Braking system and braking method for railway vehicles

Abstract

A braking system (500) for a rail vehicle (1) is disclosed, the braking system having a brake control (580), an extended function carrier (594), an actuator (582), a first brake path from a function active between a control input of the braking system and generation of a brake force, and a second brake path from a function active between a control input of the braking system and generation of a brake force, the brake control having a first brake control unit (586) configured to provide a brake function (334) and to output a force modulation amount, a first actuator control unit (588) configured to provide a function of generating a friction brake force based on the force modulation amount and to output an actuation amount, the actuator having a second brake control unit (590) configured to provide a brake function and to output a force modulation amount, a second actuator control unit (592) configured to provide a function of generating a friction brake force based on the force modulation amount and to output an actuation amount, and a brake force unit configured to provide a function of generating a friction brake force based on the actuation amount.

Description

Technical Field

[0001] The present invention relates to an apparatus and method for braking a railway vehicle, and more particularly to such an apparatus and such a method for electro-mechanical braking of a railway vehicle.

[0002] Decelerating railway vehicles equipped with pneumatic braking systems is well-known in the prior art, has developed as the primary methodology for slowing railway vehicles, and is prescribed in many fields. In this case, depending on the configuration, the overpressure present in a compressed air reservoir supplied by a compressor is used, via a pneumatic cylinder, to move, press against, or release static braking members, such as brake discs, brake shoes, or brake pads, against movable braking members, such as brake discs, wheels, or axles. The friction generated during pressing converts kinetic energy into thermal energy, thereby decelerating the railway vehicle. Based on more than 100 years of experience with such pneumatic braking systems, especially pneumatic friction brakes, they are considered sophisticated and reliable. Such braking systems provide a highly available, systematically stable, and virtually uninterrupted deceleration function that is independent of the state of other systems or environmental influences on the vehicle. However, such braking systems require additional systems for operation. These are, in particular, pneumatic compressors and supply infrastructure, such as tracks and pipelines. These components are heavy and impose high demands on structural space. Furthermore, these braking systems have relatively sluggish drive control characteristics and lack flexibility. Typically, only the adaptation of braking pressure with respect to the load and speed of the railway vehicle is achieved, and this is usually achieved only in discrete stages. For example, German Patent Application Publication No. 102009051019 describes a speed-dependent stepped emergency braking device for a railway vehicle having a hierarchical flow, in which the braking force of the emergency brake is adjusted by regenerative braking or electro-pneumatic braking, and the emergency brake is performed in a speed-dependent manner. For example, German Patent Application Publication No. 102011110047 discloses an emergency braking device for a railway vehicle comprising an emergency brake control valve device for providing an emergency brake control pressure and an emergency brake setting device for setting the provided emergency brake control pressure depending on the load and speed values ​​of the railway vehicle.

[0003] Alternatively, conventional technology includes braking systems based on other technical operating principles, such as electrodynamic braking systems that utilize electromagnetic induction to convert kinetic energy into electrical energy, which can then be stored or utilized. These systems offer advantages, particularly in terms of the overall energy efficiency of railway vehicle operation. However, the extraction of braking energy, power generation, and functionality here depend entirely on the operating state of all involved electrical and electronic subsystems, as well as the vehicle's condition. Since these components are often not readily available themselves, such braking systems as a whole cannot be considered highly available.

[0004] Standards IEC 61508 and, in particular, DIN EN 50126-2:2017 “Bahnanwendungen - Specifikation und Nachweis von Zuverlaessigkeit, Verfuegbarkeit, Instandhaltbarkeit und Sicherheit (RAMS) - Teil 2: Systembezogene Sicherheitsmethodik” in the rail-related transport domain define security integrity levels (SILs) that define the evaluation of electrical systems, electronic systems, or programmable electronic systems in terms of the reliability of their safety functions. From the target level, safety-oriented structural principles that must be adhered to in order to reduce the risk of malfunction to a specific value are derived. Four security integrity levels are defined here, with the first security integrity level (SIL 1) having the lowest requirements, and the fourth security integrity level (SIL 4) having the highest requirements, exceeding the second and third security integrity levels. Therefore, components classified as SIL 1 have a failure probability of 10 per hour. -5 ~10 -6 The component that is allowed to be classified as SIL 4 has a failure probability of 10 per hour. -8 ~10 -9 It is permissible.

[0005] International Publication No. 2021 / 198994 discloses an electromechanical module for operating the brake shoes of a friction brake via a linkage mechanism. This mechanical brake path includes a preloaded spring set and a brake force sensor. A first service brake control unit handles the service brake process and the emergency brake process and appropriately drives and controls the electric motor of the electromechanical module. A safety unit checks via the sensor whether an emergency brake force is applied in the emergency brake case. If this is not the case, for example in the event of a failure of the electric motor or the service brake control unit, the preloaded spring set is released, thereby applying an emergency brake force. Furthermore, an electromechanical module for operating the brake shoes of a friction brake via a linkage mechanism is disclosed. This mechanical brake path also includes a brake force sensor. A first service brake control unit handles the service brake process and the emergency brake process and appropriately drives and controls the electric motor of the electromechanical module. A safety unit checks via the sensor whether an emergency brake force is applied in the emergency brake case. If this is not the case, for example, in the event of a failure of the service brake control unit, a switch is operated and the electric motor is driven and controlled via an electronic emergency brake unit equipped with its own battery buffer and motor control unit, thereby applying emergency braking force. Here, there is a strict separation between the service brake function group and the safety brake function group, where a higher-level safety unit controls whether the conventional service brake function group or the safety brake function group is used for brake control. This separation between the service brake function group and the safety brake function group, as well as between the service brake function components and the safety brake function components, is inflexible and makes the system vulnerable to failure, for example, if the safety unit fails. Also, the functionality of the service brake control unit must either be fully reflected or unavailable in the safety brake process.

[0006] Therefore, the object of the present invention is to provide a braking system and braking method that solve the problems of the prior art. In particular, the object of the present invention is to provide a braking system that provides the required safety requirements and high availability, but with relatively low requirements for system integrity in railway vehicles.

[0007] The aforementioned problems are solved by the subject matter of the independent claim. A favorable development is the subject matter of the dependent claim.

