Brake systems for performing safe additional braking functions

Abstract

Various embodiments of a braking system (500) for at least one bogie or railcar are detailed, including an emergency brake control unit (503) configured according to a first safety integrity level and a service brake control unit (508) configured according to a second safety integrity level lower than the first safety integrity level. The braking system (500) performs at least one additional braking function (550) at the same safety integrity level as the emergency brake control unit (503).

Description

[Technical field]

[0001] The present invention relates generally to the field of railway braking systems, and more particularly to a braking system for a bogie or rail vehicle, which allows for the performance of additional safe braking functions. [Background technology]

[0002] Modern railway braking systems use advanced electronic solutions to simplify the pneumatic architecture, especially the pneumatic portion used for emergency braking, resulting in an overall reduction in the total product cost, weight reduction, improved performance, and increased operational safety.

[0003] FIG. 1 shows a known structure of a new generation electro-pneumatic system 100 .

[0004] An electro-pneumatic emergency braking unit 101 is supplied with a pneumatic supply pressure 102 .

[0005] The electro-pneumatic emergency braking unit 101 is controlled via closed-chain control algorithms by an emergency braking control unit 103 using a number of control and feedback signals 105. The emergency braking control unit 103 is an electronic control unit.

[0006] The emergency brake control unit 103 receives at an input thereof one or more weight signals 104 indicative of a weight value at which braking should be applied by the electro-pneumatic system (brake system) 100. The one or more weight signals 104 may be generated by pressure transducers adapted to measure pressures generated by suspension systems of the rail vehicle. Alternatively, the one or more weight signals 104 may be generated by linear or angular position transducers suitable for measuring the distance from the body of the rail vehicle to the bogie. Furthermore, it will be apparent that the distance from the body of the rail vehicle to the bogie varies depending on the weight of the rail vehicle body.

[0007] The emergency brake control unit 103 controls the electro-pneumatic emergency brake unit 101 to generate an emergency braking pressure 106. The emergency braking pressure 106 is a function of design parameters of the railcar, such as, but not limited to, a predicted maximum adhesion value between the wheels and the rail, and a weight value derived from the weight signal 104 at which the brakes should be applied.

[0008] Emergency brake pressure 106 is provided to an electro-pneumatic service brake unit 107. Additionally, emergency brake pressure 106 enables electro-pneumatic service brake unit 107 to in turn generate one or more outputs 111, ..., 114. Although four outputs are shown in the figure, the number of outputs may be different in other embodiments.

[0009] In embodiments known to those skilled in the art, emergency braking pressure 106 may be supplied simultaneously with pneumatic supply pressure 102 to an electro-pneumatic service braking unit 107 .

[0010] In both of the above cases, the current value of the emergency braking pressure 106 always corresponds to the maximum current value that one or more of the service brake pressures can reach at one or more outputs 111, ..., 114 of the electro-pneumatic service brake unit 107.

[0011] Below we provide examples of both of the above cases.

[0012] The electro-pneumatic service brake unit 107 is controlled via a closed chain control algorithm by a service brake control unit 108 using a number of control and feedback signals 109. The service brake control unit 108 is an additional electronic control unit.

[0013] The service brake control unit 108 receives a service brake request signal 110 indicating the need to perform service braking, in the form of a pressure value request, a braking force request or a deceleration request. Additionally, the service brake control unit 108 receives at an input of the service brake control unit 108 one or more weight signals 104 indicating a weight value at which braking should be applied by the electro-pneumatic system (brake system) 100.

[0014] The service brake control unit 108 controls the electro-pneumatic service brake unit 107 to propagate one or more service brake pressures to one or more outputs 111, ..., 114 of the electro-pneumatic service brake unit 107. The one or more service brake pressures at the one or more outputs 111, ..., 114 are a function of at least the service brake demand signal 110 and a weight value at which the brakes are to be applied derived from the weight signal 104. The one or more service brake pressures at the one or more outputs 111, ..., 114 of the electro-pneumatic service brake unit 107 are used to apply the brakes to one or more axles of the rail vehicle.

[0015] The electro-pneumatic service brake unit 107 is configured to generate a maximum electro-pneumatic service brake pressure value that corresponds to the pressure value of the emergency brake pressure 106 .

[0016] Furthermore, the electro-pneumatic service brake unit 107 is configured to transmit the current emergency braking pressure value of the emergency brake pressure 106 to outputs 111, ..., 114 of the electro-pneumatic service brake unit 107 in the absence of the control signal (control signal and feedback signal) 109.

[0017] The emergency braking request signal 115 indicates the need to perform emergency braking and acts on an interruption device 116, which may be implemented, for example, but not limited to, a multi-exchange relay or multiple semiconductor switches. In the absence of an emergency braking request from the emergency braking request signal 115, the interruption device 116 is configured to maintain a closed contact configuration, and in the presence of an indication of a need to perform emergency braking from the emergency braking request signal 115, the interruption device 116 is configured to maintain an open contact configuration.

[0018] In this manner, in the absence of an indication of a request to perform emergency braking via the emergency brake request signal 115, the electro-pneumatic service brake unit 107 generates one or more service brake pressures at one or more outputs 111, ..., 114 of the electro-pneumatic service brake unit 107 under the control of the service brake control unit 108.

[0019] The one or more service pressure values ​​at one or more outputs 111, ..., 114 of the electro-pneumatic service brake unit 107 are upper limits on the current value of the emergency brake pressure 106. When there is an indication from the emergency brake request signal 115 that an emergency brake should be performed, the electro-pneumatic service brake unit 107 communicates the value of the emergency brake pressure 106 to the one or more outputs 111, ..., 114 of the electro-pneumatic service brake unit 107.

[0020] A first example of a known braking system 100 is disclosed in EP 3148853, which is shown in FIG.

[0021] The EPDA unit in FIG. 2 corresponds to the electro-pneumatic emergency brake unit 101. The Weighting Control Unit in FIG.

[0022] 2 correspond to the electro-pneumatic service brake unit 107. Additionally, the outputs of the EPCA units to the brake cylinders BC1, ..., BCN correspond to the pressures of one or more outputs 111, ..., 114 of the electro-pneumatic service brake unit 107.

[0023] The brake control units in FIG. 2 correspond to the service brake control units 108 in FIG. 1, respectively. The output pressure to the relay valve 4 in FIG. 2 corresponds to the emergency brake pressure 106 in FIG. 1. The MBP pressure in FIG. 2 corresponds to the pneumatic supply pressure 102 in FIG. 1. The pressure at the output of the relay valve 4 in FIG. 2 powers a solenoid valve group, which consists of a number of solenoid valves 10, 12, 20, and is used to drive the relay valve RV. With this architecture, it is clear to a person skilled in the art how the pressure value at the brake cylinders BC1, ..., BCn, which corresponds to the emergency brake pressure 106 of the brake system 100, never exceeds the pressure value at the output of the relay valve 4 in FIG. 2.

[0024] A second example of an electro-pneumatic system (brake system) 100 is disclosed in EP 2 830 918 and is shown in FIG.

[0025] A dashed-dotted box 401 shown in Figure 3 corresponds to the electro-pneumatic emergency braking unit 101 shown in Figure 1. Also, a dashed-dotted box 402 shown in Figure 3 corresponds to the electro-pneumatic service braking unit 107 shown in Figure 1. Furthermore, a pneumatic pressure signal 403 shown in Figure 3 corresponds to the emergency braking pressure 106 shown in Figure 1.

[0026] In this patent application, reference is made to the following European regulations: EN50126 "Railway applications. The specification and demonstration of reliability, availability, maintainability and safety (RAMS)" ·EN50128 "Railway applications. Communications, signalling and processing systems. Software for railway control and protection systems" EN50129 "Railway applications. Communication, signalling and processing systems. Safety related electronic systems for signalling"

[0027] In particular, the EN50126 standard specifies a method for assigning safety integrity levels SIL0 / 1 / 2 / 3 / 4 to the multiple subsystems constituting the system according to the present invention based on the results of a safety analysis (SIL4 indicates the highest safety level), and the EN50128 and EN50129 standards specify design criteria to be applied to software and hardware components, respectively, according to the SIL levels assigned based on the results of the safety analysis.

