Electromechanical service and emergency brake actuators for rail vehicles and electromechanical braking systems

Abstract

An electro-mechanical service and emergency brake actuator (400, 500) for a rail vehicle is described, the electro-mechanical service and emergency brake actuator having a safety unit (401, 501) configured to adjust a first emergency brake control signal (402, 502) as indicated by a first emergency brake energy release means (209, 302, 306) to release energy stored in a first emergency brake energy storage means (208, 304) when an emergency brake request signal (210) indicates a request for emergency braking and a first electric signal (213) of actual brake force does not, within a predetermined maximum delay time, indicate a force value that corresponds to an additional emergency brake force value calculated by the safety unit (401, 501) or does not, within a predetermined maximum delay time, indicate a force value that does not fall within a predetermined tolerance range including the additional emergency brake force value calculated by the safety unit. Also described is an electro-mechanical brake system.

Description

[Technical Field]

[0001] The present invention is generally in the field of railway braking systems, and more particularly, the present invention relates to electro-mechanical service and emergency brake actuators for rail vehicles. [Background technology]

[0002] The following description refers to the following European standards: EN50129: 2018 revision, EN50159: 2010 revision, EN50126-1: 2017 revision, EN50126-2: 2017 revision, EN50128: 2011 revision. EN50126 ["Railway Applications. Specification and Demonstration of Reliability, Availability, Maintainability and Safety (RAMS)], · EN50128 ["Railway applications. Communication, signaling and processing systems. Software for railway control and protection systems"], · EN50129 ["Railway applications. Communication, signaling and processing systems. Safety-related electronic systems for signaling"], ·EN50159 ["Railway applications. Communication, signaling and processing systems. Safety-related communications in transmission systems"]. In particular, standard EN50126 defines a methodology for assigning safety integrity levels SIL0 / 1 / 2 / 3 / 4 (with safety integrity level SIL4 indicating the highest safety integrity level) to the subsystems that make up the system in question based on the results of a safety analysis, and standards EN50128 and EN50129 define design criteria to be applied to software and hardware components, respectively, based on the SIL levels assigned based on the results of a safety analysis.

[0003] The following is known in the art: · Safety calculations relating to emergency braking functions, carried out in accordance with the European standard EN50126, systematically assign a safety integrity level SIL ≥ 3 to emergency braking functions and, consequently, usually to the subsystems that implement them. · Safety calculations relating to service brake functions carried out in accordance with European standard EN50126 typically assign a safety integrity level SIL ≤ 2 to the service brake functions and, consequently, typically to the subsystems that implement them. Developing control units, typically microprocessor- or FPGA-based, to safety integrity level SIL ≥ 3 according to EN50128 and EN50129 involves design, verification, and certification costs that are approximately an order of magnitude higher than designs with safety integrity level SIL ≤ 2.

[0004] Regarding the last point above, it is clear that there is value in keeping the functionality developed according to a Safety Integrity Level SIL≧3 very limited and simple.

[0005] A typical pneumatic braking system for railway applications, particularly passenger trains, is shown in Figure 1.

[0006] A compressed air generation and filtration system 101 supplies a main duct 102 configured to supply compressed air to the braking and suspension systems along the train. The compressed air supplied typically ranges in value between 6 bar and 10 bar.

[0007] The main pipeline feeds, via a check valve 103, an auxiliary tank 104, an electro-pneumatic module 105, a pneumatic metering valve 106, and a relay valve 107.

[0008] The purpose of the auxiliary tank 104 is to store a certain amount of compressed air to ensure at least one emergency braking in case of a sudden loss of pressure in the main line 102.

[0009] The purpose of the check valve 103 is to prevent the loss of air from the auxiliary tank 104 into the main line 102 in the event of a sudden loss of pressure to the main line 102 .

[0010] The electro-pneumatic module 105 , the embodiment of which is prior art, is controlled by a control unit 108 by means of an electrical signal group 109 .

[0011] The control unit 108 is an electronic unit.

[0012] The control unit 108 receives the service brake request via an electrical signal 109, which may be, but is not limited to, an analog signal or a serial communication channel in nature.

[0013] Additionally, the electronic control unit 108 receives a signal 110 indicative of the weight of the bogie or car body being braked.

[0014] The electronic control unit 108 calculates the service brake pressure according to the brake demand 109 and the value assumed by a signal 110 indicating the weight of the bogie or car body to be braked, and controls the electro-pneumatic module 105 to control the service brake pressure at the outlet 105 of the electro-pneumatic module 105 to the calculated value.

[0015] The outlet 111 of the electropneumatic module 105 is connected to one of the two inlets of a double stop valve 112 .

[0016] The air pressure metering valve 106 receives an air pressure signal 113 indicative of the pressure present in the pneumatic suspension associated with the bogie or vehicle being braked, i.e., the weight bearing on the bogie or vehicle.

[0017] The air pressure metering valve 106 is designed to continuously generate an emergency braking pressure at its outlet 114, the value of which continuously corresponds to the pressure value required to generate a predetermined nominal emergency deceleration, defined during the design phase, at any weight condition associated with the air pressure signal 113.

[0018] An outlet 114 of the air pressure metering valve 106 feeds an emergency air pressure solenoid valve 116 controlled by an electrical emergency brake request signal 115, the emergency air pressure solenoid valve 116 being configured to assume a first state that prevents the propagation of emergency brake pressure at its outlet 117 when the electrical emergency brake request signal 115 is in a first state that does not request emergency braking, and to assume a second state that allows the propagation of emergency brake pressure at its outlet 117 when the electrical emergency brake request signal 115 is in a second state that requests emergency braking.

[0019] The outlet 117 of the emergency air pressure solenoid valve 116 is connected to the second inlet of the double stop valve 112 via a calibrated orifice 118 .

[0020] The outlet of the double stop valve 112 is connected to the pilot chamber of the relay valve 101 .

[0021] An outlet 119 of the relay valve 107 supplies at least one brake cylinder 120 associated with the bogie or car body being braked.

[0022] When signal 115 does not indicate an emergency braking request, the pressure at outlet 117 of emergency air pressure solenoid valve 116 is nominally 0 bar.

[0023] Therefore, when the signal 115 does not indicate an emergency braking request, the pressure at the outlet of the double stop valve 112 always corresponds to the service brake pressure at the outlet 111 of the electro-pneumatic module 105, in other words, the pressure in the pilot chamber of the relay valve 107 always corresponds to the service brake pressure at the outlet 111 of the electro-pneumatic module 105, i.e., the pressure in the at least one brake cylinder 120 corresponds to the service brake pressure.

[0024] When signal 115 indicates an emergency braking request, the pressure at outlet 117 of emergency air pressure solenoid valve 116 assumes the nominal value of the emergency braking pressure produced by air pressure metering valve 106 .

[0025] In this condition, the pressure at the outlet of the double stop valve 112 corresponds to the greater of the service brake pressure and the emergency brake pressure.

[0026] It is known that emergency brake pressure is usually equal to or greater than service brake pressure under any weight condition.

[0027] Thus, the pressure at the outlet of the double stop valve 112 corresponds to the emergency braking pressure when the electrical emergency braking request signal 115 calls for emergency braking.

[0028] The calibrated orifice 118 serves to limit the emergency braking pressure rise gradient to a predetermined value at the design stage in order to reduce the risk of passengers tipping over during emergency braking application.

[0029] The integration of the pneumatic metering valve 106, the emergency pneumatic solenoid valve 116, the double stop valve 112, and the relay valve 107 is known to reach a safety integrity level SIL≧3 as required by standard EN50126.

[0030] New electromechanical braking systems for railway applications based on mechatronic technology are being developed. Their design should functionally replicate what has been previously described for typical electro-pneumatic brakes for railway applications, especially with regard to safety-related features.

[0031] Therefore, it is necessary to check the following points: - A certain amount of energy is stored in the system to ensure at least one emergency braking; The emergency braking force applied to the wheel must always be adapted to the momentary weight of the brake wheel, in order to match the required deceleration; Emergency braking forces are applied according to the maximum gradient, including limiting the risk of passengers falling during emergency braking; · Emergency braking at the train level must reach a safety integrity level of SIL=4.