[0008] A braking system for a railway vehicle is disclosed, comprising: a brake control unit configured to provide a braking function and output a force adjustment amount or a manipulated amount; a brake force unit configured to provide a function to generate a friction brake force based on the force adjustment amount or a manipulated amount; a first brake path having a braking function that is active between the control input of the braking system and the generation of the brake force; and a second brake path having a braking function that is active between the control input of the braking system, or active when a predetermined braking system state quantity is present and when the brake force is generated. In this application, the term brake path refers to the set of all functions that are active between the control input of the braking system and the generation of the friction brake force and that form the braking function of the entire system. This makes it possible for both the brake control unit and the brake force unit to provide the functions of a first brake path, for example, a service brake path with low safety integrity, and a second brake path, for example, a safety brake path with higher safety integrity. This provides the premise that, in an error case, a switch from the service brake path to the safety brake path will be made as necessary in either the brake control unit, the brake force unit, or both the brake control unit and the brake force unit. Furthermore, it provides the premise that the safety brake path functions to access the functions of the service brake path, such as the anti-skid function. In addition, it provides the premise that if the safety brake path functions fail, the service brake path functions can be used as a redundant / redundant adjustment unit.

[0009] Advantageously, the first braking path is configured to provide a braking function with low safety integrity, and the second braking path is configured to provide a braking function with high safety integrity, where low safety integrity is lower than high safety integrity. A braking function with high safety integrity can have a higher safety degree than a braking function with low safety integrity.

[0010] Advantageously, the braking system further has a first group of segmented functional parts that are part of both a first and a second braking path. These functions are preferably configured to generate frictional force so that the railway vehicle is decelerated. By using together such highly reliable functional parts that produce the original mechanical braking function, it becomes possible to provide a compact braking system.

[0011] Advantageously, the brake control unit is configured to provide braking functionality for either a first or second braking path, and the brake force unit is configured to provide braking functionality for either a first or second braking path.

[0012] Advantageously, the brake control unit is configured to provide braking functionality for a first brake path and a second brake path, and the brake force unit is configured to provide braking functionality for a first brake path and a second brake path.

[0013] Advantageously, the brake control unit is configured to receive a control input accompanied by a braking command, determine an manipulated variable or force adjustment amount from this input, and output it.

[0014] Advantageously, the brake control unit is configured to receive a vehicle state input or a braking system state input, and to determine and output an manipulated variable or force adjustment variable from it.

[0015] Advantageously, the brake control unit is configured to receive a switching signal and, upon receiving the switching signal, to switch from the first brake path to the second brake path, or from the second brake path to the first brake path.

[0016] Advantageously, the brake control device is configured to determine the switching state and, if the switching state is determined, to output a switching signal.

[0017] Advantageously, the braking force unit is configured to obtain a force adjustment amount or manipulative amount and control a group of functional parts so that the railway vehicle is decelerated.

[0018] Advantageously, the brake control unit or brake force unit is configured to receive a switching signal and, upon receiving the switching signal, to switch from the first brake path to the second brake path, or from the second brake path to the first brake path.

[0019] Advantageously, the brake control unit or brake force unit is configured to determine the switching state and output a switching signal.

[0020] Advantageously, the braking system, in particular the braking force unit, has an energy supply unit, in particular an additional internal energy supply unit, either selectively or optionally.

[0021] Advantageously, the energy supply unit is configured to determine the switching state and output a switching signal.

[0022] A railway vehicle equipped with a braking system according to the present invention is disclosed.

[0023] Furthermore, a braking method for a railway vehicle is disclosed, which includes the steps of: a) providing a braking function by a brake control unit; b) outputting a force adjustment amount or an operating amount by the brake control unit; c) providing a function by a brake force unit to generate a braking force, preferably a friction braking force, based on the operating amount from step b); d) providing a first braking path having the function of being active between a control input to a braking system and the generation of a braking force; and e) providing a second braking path having the function of being active between a control input to a braking system and the generation of a braking force.

[0024] Advantageously, the first braking path from step d) is configured to provide a braking function with low safety integrity, and the second braking path from step e) is configured to provide a braking function with high safety integrity.

[0025] Advantageously, step a) includes aa) a step of providing a braking function for a first braking path or ab) a step of providing a braking function for a second braking path, and step c) includes ca) a step of providing a braking function for a first braking path or cb) a step of providing a braking function for a second braking path.

[0026] Advantageously, step a) includes aa) a step of providing a braking function for a first braking path and ab) a step of providing a braking function for a second braking path, and step b) includes ba) a step of providing a braking function for a first braking path and bb) a step of providing a braking function for a second braking path.

[0027] Advantageously, this method further comprises the steps of: f) obtaining a control input with a braking command by a brake control unit; g) determining an operation amount or a force adjustment amount from the control input by the brake control unit; h) outputting the operation amount or the force adjustment amount by the brake control unit.

[0028] Advantageously, this method further comprises the steps of: i) obtaining a vehicle state quantity input or a braking system state quantity input by the brake control unit; j) determining an operation amount or a force adjustment amount from the vehicle state quantity input or the braking system state quantity input by the brake control unit; k) outputting the operation amount or the force adjustment amount by the brake control unit.

[0029] Advantageously, this method further comprises the steps of: l) receiving a switching signal by the brake control unit or the brake force unit; m) switching from a first braking path to a second braking path, or from the second braking path to the first braking path in the brake control unit, the brake force unit or the energy supply unit.

[0030] Advantageously, this method further comprises the steps of: n) determining a switching state by the brake control unit, the brake force unit or the energy supply unit; o) outputting a switching signal by the brake control unit, the brake force unit or the energy supply unit when the switching state is determined.

[0031] Advantageously, this method further comprises the steps of: p) obtaining a force adjustment amount or an operation amount by the brake force unit; q) controlling a common functional sub-group by the brake force unit, thereby decelerating the railway vehicle.

[0032] A braking system for a railway vehicle is disclosed, comprising: a brake control unit configured to provide a braking function and output a force adjustment amount; an actuator control unit configured to provide a function to generate a friction brake force based on the force adjustment amount and output an operator amount; a brake force unit configured to provide a function to generate a friction brake force based on an operator amount; a first brake path having a function to be active between the control input of the braking system and the generation of the brake force; and a second brake path having a function to be active between the control input of the braking system, or active when a predetermined braking system state quantity is present and when a brake force is generated. Furthermore, the function of the second brake path does not need to be activated by the control input of the braking system, and can be activated without the control input of the braking system even when a predetermined braking system state quantity is present, for example, when an interruption of energy supply is imminent.