[0028] Factors known to those skilled in the railroad art include: Safety calculations relating to emergency braking functions for rail vehicles, carried out in accordance with the European standard EN50126, should systematically assign a safety integrity level SIL ≥ 3 to the emergency braking functions and, consequently, to the subsystems implementing them. Safety calculations relating to the service braking function for rail vehicles carried out in accordance with the European standard EN50126 will normally assign a safety integrity level SIL ≤ 2 to the service braking functions and, consequently, will normally assign a safety integrity level SIL ≤ 2 to the subsystems which implement them. The development of control units according to SIL ≥ 3 level for EN50128 and EN50129, typically based on one or more microprocessors, one or more FPGAs or using a mixed microprocessor / FPGA structure, necessarily entails design, verification and certification costs that are approximately an order of magnitude higher when compared to designs achieving a similar functionality according to SIL ≤ 2 level.

[0029] Related to the last point above, there is clearly value in keeping the functions to be developed in accordance with a safety level of SIL ≥ 3 very limited and simple.

[0030] It is therefore known in the prior art that the emergency brake control unit 103 used to control the generation of the emergency brake pressure 106 must be developed according to a higher SIL safety level than the SIL safety level required for the development of the service brake control unit 108. Typically, the emergency brake control unit 103 is developed according to EN50128 and EN50129 to a SIL≧3, whereas the service brake control unit 108 is developed according to EN50128 and EN50129 to a SIL≦2.

[0031] The safety of railway systems for passenger trains is a growing concern. Due to this growing concern, the SIL safety integrity level of some additional functions related to braking systems has been reconsidered in recent years, and these additional functions are now being developed according to a safety integrity level of SIL≦2.

[0032] The first function is known to those skilled in the art as Holding Brake. This function consists of automatically applying a braking force by the braking system when the train speed falls below a predetermined value, typically a speed in the range of 1 km / h to 3 km / h.

[0033] This speed level is reached, for example, when a rail car is about to stop at a platform where passengers are boarding and disembarking.

[0034] The purpose of the restraining brake function is to prevent the vehicle from moving in one of the two possible directions due to the inclination of the rail while passengers are getting on or off.

[0035] In the normal operating mode of the vehicle, the retarder brakes are maintained applied at least the entire time and the rail car doors remain open.

[0036] The retarder brake is automatically removed from the brake system only when appropriate safety signals indicate that the rail car doors are closed and when signals from the traction system indicate that sufficient traction torque is being applied by the traction motors to move the car in the forward direction.

[0037] This last measure is necessary to prevent the train from rolling backwards while releasing the retarder brakes on an uphill stretch, hence the retarder brake function is sometimes known as the anti-rollback function.

[0038] Currently, the retarder brake function is managed automatically by the service brake control unit 108 according to a safety integrity level of SIL≦2.

[0039] To be able to perform the aforementioned suppression brake function, the service brake control unit 108 receives one or more speed signals 200, for example but not limited to, from a speed sensor or other module that generates a rail vehicle reference speed signal (not shown). Using the rail vehicle speed information, the service brake control unit 108 determines the moment when the suppression brake function should be activated. Furthermore, the service brake control unit 108 receives one or more traction torque signals 201 generated by the traction system. Such one or more traction torque signals 201 indicate whether the traction torque is sufficient to prevent the situation defined as rollback as described above. Furthermore, the service brake control unit 108 may receive one or more door status signals 202 from a vehicle door management system, indicating the door opening or closing status.

[0040] By observing one or more traction torque signals 201 and one or more door status signals 202, the service brake control unit 108 determines the moment when the retard brake function is deactivated.

[0041] The service brake control unit 108 performs a retarder brake function by driving the electro-pneumatic service brake unit 107 to obtain retarder brake pressure at one or more outputs 111 , . . . , 114 of the electro-pneumatic service brake unit 107 .

[0042] In most cases, this retarding brake pressure is a function of one or more weight signals 104 indicative of the weight to be braked by the brake system 100 and is determined by a service brake control unit 108 .

[0043] The functional and operational analysis of the retarder brake function shows how a malfunction can occur in the service brake control unit 108. Typically, an error that can be caused by the software is, for example, an error that the retarder brake is released while passengers are boarding or alighting from the railcar. In particular, if there is a space between the platform and the boarding / alighting plane of the train, passengers may accidentally place their feet in the space. Considering the above situation, when the railcar is on a slope, such a railcar may take an undue movement that may cause serious trauma to the passengers' bodies.

[0044] It is known to those skilled in the art that some railroad operators, regardless of the presence of an automatic detent brake function, require their engineers to systematically activate the detent brakes at each stop during the passenger loading / unloading phase of the train. The engineers ensure that the detent brakes are manually activated to prevent improper operation of the railcar during the passenger loading / unloading phase.

[0045] In other cases, if a malfunction of the restraining brake system causes the rail vehicle to move inappropriately while passengers are embarking or disembarking, the precaution of applying the emergency brake is left solely to the attention of the engineer.

[0046] The above considerations would lead to the opinion that the development of a retarding brake function according to a level of SIL ≥ 3 would be appropriate to mitigate the potential risk of serious injury to passengers and to avoid the systematic intervention of the engineer at each stop.

[0047] The second function is known as "Distributor Emulation." This function emulates the functional behavior of a distributor valve through software functions. The distributor valve is known to perform both a service braking function, which requires development limited to a safety level of SIL≦2, and an emergency braking function, which requires development to a safety level of SIL≧3.

[0048] Currently, the "distributor emulation" function is performed by the service brake control unit 108 only according to safety levels SIL≦2.

[0049] To perform the "distributor emulation" function, the service brake control unit 108 receives a pressure signal 202 indicative of the pressure in the main brake pipe. The pressure signal 202 is typically generated by a pressure transducer, not shown, which is pneumatically connected to the main brake pipe.

[0050] The distributor emulation function is disclosed in International Publication WO2018189693, which discloses that it is possible to realize a "distributor emulation" function according to a fully developed structure at a level of SIL≧3.

[0051] Those skilled in the art envisage additional safety braking functions consisting of brakes that can be modulated by signalling systems such as ERTMS / ETCS, automatic train operation systems ATO (Automatic Train Operation) or a system defined as the Virtual Coupling of several trains.

[0052] Currently, linearly modulated brakes are represented by service brakes. The current safety level of service brakes is assumed to be SIL2, which is insufficient for the requirements of the aforementioned automated driving system. At the same time, the emergency brake function, although classified as SIL4, operates in a binary on / off manner, which is inadequate for the functional requirements of the aforementioned automated driving system.

[0053] It is known to those skilled in the art that the aforementioned automated driving systems must linearly control the braking system at a safety level higher than the current safety level of the service brakes, which means that the safety level of the service brakes must be increased to SIL4 or the emergency brakes must be modulated.

[0054] As mentioned above, the complete implementation of complex functions such as, for example but not limited to, "restraint braking", "distributor emulation" or "modulated braking with signalling system" functions according to a safety level of SIL≧3 represents a substantial source of development, certification and maintenance costs. Summary of the Invention [Problem to be solved by the invention]

[0055] The object of the present invention is therefore to propose a braking system for at least one bogie or rail vehicle, which allows to increase the safety integrity level of any additional braking functions of the braking system, for example but not exclusively from a level SIL≦2 to a level SIL≧3, and which makes it possible to reduce the complexity of the system, the full system development, certification costs and maintenance costs by utilizing existing units of the braking system.