[0032] FIG. 2 is a first non-exclusive example of a functional diagram of an electromechanical brake actuator 200 according to the prior art.

[0033] A first electromechanical module 201 comprising at least one electric motor and possibly a reducer, i.e. a torque multiplier, is capable of extending or retracting an arm 206 connected to an emergency braking module 207 .

[0034] The emergency brake module 207 includes an emergency brake energy storage means 208, such as a potential mechanical energy storage means, where the mechanical means for storing potential mechanical energy is, by way of non-limiting example, a coil spring. The emergency brake module 207 further includes an emergency brake energy release means 209, such as an electromechanical holding mechanism, controlled by an emergency brake request signal 210. The emergency brake energy release means 209 is configured to have a first state that maintains the potential mechanical energy previously stored in the emergency brake energy storage means 208 when the emergency brake request signal 210 does not indicate a request for emergency braking. The emergency brake energy release means 209 is also configured to have a second state that releases the potential mechanical energy previously stored in the emergency brake energy storage means 208 when the emergency brake request signal 210 indicates a request for emergency braking.

[0035] By way of non-limiting example, other forms of mechanical energy storage can be used, such as flat spiral springs where the force transmission is rotational rather than translational.

[0036] Additionally, the stored energy may be kinetic energy stored in a flywheel suitably rotated by a second motor (not shown).

[0037] Reference will be made below to a linear type, i.e. helical spring, emergency braking energy storage means 208, although it will be apparent that the invention is applicable to all other configurations mentioned above.

[0038] The arm 211 is connected to a force sensor 212 which generates an electrical brake force signal 213 indicative of the mechanical force applied between the arms 211 and 214. The electrical brake force signal 213 is transmitted to an input of the service brake control unit 202.

[0039] The arm 214 is connected between the force sensor means 212 and a backlash recuperator 215 which transmits the force to a final arm 216 which is connected to a pad holder and brake pad assembly 217 .

[0040] The backlash recuperator 215 has the purpose of continuously replenishing the wear on the brake pads.

[0041] Pad wear can also be remedied by a software procedure executed by the control unit, but this procedure is outside the scope of this patent.

[0042] The service brake control unit 202 is electronic in nature and receives at its input a supply voltage 205, as well as from the vehicle battery.

[0043] The service brake control unit 202 is configured to modulate a supply voltage 205 to control an electric motor included in the electric machine module 201 through at least one electric control signal 204 .

[0044] The service brake control unit 202 is configured to receive an input signal indicative of a service brake force demand 203, apply a service brake force corresponding to the service brake force demand 203, and control the electromechanical module 201 to extend the arm 206 until the electrical signal 213 indicative of the brake force indicates that the brake force corresponding to the service brake force demand 203 has been reached.

[0045] It is understood that the order in which modules 201, 207, 212, 215 are connected may be varied for design and manufacturing reasons.

[0046] During the initialization phase of the electromechanical brake actuator 200, the service brake control unit 202 controls the electromechanical module 201 to extend the arm 206 until the mechanical means for storing potential mechanical energy contained in the emergency brake module 207 is charged with energy for emergency braking.

[0047] Typically, during the initialization phase of the electromechanical brake actuator 200, the emergency brake request signal 210 does not indicate a request for emergency braking, and therefore the emergency brake energy release means 209 is in a first state that retains the potential mechanical energy stored in the emergency brake energy storage means 208 for storing potential mechanical energy.

[0048] As mentioned above, the emergency brake energy storage means 208 for storing potential mechanical energy performs the same function as that performed by the auxiliary tank 104, which stores the energy required for at least one emergency braking application.

[0049] Furthermore, the means for releasing emergency braking energy 209 performs the same function as that performed by the electro-pneumatic emergency valve 116 .

[0050] Due to mechanical construction issues in the space allowed by the electromechanical brake actuator 200, it would be complex and expensive to create an emergency brake module 207 to maintain different values ​​of potential mechanical energy within certain predetermined ranges, or to maintain an emergency brake energy value that is continuously proportional to the current weight.

[0051] In the limited use of electromechanical brakes currently available for rail applications, the state of the art is to store and apply a single emergency braking force value, typically corresponding to the force value required to brake a fully loaded vehicle, thus increasing the risk of wheel damage with each emergency braking application when the actual weight is low.

[0052] Due to mechanical construction issues in the space allowed by the electromechanical brake actuator 200, providing a grade limiting system for applying emergency braking force is complex and expensive.

[0053] Releasing stored energy for emergency braking with an inherent gradient of the latent mechanical energy storage means 208 is state of the art due to the limited use of electromechanical braking for railway applications that currently exists. The gradient is highly dependent on further factors such as the temperature of the material in which the mechanical components of the electromechanical brake 200 are immersed and its dependence on the viscosity of the lubricant.

[0054] The functional diagram shown in Figure 2 is purely for illustrative purposes, and a mechanical designer skilled in the art can replicate the same functionality through a variety of variations, each maintaining the same theoretical functionality and mode of operation unchanged, i.e., storing a fixed energy value for emergency braking and releasing energy for emergency braking on poorly controlled or uncontrolled gradients. Figure 3 shows a further non-exclusive example of a functional diagram of an electromechanical brake actuator 200 according to the prior art.

[0055] A first electromechanical module 201 consisting of at least one electric motor and possibly a reducer or torque multiplier can extend or retract an arm 206 connected to force sensor means 212 which generate an electrical signal 213 indicative of the brake force indicative of the mechanical force applied between the arms 206 and 214, the electrical signal 213 indicative of the brake force being input to the service brake control unit 202.

[0056] The arm 214 is connected between the force sensor means 212 and a backlash recuperator 215 which transmits the force to a final arm 216 which is connected to a pad holder and brake pad assembly 217 .

[0057] An emergency braking energy release means, for example a switching device 302, is controlled by the emergency braking request signal 301. The switching device is configured to connect the electrical control signal 204 to the control unit 202 for service braking when the emergency braking request signal 301 does not indicate an emergency braking request. The switching device is configured to connect the electrical control signal 204 to the electronic emergency braking unit 303 when the emergency braking request signal 301 does not indicate an emergency braking request.

[0058] The service brake control unit 202 receives input voltage 205 from more than just the vehicle battery.

[0059] The service brake control unit 202 is designed to modulate a supply voltage 205 to control the electric motors contained in the electric machine module 201 via an electric control signal group 204 .

[0060] The service brake control unit 202 is configured to receive the service brake force request 203 as an input and to apply a braking force corresponding to the service brake force request 203 by instructing the electromechanical module 201 to extend the arm 206 until an electrical signal 213 indicating the braking force indicates that the braking force corresponding to the service brake force request 203 has been reached.

[0061] It is noted that the connection sequence in which the electromechanical module 201, the force sensor means 212, and the backlash recuperator 215 are connected may vary depending on design and manufacturing convenience.

[0062] The electronic emergency braking unit 303 includes an electric energy storage unit 304, such as, but not limited to, a battery or a supercapacitor, an energy charger 305 that transfers energy from the power source 205 to the energy storage unit 304, and a modulation circuit 306 configured to modulate the energy stored in the energy storage unit 304 for an electric motor forming part of the electromechanical module 201 when the emergency request signal 301 indicates a request for emergency braking.

[0063] The modulation circuit 306 is configured not to modulate the energy stored in the energy storage unit 304 for the electric motor forming part of the electric machine module 201 when the emergency braking request signal 301 does not indicate a request for emergency braking.

[0064] In accordance with the foregoing, the electrical energy storage unit 304 performs the same function as that performed by the auxiliary tank 104, storing the energy required for at least one emergency braking application.

[0065] Additionally, the switching device 302 performs the same function as that performed by the electro-pneumatic emergency valve 116 .

[0066] In order to provide a grade-controlled emergency braking force proportional to the current weight of the braking bogie, the modulation circuit 306 must calculate its value based on the electrical signal 307 indicative of the weight of the braking bogie and close the control loop by reading the electrical signal 213 indicative of the brake force, which indicates the current force value being applied.