[0033] Advantageously, the first braking path is configured to provide a braking function with low safety integrity, and the second braking path is configured to provide a braking function with high safety integrity, where low safety integrity is lower than high safety integrity. A braking function with high safety integrity can have a higher safety degree than a braking function with low safety integrity.

[0034] Advantageously, the braking system further has a first group of segmented functional parts which are part of a first braking path and part of a second braking path and are configured to generate a frictional force so that the railway vehicle is decelerated. Preferably, this is configured to generate a frictional force so that the railway vehicle is decelerated.

[0035] Advantageously, the brake control unit is configured to provide braking functions for a first brake path and a second brake path, the actuator control unit is configured to provide braking functions for a first brake path and a second brake path, or the brake force unit is configured to provide braking functions for a first brake path and a second brake path. In this application, the brake control unit provides braking functions, the actuator control unit provides actuator functions, and the brake force unit provides force adjustment functions.

[0036] Advantageously, the brake control unit is configured to provide braking functionality for a first or second brake path, the actuator control unit is configured to provide braking functionality for a first or second brake path, and the brake force unit is configured to provide braking functionality for a first or second brake path.

[0037] Advantageously, the braking system further includes an energy supply unit configured to supply energy to the braking system, in particular, electrical energy for braking operation.

[0038] Advantageously, the brake control unit, actuator control unit, energy supply unit, or brake force unit is configured to receive a switching signal and, upon receiving the switching signal, to switch from a first brake path to a second brake path, or from a second brake path to a first brake path. In this application, the switching between the function assigned to the first brake path and the function assigned to the second brake path, and vice versa, is performed by brake functions localized to the corresponding units.

[0039] Advantageously, the braking system is configured to perform safety functions.

[0040] Advantageously, the safety function is a safety function from a group of safety functions that includes elements such as brake path monitoring, actuator monitoring, supply monitoring, decision unit, and data storage function.

[0041] Advantageously, a distributed assignment of safety functions is obtained to brake control units, actuator control units, energy supply units, or brake force units, and the distributed safety functions are performed by the assigned units.

[0042] Advantageously, the brake control unit, actuator control unit, and optionally included energy supply unit or brake force unit have a changeover switch and are configured to determine the changeover state and, if the changeover state is determined, output a changeover signal.

[0043] Advantageously, the braking force unit is configured to obtain a force adjustment amount or manipulative amount and control a group of functional parts so that the railway vehicle is decelerated.

[0044] Advantageously, the braking system, in particular the brake control unit, actuator control unit, or brake force unit, has an energy supply unit, and preferably, optionally or optionally, an additional internal energy supply unit.

[0045] Furthermore, a railway vehicle equipped with the aforementioned braking system is disclosed.

[0046] Furthermore, a braking method for railway vehicles is disclosed, which includes the steps of: a) providing a braking function by a brake control unit; b) outputting a force adjustment amount by the brake control unit; c) providing a braking function by an actuator control unit that generates a friction braking force based on the force adjustment amount from step b); d) providing a braking function by a brake force unit that generates a friction braking force based on an operation amount from step c); e) providing a first braking path that has the function of being active between the control input of the braking system and the generation of the braking force; and f) providing a second braking path that has the function of being active between the control input of the braking system or when a predetermined braking system state quantity is present and when the braking force is generated.

[0047] Advantageously, the first brake path from step e) is configured to provide a braking function with low safety integrity, and the second brake path from step f) is configured to provide a braking function with high safety integrity.

[0048] Advantageously, step a) has the steps of aa) providing a braking function for a first braking path or ab) providing a braking function for a second braking path; step c) has the steps of ca) providing a braking function for a first braking path or cb) providing a braking function for a second braking path; and step d) has the steps of da) providing a braking function for a first braking path or db) providing a braking function for a second braking path.

[0049] Advantageously, step a) has the steps of aa) providing a braking function for a first braking path or ab) providing a braking function for a second braking path; step c) has the steps of ca) providing a braking function for a first braking path or cb) providing a braking function for a second braking path; and step d) has the steps of da) providing a braking function for a first braking path or db) providing a braking function for a second braking path.

[0050] Advantageously, step a) includes aa) a step of providing a braking function for a first braking path and ab) a step of providing a braking function for a second braking path; step c) includes ca) a step of providing a braking function for a first braking path and cb) a step of providing a braking function for a second braking path; and step d) includes da) a step of providing a braking function for a first braking path and db) a step of providing a braking function for a second braking path.

[0051] Advantageously, the following steps are also performed: g) a safety function is performed by a brake control unit, an actuator control unit, or a brake force unit.

[0052] Advantageously, a safety function is one of a group of safety functions that include elements such as a brake path monitor, actuator monitor, supply monitor, decision unit, and data storage function.

[0053] Advantageously, this method further includes the steps of: h) receiving a switching signal by a brake control unit, actuator control unit, energy supply unit, or brake force unit; and i) switching from a first brake path to a second brake path, or from a second brake path to a first brake path, in the brake control unit, actuator control unit, energy supply unit, or brake force unit.

[0054] Advantageously, this method further includes n) a step of determining a switching state by a brake control unit, actuator control unit, or brake force unit, particularly by safety functions distributed thereto; and o) a step of outputting a switching signal by the brake control unit, actuator control unit, or brake force unit when a switching state has been determined.

[0055] A braking system for a railway vehicle is disclosed, the braking system comprising a brake control unit, an actuator, a first brake path from a function that is active between at least one control input of the braking system and the generation of a braking force, and a second brake path from a function that is active between at least one control input of the braking system and the generation of a braking force, wherein the brake control unit comprises a first brake control unit configured to provide a braking function and output a force adjustment amount, and a first actuator control unit configured to provide a function to generate a friction braking force based on the force adjustment amount and to output an manipulated amount, wherein the actuator comprises a second brake control unit configured to provide a braking function and output a force adjustment amount, a second actuator control unit configured to provide a function to indirectly generate a friction braking force based on the force adjustment amount and to output an manipulated amount, and a brake force unit configured to provide a function to generate a friction braking force based on an manipulated amount.

[0056] Advantageously, the first braking path is configured to provide a braking function with low safety integrity, while the second braking path is configured to provide a braking function with high safety integrity. The braking function with high safety integrity can have a higher safety level than the braking function with low safety integrity.