[0056] According to one aspect of the invention, the above and other objects and advantages are achieved by a braking system for a bogie or rail vehicle having the features defined in the respective independent claims. Preferred embodiments of the invention are defined in the dependent claims, the content of which is to be understood as an essential part of this description. [Brief description of the drawings]

[0057] Next, functional and structural features of some preferred embodiments of an electronic control system for emergency and service braking according to the present invention will be described in detail with reference to the accompanying drawings. [Figure 1] FIG. 1 shows the structure of a known new generation electro-pneumatic brake system. [Diagram 2] FIG. 2 shows a first example of a known braking system 100 from EP 3148853. [Diagram 3] FIG. 3 shows a second example of a known braking system 100 from EP 2 830 918 B1. [Figure 4] FIG. 4 shows a first embodiment of a brake system according to the present invention. [Diagram 5] FIG. 5 shows a second embodiment of a brake system according to the present invention. [Figure 6] FIG. 6 shows a third embodiment of a brake system according to the present invention. [Figure 7] FIG. 7 shows a fourth embodiment of a brake system according to the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0058] Before describing several embodiments of the invention in detail, it should be made clear that the invention is not limited in its application to the details of construction and the arrangement of parts set forth hereinafter in the specification or illustrated in the drawings. The invention is capable of other embodiments and of actually being practiced or constructed in various ways. It is also to be understood that the phraseology and terminology are for the purpose of description and should not be construed as limiting. The words "include," "comprise," or variations thereof, mean the inclusion of the elements described below and equivalents thereof, as well as additional elements and equivalents thereof.

[0059] FIG. 4 shows a first embodiment of a braking system 500 according to the invention.

[0060] A braking system 500 for at least one bogie or rail car includes an emergency brake control unit 503 configured in accordance with a first safety integrity level SIL and a service brake control unit 508 configured in accordance with a second safety integrity level SIL lower than the first safety integrity level SIL.

[0061] The emergency brake control unit 503 is arranged to control the electro-pneumatic emergency brake unit 501 by means of a first group of control and feedback signals 505 and to generate via the electro-pneumatic emergency brake unit 501 an emergency brake pressure 506, the pressure value of which is a function of at least one weight signal 504 indicative of the weight of the bogie or rail car to be braked.

[0062] As shown in FIG. 4, an electro-pneumatic emergency brake unit 501 is provided which is supplied with a pneumatic supply pressure 502 .

[0063] Moreover, the emergency brake control unit 503 is further arranged to determine at least one additional pressure value 551 associated with the additional braking function 550. The additional pressure value 551 is determined in response to at least one input signal 520 associated with the additional braking function 550. The at least one input signal 520 is received by the emergency brake control unit 503.

[0064] The phrase "determining" a value may be understood as either the act of calculating this value or retrieving this value from some table or database.

[0065] The emergency brake control unit 503 is further arranged to transmit, by means of the communication means 518 , at least one additional pressure value 551 associated with the additional braking function 550 to the service brake control unit 508 .

[0066] For example, but not by way of limitation, communication means 518 may be a serial communication network.

[0067] A service brake control unit 508 is configured to determine at least one service brake pressure value in response to a service brake demand signal 510 and the at least one weight signal 504. The service brake demand signal 510 is indicative of a service brake demand.

[0068] The service brake control unit 508 is further arranged to control the electro-pneumatic service brake unit 507 using a second group of control and feedback signals 509 and to provide a pressure value to at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507. The provided pressure value is the greater of at least one additional pressure value 551 associated with the additional braking function 550 and at least one service brake pressure value determined by the service brake control unit 508.

[0069] The number of outputs 511, . . . , 514 of the electro-pneumatic service brake unit 507 shown as an example in several figures is four, although the number of outputs may be different in other examples.

[0070] As shown in FIG. 4, an electro-pneumatic service brake unit 507 is provided to receive at least emergency brake pressure 506 .

[0071] Returning now to the description of the emergency brake control unit 503, the emergency brake control unit 503 is further arranged to receive at least one feedback signal 519 indicative of a pressure value at at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507.

[0072] Furthermore, the emergency brake control unit 503 is arranged to monitor the pressure value at the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 by means of at least one feedback signal 519 when an additional pressure value 551 associated with the additional brake function 550 is predicted at the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 (in other words the additional pressure value 551 associated with the additional brake function 550 must be present) but the pressure value at the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 is lower than the at least one additional pressure value 551 associated with the additional brake function 550 by at least one predetermined tolerance value. The emergency brake control unit 503 is then arranged to force a pressure value at the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 which corresponds to the pressure value of the emergency brake pressure 506. At least one additional pressure value 551 associated with an additional brake function 550 is determined by the emergency brake control unit 503 .

[0073] In this way, the brake system 500 subsequently performs at least one additional brake function 550 , in any case with the same safety integrity level as the emergency brake control unit 503 .

[0074] Reference is now made to Figure 5. In Figure 5, a second embodiment of a braking system 500 according to the present invention is shown.

[0075] Again, the braking system 500 for at least one bogie or rail vehicle includes an emergency brake control unit 503 configured in accordance with a first safety integrity level SIL and a service brake control unit 508 configured in accordance with a second safety integrity level SIL, which is lower than the first safety integrity level SIL.

[0076] Also in this second embodiment, an emergency brake control unit 503 is arranged to control an electro-pneumatic emergency brake unit 501 by means of a first group of control and feedback signals 505. The emergency brake control unit 503 is arranged to control the electro-pneumatic emergency brake unit 501 and to generate an emergency brake pressure 506 via the electro-pneumatic emergency brake unit 501, the pressure value of which is a function of at least one weight signal 504 indicative of the weight of the bogie or rail car to be braked. As shown in Figure 5, the electro-pneumatic emergency brake unit 501 is arranged to be supplied with a pneumatic supply pressure 502.

[0077] The emergency brake control unit 503 is further arranged to determine at least a first additional pressure value 551 associated with the additional brake function 550. The first additional pressure value 551 is determined in response to at least one input signal 520 associated with the additional brake function 550. The at least one input signal 520 is received by the emergency brake control unit 503.

[0078] The service brake control unit 508 is arranged to determine at least one service brake pressure value in response to the service brake demand signal 510 and the at least one weight signal 504. And the service brake control unit 508 is arranged to determine at least one second additional pressure value 551' associated with the additional brake function 550 in response to at least one input signal 520' associated with the additional brake function 550. The at least one input signal 520' is received by the service brake control unit 508.

[0079] The service brake control unit 508 is further arranged to control the electro-pneumatic service brake unit 507 using a second group of control and feedback signals 509 to provide a pressure value to at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507. The provided pressure value is the greater of at least one second additional pressure value 551' associated with the additional braking function 550 and at least one service pressure value determined by the service brake control unit 508. As shown in Figure 5, the electro-pneumatic service brake unit 507 is arranged to receive at least an emergency brake pressure 506.

[0080] Returning now to the description of the emergency brake control unit 503. In this second embodiment, the emergency brake control unit 503 is further arranged to receive at least one feedback signal 519 indicative of a pressure value at at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507.

[0081] Furthermore, if at least one additional pressure value 551' determined by the service brake control unit 508 is predicted at at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507, but the pressure value at the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 is lower by at least one predetermined tolerance value than the at least one first additional pressure value 551 determined by the emergency brake control unit 503 and associated with the additional brake function 550, the emergency brake control unit 503 is configured to monitor the pressure value at the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 using at least one feedback signal 519 and to force it to a pressure value corresponding to the pressure value of the emergency brake pressure 506 at the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507.

[0082] Also in this second embodiment, the braking system 500 performs at least one additional braking function 550 , which in any event results in the same safety integrity level as the emergency brake control unit 503 .

[0083] Preferably, for both the first and second embodiments described above, the emergency brake control unit 503 may be arranged to control an interruption device 516 by means of a control signal 517 .

[0084] In this case, the emergency brake control unit 503 may be provided to open the interrupting device 516 so as not to allow the connection of the second group 509 of control and feedback signals between the service brake control unit 508 and the electro-pneumatic service brake unit 507 when the emergency brake control unit 503 has to force a pressure value corresponding to the pressure value of the emergency brake pressure 506 to the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507. The electro-pneumatic service brake unit 507 may thus be provided to transmit the pressure value of the emergency brake pressure 506 to the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 when the second group 509 of control and feedback signals is not connected between the service brake control unit 508 and the electro-pneumatic service brake unit 507.