[0067] In fact, in the configuration shown in FIG. 3, the modulation circuit 306 assumes the same circuit and software complexity as the service brake control unit 202, in addition to having to be developed in accordance with EN50129, safety integrity level SIL≧3 with respect to standard EN50129. Summary of the Invention [Problem to be solved by the invention]

[0068] It is therefore one object of the present invention to provide an electromechanical service and emergency brake actuator for rail vehicles that can be made to allow cost-effective emergency braking while maintaining all requirements to be compatible with state-of-the-art pneumatic emergency brakes.

[0069] These and other objects and advantages are achieved according to one aspect of the present invention by an electromechanical service and emergency brake actuator for railway vehicles having the features defined in claim 1 or 4, and by an electromechanical braking system for at least one railway vehicle having the features defined in claim 22 or 23 or 24 or 25. Preferred embodiments of the invention are defined in the dependent claims, the content of which should be understood as an integral part of this description. [Brief explanation of the drawings]

[0070] The functional and structural features of some preferred embodiments of an electromechanical service and emergency brake actuator for a rail vehicle according to the present invention will now be described with reference to the accompanying drawings. [Figure 1]FIG. 1 shows a typical pneumatic braking system for railway applications, particularly passenger trains. [Figure 2] FIG. 2 shows a first non-exclusive example of a functional diagram of an electromechanical brake actuator according to the prior art. [Figure 3] FIG. 3 shows a further non-exclusive example of a functional diagram of an electromechanical brake actuator 200 according to the prior art. [Figure 4] FIG. 4 shows an embodiment of an electromechanical service and emergency brake actuator for a rail vehicle according to the present invention. [Figure 5] FIG. 5 shows a further embodiment of an electromechanical service and emergency brake actuator for a rail vehicle according to the invention. [Figure 6] FIG. 6 shows an embodiment of an electromechanical braking system for at least one rail vehicle according to the invention. [Figure 7] FIG. 7 shows a further embodiment of an electromechanical braking system for at least one rail vehicle according to the invention. DETAILED DESCRIPTION OF THE INVENTION

[0071] Before describing several embodiments of the present invention in detail, it should be clear that the invention is not limited in its application to the details of construction and arrangement of components set forth in the following specification or illustrated in the drawings. The invention is capable of other embodiments and of being actually practiced or constructed in a variety of different ways. Also, it is to be understood that the phraseology and terminology is for the purpose of description and should not be regarded as limiting. Words such as "include," "comprise," or variations thereof should be understood to encompass the elements described below and equivalents thereof, as well as additional elements and equivalents thereof.

[0072] Referring first to FIG. 4, an electromechanical service and emergency brake actuator 400 for a rail vehicle is shown.

[0073] The electromechanical service and emergency brake actuator 400 includes a first electromechanical module 201 for generating a first brake force. The first electromechanical module 201 is configured to receive a first brake force control signal 204 and to generate a first brake force, the value of which is a function of said first brake force control signal 204.

[0074] The first brake force control signal 204 may be a signal that provides power to the first electromechanical module 201, in which case it is a brake force control signal and a power source, or it may provide a separate power signal.

[0075] The electromechanical service and emergency brake actuator 400 further comprises a first force sensor means 212 configured to measure a first braking force generated by the first electromechanical module 201 and to generate a first electrical signal 213 indicative of the braking force. The value of the braking force 213 is indicative of a value of the first braking force.

[0076] The force sensor means may for example be a force sensor.

[0077] Additionally, the electromechanical service and emergency brake actuator 400 comprises a first emergency brake energy storage means 208, 304 configured to store a sufficient amount of energy to actuate at least one emergency brake.

[0078] Furthermore, the electromechanical service and emergency brake actuator 400 comprises a safety unit 401 configured to issue a first emergency brake control signal 402 and first emergency brake energy release means 209 .

[0079] The first emergency brake energy release means 209 is configured to prevent the first emergency brake energy storage means 208, 304 from releasing the stored energy when the first emergency brake control signal 402, 502 indicates not to release the stored energy. The emergency brake energy release means 209 is further configured to enable the first emergency brake energy storage means 208, 304 to release the stored energy to activate the at least one emergency brake when the first emergency brake control signal 402, 502 indicates to release the stored energy for activating the at least one emergency brake.

[0080] In other words, the first emergency brake energy release means 209 is configured to have a first state in which it retains the potential energy previously stored in the emergency brake energy storage means 208 when the first emergency brake control signal 402 does not command the release of energy for emergency braking, and a second state in which it releases the potential energy previously stored in the emergency brake energy storage means 208 when the first emergency brake control signal 402 commands the release of energy for emergency braking.

[0081] Furthermore, the electromechanical service and emergency brake actuator 400 comprises a first service brake control unit 202 .

[0082] The service brake control unit 202 is configured to receive an electric service brake request signal 203 and an electric emergency brake request signal 210 .

[0083] Of course, the service brake control unit 202 may be configured to receive a power source 205 .

[0084] The service brake control unit 202 is further configured to calculate a service brake force value as a function of the electric service brake request signal 203 and to control the first electric machine module 201 via a first brake force control signal 204 to generate a first brake force having a value corresponding to the service brake force value when the electric emergency brake request signal 210 does not indicate an emergency braking request.

[0085] Furthermore, the service brake control unit 202 is configured to calculate an emergency brake force value as a function of a predetermined emergency deceleration and to control the first electric machine module 201 via the first brake force control signal 204 to generate a first brake force having a value corresponding to the emergency brake force value when the first electric emergency brake request signal 210 indicates an emergency brake request.

[0086] In other words, the first service brake control unit 202 may continuously calculate the emergency brake force value as a function of at least a predetermined emergency deceleration value, for example indicated by a further input signal 405 or predetermined at the design stage and stored in a non-volatile memory of the service brake control unit 202.

[0087] The above-mentioned safety unit 401 is further configured to receive the emergency braking request signal 210, receive and monitor the first electrical signal 213 indicative of the braking force, and calculate a value of the emergency braking force based on a predetermined emergency deceleration value.

[0088] Furthermore, the safety unit 401 is configured to adjust the first emergency brake control signal 402, as indicated by the first emergency brake energy release means 209, 302, so as not to release the stored energy when the emergency brake request signal 210 does not indicate an emergency braking request or when the emergency brake request signal 210 indicates an emergency braking request and the first electrical signal 213 indicating the braking force indicates, within a predetermined maximum delay time, a force value that matches or is decreasing to a further emergency braking force value calculated by the safety unit 401 and within a predetermined tolerance range including said further emergency braking force value calculated by the safety unit 401, within a predetermined maximum delay time.

[0089] Furthermore, the safety unit 401 is configured to adjust the first emergency brake control signal 402, as indicated by the first emergency brake energy release means 209, 302, to release the energy stored in the first emergency brake energy storage means 208, 304, when the emergency brake request signal 210 indicates an emergency braking request and the first electrical signal 213 indicating the braking force does not indicate, within a predetermined maximum delay time, a force value that corresponds to or does not decrease from the further emergency brake force value calculated by the safety unit 401, and within a predetermined tolerance range including said further value of the emergency brake force calculated by the safety unit 401.

[0090] In other words, the safety unit 401 can monitor the first electrical signal 213 indicating the braking force and verify that its value corresponds to the emergency braking force value calculated therefrom within a predetermined tolerance and within a predetermined maximum delay time.

[0091] As long as the safety unit 401 determines within a predetermined tolerance and a predetermined maximum delay time that the value of the first electric signal 213 indicative of the braking force corresponds to the value of the emergency braking force calculated therefrom and controlled by the first control unit 202 for the service brakes, the safety unit 401 keeps the emergency brake control signal 402 in a state that does not release the emergency energy stored in the first emergency brake energy storage means 208, allowing the first service brake control unit 202 to apply the emergency braking. When the safety unit 401 determines within a predetermined tolerance and a predetermined maximum delay time that the first electric signal 213 indicative of the braking force does not correspond to the value of the emergency braking force calculated therefrom and commanded by the first service brake control unit 202, the safety unit 401 puts the emergency brake control signal 402 in a state that releases the emergency energy stored in the brake energy storage means 208, allowing the emergency braking to be applied.

[0092] In this first embodiment, both the safety unit 401 and the first service brake control unit 202 continuously calculate emergency brake force values ​​independently of each other.