[0057] Advantageously, the braking system further has a first group of segmented functional parts, which are part of a first braking path and part of a second braking path, and are configured to generate frictional force so that the railway vehicle is decelerated.

[0058] Advantageously, the brake control unit is configured to provide braking functionality for either a first or second brake path, and the actuator is configured to provide braking functionality for either a first or second brake path.

[0059] Advantageously, the first brake control unit and the second brake control unit are configured to provide braking functionality for a first brake path or a second brake path, the first actuator control unit and the second actuator control unit are configured to provide braking functionality for a first brake path or a second brake path, and the brake force unit is configured to provide braking functionality for a first brake path or a second brake path.

[0060] Advantageously, the first brake control unit and the first actuator control unit are configured to provide braking functionality for the first brake path, the second brake control unit and the second actuator control unit are configured to provide braking functionality for the second brake path, and the brake force unit is configured to provide braking functionality for the first brake path and the second brake path.

[0061] Advantageously, the first brake control unit is configured to provide braking functionality for either a first or second brake path, the first actuator control unit is configured to provide braking functionality for the first brake path, the second brake control unit and the second actuator control unit are configured to provide braking functionality for the second brake path, and the brake force unit is configured to provide braking functionality for both the first and second brake paths.

[0062] Advantageously, the braking system further includes an energy supply unit, which is configured to supply electrical energy to the components of the braking system for the operation of the braking system.

[0063] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, the energy supply unit, or the brake force unit are configured to receive a switching signal and to switch from the first brake path to the second brake path, or from the second brake path to the first brake path, upon receiving the switching signal.

[0064] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, or the brake force unit each have a switching unit that determines the switching state and, if a switching state is determined, outputs a switching signal.

[0065] Advantageously, the braking system is configured to perform safety functions.

[0066] Advantageously, the safety function is a safety function from a group of safety functions that includes elements such as brake path monitoring, actuator monitoring, supply monitoring, decision unit, and data storage function.

[0067] Advantageously, the energy supply unit is configured to perform the safety functions of the supply monitor, and the second brake control unit is configured to perform the safety functions of the brake path monitor, actuator monitor, data storage function, and decision unit.

[0068] Advantageously, the energy supply unit is configured to perform safety functions for the supply monitor, the first brake control unit is configured to perform safety functions for the brake path monitor and actuator monitor, and the second brake control unit is configured to perform safety functions for the determination unit and data storage function.

[0069] Advantageously, the braking force unit is configured to obtain a force adjustment amount or manipulative amount and control a group of functional parts so that the railway vehicle is decelerated.

[0070] Advantageously, braking systems, particularly brake control units or actuators, have energy supply units, especially and optionally or additionally, internal energy supply units.

[0071] A railway vehicle equipped with the aforementioned braking system is disclosed.

[0072] A braking method for a railway vehicle is disclosed, the braking method comprising: a) a step of providing a braking function by a first brake control unit in a brake control unit; b) a step of outputting a force adjustment amount by the first brake control unit; c) a step of providing a braking function in the brake control unit that generates a friction braking force by a first actuator control unit based on the force adjustment amount from step b); d) a step of outputting an operation amount by a first actuator control unit; e) a step of providing a braking function by a second brake control unit in an actuator; f) a step of outputting a force adjustment amount by a second brake control unit; g) a step of providing a braking function in an actuator that generates a friction braking force by a second actuator control unit based on the force adjustment amount from step f); h) a step of outputting an operation amount by a second actuator control unit; i) a step of providing a braking function that generates a friction braking force by a brake force unit based on an operation amount from step d) or step h); j) a step of providing a first brake path having a function that is active between the control input of the braking system and the generation of the braking force; and k) a step of providing a second brake path having a function that is active between the control input of the braking system and the generation of the braking force.

[0073] Advantageously, the first brake path from step j) is configured to provide a brake function with low safety integrity, and the second brake path from step k) is configured to provide a brake function with high safety integrity.

[0074] Advantageously, step a), step c), step e), step g), or step i) has a step of aa) providing a braking function for a first braking path and ab) providing a braking function for a second braking path.

[0075] Advantageously, steps a), c), e), g), and i) include steps ac) providing a braking function for a first braking path or ad) providing a braking function for a second braking path.

[0076] Advantageously, the following steps are performed: l) safety functions are performed by a first brake control unit, a second brake control unit, a first actuator control unit, a second actuator control unit, or a brake force unit.

[0077] Advantageously, a safety function is one of a group of safety functions that include elements such as a brake path monitor, actuator monitor, supply monitor, decision unit, and data storage function.

[0078] Advantageously, this method further includes m) the step of obtaining a switching signal by a first brake control unit, a second brake control unit, a first actuator control unit, a second actuator control unit, or a brake force unit; and n) the step of switching from a first brake path to a second brake path, or from a second brake path to a first brake path, in the first brake control unit, a second brake control unit, a first actuator control unit, a second actuator control unit, or a brake force unit.

[0079] Advantageously, this method further includes: o) determining a switching state by a first brake control unit, a second brake control unit, a first actuator control unit, a second actuator control unit, or a brake force unit; and p) outputting a switching signal by a first brake control unit, a second brake control unit, a first actuator control unit, a second actuator control unit, or a brake force unit when a switching state has been determined.

[0080] A braking system for a railway vehicle is disclosed, the braking system comprising a brake control unit, an actuator, a first brake path from a function that is active between a control input to the braking system and the generation of a braking force, and a second brake path from a function that is active between a control input to the braking system and the generation of a braking force, wherein the brake control unit comprises a first brake control unit configured to provide a braking function and output a force adjustment amount, the actuator comprises a second brake control unit configured to provide a braking function and output a force adjustment amount, a first actuator control unit configured to provide a function to generate a friction brake force based on a force adjustment amount and output an operator amount, a second actuator control unit configured to provide a function to generate a friction brake force based on a force adjustment amount and output an operator amount, and a brake force unit configured to provide a function to generate a friction brake force based on an operator amount.

[0081] Advantageously, the first braking path is configured to provide a braking function with low safety integrity, and the second braking path is configured to provide a braking function with high safety integrity, where low safety integrity is lower than high safety integrity. A braking function with high safety integrity can have a higher safety degree than a braking function with low safety integrity.