[0085] Preferably, the emergency brake control unit 503 may further be arranged to receive an emergency brake request signal 515 indicative of an emergency brake request. When the emergency brake request signal 515 indicates an emergency brake request, the emergency brake control unit 503 may open the cut-off device 516 by means of a control signal 517, regardless of the outcome of a comparison between the at least one feedback signal 519 and a pressure value at the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507. In other words, when the need for emergency braking is indicated, the emergency brake control unit 503 ensures that the emergency brake pressure 506 is transmitted to the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507.

[0086] Preferably, for both the first and second embodiments described above, when the emergency brake control unit 503 has to force a pressure value corresponding to the pressure value of the emergency brake pressure 506 on at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507, the emergency brake pressure 506 may be directly transmitted to at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507. Also, as shown in Figures 5 and 6, the electro-pneumatic service brake unit 507 may be further provided to receive a pneumatic supply pressure 502. In this case, the pressure value of the pneumatic supply pressure 502 is limited to the value of the emergency brake pressure 506 inside the electro-pneumatic service brake unit 507, when the emergency brake control unit 503 has to force a pressure value corresponding to the pressure value of the emergency brake pressure 506 on at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507. The pressure value of the pneumatic supply pressure 502 , limited to the value of the emergency brake pressure 506 , is then transmitted to at least one output 511 , . . . , 514 of an electro-pneumatic service brake unit 507 .

[0087] Reference is now made to Figure 6. In Figure 6, a third embodiment of a braking system 500 according to the present invention is shown.

[0088] In this third embodiment, as in the previous embodiment, a braking system 500 for at least one bogie or rail vehicle includes an emergency brake control unit 503 configured according to a first safety integrity level SIL and a service brake control unit 508 configured according to a second safety integrity level SIL lower than the first safety integrity level SIL.

[0089] In a third embodiment, an emergency brake control unit 503 is arranged to control an electro-pneumatic emergency brake unit 501 by means of a first group of control and feedback signals 505 and to generate via the electro-pneumatic emergency brake unit 501 an emergency brake pressure 506, the pressure value of which is a function of at least one weight signal 504 indicative of the weight of the bogie or rail car to be braked. The electro-pneumatic emergency brake unit 501 is arranged to be supplied with a pneumatic supply pressure 502.

[0090] The emergency brake control unit 503 is further configured to determine at least one first additional pressure value 551 associated with the additional brake function 550 in response to at least one input signal 520 received by the emergency brake control unit 503 and associated with the additional brake function 550.

[0091] A service brake control unit 508 is provided to determine at least one service brake pressure value in response to a service brake demand signal 510 and the at least one weight signal 504 .

[0092] The service brake control unit 508 is arranged to determine at least a second additional pressure value 551' associated with the additional brake function 550 in response to at least one input signal 520' received by the service brake control unit 508 and associated with the additional brake function 550.

[0093] Further, the service brake control unit 508 controls the electro-pneumatic service brake unit 507 using a second group of control and feedback signals 509 to provide a pressure value to at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507. The provided pressure value is the greater of at least one second additional pressure value 551' determined by the service brake control unit 508 and associated with an additional braking function 550, and the at least one service brake pressure value determined by the service brake control unit 508. As can be seen in Figure 6, the electro-pneumatic service brake unit 507 is arranged to receive at least a pneumatic supply pressure 502.

[0094] In the third embodiment, the braking system 500 for at least one bogie or rail car further comprises an electro-pneumatic selection unit 601 with at least one pressure output 611, . . . , 614.

[0095] The electro-pneumatic selection unit 601 is arranged to receive at least the emergency brake pressure 506 , at least one pressure at at least one output 511 , . . . , 514 of the electro-pneumatic service brake unit 507 , and a control signal 617 from the emergency brake control unit 503 .

[0096] The electro-pneumatic selection unit 601 is further arranged to transmit the emergency brake pressure 506 or at least one pressure at at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 to at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601 in response to a control signal 617 from the emergency brake control unit 503.

[0097] The emergency brake control unit 503 is further configured to receive at least one feedback signal 519 indicative of a pressure value at at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601 and to monitor the pressure value at the at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601 using the at least one feedback signal 519.

[0098] Furthermore, when at least one second additional pressure value 551' determined by the service brake control unit 508 is predicted at at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601, but the pressure value at the at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601 is lower by at least one predetermined tolerance value relative to the at least one first additional pressure value 551 determined by the emergency brake control unit 503 and associated with the additional braking function 550, the emergency brake control unit 503 is configured to control the electro-pneumatic selection unit 601 via a control signal 617 to activate the propagation of the emergency brake pressure 506 to the at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601.

[0099] Thus, also in the third embodiment, the brake system 500 performs at least one additional brake function 550 , in any case with the same safety integrity level as the emergency brake control unit 503 .

[0100] Reference is now made to Figure 7. In Figure 7, a fourth embodiment of a braking system 500 according to the present invention is shown.

[0101] Also in the fourth embodiment, a braking system 500 for at least one bogie or rail car includes an emergency brake control unit 503 configured according to a first safety integrity level and a service brake control unit 508 configured according to a second safety integrity level lower than the first safety integrity level.

[0102] The emergency brake control unit 503 is arranged to control the electro-pneumatic emergency brake unit 501 by means of a first group of control and feedback signals 505 and to generate via the electro-pneumatic emergency brake unit 501 an emergency brake pressure 506, the pressure value of which is a function of at least one weight signal 504 indicative of the weight of the bogie or rail car to be braked. The electro-pneumatic emergency brake unit 501 is arranged to be supplied with a pneumatic supply pressure 502.

[0103] The emergency brake control unit 503 is further provided to determine at least one additional pressure value 551 associated with the additional brake function 550 in response to at least one input signal 520 received by the emergency brake control unit 503 and associated with the additional brake function 550.

[0104] Furthermore, the emergency brake control unit 503 is arranged to transmit, via the communication means 518 , at least one additional pressure value 551 associated with the additional braking function 550 to the service brake control unit 508 .

[0105] The service brake control unit 508 is arranged to determine at least one service brake pressure value in response to the service brake request signal 510 and the at least one weight signal 504. The service brake control unit 508 is further arranged to control the electro-pneumatic service brake unit 507 using a second group of control and feedback signals 509 to provide at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 with the at least one additional pressure value 551 determined by the emergency brake control unit 503 and associated with an additional braking function 550 and the at least one service brake pressure value determined by the service brake control unit 508, the greater of the pressure values. The electro-pneumatic service brake unit 507 is also arranged to receive at least a pneumatic supply pressure 502.

[0106] Similar to the third embodiment described above, in the fourth embodiment a braking system 500 for at least one bogie or rail car includes an electro-pneumatic selection unit 601 with at least one pressure output 611, ..., 614. Also similar to the third embodiment described above, the electro-pneumatic selection unit 601 is arranged to receive at least the emergency braking pressure 506, at least one pressure at at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507, and a control signal 617 sent from the emergency brake control unit 503. Furthermore, the electro-pneumatic selection unit 601 is arranged to transmit the emergency braking pressure 506 or the at least one pressure at the at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 to the at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601 according to the control signal 617 sent from the emergency brake control unit 503.

[0107] In the fourth embodiment, if at least one additional pressure value 551 is predicted in at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601, but the pressure value in the at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601 is determined by the emergency brake control unit 503 to be lower by at least one predetermined tolerance value than the at least one additional pressure value 551 associated with the additional braking function 550, the emergency brake control unit 503 is further configured to receive at least one feedback signal 519 indicative of the pressure value in the at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601 and to monitor the pressure value in the at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601 using the at least one feedback signal 519. And the emergency brake control unit 503 is arranged to control the electro-pneumatic selection unit 601 via a control signal 617 to activate the transmission of the pressure value of the emergency brake pressure 506 to at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601.