[0093] The emergency brake force application gradient may be calculated by the first service brake control unit 202 and applied in real time when an emergency braking request occurs, or the application gradient may be stored in non-volatile memory of the first service brake control unit 202 and applied during application of the emergency brake force.

[0094] The service brake control unit 202 can be configured to control the first electromechanical module 201 via the first brake force control signal 204 to generate a first brake force having a value corresponding to the greater of the value of the service brake force calculated by the first service brake control unit 202 and the value of the emergency brake force calculated by the first service brake control unit 202. When the service brake force value calculated by the first service brake control unit 202 is greater than the emergency brake force value calculated by the first service brake control unit, the safety unit 401 is configured to adjust the first emergency brake control signal 402, 502 as indicated by the first emergency brake energy release means 209, 302 so as not to release the stored energy even if the brake request signal 210 indicates an emergency braking request and the first electric signal 213 of the actual brake force indicates, within a predetermined maximum delay time, a force value that is greater than the additional emergency brake force value calculated by the safety unit 401 or that is greater than the upper limit value of the aforementioned predetermined tolerance range including said further emergency brake force value calculated by the safety unit 401, i.e. greater than the upper threshold of the aforementioned tolerance range. This is necessary to prevent the safety unit from intervening if braking needs to be applied with a service brake force value that is greater than the emergency brake force value.

[0095] The first service brake control unit 202 may also be configured to receive a weight signal 404 indicative of the weight of the rail car or rail car bogie. It may further be configured to calculate a service brake force value as a function of the electric service brake request signal 203 and the weight signal 404, and may also calculate an emergency brake force value as a function of a predetermined emergency deceleration value and the weight signal 404. The safety unit 401 is further configured to calculate a further emergency brake force value as a function of the predetermined emergency deceleration value and the weight signal 404.

[0096] The predetermined emergency deceleration value may be provided to the service brake control unit 202 and / or the safety unit 401 by an electrical signal.

[0097] In this case, when the safety unit 401 determines that the first electrical signal 213 indicating the braking force does not correspond within a predetermined tolerance range and within a predetermined maximum delay time to the value of the emergency braking force calculated therefrom and controlled by the first service brake control unit 202, the safety unit 401 puts the first emergency brake control signal 402 into a state that releases the emergency energy stored in the first brake force energy storage means 208 and applies the emergency brake anyway, even if it has decreased in terms of metering and / or application gradient.

[0098] In FIG. 5 , in a second embodiment, an electromechanical service and emergency brake actuator 500 for a rail vehicle again comprises a first electromechanical module 201, a first force sensor means 212, a first emergency brake energy storage means 208 and a first means for releasing the emergency brake energy 209.

[0099] The electromechanical service and emergency brake actuator 500 again comprises a safety unit 501, but in this second embodiment the safety unit 501 is configured to receive the emergency brake request signal 210, calculate an emergency brake force value as a function of a predetermined emergency deceleration value and transmit the calculated emergency brake force value therefrom via a first electric emergency brake force request signal 503 to the first service brake control unit 202 which emits an emergency brake control signal 502.

[0100] In this second embodiment, the electromechanical service and emergency brake actuator 500 again comprises a first service brake control unit 202, but configured as follows: Receives an electric service brake request signal 203 and an electric emergency brake request signal 210. Calculating the service brake force value as a function of the electric service brake request signal 203. When the electric emergency brake request signal 210 does not indicate an emergency brake request, the first electric machine module 201 is controlled via the first brake force control signal 204 to generate a first brake force having a value corresponding to the service brake force value. When the emergency brake request signal 210 indicates an emergency brake request, the first electric machine module 201 is controlled via the first brake force control signal 204 to generate a first brake force having a value corresponding to the emergency brake force value received by the first service brake control unit 202 from the safety unit 501 via the first electric emergency brake force request signal 503.

[0101] In the second embodiment, the safety unit 501 is configured as follows. · Receive and monitor a first electrical signal 213 indicative of braking force. adjusting the first emergency brake control signal 502 to indicate to the first emergency brake energy release means 209, 302 not to release the stored energy when the emergency brake request signal 210 does not indicate an emergency braking request or when the emergency brake request signal 210 indicates a request for emergency braking and the first electrical signal 213 indicating the braking force indicates, within a predetermined maximum delay time, a force value that matches or decreases to the emergency brake force value calculated by the safety unit 501 and within a predetermined tolerance range including the emergency brake force value calculated by the safety unit 501 and within a predetermined maximum delay time. adjusting the first emergency brake control signal 502 to instruct the first emergency brake energy release means 209, 302 to release the energy stored in the first emergency brake energy storage means 208, 304 when the emergency brake request signal 210 indicates a request for emergency braking and the first electrical signal 213 indicating the brake force does not indicate, within a predetermined maximum delay time, a force value that matches the emergency brake force value calculated by the safety unit 501, or a force value that does not fall within a predetermined maximum delay time and is within a predetermined tolerance range including the emergency brake force value calculated by the safety unit 501.

[0102] Unlike that described in the first embodiment, in this second embodiment the safety unit 501 communicates the emergency braking force value by signal 503, further reducing the complexity of the safety unit 401.

[0103] Also in this second embodiment, the service brake control unit 202 may be further configured to receive a weight signal 504 indicative of the weight of the rail car or a bogie of the rail car and calculate a service brake force, the value of which is a function of the electric service brake request signal 203 and the weight signal 504. The safety unit 501 may further be configured to receive the weight signal 504 and calculate a value of the emergency brake force as a function of a predetermined emergency deceleration value and the weight signal 504.

[0104] In other words, the safety unit 501 can continuously calculate the emergency braking force value as a function of at least a predetermined emergency deceleration value, which is indicated, for example, by a further input signal 505 or which is pre-set at the design stage and stored in the non-volatile memory of the safety unit.

[0105] The safety unit 501 may transmit the calculated emergency brake force value to the first service brake control unit 202 via a first electrical emergency brake force request signal 503 .

[0106] As long as the safety unit 401 verifies that the first electrical signal 213 indicative of the braking force corresponds within predetermined tolerances and within predetermined maximum delay times to the emergency braking force value calculated therefrom and requested from the first service brake control unit 202 via the first electrical emergency brake force request signal 403, the safety unit 501 maintains the emergency brake control signal 502 in a state that does not release the emergency braking energy stored in the first emergency brake energy storage means 208, allowing the first service brake control unit 202 to perform emergency braking at the predetermined gradient according to the actual weight of the associated bogie or body.

[0107] When the safety unit 501 determines that the first electrical signal 213 indicative of the braking force does not correspond within a predetermined tolerance and within a predetermined maximum delay time to the emergency braking force value calculated therefrom and requested from the first service brake control unit 202 via the first electrical emergency brake force request signal 503, the safety unit 501 causes the first emergency brake control signal 502 to be in a state that releases the emergency braking energy stored in the first emergency brake energy storage means 208 and applies the emergency brake in any case reduced in terms of metering and / or application gradient.

[0108] Also in this second embodiment, the first service brake control unit 202 can be configured to control the first electromechanical module 201 via the first brake force control signal 204 to generate the greater of the service brake force value calculated by the first service brake control unit 202 and the emergency brake force value transmitted to the first service brake control unit 202 by the safety unit 501. Again, when the service brake force value calculated by the first service brake control unit 202 is greater than the emergency brake force value received by the first service brake control unit, the safety unit 501 is configured to adjust the first emergency brake control signal 502 so as to indicate not to release the energy stored in the first emergency brake energy release means 209, 302, even if the emergency brake request signal 210 indicates a request for emergency braking and the first electrical signal 213 of the actual brake force indicates, within a predetermined maximum delay time, a force value that is greater than the emergency brake force value calculated by the safety unit 501 or greater than the upper value of a predetermined tolerance range that includes the emergency brake force value calculated by the safety unit 501, i.e. a force value that is higher than the upper threshold of this tolerance range.

[0109] The safety unit 501 may also be configured to send a null emergency brake force value to the first service brake control unit 202 via the first electric emergency brake request signal 503 when the emergency brake request signal 210 does not indicate an emergency brake request.