[0082] Advantageously, the braking system, in particular the braking force unit, further has a first group of segmented functional parts, which are part of a first braking path and part of a second braking path, and are configured to generate frictional force so that the railway vehicle is decelerated.

[0083] Advantageously, the brake control unit is configured to provide braking functions for a first brake path and a second brake path, or the actuator is configured to provide braking functions for a first brake path and a second brake path.

[0084] Advantageously, the brake control unit is configured to provide braking functions for a first brake path and a second brake path, or the brake control unit is configured to provide braking functions for a first brake path, and the actuator is configured to provide braking functions for either the first brake path or the second brake path.

[0085] Advantageously, the first brake control unit and the first actuator control unit are configured to provide braking functionality for a first brake path, the second brake control unit and the second actuator control unit are configured to provide braking functionality for a second brake path, and the brake force unit is configured to provide braking functionality for either the first or second brake path.

[0086] Advantageously, the first brake control unit is configured to provide braking functionality for either a first or second brake path, the first actuator control unit is configured to provide braking functionality for the first brake path, the second brake control unit and the second actuator control unit are configured to provide braking functionality for the second brake path, and the brake force unit is configured to provide braking functionality for both the first and second brake paths.

[0087] Advantageously, the first brake control unit is configured to provide braking functionality for a first brake path and a second brake path, or the first actuator control unit is configured to provide braking functionality for a first brake path and a second brake path, the second brake control unit and the second actuator control unit are configured to provide braking functionality for a second brake path, and the brake force unit is configured to provide braking functionality for a first brake path and a second brake path.

[0088] Advantageously, the first brake control unit is configured to provide braking functionality for the first brake path, the second brake control unit is configured to provide braking functionality for either the first or second brake path, the second actuator control unit is configured to provide braking functionality for the second brake path, and the brake force unit is configured to provide braking functionality for either the first or second brake path.

[0089] Advantageously, the braking system further includes an energy supply unit, which is configured to supply electrical energy to the components of the braking system for the operation of the braking system.

[0090] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, or the brake force unit are configured to receive a switching signal and to switch from the first brake path to the second brake path, or from the second brake path to the first brake path, upon receiving the switching signal.

[0091] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, or the brake force unit each have a switching unit that determines the switching state and, if a switching state is determined, outputs a switching signal.

[0092] Advantageously, the braking system is configured to perform safety functions.

[0093] Advantageously, the safety function is a safety function from a group of safety functions that includes elements such as brake path monitoring, actuator monitoring, supply monitoring, decision unit, and data storage function.

[0094] Advantageously, the energy supply unit is configured to perform safety functions of the supply monitor, and the second brake control unit is configured to perform safety functions of the brake path monitor, actuator monitor, determination unit, and data storage function.

[0095] Advantageously, the energy supply unit is configured to perform safety functions of the supply monitor, and the second brake control unit is configured to perform safety functions of the brake path monitor, actuator monitor, determination unit, and data storage function.

[0096] Advantageously, the braking force unit is configured to obtain a force adjustment amount or an operating amount.

[0097] Advantageously, the braking system, in particular the brake control unit or actuator, has an energy supply unit, preferably an optional additional internal energy supply unit.

[0098] Furthermore, a railway vehicle equipped with the aforementioned braking system is disclosed.

[0099] Furthermore, a braking method for railway vehicles is disclosed, which includes the steps of: a) providing a braking function by a first brake control unit in a brake control unit; b) outputting a force adjustment amount by the first brake control unit; c) providing a braking function in an actuator that generates a friction braking force by a first actuator control unit based on the force adjustment amount from step b); d) outputting an operation amount by a first actuator control unit; e) outputting a braking function by a second brake control unit in an actuator; f) outputting a force adjustment amount by a second brake control unit; g) providing a braking function in an actuator that generates a friction braking force by a second actuator control unit based on the force adjustment amount from step f); h) outputting an operation amount by a second actuator control unit; i) providing a braking function that generates a friction braking force by a brake force unit based on an operation amount from step d) or step h); j) providing a first braking path having a function that is active between the control input of the braking system and the generation of the braking force; and k) providing a second braking path having a function that is active between the control input of the braking system and the generation of the braking force.

[0100] Advantageously, the first brake path from step j) is configured to provide a brake function with low safety integrity, and the second brake path from step k) is configured to provide a brake function with high safety integrity.

[0101] Advantageously, step a), step c), step e), step g), or step i) has a step of aa) providing a braking function for a first braking path and ab) providing a braking function for a second braking path.

[0102] Advantageously, steps a), c), e), g), and i) include steps ac) providing a braking function for a first braking path or ad) providing a braking function for a second braking path.

[0103] Advantageously, the following steps are performed: l) safety functions are performed by a first brake control unit, a second brake control unit, a first actuator control unit, a second actuator control unit, or a brake force unit.

[0104] Advantageously, a safety function is one of a group of safety functions that include elements such as a brake path monitor, actuator monitor, supply monitor, decision unit, and data storage function.

[0105] Advantageously, this method further includes m) the step of obtaining a switching signal by a first brake control unit, a second brake control unit, a first actuator control unit, a second actuator control unit, or a brake force unit; and n) the step of switching from a first brake path to a second brake path, or from a second brake path to a first brake path, in the first brake control unit, a second brake control unit, a first actuator control unit, a second actuator control unit, or a brake force unit.

[0106] Advantageously, this method further includes: o) determining a switching state by a first brake control unit, a second brake control unit, a first actuator control unit, a second actuator control unit, an energy supply unit, or a brake force unit; and p) if a switching state has been determined, outputting a switching signal by a first brake control unit, a second brake control unit, a first actuator control unit, a second actuator control unit, an energy supply unit, or a brake force unit.

[0107] A braking system for a railway vehicle is disclosed, the braking system comprising a brake control unit, an extension carrier, an actuator, a first brake path from a function that is active between a control input to the braking system and the generation of a braking force, and a second brake path from a function that is active between a control input to the braking system and the generation of a braking force, wherein the brake control unit comprises a first brake control unit configured to provide a braking function and output a force adjustment amount, and a first actuator control unit configured to provide a function to generate a friction braking force based on the force adjustment amount and to output an operator amount, and the actuator comprises a second brake control unit configured to provide a braking function and output a force adjustment amount, a second actuator control unit configured to provide a function to generate a friction braking force based on the force adjustment amount and to output an operator amount, and a brake force unit configured to provide a function to generate a friction braking force based on an operator amount.