[0108] Again, the brake system 500 performs at least one additional brake function 550 with the same safety integrity level as the emergency brake control unit 503 .

[0109] The electro-pneumatic selection unit 601 may be configured, for example, as a simple pneumatic multi-way valve, or it may be a more complex device in which the emergency braking pressure 506 and at least one pressure at at least one output 511, ..., 514 of the electro-pneumatic service braking unit 507 are selected to comprise a drive pressure for a pneumatic amplification device to which the pneumatic supply pressure 502 is supplied.

[0110] Preferably, the emergency brake control unit 503 may further be arranged to receive an emergency brake request signal 515 indicative of an emergency brake request. If the emergency brake request signal 515 indicates the presence of an emergency brake request, the emergency brake control unit 503 may activate the transmission of the emergency brake pressure 506 to the at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601 via a control signal 617. In other words, if the need for emergency braking is indicated, the emergency brake control unit 503 ensures the transmission of the emergency brake pressure 506 to the at least one pressure output 611, ..., 614 of the electro-pneumatic selection unit 601.

[0111] Preferably, as with any of the above-mentioned embodiments, the additional braking function 550 may be a retarding braking function. And, at least one input signal 520, 520' associated with the additional braking function 550 is received by only the emergency brake control unit 503 or by both the emergency brake control unit 503 and the service brake control unit 508. The at least one input signal 520, 520' may include at least one speed signal 200 and at least one available traction torque signal 201. The at least one speed signal 200 indicates the speed of at least one axle of the bogie or railcar or directly indicates the running speed of the bogie or railcar. The at least one available traction torque signal 201 indicates the currently existing traction torque. The at least one input signal 520, 520' received by only the emergency brake control unit 503 or by both the emergency brake control unit 503 and the service brake control unit 508 and associated with the additional braking function 550 may further include one or more door status signals 202 from the vehicle door management system indicating the open or closed status of the doors.

[0112] Preferably, as with any of the embodiments described above, the additional braking function 550 may be a distributor emulation function. At least one input signal 520, 520' received by only the emergency brake control unit 503 or by both the emergency brake control unit 503 and the service brake control unit 508 and associated with the additional braking function 550 may correspond to a signal indicative of the main brake pipe pressure 202 of the bogie or rail car.

[0113] In a further aspect, the emergency brake control unit 503 may be arranged to determine at least one first additional pressure value 551 associated with the additional brake function 550 by selecting from a single or multi-dimensional matrix indexed with discretized values ​​for at least one input signal 520 received by the emergency brake control unit 503 and associated with the additional brake function 550. Alternatively or additionally, the service brake control unit 508 may be arranged to determine at least one second additional pressure value 551′ associated with the additional brake function 550 by selecting from a single or multi-dimensional matrix indexed with discretized values ​​for at least one input signal 520′ received by the service brake control unit 508 and associated with the additional brake function 550.

[0114] This matrix may be pre-determined and then loaded into the non-volatile memory of the braking system 500 .

[0115] Now, one example will be described in detail with reference to the first embodiment described above. In this example, the additional braking function 550 whose safety level should be increased is a retarding braking function.

[0116] At least one input signal 520 received by the emergency brake control unit 503 and associated with the additional braking function 550 includes one or more speed signals and a traction signal. The one or more speed signals may be transmitted, for example, but not limited to, from a speed sensor or other module that generates a reference speed signal for the train or rail car. The one or more traction signals may be generated by traction computers. The one or more traction signals may also be provided to indicate whether the traction torque is sufficient to prevent a defined rollback situation. Additionally, the at least one input signal 520 received by the emergency brake control unit 503 and associated with the additional braking function 550 may include one or more signals from a vehicle door management system indicating a door open or closed status.

[0117] The communication means 518 is, for example but not limited to, a serial communication network. The communication means 518 allows the emergency brake control unit 503 to communicate with the service brake control unit 508.

[0118] With regard to the suppression braking function, considering the first embodiment described above, the emergency brake control unit 503, in addition to performing the operations related to generating the emergency brake pressure 506 described above, monitors one or more speed signals to determine whether the train speed has reached a value at which the brake system 500 should apply a suppression brake pressure to the outputs 511, ..., 514 of the electro-pneumatic service brake unit 507. If the emergency brake control unit 503 determines that the train speed has reached a value at which the brake system 500 should apply a suppression brake pressure value (additional pressure value) 551, the emergency brake control unit 503 determines the suppression brake pressure value 551 to be applied depending on, for example, but not limited to, the weight value at which the brakes should be applied (weight signal 504). The emergency brake control unit 503 then sends a command via the communication means 518 to the service brake control unit 508 to apply the suppression brake pressure value 551 to the outputs 511, ..., 514 of the electro-pneumatic service brake unit 507.

[0119] The emergency brake control unit 503 then verifies via one or more feedback signals 519 that the pressure values ​​at one or more outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 match within a predetermined tolerance with a retarder brake pressure value 551 previously determined by the emergency brake control unit 503. If the read pressure value of at least one feedback signal 519 does not match within a predetermined tolerance with the retarder brake pressure value 551 previously determined, the emergency brake control unit 503 commands the opening of the contacts of the cut-off device 516 by means of a control signal 517. In this way, the electro-pneumatic service brake unit 507 transmits the value of the emergency brake pressure 506 to at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507.

[0120] On the other hand, if the retarding braking is successful, when one or more traction signals indicate the presence of sufficient traction torque to avoid being subjected to rollback, more precisely when one or more traction signals indicate that all doors of the car / train are closed, the emergency brake control unit 503 sends a command to the service brake control unit 508 via the communication means 518 to reinstate normal service braking management.

[0121] In a further embodiment, reference is made to the second embodiment described above with regard to the suppression braking function. What was said in the second embodiment above about the at least one input signal 520 received by the emergency brake control unit 503 and associated with the additional braking function 550 is also valid for this further embodiment. However, in this further embodiment, one or more speed signals and one or more traction signals are the at least one input signal 520' received by the service brake control unit 508 and associated with the additional braking function 550. Furthermore, the at least one input signal 520' received by the service brake control unit 508 and associated with the additional braking function 550 may include one or more signals from a vehicle door management system indicating the open or closed state of the door.

[0122] In this second embodiment, in addition to performing the actions associated with generating emergency braking pressure 506 discussed above, emergency brake control unit 503 also monitors one or more speed signals to determine whether the speed of the train has reached a value at which braking system 500 should apply a retard brake pressure value 551. If emergency brake control unit 503 determines that the speed of the train or rail car has reached a value at which braking system 500 should apply a retard brake pressure value 551, then emergency brake control unit 503 determines the retard brake pressure value 551 to be applied as a function of, for example, but not by way of limitation, the weight value at which the brakes should be applied (weight signal 504).

[0123] At the same time, the service brake control unit 508, in addition to performing operations related to generating service brake pressures at outputs 511, ..., 514 of the electro-pneumatic service brake unit 507, also monitors one or more speed signals to determine whether the speed of the train or railcar has reached a value at which the brake system 500 should apply a retarder brake pressure value 551. If the service brake control unit 508 determines that the speed of the train or railcar has reached a value at which the brake system 500 should apply a retarder brake pressure value 551, the service brake control unit 508 determines the retarder brake pressure value 551 to be applied as a function of, for example, but not by way of limitation, the weight value at which the brakes are to be applied (weight signal 504). The service brake control unit 508 then controls the electro-pneumatic service brake unit 507 to generate pressures at outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 corresponding to the retarder brake pressure values ​​determined by the service brake control unit 508.

[0124] The emergency brake control unit 503 then verifies via one or more feedback signals 519 that the service brake pressure value at one or more outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 matches within a predetermined tolerance with a retarder brake pressure value 551 previously determined by the emergency brake control unit 503. If the pressure value read via one or more feedback signals 519 does not match within a predetermined tolerance with the retarder brake pressure value 551 previously determined by the emergency brake control unit 503, the emergency brake control unit 503 commands the opening of the contacts of the cut-off device 516 by means of a control signal 517. In this way, the electro-pneumatic service brake unit 507 transmits the value of the emergency brake pressure 506 to the outputs 511, ..., 514 of the electro-pneumatic service brake unit 507.