[0110] For all embodiments described so far, the electromechanical service and emergency brake actuator 400, 500 may comprise an integrated module, for example an integrated mechatronics module including at least a first electromechanical module 201, a first force sensor means 212, a first emergency brake energy storage means 208, 304, a first emergency brake energy release means 209, 302, a first service brake control unit 202, a safety unit 401, 501.

[0111] 6, the electromechanical service and emergency brake actuator 400, 500 may comprise an integrated module including the first electromechanical module 201, the first force sensor means 212, the first emergency brake system energy storage means 208, 304, the first emergency brake energy release means 209, 302, and the first service brake control unit 202. In this case, the safety unit 401, 501, 601 may be external to said integrated module. In this figure, the bogie may for example have four wheels 631, 632, 633, 634 and at least two of these integrated modules including the first electromechanical module 201, the first force sensor means 212, the first emergency brake energy storage means 208, 304, the first emergency brake energy release means 209, 302, the first service brake control unit 202, one for each axle or four of these integrated modules 620, 621, 622, 623, each associated with a wheel 631, 632, 633, 634.

[0112] Alternatively, referring to Figure 7, the integrated module may include the first electromechanical module 201, the first force sensor means 212, the first emergency brake energy storage means 208, 304 and the first emergency brake energy release means 209, 302. In this case, the safety unit 401, 501, 601 and the first service brake control unit 702 may be external to said integrated module. For example, in this figure, the bogie has four wheels 631, 632, 633, 634 and may also have at least two of the integrated modules including the first electromechanical module 201, the first force sensor means 212, the first emergency brake energy storage means 208, 304 and the first emergency brake energy release means 209, 302, one for each axle, or four of these integrated modules 620, 621, 622, 623, each associated with a wheel 631, 632, 633, 634.

[0113] In a further aspect, the first braking force generated by the first electromechanical module 201 is configured to be transmitted to the braking means by a mechanical transmission means 216,680.

[0114] The braking means may comprise at least one disc friction pad or wheel friction block 631, 632, 633, 634.

[0115] The first emergency braking energy storage means 208 may comprise latent mechanical energy storage means or mechanical kinetic energy storage means or electrical energy storage means.

[0116] It is conventional to develop control units in accordance with the EN50128 and EN50129 standards with a safety integrity level of SIL≦2. The safety units 401, 501, and 601 may have a safety integrity level SIL higher than the safety integrity level SIL of the first service brake control unit 202 and 702. The safety units 401, 501, and 601 may have a safety integrity level SIL≧3.

[0117] By developing the safety units 401, 501, 601 according to the SIL≧3 level, the entire system, in particular in relation to emergency braking, is at the same level as related to the safety units 401, 501, 601.

[0118] Advantageously, the safety unit is of much simpler construction than the first service brake control unit 202 .

[0119] In a further embodiment, the safety units 401, 501, 601 may be made according to an architecture including at least one microprocessor and / or at least one programmable device, which helps to achieve a SIL≧3 level.

[0120] To illustrate an embodiment, reference can be made again to Figure 5, which shows a functional diagram of the electromechanical brake actuator 300 shown in Figure 3 and previously described, modified in accordance with the present invention.

[0121] The safety unit 501 generates a first electrical emergency brake control signal 502 for controlling a first emergency brake energy release means, i.e. a switching device 302 configured to connect the first electrical control signal 204 to the first service brake control unit 202 when said first emergency brake control signal 501 does not indicate a command to apply emergency braking. The switching device 302 is configured to connect the first electrical control signal 204 to the electronic emergency brake unit 303 when said emergency brake request signal 301 indicates an emergency braking request.

[0122] Furthermore, the electric emergency brake control signal 502 may control a modulation circuit 306 configured to modulate energy stored in an energy storage unit 304 for an electric motor forming part of the first electric machine module 201 when the emergency brake request signal 301 indicates an emergency braking request.

[0123] The modulation circuit 306 is configured not to modulate the energy stored in the energy storage unit 304 for the electric motor forming part of the electric machine module 201 when the emergency braking request signal 301 does not indicate an emergency braking request.

[0124] In accordance with the foregoing, the electrical energy storage unit 304 performs the same function as that performed by the auxiliary tank 104, storing the energy required for at least one emergency braking application.

[0125] The safety unit 501 receives at its inputs the emergency brake request signal 210, a first electrical signal 213 indicative of the braking force generated by the first force sensor means 212, and a signal 504 (if present) indicative of the weight of the bogie or vehicle to be braked.

[0126] According to the second embodiment described above, the safety unit 501 is able to continuously calculate an emergency braking force value as a function of a predetermined emergency deceleration value indicated by a further input signal 505 or predetermined at the design stage and stored in a non-volatile memory of said safety unit, and of a weight value received via signal 504 (if present).

[0127] According to the second embodiment, the safety unit 501 transmits the calculated emergency braking force value to the first service brake control unit 202 via a first electrical signal 503 .

[0128] When the emergency braking request signal 210 does not indicate an emergency braking request, the first control unit 210 controls the first electromechanical module 201 to obtain a service brake force as a function of the service brake force request 203 .

[0129] When the emergency braking request signal 210 indicates an emergency braking request, the first service control unit 210 commands the first electric machine module 201 to acquire a braking force equal to the emergency braking force value corresponding to the first electric emergency braking signal 503.

[0130] The emergency braking force application gradient may be calculated by the safety unit 501 and applied to the emergency braking force value 503 in real time.

[0131] Alternatively, the emergency brake force signal 503 may always indicate the target value and the application gradient may be stored in non-volatile memory of the service brake control unit 202 and applied by the first electronic service control unit during application of the emergency brake force.

[0132] At the same time, the safety unit 501 can monitor the first electrical signal indicative of the braking force 213 and verify that it corresponds to the emergency braking force value calculated therefrom within a predetermined tolerance and within a predetermined maximum delay time.

[0133] As long as the safety unit 501 verifies, within predetermined tolerances and within a predetermined maximum delay time, that the first electrical signal indicative of the braking force 213 corresponds to the value of the emergency braking force calculated therefrom and requested by the first service brake control unit 202 via signal 503, said safety unit 501 maintains signal 502 in a state that connects the control signal 204 to the service brake control unit 202, and the service brake control unit 202 uses the predetermined gradient as calculated by the safety module 501, i.e. the actual weight of the associated bogie or vehicle.

[0134] When the safety unit 501 ascertains, within a predetermined tolerance and within a predetermined maximum delay time, that the first electric signal 213 indicative of the braking force does not correspond to the value of the emergency braking force calculated therefrom and requested by the service brake control unit 202 via signal 503, said safety unit 501 acts on the electric emergency brake control signal 502 and switches the switching device 302 to a state in which it connects the control signal 204 to a modulation circuit 306 and activates said modulation circuit 306 to modulate the energy stored in the energy storage unit 304 for the electric motor forming part of the electromechanical module 201. Advantageously, the safety unit 501 is of much simpler construction than the service brake control unit 202 .

[0135] The introduction of the safety unit 501 greatly simplifies the modulation circuit 306. In this architecture configuration, the modulation circuit 306 becomes a backup circuit, requiring design simplicity and reliability in the very rare case where the first service control unit 202 cannot execute control of the first electromechanical module 201.

[0136] Considering the first embodiment, the only difference with respect to the second embodiment is that both the safety unit 401 and the service brake control unit 202 continuously and independently calculate the emergency braking force value as a function of the emergency deceleration value indicated by a further input signal 405 or predetermined at the design stage and stored in a non-volatile memory of said safety unit, and of the weight value received via the weight signal 404.

[0137] Unlike that described in the second embodiment, the safety unit 401 does not transmit the emergency braking force value via signal 503, further reducing the complexity of the safety unit 401.

[0138] In a further aspect, with reference to Figures 6 and 7, the present invention further relates to an electromechanical braking system for at least one railway vehicle including a service and emergency brake actuator 400, 500 manufactured according to one of the previously described embodiments.

