the presence of a predetermined brake system state quantity and during the generation of a brake force; The brake controller includes a first brake control unit configured to provide a braking function and to output a force modulation amount; a first actuator control unit configured to provide a function of generating a friction brake force based on the force adjustment amount and to output an operation amount; a second brake control unit configured to provide a braking function and to output a force adjustment; a second actuator control unit configured to provide a function of generating a friction brake force based on the force adjustment amount and to output an operation amount; and a brake force unit configured to provide a function of generating a friction brake force based on the operation amount. Braking system.

2. the first brake path is configured to provide a brake function having a low safety integrity; the second brake path is configured to provide braking function with high safety integrity; 2. The braking system of claim 1, wherein a braking function having a high safety integrity has a higher safety integrity level than a braking function having a low safety integrity.

3. 3. The braking system of claim 1 or 2, further comprising a first group of divided functional parts that are part of the first brake path and part of the second brake path and that are configured to generate a friction force such that the rail vehicle is slowed.

4. the brake control is configured to provide a braking function for the first brake path or the second brake path; The braking system of claim 3 , wherein the actuator is configured to provide a braking function for the first brake path or the second brake path.

5. the first brake control unit and the second brake control unit are configured to provide a braking function for the first brake path or the second brake path; the first actuator control unit and the second actuator control unit are configured to provide a braking function for the first brake path or the second brake path; A braking system according to any one of claims 1 to 4, wherein the brake force unit is configured to provide a braking function for the first brake path or the second brake path.

6. the first brake control unit and the first actuator control unit are configured to provide a braking function for the first brake path; the second brake control unit and the second actuator control unit are configured to provide a braking function for the second brake path; A braking system according to any one of claims 1 to 5, wherein the brake force unit is configured to provide braking functions for the first brake path and the second brake path.

7. the first brake control unit is configured to provide a braking function for the first brake path or the second brake path; the first actuator control unit is configured to provide a braking function for the first brake path; the second brake control unit and the second actuator control unit are configured to provide a braking function for the second brake path; A braking system according to any preceding claim, wherein the brake force unit is configured to provide braking functions for the first brake path and the second brake path.

8. 8. The braking system according to claim 1, further comprising an energy supply unit configured to supply components of the braking system with energy, in particular electrical energy, for the operation of the braking system.

9. 9. The braking system according to claim 1, wherein the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the brake force unit is configured to receive a switching signal and to switch from the first brake path to the second brake path or to switch from the second brake path to the first brake path upon receiving the switching signal.

10. 10. The braking system according to claim 1, wherein the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the brake force unit has a switching unit and is configured to determine a switching state and to output a switching signal if a switching state is determined.

11. The braking system according to any one of claims 1 to 10, wherein the braking system is configured to perform a safety function.

12. 12. The braking system of claim 11, wherein the safety function is from a safety function group including the elements brake path monitor, actuator monitor, supply monitor, decision unit and data storage function.

13. the energy supply unit is configured to perform the safety function of the supply monitor; 13. A braking system according to claim 11 or 12, wherein the second brake control unit is configured to perform the brake path monitor, the actuator monitor, the data storage function and the safety function of the decision maker.

14. the energy supply unit is configured to perform the safety function of the supply monitor; the first brake control unit is configured to perform the safety functions of the brake path monitor and the actuator monitor; 14. A braking system according to any one of claims 11 to 13, wherein the second brake control unit is adapted to perform the safety functions of the decision making part and the data storage function.

15. 15. A braking system according to any one of the preceding claims, wherein the brake force unit is configured to obtain a manipulated variable and to control a functional sub-group such that the rail vehicle is decelerated.

16. 16. The braking system according to claim 1, wherein the braking system, in particular the brake control or the actuator, comprises an energy supply unit, in particular and optionally or additionally an internal energy supply unit.

17. A railway vehicle, Equipped with a braking system according to any one of claims 1 to 16 Railway vehicle.

18. 1. A braking method for a rail vehicle, comprising: The braking method includes: a) providing a braking function by a first brake control unit in a brake control section; b) outputting a force adjustment by the first brake control unit; c) providing a brake function generating a friction brake force in the brake control by a first actuator control unit based on the force adjustment from step b); d) outputting an operation amount by the first actuator control unit; e) providing a braking function by a second brake control unit at the actuator; f) outputting a force adjustment by the second brake control unit; g) providing a braking function generating a friction braking force at the actuator by a second actuator control unit based on the force adjustment from step f); h) outputting an operation amount by the second actuator control unit; i) providing a braking function generating a friction braking force by a braking force unit based on the operation amount from step d) or step h); j) providing a first brake path having a function active between a control input of the braking system and the generation of a brake force; and k) providing a second brake path having an active function between a control input of the braking system and the generation of braking force. Braking method.

19. the first brake path from step j) is configured to provide a brake function having a low safety integrity; 20. The braking method of claim 18, wherein the second brake path from step k) is configured to provide a brake function having a high safety integrity.

20. Step a), step c), step e), step g) or step i) ac) providing a braking function for said first brake path; or 20. The method of claim 18 or 19, further comprising the step of: ad) providing a braking function of the second brake path.

21. moreover, 21. The braking method according to claim 18, further comprising the step of: l) executing a safety function by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit or the braking force unit.

22. 22. The braking method of claim 21, wherein the safety function is one of a safety function group including the elements brake path monitor, actuator monitor, supply monitor, decision unit and data storage function.

23. moreover, m) receiving a switching signal by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, an energy supply unit or the braking force unit; 23. The method according to claim 18, further comprising the step of: n) switching from the first brake path to the second brake path or switching from the second brake path to the first brake path in the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the brake force unit.

24. moreover, o) determining a switching state by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the braking force unit; p) outputting a switching signal by the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit or the braking force unit when the switching state is determined.

Images