[0125] On the other hand, if the deterrent braking is successful, when one or more traction signals indicate the presence of sufficient traction torque to avoid rollback effects and / or all doors of the car / train are closed, the service brake control unit 508 reverts management of the service brakes and the emergency brake control unit 503 considers the deterrent brake monitoring procedure to have been successfully completed.

[0126] In the two embodiments relating to the suppression braking function described above, the control, monitoring and possible replacement actions performed by the emergency brake control unit 503 with respect to the service brake control unit 508 ensure that, in the event of any fault or malfunction in the service brake control unit 508 in connection with the performance of the suppression braking function, a braking pressure equal to or greater than that required by the suppression braking function is always and in any case applied to the outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 according to a safety level equal to the safety level assigned to the emergency brake control unit 503. In this way, the safety level of the suppression braking function is raised to a safety level equal to the level assigned to the emergency brake control unit 503.

[0127] Now, with reference to the second embodiment described above, an example will be detailed, where the additional brake function 550 which should increase the safety level is a distributor valve emulation function.

[0128] It is known to those skilled in the art that the distributor valve performs two functions depending on the pressure in the main brake pipe: -When the main brake pipe pressure value is within the range between a nominal value of 5 bar (500 kPa) and a nominal value of 3.5 bar (350 kPa), it is intended to operate within a functional area that can be defined as a service brake. -When the main brake pipe pressure value falls below the nominal value of 3.5 bar (350 kPa), it is intended to operate within a functional area that can be defined as an emergency brake.

[0129] Based on these assumptions, the service brake control unit 508, in addition to performing actions related to generating service brake pressures at outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 in response to the service brake demand signal 510 and the weight signal 504, operates as follows:

[0130] The at least one input signal 520' received by the service brake control unit 508 and associated with the additional brake functions 550 may include a main brake pipe pressure signal indicative of the pressure in the main brake pipe. The main brake pipe pressure signal is generated by a pressure sensor (not shown) pneumatically connected to the main brake pipe. The service brake control unit 508 continuously monitors the main brake pipe pressure signal.

[0131] The service brake control unit 508 may be configured to transmit to outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 the greater of the distributor brake pressure 551 determined by the service brake control unit 508 and further taking into account the weight signal 504, and the service brake pressure determined by the service brake control unit 508 in response to the service brake demand signal 510 and the weight signal 504.

[0132] At least one input signal 520 received by the emergency brake control unit 503 and associated with the additional brake functions 550 may include a main brake pipe pressure signal indicative of pressure in the main brake pipe. In addition to performing actions related to the generation of emergency brake pressure 506 as described above, the emergency brake control unit 503 continuously monitors the main brake pipe pressure signal indicative of pressure in the main brake pipe. This main brake pipe pressure signal is generated by a pressure sensor (not shown) pneumatically connected to the main brake pipe. If desired, the main brake pipe pressure signals indicative of pressure in the main brake pipe received by the emergency brake control unit 503 and the service brake control unit 508 may be coincident and both may be generated by the same sensor.

[0133] If the emergency brake control unit 503 determines that the main brake pipe pressure signal has assumed a value indicative of an emergency braking request, i.e. a pressure value less than the nominal value of 3.5 bar (350 kPa), the emergency brake control unit 503 verifies that the pressure generated by the service brake control unit 508 at the outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 corresponds, within predetermined tolerances, to the value of the emergency brake pressure 506 determined by the electro-pneumatic service brake unit 507.

[0134] If the pressure value read by one or more feedback signals 519 is equal to or greater than the determined distributor brake pressure 551 value, the emergency brake control unit 503 will not take any action unless a predetermined tolerance is exceeded.

[0135] If the pressure value read by one or more feedback signals 519 is lower than the determined distributor brake pressure 551 value, within a predefined tolerance, the emergency brake control unit 503 commands, by means of a control signal 517, the opening of the contacts of the cut-off device 516. In this way, the electro-pneumatic service brake unit 507 transmits the value of the emergency brake pressure 506 to the outputs 511, ..., 514 of the electro-pneumatic service brake unit 507.

[0136] In the following there is given one embodiment of how to increase the safety level of the service braking function, which may be considered as constituting a modulated emergency braking.

[0137] The service brake request signal 510 is further provided to the emergency brake control unit 503. In fact, the service brake request signal 510 provided to the emergency brake control unit 503 corresponds to at least one input signal 520 received by the emergency brake control unit 503 and associated with an additional brake function 550.

[0138] In addition to performing actions related to generating the emergency braking pressure 506 described above, the emergency brake control unit 503 continuously monitors the received service brake request signal and further continuously determines a "safe" service brake value as a function of the received service brake request signal and the weight signal 504.

[0139] In the first embodiment described above, the emergency brake control unit 503 sends a command via communication means 518 to the service brake control unit 508 to apply "safe" service brake pressure values ​​to the outputs 511, ..., 514 of the electro-pneumatic service brake unit 507.

[0140] Thereafter, via one or more feedback signals 519, it is verified that the pressure value at one or more outputs 511, ..., 514 corresponds to a pre-determined "safe" service pressure value within a pre-defined tolerance. If the pressure value read by one or more feedback signals 519 does not correspond to a pre-determined "safe" service pressure value within a pre-defined tolerance, the emergency brake control unit 503 commands the opening of the contacts of the cut-off device 516 by means of a control signal 517. In this way, the electro-pneumatic service brake unit 507 transmits the value of the emergency brake pressure 506 to the outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 in the manner described above.

[0141] On the other hand, if the pressure value read via one or more feedback signals 519 indicating the pressure value at one or more outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 indicates that the pressure value matches a pre-determined "safe" service brake pressure value within a predetermined tolerance, the emergency brake control unit 503 does not take any action.

[0142] In the second embodiment described above, the service brake control unit 508 typically performs operations related to generating service brake pressures at outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 in response to the service brake demand signal 510 and the weight signal 504.

[0143] The service brake request signal 510 provided to the service brake control unit 508 corresponds to at least one input signal 520 ′ received by the service brake control unit 508 and associated with an additional brake function 550 .

[0144] At the same time, the emergency brake control unit 503 determines the pressure value associated with "safe" service braking in response to the service brake demand and weight signal 504.

[0145] The emergency brake control unit 503 then verifies, via one or more feedback signals 519, that the pressure values ​​at one or more outputs 511, ..., 514 of the electro-pneumatic service brake unit 507 match, within a predetermined tolerance, a "safe" service brake pressure value determined by the emergency brake control unit 503.

[0146] If the pressure value read by one or more feedback signals 519 does not match, within a predetermined tolerance, a "safe" service pressure value previously determined by the emergency brake control unit 503, the emergency brake control unit 503 commands the opening of the contacts of the cut-off device 516 by means of a control signal 517. In this way, the electro-pneumatic service brake unit 507 transmits the value of the emergency brake pressure 506 to the outputs 511, ..., 514 of the electro-pneumatic service brake unit 507.

[0147] On the other hand, if the pressure value read via feedback signal 519 matches within a predetermined tolerance a "safe" service brake value as determined by emergency brake control unit 503, then emergency brake control unit 503 will not take any action.

[0148] According to the invention, advantageously, the emergency brake control unit 503 does not have to perform a complex closed-loop pressure check of the electro-pneumatic service brake unit 507 and associated diagnostic algorithms to generate pressures related to the additional functions whose safety level is to be increased. In the present invention, these functions are delegated to the service brake control unit 508 according to the state of the art, which is already provided to perform a closed-chain control of the electro-pneumatic service brake unit 507 and associated diagnostic algorithms. Advantageously, the emergency brake control unit 503 is limited to a simple calculation and subsequent monitoring of pressures at at least one output 511, ..., 514 of the electro-pneumatic service brake unit 507 for the additional brake functions whose safety level is to be increased. Thus, the brake system 500 according to the invention allows to increase the safety level of the additional brake functions up to the safety level of the emergency brake control unit 503 without increasing the development costs.