[0108] Advantageously, the first braking path is configured to provide a braking function with low safety integrity, while the second braking path is configured to provide a braking function with high safety integrity. The braking function with high safety integrity can have a higher safety level than the braking function with low safety integrity.

[0109] Advantageously, the braking system, in particular the braking force unit, further has a first group of segmented functional parts, which are part of a first braking path and part of a second braking path, and are configured to generate frictional force so that the railway vehicle is decelerated.

[0110] Advantageously, the extension carrier is configured to provide a braking function for the second braking path.

[0111] Advantageously, the extension carrier is configured to receive a sensor quantity or output an extension quantity.

[0112] Advantageously, the first brake control unit is configured to receive an expansion amount and output a force adjustment amount, the first actuator control unit is configured to receive a force adjustment amount and output an manipulated amount, the second brake control unit is configured to receive a force adjustment amount or expansion amount and output a force adjustment amount or a switching command, the second actuator control unit is configured to receive a force adjustment amount or a switching command and output an manipulated amount or a switching command, or the brake force unit is configured to receive a switching command or a manipulated amount.

[0113] Advantageously, the first brake control unit and the first actuator control unit are configured to provide braking functionality for the first brake path, the second brake control unit and the second actuator control unit are configured to provide braking functionality for the second brake path, and the brake force unit is configured to provide braking functionality for either the first or second brake path.

[0114] Advantageously, the braking system further includes an energy supply unit, which is configured to supply electrical energy to the components of the braking system for the operation of the braking system.

[0115] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, or the brake force unit are configured to receive a switching signal and to switch from the first brake path to the second brake path, or from the second brake path to the first brake path, upon receiving the switching signal.

[0116] Advantageously, the first brake control unit, the second brake control unit, the first actuator control unit, the second actuator control unit, or the brake force unit each have a switching unit that determines the switching state and, if a switching state is determined, outputs a switching signal.

[0117] Advantageously, the braking system is configured to perform safety functions.

[0118] Advantageously, the safety function is a safety function from a group of safety functions that includes elements such as brake path monitoring, actuator monitoring, supply monitoring, decision unit, and data storage function.

[0119] Advantageously, the energy supply unit is configured to perform the safety functions of the supply monitor, and the second brake control unit is configured to perform the safety functions of the brake path monitor, actuator monitor, data storage function, and decision unit.

[0120] Advantageously, the braking force unit is configured to obtain a force adjustment amount or manipulative amount and control a group of functional parts so that the railway vehicle is decelerated.

[0121] Advantageously, the braking system, particularly the brake control unit or actuator, has an energy supply unit.

[0122] Furthermore, a railway vehicle equipped with the braking system described in one of the preceding claims is disclosed.

[0123] Furthermore, a braking method for railway vehicles is disclosed, which comprises: a) a step of providing a braking function by a first brake control unit in a brake control unit; b) a step of outputting a force adjustment amount by the first brake control unit; c) a step of providing a braking function by generating a friction braking force by a first actuator control unit in the brake control unit based on the force adjustment amount from step b); d) a step of outputting an operation amount by the first actuator control unit; e) a step of providing a braking function by an extension unit in an extension carrier; f) a step of providing a braking function by a second brake control unit in an actuator; g) a step of outputting a force adjustment amount by the second brake control unit. The steps include: h) providing a brake function that generates a friction brake force in the actuator by a second actuator control unit based on the force adjustment amount from step e); i) providing an operation variable by a first actuator control unit; j) providing a brake function that generates a friction brake force by a brake force unit based on the operation variable from step d) or step h); k) providing a first brake path that has the function of being active between the control input of the braking system and the generation of the brake force; and l) providing a second brake path that has the function of being active between the control input of the braking system and the generation of the brake force.

[0124] Advantageously, the first brake path from step k) is configured to provide a brake function with low safety integrity, and the second brake path from step l) is configured to provide a brake function with high safety integrity.

[0125] Advantageously, step a), step c), step e), step f), step h), or step j) has a step of providing a braking function for a first braking path and a step of providing a braking function for a second braking path.

[0126] Advantageously, steps a), c), e), f), h), and j) include step ac) providing a braking function for a first braking path or step ad) providing a braking function for a second braking path.

[0127] Advantageously, the braking function from step e) is the braking function of the second braking path.

[0128] Advantageously, the following steps are also provided: m) receiving a sensor quantity by an extension carrier, and n) processing the sensor quantity from step m) by the extension carrier.

[0129] Advantageously, the step of o) outputting the extended amount by the extension carrier is also shown.

[0130] Advantageously, the following steps are also provided: p) receiving an expansion amount by a first brake control unit; q) outputting a force adjustment amount by a first brake control unit; r) receiving a force adjustment amount by a first actuator control unit; s) outputting an manipulated variable by a first actuator control unit; t) receiving a force adjustment amount or expansion amount by a second brake control unit; u) outputting a force adjustment amount or switching command by a second brake control unit; v) receiving a force adjustment amount or switching command by a second actuator control unit; w) outputting an manipulated variable or switching command by a second actuator control unit; or x) receiving a switching command or manipulated variable by a brake force unit.

[0131] The concept of the present invention disclosed herein aims to enable the development of alternative friction braking systems based on electromechanical operating principles, using safety features. The reasons and technical advantages of such systems may include, without requiring exhaustion, one or more of the following points: • Reduce system weight by avoiding additional peripheral systems for energy conversion, such as pneumatic compressors and supply infrastructure, which generally consist of pipeline arrangements. To simplify modular systems, braking system functions are designed using electronic and software techniques, enabling functionality tailored to customer requirements, market demands, or vehicle types. For example, to improve braking quality in terms of braking distance or braking comfort, the system enables situation-dependent, dynamic behavior over the operating time, based on electronic equipment and software. For example, to improve the quality of the brakes in anti-slip functions, the dynamics of the brake force change, i.e., the change in the state of the brakes, are increased. Based on additional sensor devices and their associated evaluation electronic devices and evaluation software, the maintenance, error detection, and monitoring capabilities of subcomponents are improved, for example, based on the detection of brake pad condition.