[0139] In a first embodiment of the electromechanical braking system for at least one rail vehicle, there is a single safety unit and a single control unit for service brakes that controls several electromechanical modules according to emergency braking values ​​calculated therefrom. In this embodiment, the safety units 401, 501, 601 are further configured to issue a second emergency brake control signal 602. The electromechanical braking system for at least one rail vehicle comprises: a second electromechanical module for generating a second braking force, said second electromechanical module being arranged to receive second braking force control signals 660, 661, 662, 663 and to generate said second braking force, the value of which is a function of said second braking force control signals 660, ..., 663; second force sensor means arranged to measure the second braking force generated by the second electromechanical module and to generate a second electrical signal 640, 641, 642, 643 indicative of a braking force, the value of which indicates a value of the second braking force; a second emergency brake energy storage means configured to store a sufficient amount of energy to activate at least one emergency brake; and second means for releasing emergency braking energy.

[0140] The second emergency brake energy release means is arranged as follows: Preventing the second emergency brake energy storage means from releasing stored energy when the second emergency brake control signal 602 does not indicate releasing stored energy. enabling the second emergency brake energy storage means to release stored energy for actuating at least one emergency brake when said second emergency brake control signal 602 indicates to release stored energy for actuating at least one emergency brake.

[0141] The first control unit 202 for the service brakes is further configured as follows. When the electric emergency brake request signal 210 does not indicate an emergency brake request, control the second electric machine module via the second brake force control signals 660,...,663 to generate a second brake force having a value corresponding to the service brake force value. · When the electric emergency braking request signal 210 indicates an emergency braking request, controlling the second electric machine module via second brake force control signals 660, ···, 663 to generate a second brake force having a value corresponding to the emergency braking force value.

[0142] The safety units 401, 501, 601 are further configured as follows: · Receive and monitor second electrical signals 640,...,643 indicative of braking force. adjusting the second emergency brake control signal 602 to indicate not to release the energy stored in the second emergency brake energy release means when the emergency brake request signal 210 does not indicate an emergency braking request or when the emergency brake request signal 210 indicates an emergency braking request and the second electrical signals 640,...,643 indicating the braking force indicate, within a predetermined maximum delay time, a force value that matches the further emergency braking force value calculated by said safety unit 401,501 or that falls within a predetermined tolerance range including the further emergency braking force value calculated by said safety unit 401,501,601 within a predetermined maximum delay time. adjusting the second emergency brake control signal 602 to instruct the second emergency brake energy release means to release the energy stored in the second emergency brake energy storage means when the emergency brake request signal 210 indicates an emergency braking request and the second electrical signals 640,...,643 indicating the braking force do not, within a predetermined maximum delay time, indicate a force value that matches the further emergency brake force value calculated by said safety unit 401, 501, 601 or do not, within a predetermined maximum delay time, indicate a force value that does not fall within a predetermined tolerance range including the further emergency brake force value calculated by said safety unit 401, 501, 601.

[0143] In a second embodiment of the electromechanical braking system for at least one rail vehicle, there is a single safety unit and multiple control units for the service brakes, which control respective electromechanical modules according to respective emergency braking values ​​calculated therefrom. In this embodiment, the safety units 401, 501, 601 are further configured to issue a second emergency brake control signal 602. The electromechanical braking system for at least one rail vehicle includes: a second electromechanical module for generating a second braking force, the second electromechanical module being configured to receive a second braking force control signal and to generate a second braking force, the value of which is a function of the second braking force control signal; a second control unit for the service brake configured to receive an electric service brake request signal (203), an electric emergency brake request signal (210), calculate a second service brake force value as a function of the electric service brake request signal (203), control a second electromechanical module via second brake force control signals (660, 663) to generate a second brake force having a value corresponding to the second service brake force value when the electric emergency brake request signal (210) does not indicate an emergency braking request, calculate the second emergency brake force value as a function of a predetermined emergency deceleration value, and control a second electromechanical module via second brake force control signals (660, 663) to generate a second brake force having a value corresponding to the second emergency brake force value when the electric emergency brake request signal (210) indicates an emergency braking request; second force sensor means arranged to measure the second braking force generated by the second electromechanical module and to generate second electrical signals 640,...,643 indicative of a braking force, the value of which indicates a value of the second braking force; a second emergency brake energy storage means configured to store a sufficient amount of energy to activate at least one emergency brake; and second means for releasing emergency braking energy.

[0144] The second emergency brake energy release means is arranged as follows: Preventing the second emergency brake energy storage means from releasing stored energy when the second emergency brake control signal 602 does not indicate releasing stored energy. When said second emergency brake control signal 602 indicates releasing stored energy to activate at least one emergency brake, the second emergency brake energy storage means 208, 304 releases stored energy to enable the activation of at least one emergency brake.

[0145] The safety units 401, 501, 601 are further configured as follows: · Receive and monitor a second electrical signal indicative of braking force 640, ···, 643. adjusting the second emergency brake control signal 402, 502 to indicate not to release the energy stored in the second emergency brake energy release means when the emergency brake request signal 210 does not indicate an emergency braking request or when the emergency brake request signal 210 indicates a request for emergency braking and the second electrical signals 640,...,643 indicating the braking force indicate, within a predetermined maximum delay time, a force value that matches a further emergency braking force value calculated by said safety unit 401, 501, 601 or that falls within a predetermined tolerance range including said further emergency braking force value calculated by said safety unit 401, 501, 601 within a predetermined maximum delay time. adjusting the second emergency brake control signal 602 to instruct the second emergency brake energy release means to release the energy stored in the second emergency brake energy storage means when the emergency brake request signal 210 indicates an emergency braking request and the second electrical signals 640,...,643 indicating the braking force do not, within a predetermined maximum delay time, indicate a force value that matches the further emergency brake force value calculated by said safety unit 401, 501, 601 or do not, within a predetermined maximum delay time, indicate a force value that does not fall within a predetermined tolerance range including the further emergency brake force value calculated by said safety unit 401, 501, 601.

[0146] In a third embodiment of an electromechanical braking system for at least one rail vehicle, there is a single safety unit and a single service brake control unit that controls several electromechanical modules according to emergency braking values ​​calculated and transmitted by the safety unit. In this embodiment, the safety unit 401, 501, 601 is further configured to issue a second emergency brake control signal 602.

[0147] The electromechanical braking system for at least one rail vehicle shall a second electromechanical module for generating a second braking force, the second electromechanical module being configured to receive second braking force control signals 660, ..., 663 and to generate a second braking force, the value of which is a function of the second braking force control signals 660, ..., 663; second force sensor means configured to measure the second braking force generated by the second electromechanical module and to generate a second electrical signal 640,...,643 indicative of a braking force, the value of which indicates a value of the second braking force; a second emergency brake energy storage means configured to store a sufficient amount of energy to activate at least one emergency brake; and second means for releasing emergency braking energy.

[0148] The second emergency brake energy release means is arranged as follows: Preventing the second emergency brake energy storage means from releasing stored energy when the second emergency brake control signal 602 does not indicate releasing stored energy. When said second emergency brake control signal 602 indicates releasing stored energy to activate at least one emergency brake, the second emergency brake energy storage means 208, 304 releases stored energy to enable the activation of at least one emergency brake.

[0149] The first control unit 202 for the service brakes is further configured as follows. When the electric emergency brake request signal 210 does not indicate an emergency brake request, control the second electric machine module via the second brake force control signals 660,...,663 to generate a second brake force having a value corresponding to the service brake force value. when the electric emergency brake request signal 210 indicates an emergency brake request, controls a second electromechanical module via a second brake force control signal 660,...,663 to generate a second brake force having a value corresponding to the emergency brake force value received by the first control unit for service brakes from the safety unit 401,501 via the first electric emergency brake force request signal 403,503.

[0150] The safety unit 401, 501 is further configured as follows: · Receive and monitor second electrical signals 640,...,643 indicative of braking force. adjusting the second emergency brake control signal 602 to indicate not to release the energy stored in the second emergency brake energy release means when the emergency brake request signal 210 does not indicate an emergency braking request, or when the emergency brake request signal 210 indicates an emergency braking request and the second electrical signals 640,...,643 indicating the braking force indicate, within a predetermined maximum delay time, a force value that matches the emergency braking force value calculated by said safety unit 401, 501, 601 or that falls within a predetermined tolerance range including said emergency braking force value calculated by said safety unit 401, 501, 601, within a predetermined maximum delay time. adjusting the second emergency brake control signal 602 to instruct the second emergency brake energy release means to release the energy stored in the second emergency brake energy storage means when the emergency brake request signal 210 indicates an emergency braking request and the second electrical signals 640,...,643 indicating the braking force do not, within a predetermined maximum delay time, indicate a force value that matches the emergency brake force value calculated by said safety unit 401, 501, 601 or do not, within a predetermined maximum delay time, indicate a force value that does not fall within a predetermined tolerance range including the emergency brake force value calculated by said safety unit 401, 501, 601.