[0149] It should be noted that the above-mentioned embodiments proposed for the present invention are merely non-limiting examples of the present invention. Those skilled in the art can easily implement the present invention in different embodiments that fall within the scope of the present invention without departing from the principles described herein.

[0150] This means in particular that the at least one input signal 520 received by the emergency brake control unit 503 and associated with the additional braking function 550 and the at least one input signal 520' received by the service brake control unit 508 and associated with the additional braking function 550 can be two separate signals conveying the same information, or the at least one input signal 520 received by the emergency brake control unit 503 and associated with the additional braking function 550 and the at least one input signal 520' received by the service brake control unit 508 and associated with the additional braking function 550 can originally be a single signal that is duplicated in order to be transmitted to both the emergency brake control unit 503 and the service brake control unit 508.

[0151] Various aspects and embodiments of the braking system for at least one bogie or rail vehicle according to the present invention have been detailed. It is understood that each embodiment can be combined with any other embodiment. Moreover, the present invention is not limited to the detailed embodiments, but may be modified within the scope defined by the appended claims.

Claims

1. 1. A braking system (500) for at least one bogie or rail car, comprising: an emergency brake control unit (503) configured according to a first safety integrity level; and a service brake control unit (508) configured according to a second safety integrity level lower than the first safety integrity level, The emergency brake control unit (503) using a first group of control and feedback signals (505) to control an electro-pneumatic emergency brake unit (501) provided with a pneumatic supply pressure (502) and via said electro-pneumatic emergency brake unit (501) generating an emergency brake pressure (506) whose pressure value is a function of at least one weight signal (504) indicative of the weight of said bogie or said rail car to be braked, determining at least one additional pressure value (551) associated with an additional braking function (550) in response to at least one input signal (520) received by said emergency brake control unit (503) and further associated with said additional braking function (550); is provided for transmitting, by means of communication means (518), said at least one additional pressure value (551) associated with said additional braking function (550) to said service brake control unit (508), The service brake control unit (508) determining at least one service brake pressure value in response to a service brake demand signal (510) and the at least one weight signal (504); a second group (509) of control and feedback signals is arranged to control an electro-pneumatic service brake unit (507) arranged to receive at least said emergency brake pressure (506) and to provide at least one output (511, . . . , 514) of said electro-pneumatic service brake unit (507) with the greater of said at least one additional pressure value (551) associated with said additional braking function (550) and said at least one service brake pressure value determined by said service brake control unit (508); The emergency brake control unit (503) further comprises: receiving at least one feedback signal (519) indicative of a pressure value at the at least one output (511, . . . , 514) of the electro-pneumatic service brake unit (507); monitoring said pressure value at said at least one output (511, . . . , 514) of said electro-pneumatic service brake unit (507) using said at least one feedback signal (519); a pressure value corresponding to the pressure value of the emergency brake pressure (506) is forced on the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507) if the additional pressure value (551) associated with the additional brake function (550) is expected at the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507) but the pressure value at the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507) is determined by the emergency brake control unit (503) to be lower than the at least one additional pressure value (551) associated with the additional brake function (550) by at least a predetermined tolerance value, This allows the brake system (500) to achieve at least one additional brake function (550) at the same safety integrity level as the emergency brake control unit (503).

2. 1. A braking system (500) for at least one bogie or rail car, comprising: an emergency brake control unit (503) configured according to a first safety integrity level; and a service brake control unit (508) configured according to a second safety integrity level lower than the first safety integrity level, The emergency brake control unit (503) using a first group of control and feedback signals (505) to control an electro-pneumatic emergency brake unit (501) provided with a pneumatic supply pressure (502) and via said electro-pneumatic emergency brake unit (501) generating an emergency brake pressure (506) whose pressure value is a function of at least one weight signal (504) indicative of the weight of said bogie or said rail car to be braked, is provided for determining at least one first additional pressure value (551) associated with an additional braking function (550) in response to at least one input signal (520) received by said emergency brake control unit (503) and further associated with said additional braking function (550); The service brake control unit (508) determining at least one service brake pressure value in response to a service brake demand signal (510) and the at least one weight signal (504); determining at least one second additional pressure value (551') associated with said additional brake function (550) in response to at least one input signal (520') received by said service brake control unit (508) and further associated with said additional brake function (550); a second group of control and feedback signals (509) for controlling an electro-pneumatic service brake unit (507) arranged to receive at least said emergency brake pressure (506) and to provide at least one output (511, . . . , 514) of said electro-pneumatic service brake unit (507) with the greater of said at least one second additional pressure value (551') determined by said service brake control unit (508) and associated with said additional braking function (550) and said at least one service brake pressure value determined by said service brake control unit (508); The emergency brake control unit (503) further comprises: receiving at least one feedback signal (519) indicative of a pressure value at the at least one output (511, . . . , 514) of the electro-pneumatic service brake unit (507); monitoring said pressure value at said at least one output (511, . . . , 514) of said electro-pneumatic service brake unit (507) using said at least one feedback signal (519); to force a pressure value corresponding to a pressure value of the emergency brake pressure (506) on the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507) if the at least one second additional pressure value (551') determined by the service brake control unit (508) is expected at the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507) but the pressure value at the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507) is lower than the at least one first additional pressure value (551) determined by the emergency brake control unit (503) and associated with the additional brake function (550) by at least a predetermined tolerance value, This allows the brake system (500) to achieve at least one additional brake function (550) at the same safety integrity level as the emergency brake control unit (503).

3. said emergency brake control unit (503) being arranged to control a disconnecting device (516) by means of a control signal (517); the emergency brake control unit (503) is arranged to open the disconnecting device (516) and not allow the connection of the second group (509) of control and feedback signals between the service brake control unit (508) and the electro-pneumatic service brake unit (507) when the pressure value corresponding to the pressure value of the emergency brake pressure (506) must be forced onto the at least one output (511, . . . , 514) of the electro-pneumatic service brake unit (507), 3. A braking system (500) as claimed in claim 1 or 2, wherein the electro-pneumatic service brake unit (507) is configured to transmit the pressure value of the emergency brake pressure (506) to the at least one output (511, ..., 514) when the second group (509) of control and feedback signals is not connected between the service brake control unit (508) and the electro-pneumatic service brake unit (507).

4. the electro-pneumatic service brake unit (507) is further adapted to receive the pneumatic supply pressure (502); 4. A brake system (500) as claimed in any one of claims 1 to 3, wherein when the emergency brake control unit (503) has to transmit the pressure value corresponding to the pressure value of the emergency brake pressure (506) to the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507), the pressure value of the pneumatic supply pressure (502) is limited to the value of the emergency brake pressure (506) inside the electro-pneumatic service brake unit (507) and then the pressure value of the pneumatic supply pressure (502) is transmitted to the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507).

5. 4. A brake system (500) as claimed in any one of claims 1 to 3, wherein the emergency braking pressure (506) is transmitted to the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507) when the emergency brake control unit (503) must transmit the pressure value corresponding to the pressure value of the emergency braking pressure (506) to the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507).

6. The emergency brake control unit (503) receiving an emergency brake request signal (515) indicating an emergency brake request; 6. A braking system (500) as claimed in any one of claims 1 to 5, further comprising: a means for forcing a pressure value corresponding to the pressure value of the emergency braking pressure (506) onto the at least one output (511, ..., 514) of the electro-pneumatic service brake unit (507) when the emergency brake request signal (515) indicates the need for emergency braking.