[0132] The challenge of establishing a braking system based on electromechanical operating principles represents a paradigm shift and a departure from the principles of pneumatic friction brakes, which can be realized using purely mechanical principles without employing the domains of software, electronics, and electrical equipment in their basic functions. To this end, this invention provides apparatus and methods that verify the effectiveness and reliability of a new form of technology and enable changes in the standards context to which such systems belong, thereby allowing for their market introduction. To this end, this document first discloses a system architecture including basic safety functions and principles, thereby enabling such a braking system to achieve failure and operational behavior at least equivalent to existing pneumatic brakes. The necessary principles and proposed systematic functional structure are described below.

[0133] Hereafter, embodiments of the present invention will be described with reference to the figures. [Brief explanation of the drawing]

[0134] [Figure 1] This figure shows a railway vehicle coupling equipped with the braking system according to the present invention. [Figure 2] This figure shows the braking system according to the present invention. [Figure 3] This is a block circuit diagram of a first embodiment of the braking system according to the present invention. [Figure 4] This is a block circuit diagram of a second embodiment of the braking system according to the present invention. [Figure 5] This is a block circuit diagram of a third embodiment of the braking system according to the present invention. [Figure 6] This is a block circuit diagram of a fourth embodiment of the braking system according to the present invention. [Figure 7] This is a block circuit diagram of the first modified form of the fourth embodiment. [Figure 8] This is a block circuit diagram of the second modified form of the fourth embodiment. [Figure 9] This is a block circuit diagram of a fifth embodiment of the braking system according to the present invention. [Figure 10] This is a block circuit diagram of a sixth embodiment of the braking system according to the present invention. [Figure 11] This is a block circuit diagram of a seventh embodiment of the braking system according to the present invention. [Figure 12] This is a block circuit diagram of an eighth embodiment of the braking system according to the present invention. [Figure 13] This is a block circuit diagram of a ninth embodiment of the braking system according to the present invention. [Figure 14] This is a block diagram relating to the switching process in Examples 2 to 9.

[0135] A first embodiment of the present invention will be described with reference to Figure 1.

[0136] Figure 1 discloses a railway vehicle coupling 1 having railway vehicles 110, 150, and 160. The railway vehicle coupling has a driven vehicle 110, which is provided with a drive means 112, which in this embodiment is implemented by an electric motor. The driving force provided by the drive means 112 is transmitted to the drive wheels 116 via a driven axle 114. The drive wheels 116 travel on rails 118.

[0137] Furthermore, the driven vehicle 110 has a pantograph 120, and electrical energy is supplied to the train coupling 1 via the overhead wire 122 and rail 118 through the pantograph 120. Electrical energy is temporarily stored via a battery 123.

[0138] The driven vehicle 110 has a driver's cab 124. In this driver's cab 124, the train coupling can be controlled by a train driver (not shown).

[0139] The braking system 200, which can decelerate the train coupling 1, will be described later with reference to Figure 2.

[0140] The driven vehicle 110 is coupled to one or more towing vehicles 150 via a coupling portion 140. If there are multiple towing vehicles 150, these towing vehicles 150 are similarly coupled to each other by coupling portions 140. The towing vehicles 150 have undriven axles 154 with undriven wheels 156.

[0141] The towing vehicle 150 has a braking system 152 that can decelerate the train coupling 1. In this embodiment, the braking system 152 of the towing vehicle is configured identically to the braking system 200 of the driven vehicle. For details, please refer to the description of the braking system 200 of the driven vehicle.

[0142] The last towing vehicle 160 of train coupling 1 is configured as the final vehicle. It is configured similarly to towing vehicle 150, but has a dedicated driver's cab 162 for reverse travel.

[0143] Tension and compression forces are transmitted between the vehicles 110, 150, and 160 of the train coupling via the coupling section 140. Furthermore, electrical energy is supplied to all vehicles of the train coupling via the coupling section 140, the power supply line 126, and the driven vehicle 110 and the pantograph 120. In addition, all vehicles of the train coupling 1 are connected via the coupling section 140 and the control line 128, so that data communication can be performed between the vehicles 110, 150, and 160 of the train coupling 1. In this embodiment, the control line is configured as a CAN bus that allows components within vehicles 110, 150, and 160 to exchange sensor data and control data with each other.

[0144] The braking system 200 is described based on Figure 2. The braking system 200 is an electromechanical braking system. An electromechanical braking system is a braking system that uses electronic components, electrical components and mechanical components to provide the ability to generate deceleration / braking force for a vehicle. The braking system 200 has an energy supply interface 202 which is connected to an electrical supply line 126 and supplies operating energy to the braking system. Furthermore, the braking system 200 has a control line interface 204 which is connected to a control line 128. The braking system 200 has a movable, particularly rotary, friction element in the form of a brake disc 206, the brake disc 206 is coupled to one of the axles 114, 154 in a relative rotation-immobile manner, thereby enabling torque to be transmitted between the axle 114, 154 and the brake disc 206. The brake caliper 208 is mounted in the vehicle so as not to move relative to the vehicle and has a static friction element in the form of a brake shoe 210, which is supported within the brake caliper 208 so as to be reciprocating relative to the brake disc 206. The brake shoe 210 can be moved with a motion component perpendicular to the rotation axis of the brake disc 206 via friction element driving means in the form of a brake actuator motor 212 and a spindle drive unit 214, thereby generating friction between the brake shoe 210 and the brake disc 206, and transmitting torque between the brake caliper 208 and the brake disc, thereby decelerating the vehicle.

[0145] The group of elements consisting of the brake disc 206, brake caliper 208, brake shoe 210, brake actuator motor 212, and spindle drive unit 214 is understood in the present invention as an extremely reliable functional part 216. This is because they are based on a well-established, unwavering functional mechanism and possess inherent safety characteristics.

[0146] Based on Figure 3, the security architecture of the first embodiment of the braking system 200 will be described.

[0147] The braking system 200 according to the first embodiment aims to generate a frictional braking force to decelerate the vehicle mass of the railway vehicle coupling 1, as such a braking system can provide a service brake function as well as safety-related braking functions such as an emergency brake function, a quick brake function, or a parking brake function.

[0148] For this purpose, the braking system has a security architecture with two different integrity classifications for operating the electromechanical braking system in rail-related vehicles. Here, an error-reactive (so-called reactive fail-safe) architecture is pursued to achieve functional safety of the braking system, and this architecture is divided into a safety braking path with high integrity and a service braking path with low integrity.