[0151] In a fourth embodiment of the electromechanical braking system for at least one rail vehicle, there is a single safety unit and a single service brake control unit which controls several electromechanical modules according to further emergency braking values ​​calculated and transmitted by the safety unit. In this embodiment, said safety unit 401, 501, 601 is further configured to transmit the emergency braking force value calculated by the safety unit 401, 501, 601 via a second electric emergency brake request signal to a second control unit for the service brakes and to issue a second emergency brake control signal 602.

[0152] The electromechanical braking system for at least one rail vehicle shall a second electromechanical module for generating a second braking force, the second electromechanical module being configured to receive second braking force control signals 660, ..., 663 and to generate a second braking force, the value of which is a function of the second braking force control signals 660, ..., 663; second force sensor means configured to measure the second braking force generated by the second electromechanical module and to generate a second electrical signal indicative of the braking force, the value of which indicates a value of the second braking force; a second emergency brake energy storage means configured to store a sufficient amount of energy to activate at least one emergency brake; and second means for releasing emergency braking energy.

[0153] The second emergency brake energy release means is arranged as follows: Preventing the second emergency brake energy storage means from releasing stored energy when the second emergency brake control signal 602 does not indicate releasing stored energy. When said second emergency brake control signal 602 indicates releasing stored energy to activate at least one emergency brake, the second emergency brake energy storage means 208, 304 releases stored energy to enable the activation of at least one emergency brake.

[0154] The second control unit for the service brake is configured as follows: Receives an electric service brake request signal 203 and an electric emergency brake request signal 210. Calculating the service brake force value as a function of the electric service brake request signal 203. · When the electric emergency brake request signal 210 does not indicate an emergency brake request, control the second electromechanical module via the second brake force control signals 660, ···, 663 to generate a second brake force having a value corresponding to the second service brake force value. · when the emergency brake request signal 210 indicates an emergency brake request, controlling said second electric machine module via a second brake force control signal 660, ···, 663 to generate a second brake force having a value corresponding to the emergency brake force value received by the second service brake control unit from the safety unit 401, 501, 601 via the second electric emergency brake force request signal.

[0155] The safety units 401, 501, 601 are further configured as follows: · Receive and monitor second electrical signals 640,...,643 indicative of braking force. adjusting the second emergency brake control signal 602 to indicate not to release the energy stored in the second emergency brake energy release means when the emergency brake request signal 210 does not indicate an emergency braking request or when the emergency brake request signal 210 indicates an emergency braking request and the second electrical signals 640,...,643 indicating the braking force indicate, within a predetermined maximum delay time, a force value that matches the emergency braking force value calculated by said safety unit 401,501 or that falls within a predetermined tolerance range including said further emergency braking force value calculated by said safety unit 401,501,601 within a predetermined maximum delay time. adjusting the second emergency brake control signal 602 to instruct the second emergency brake energy release means to release the energy stored in the second emergency brake energy storage means when the emergency brake request signal 210 indicates an emergency braking request and the second electrical signals 640,...,643 indicating the braking force do not, within a predetermined maximum delay time, indicate a force value that matches the emergency brake force value calculated by said safety unit 401, 501, 601 or do not, within a predetermined maximum delay time, indicate a force value that does not fall within a predetermined tolerance range including the emergency brake force value calculated by said safety unit 401, 501, 601.

[0156] For any of the aforementioned embodiments of the electromechanical service and emergency brake actuator or electromechanical brake system, the first service brake control unit 202 may be configured to receive the first electrical signal of actual brake force 213. For example, this may be used by the first service brake control unit 202 in the case of a service brake to check that a brake force corresponding to the service brake force request 203 has been reached. The first service brake control unit 202 may control the first electromechanical module 210 to adjust the first brake force until the first electrical signal of actual brake force 213 indicates that the first brake force substantially corresponds to the service brake force request 203.

[0157] Obviously, the first service brake control unit 202 can also be configured to receive the second electrical signals 640,...,643 of the actual brake force, if present. For example, this may be used by the first service brake control unit 202 in the case of a service brake to check that a brake force corresponding to the service brake force request 203 has been reached. The first service brake control unit 202 can control the second electromechanical module to adjust the second brake force until the second electrical signals 640,...,643 of the actual brake force indicate that the second brake force substantially corresponds to the service brake force request 203.

[0158] Obviously, if a second control unit for the service brake is present, the second electrical signals of the actual brake force 640,...,643 may also be received. For example, this may be used by the second control unit for the service brake 202 to verify that in the case of a service brake, a brake force corresponding to the service brake force request 203 has been reached. The second control unit for the service brake may control the second electromechanical module to adjust the second brake force until the second electrical signals of the actual brake force 640,...,643 indicate that the second brake force substantially corresponds to the service brake force request 203.

[0159] Various aspects and embodiments of an electro-mechanical service and emergency brake actuator for a rail vehicle and an electro-mechanical braking system for at least one rail vehicle according to the present invention have been described. It is understood that each embodiment can be combined with any other embodiment. Furthermore, the present invention is not limited to the described embodiments, but can be modified within the scope defined by the appended claims.

Claims

1. a first electromechanical module for generating a first braking force, the first electromechanical module configured to receive a first braking force control signal and generate a first braking force, the first electromechanical module having a value that is a function of the first braking force control signal; first force sensor means configured to measure the first braking force generated by the first electromechanical module and to generate a first electrical actual braking force signal, the signal indicating a value of the first braking force; a first emergency brake energy storage means configured to store a sufficient amount of energy to actuate at least one emergency brake; a safety unit configured to emit a first emergency brake control signal; a first emergency brake energy release means, preventing the first emergency brake energy storage means from releasing the stored energy when the first emergency brake control signal does not indicate that the energy stored in the first emergency brake energy storage means should be released; a first emergency brake energy release means configured to cause the first emergency brake energy storage means to release the stored energy and enable the at least one emergency brake to be actuated when the first emergency brake control signal indicates that the energy stored in the first emergency brake energy storage means should be released to actuate the at least one emergency brake; and a first service brake control unit, Receives an electric service brake request signal and an electric emergency brake request signal; calculating a service brake force value as a function of the electric service brake request signal; controlling the first electric machine module via the first brake force control signal when the electric emergency brake request signal does not indicate an emergency brake request; generating the first brake force having a value corresponding to the service brake force value, and calculating an emergency brake force value based on a predetermined emergency deceleration value; and the first service brake control unit configured to control the first electro-mechanical module via the first brake force control signal to generate the first brake force having a value corresponding to the emergency brake force value when the electric emergency brake request signal indicates an emergency braking request; The safety unit further comprises: receiving the electric emergency brake request signal; receiving and monitoring the first electrical signal of actual braking force; calculating an additional emergency braking force value as a function of the predetermined emergency deceleration value; adjusting the first emergency brake control signal to indicate to the first emergency brake energy release means not to release the energy stored in the first emergency brake energy storage means when the electric emergency brake request signal does not indicate an emergency braking request, or when the electric emergency brake request signal indicates an emergency braking request and the first electric signal of actual braking force indicates, within a predetermined maximum delay time, a force value that matches the additional emergency brake force value calculated by the safety unit or that falls within a predetermined tolerance range that includes the additional emergency brake force value calculated by the safety unit, 1. An electro-mechanical service and emergency brake actuator for a railway vehicle, comprising: an actuator configured to adjust the first emergency brake control signal to indicate to the first emergency brake energy release means to release the energy stored in the first emergency brake energy storage means when the electric emergency brake request signal indicates an emergency braking request and the first electric signal of actual brake force does not, within a predetermined maximum delay time, indicate a force value that matches the additional emergency brake force value calculated by the safety unit or does not, within a predetermined maximum delay time, indicate a force value that does not fall within a predetermined tolerance range that includes the additional emergency brake force value calculated by the safety unit.