7. 1. A braking system (500) for at least one bogie or rail car, comprising: an emergency brake control unit (503) configured according to a first safety integrity level; and a service brake control unit (508) configured according to a second safety integrity level lower than the first safety integrity level, The emergency brake control unit (503) using a first group of control and feedback signals (505) to control an electro-pneumatic emergency brake unit (501) provided with a pneumatic supply pressure (502) and via said electro-pneumatic emergency brake unit (501) generating an emergency brake pressure (506) whose pressure value is dependent on at least one weight signal (504) indicative of the weight of said bogie or said rail car to be braked, is provided for determining at least one first additional pressure value (551) associated with an additional braking function (550) in response to at least one input signal (520) received by said emergency brake control unit (503) and further associated with said additional braking function (550); The service brake control unit (508) determining at least one service brake pressure value in response to a service brake demand signal (510) and the at least one weight signal (504); determining at least one second additional pressure value (551') associated with said additional brake function (550) in response to at least one input signal (520') received by said service brake control unit (508) and further associated with said additional brake function (550); a second group of control and feedback signals (509) for controlling an electro-pneumatic service brake unit (507) arranged to receive at least said pneumatic supply pressure (502) and to provide at least one output (511, . . . , 514) of said electro-pneumatic service brake unit (507) with the greater of said at least one second additional pressure value (551') determined by said service brake control unit (508) and associated with said additional braking function (550) and said at least one service brake pressure value determined by said service brake control unit (508); The braking system (500) for the at least one bogie or rail car comprises an electro-pneumatic selection unit (601) with at least one pressure output (611, . . . , 614), The electropneumatic selection unit (601) comprises: receiving at least the emergency brake pressure (506), at least one pressure at the at least one output (511, . . . , 514) of the electro-pneumatic service brake unit (507), and a control signal (617) transmitted from the emergency brake control unit (503); adapted to transmit the emergency brake pressure (506) or the at least one pressure at the at least one output (511, . . . , 514) of the electro-pneumatic service brake unit (507) to the at least one pressure output (611, . . . , 614) in response to the control signal (617) sent from the emergency brake control unit (503), The emergency brake control unit (503) further comprises: receiving at least one feedback signal (519) indicative of a pressure value at said at least one pressure output (611, .., 614) of said electro-pneumatic selection unit (601); monitoring said pressure value at said at least one pressure output (611, . . . , 614) of said electro-pneumatic selection unit (601) using said at least one feedback signal (519); to control the electro-pneumatic selection unit (601) via the control signal (617) to activate the transmission of the pressure value of the emergency brake pressure (506) to the at least one pressure output (611, . . . , 614) of the electro-pneumatic selection unit (601) if the at least one second additional pressure value (551') associated with the additional brake function (550) determined by the service brake control unit (508) is expected at the at least one pressure output (611, . . . , 614) of the electro-pneumatic selection unit (601) but the pressure value at the at least one pressure output (611, . . . , 614) of the electro-pneumatic selection unit (601) is lower than the at least one first additional pressure value (551) determined by the emergency brake control unit (503) and associated with the additional brake function (550) by at least a predetermined tolerance value, This allows the brake system (500) to achieve at least one additional brake function (550) at the same safety integrity level as the emergency brake control unit (503).

8. 1. A braking system (500) for at least one bogie or rail car, comprising: an emergency brake control unit (503) configured according to a first safety integrity level; and a service brake control unit (508) configured according to a second safety integrity level lower than the first safety integrity level, The emergency brake control unit (503) using a first group of control and feedback signals (505) to control an electro-pneumatic emergency brake unit (501) provided with a pneumatic supply pressure (502) and via said electro-pneumatic emergency brake unit (501) generating an emergency brake pressure (506) whose pressure value is a function of at least one weight signal (504) indicative of the weight of said bogie or said rail car to be braked, said electro-pneumatic emergency brake unit (501) determining at least one additional pressure value (551) associated with an additional braking function (550) in response to at least one input signal (520) received by said emergency brake control unit (503) and further associated with said additional braking function (550); is provided for transmitting, by means of communication means (518), said at least one additional pressure value (551) associated with said additional braking function (550) to said service brake control unit (508), The service brake control unit (508) determining at least one service brake pressure value in response to a service brake demand signal (510) and the at least one weight signal (504); a second group (509) of control and feedback signals is arranged to control an electro-pneumatic service brake unit (507) arranged to receive at least said pneumatic supply pressure (502) and to provide at least one output (511, . . . , 514) of said electro-pneumatic service brake unit (507) with the greater of said at least one additional pressure value (551) determined by said emergency brake control unit (503) and associated with said additional braking function (550) and said at least one service brake pressure value determined by said service brake control unit (508); The braking system (500) for the at least one bogie or rail car comprises an electro-pneumatic selection unit (601) with at least one pressure output (611, . . . , 614), The electropneumatic selection unit (601) comprises: receiving at least the emergency brake pressure (506), at least one pressure at the at least one output (511, . . . , 514) of the electro-pneumatic service brake unit (507), and a control signal (617) transmitted from the emergency brake control unit (503); adapted to transmit the emergency brake pressure (506) to the at least one pressure output (611, . . . , 614) of the electro-pneumatic selection unit (601) or the at least one pressure at the at least one output (511, . . . , 514) of the electro-pneumatic service brake unit (507) in response to the control signal (617) sent from the emergency brake control unit (503), The emergency brake control unit (503) further comprises: receiving at least one feedback signal (519) indicative of a pressure value at the at least one pressure output (611, .., 614) of the electro-pneumatic selection unit (601); monitoring said pressure value at said at least one pressure output (611, . . . , 614) of said electro-pneumatic selection unit (601) using said at least one feedback signal (519); if the at least one additional pressure value (551) associated with the additional braking function (550) is predicted at the at least one pressure output (611, ..., 614) of the electro-pneumatic selection unit (601) and the pressure value at the at least one pressure output (611, ..., 614) of the electro-pneumatic selection unit (601) is determined by the emergency brake control unit (503) to be lower than the at least one additional pressure value (551) associated with the additional braking function (550) by at least a predetermined tolerance value, then the emergency brake control unit (503) is provided to control the electro-pneumatic selection unit (601) via the control signal (617) to activate the transmission of the pressure value of the emergency brake pressure (506) to the at least one pressure output (611, ..., 614) of the electro-pneumatic selection unit (601), This allows the brake system (500) to achieve the at least one additional brake function (550) with the same safety integrity level as the emergency brake control unit (503).

9. The emergency brake control unit (503) receiving an emergency brake request signal (515) indicating an emergency brake request; 9. A braking system (500) as claimed in claim 7 or 8, further comprising: a control signal (617) for controlling the electro-pneumatic selection unit (601) to activate the at least one pressure output (611, ..., 614) to transmit the emergency braking pressure (506) when the emergency braking request signal (515) indicates the need for emergency braking.

10. The additional brake function (550) is a retarder brake function; At least one input signal (520, 520') associated with said additional braking function (550) - at least one speed signal (200) indicative of the speed of at least one axle of said bogie or said railcar, or directly indicative of the running speed of said bogie or said railcar; and at least one available traction torque signal (201) indicative of a currently existing traction torque.

11. The additional brake function (550) is a distributor emulation function; 11. A braking system (500) as claimed in any preceding claim, wherein at least one input signal (520, 520') associated with the additional braking function (550) comprises a signal indicative of main brake pipe pressure (202) of the bogie or rail car.

12. said additional braking function (550) being a modulated emergency braking function or a service braking function with a high safety level; 12. The braking system (500) of any one of claims 1 to 11, wherein at least one input signal (520, 520') associated with said additional braking function (550) includes said service brake demand signal (510).

13. the emergency brake control unit (503) being arranged to determine the at least one first additional pressure value (551) associated with the additional brake function (550) by selecting from a single or multi-dimensional matrix indexed by discretized values ​​for the at least one input signal (520) received by the emergency brake control unit (503) and associated with the additional brake function (550); and / or the service brake control unit (508) is arranged to determine at least one second additional pressure value (551') associated with said additional brake function (550) by selecting from a single or multi-dimensional matrix indexed by discretized values ​​for at least one input signal (520') received by the service brake control unit (508) and further associated with said additional brake function (550), 13. The braking system (500) of any of claims 1 to 12, wherein the matrix is ​​pre-determined and then loaded into a non-volatile memory of the braking system (500).

Images