2. the first service brake control unit is configured to control the first electro-mechanical module via the first brake force control signal to generate the first brake force having a value corresponding to a larger one of the service brake force value calculated by the first service brake control unit and the emergency brake force value calculated by the first service brake control unit; 2. The electro-mechanical service and emergency brake actuator of claim 1, wherein the safety unit is configured to adjust the first emergency brake control signal to indicate to the first emergency brake energy release means not to release the energy stored in the first emergency brake energy storage means when the service brake force value calculated by the first service brake control unit is greater than the emergency brake force value calculated by the first service brake control unit even when the electric emergency brake request signal indicates an emergency braking request and the first electric signal of actual brake force indicates, within a predetermined maximum delay time, a force value higher than the additional emergency brake force value calculated by the safety unit or a force value higher than an upper limit value of a predetermined tolerance range including the additional emergency brake force value calculated by the safety unit.

3. the first service brake control unit is configured to receive a weight signal indicative of a weight of the railcar or a bogie of the railcar, calculate the service brake force value as a function of the electric service brake request signal and the weight signal, and calculate the emergency brake force value based on the predetermined emergency deceleration value and the weight signal; The electromechanical service and emergency brake actuator of claim 1 , wherein the safety unit is configured to calculate the additional emergency brake force value as a function of the predetermined emergency deceleration value and the weight signal.

4. a first electromechanical module for generating a first braking force, the first electromechanical module configured to receive at least one first brake force control signal and generate a first braking force that is a function of the first brake force control signal; first force sensor means configured to measure the first braking force generated by the first electromechanical module and to generate a first electrical actual braking force signal, the signal indicating a value of the first braking force; a first emergency brake energy storage means configured to store a sufficient amount of energy to actuate at least one emergency brake; A safety unit, Receives an emergency brake request signal, calculating an emergency braking force value as a function of a predetermined emergency deceleration value; transmitting the emergency brake force value calculated by the safety unit to a first service brake control unit via a first electrical emergency brake force request signal; and the safety unit configured to emit a first emergency brake control signal; a first emergency brake energy release means, preventing the first emergency brake energy storage means from releasing the stored energy when the first emergency brake control signal does not indicate that the energy stored in the first emergency brake energy storage means should be released; a first emergency brake energy release means configured to cause the first emergency brake energy storage means to release the stored energy and enable the at least one emergency brake to be actuated when the first emergency brake control signal indicates that the energy stored in the first emergency brake energy storage means should be released to actuate the at least one emergency brake; and The first service brake control unit, Receives an electric service brake request signal and an electric emergency brake request signal; calculating a service brake force value as a function of the electric service brake request signal; controlling the first electromechanical module via the first brake force control signal to generate the first brake force having a value corresponding to the service brake force value when the electric emergency brake request signal does not indicate an emergency brake request; the first service brake control unit configured to control the first electro-mechanical module via the first brake force control signal to generate the first brake force having a value corresponding to the emergency brake force value when the electric emergency brake request signal indicates an emergency braking request; The safety unit includes: receiving and monitoring the first electrical signal of actual braking force; calculating an additional emergency braking force value as a function of the predetermined emergency deceleration value; adjusting the first emergency brake control signal to instruct the first emergency brake energy release means not to release the energy stored in the first emergency brake energy storage means when the emergency brake request signal does not indicate an emergency braking request, or when the emergency brake request signal indicates an emergency braking request and the first electrical signal of actual braking force indicates, within a predetermined maximum delay time, a force value that matches the additional emergency brake force value calculated by the safety unit, or a force value that falls within a predetermined tolerance range that includes the additional emergency brake force value calculated by the safety unit, within a predetermined maximum delay time; 1. An electro-mechanical service and emergency brake actuator for a railway vehicle, comprising: an electro-mechanical service and emergency brake actuator configured to adjust the first emergency brake control signal to indicate to the first emergency brake energy release means to release the energy stored in the first emergency brake energy storage means when the emergency brake request signal indicates an emergency braking request and the first electrical signal of actual brake force does not, within a predetermined maximum delay time, indicate a force value that matches the additional emergency brake force value calculated by the safety unit, or does not, within a predetermined maximum delay time, indicate a force value that does not fall within a predetermined tolerance range that includes the additional emergency brake force value calculated by the safety unit.

5. the first service brake control unit is further configured to receive a weight signal indicative of a weight of the railcar or a bogie of the railcar, and to calculate the service brake force value as a function of the electric service brake request signal and the weight signal; The electromechanical service and emergency brake actuator of claim 4 , wherein the safety unit is further configured to receive the weight signal and calculate the additional emergency brake force value as a function of the predetermined emergency deceleration value and the weight signal.

6. the first service brake control unit is configured to control the first electro-mechanical module via the first brake force control signal to generate the first brake force having a value corresponding to a larger one of the service brake force value calculated by the first service brake control unit and the emergency brake force value calculated by the first service brake control unit; 6. The electro-mechanical service and emergency brake actuator of claim 5, wherein the safety unit is configured to adjust the first emergency brake control signal to indicate to the first emergency brake energy release means not to release the energy stored in the first emergency brake energy storage means when the service brake force value calculated by the first service brake control unit is greater than the emergency brake force value calculated by the first service brake control unit even when the emergency brake request signal indicates an emergency braking request and the first electrical signal of actual brake force indicates, within a predetermined maximum delay time, a force value higher than the additional emergency brake force value calculated by the safety unit or a force value higher than an upper value of a predetermined tolerance range including the additional emergency brake force value calculated by the safety unit, within a predetermined maximum delay time.

7. 7. The electro-mechanical service and emergency brake actuator of claim 6, wherein the safety unit is configured to transmit a null emergency brake force value via the first electric emergency brake force request signal to the first service brake control unit when the emergency brake request signal does not indicate a request for emergency braking.

8. 2. The electro-mechanical service and emergency brake actuator of claim 1, wherein the electro-mechanical service and emergency brake actuator has an integrated module including at least the first electro-mechanical module, the first force sensor means, the first emergency brake energy storage means, the first emergency brake energy release means, the first service brake control unit, and the safety unit.

9. the electromechanical service and emergency brake actuator has an integrated module including the first electromechanical module, the first force sensor means, the first emergency brake energy storage means, the first emergency brake energy release means, and the first service brake control unit; The electromechanical service and emergency brake actuator of claim 1 , wherein the safety unit is external to the integrated module.

10. the electromechanical service and emergency brake actuator has an integrated module including the first electromechanical module, the first force sensor means, the first emergency brake energy storage means, and the first emergency brake energy release means; The electromechanical service and emergency brake actuator of claim 1 , wherein the safety unit and the first service brake control unit are external to the integrated module.

11. The electromechanical service and emergency brake actuator of claim 1 , wherein the first braking force generated by the first electromechanical module is configured to be transmitted to a brake means via a mechanical transmission means.

12. 12. An electromechanical service and emergency brake actuator according to claim 11, wherein the braking means comprises at least one disc friction pad or wheel friction block.

13. 10. The electro-mechanical service and emergency brake actuator of claim 1, wherein the first emergency brake energy storage means comprises a mechanical means for storing potential mechanical energy.

14. 10. The electro-mechanical service and emergency brake actuator of claim 1, wherein the first emergency brake energy storage means comprises a mechanical means for storing kinetic energy.

15. The electromechanical service and emergency brake actuator of claim 1 , wherein the first emergency brake energy storage means comprises a mechanical means for storing electrical energy.

16. The electromechanical service and emergency brake actuator of claim 1 , wherein the safety unit has a safety integrity level SIL higher than a safety integrity level SIL of the first service brake control unit.

17. The electromechanical service and emergency brake actuator of claim 1 , wherein the safety unit has a safety integrity level SIL≧3.

18. 10. The electromechanical service and emergency brake actuator of claim 1, wherein the safety unit is constructed according to an architecture that includes at least one microprocessor.

19. The electromechanical service and emergency brake actuator of claim 1 , wherein the safety unit is constructed according to an architecture that includes at least one programmable device.

20. The electromechanical service and emergency brake actuator of claim 1 , wherein the predetermined emergency deceleration value is provided to the first service brake control unit and / or the safety unit via an electrical signal.

Images