[0149] The electromechanical braking system 200 receives control inputs 218 via the control line interface 204, such as a service brake function initiated by a train driver or an emergency brake function initiated by an emergency brake mechanism.

[0150] Furthermore, the electromechanical braking system 200 obtains vehicle state inputs 220, such as wheel rotation speed detected using sensors, vehicle weight detected via sensors or using manual input, etc., via the control line interface 204.

[0151] Furthermore, the electromechanical braking system 200 obtains braking system state inputs 222, such as the friction element temperature detected using a sensor, the position of the friction element driving means 212, or the brake force unit, via the control line interface 204.

[0152] The electromechanical braking system 200 is supplied with electrical energy via an energy supply interface. The energy supply is used, on the one hand, to provide current to electronic components so that functions provided by the components, particularly control functions, can be provided. On the other hand, or alternatively, the energy supply is used to apply brake energy, which in this embodiment is mechanical energy that indirectly or directly presses the brake shoe 210 against the brake disc 206. This energy is, in this case, electrical energy that drives the brake actuator motor 212. In particular, in the case of a safety brake, the energy supply can also be mechanical energy, for example, by a force from a preloaded spring set that is triggered in the case of a safety brake.

[0153] The electromechanical braking system 200 has a brake control unit 224 as a functional assembly. This assembly provides a set of functions that provide overall train braking and extension functions as well as local braking and extension functions based on a control input 218, a vehicle state input 220, or a braking system state input 222. The brake control unit 224 implements a first control path 226, which is part of a service brake path 228 (dotted outline). The service brake path 228 is a brake path as a set of functions that achieve a braking process with low safety integrity as a whole. The brake control unit 224 implements a second control path 230, which is part of a safety brake path 232 (dashed outline). The safety brake path 232 is a brake path as a set of functions, in particular a set of safety brake functions, that achieve a braking process with high safety integrity as a whole, i.e., implements at least one safety brake function.

[0154] The electromechanical braking system 200 has a brake force unit 234 as a functional assembly. This assembly provides a set of functions for generating friction brake force based on a control input 218, a vehicle state input 220, or a brake system state input 222. A first functional part 236 is implemented in the brake force unit 234, which is part of a service brake path 228 and provides functions for generating brake force in the first path. A second functional part 238 is implemented in the brake force unit 234, which is part of a safety brake path 232 and provides functions for generating brake force in the second path.

[0155] The electromechanical braking system 200 has a highly reliable functional component 216, as described above. The highly reliable functional component 216 as a whole forms part of both the service brake path 228 and part of the safety brake path 232. The highly reliable functional component 216 generates the friction brake force 240.

[0156] Brake functions related to safety (also referred to as safety brake functions) require high safety integrity, i.e., high effectiveness of the safety function under the required conditions. The functional safety of the braking system 200 in its electrical / electronic configuration here depends on the complexity of its functional implementation, and in particular, is only verifiable by relying on this complexity. As the complexity of the software or electronics increases, there is a risk of state-space explosion that can no longer be addressed from the standpoint of safety validation. Therefore, the provision of safety functions available in all downgraded states, i.e., all states in which the braking system operates below its nominal functional capability, or the provision of a highly integrated minimum functionality of safety functions, is achieved by arranging as few elements as possible. These elements are simplified, statically configured, or configured independently of states, or dependent on a limited number of states. This configuration enables simplified validation and verification, or, fundamentally, enables them for the first time. Thus, these safety functions are performed in the safety brake path 232. This is performed technically as an implementation of today's operating principles by electrical, electronic, or mechanical means, as well as a combination of these means. In this sense, the safety brake path 232 is further configured to be dominant over the service brake path 228, and to bypass the service brake path 228 in a situation-dependent manner or to deactivate it by activating a switching process. In connection with this, the safety function is also part of the path, thereby allowing for an evaluation of the overall integrity of the system or its subcomponents, and providing the safety brake path with a basis for decisions regarding the switching process or for restoring the required safety brake function.

[0157] The electromechanical braking system 200 opens up the possibility of implementing technical solutions that have previously been carried out purely mechanically using software functions, thus increasing the complexity of functions in terms of parameters and modulo forms, depending on the project-specific application. Furthermore, in such a system, in order to improve the quality of braking, situation-dependent, dynamically and time-variable extension functions can also be implemented in the braking system software. Therefore, this complex part can be provided as a combination of electronic equipment, electrical equipment, and software, as part of the brake control unit 224 and from the first functional part 236 of the brake force unit 234, each with a low degree of integrity, thereby not compromising the integrity of the safety function. The braking function provided by this software is either provided supplementarily to safety-related braking functions (e.g., emergency brake / quick brake, parking brake) or is not fully assigned to safety-related braking functions and is therefore assigned to the service brake function during the normal operation of the railway vehicle 1. However, in supplementary cases, these functions are configured not to impair, block, or impair any minimum functionality with extremely high availability under any technical conditions, without any reciprocal effect on safety functions.

[0158] The service brake path 228 and the safety brake path 232 utilize highly reliable functional parts 216 of the brake force unit 234 to fulfill their functions, and these highly reliable functional parts 216 are not configured redundantly and their uninterrupted functional characteristics can be proven. The highly reliable functional parts 216 may include, for example, mechanical parts (e.g., brake calipers) or electric motors.

[0159] The arrangement of the service brake path 228 and the safety brake path 232 is configured such that the provision of the safety brake path 232, particularly the provision of its minimum functionality, is independent of the behavior of the service brake path 228. The service brake path 228 is also implemented without any reaction to the safety brake path 232 and the highly reliable functional part 216. Here, it is ensured that individual errors will not cause failures in the safety brake path 232.

[0160] If the service brake function or extended function fails in the first functional unit 236, a switch to the safety brake path 232 is performed according to the brake function / brake mode, and the requested function is realized with at least a highly integrated minimum function, or an acceptable error response is performed for the mode of operation, failure mode, or failure range.

[0161] Based on Figure 4, the security architecture of a second embodiment of the braking system 300 will be described.

[0162] Braking system 300 corresponds to braking system 200 of the first embodiment. For a description of it and its components, please refer to the first embodiment unless there is a discrepancy in the following description.

[0163] The braking system 300 according to the second embodiment aims to generate a frictional braking force to decelerate the vehicle mass of the railway vehicle coupling 1, as such a braking system can provide a service brake function as well as safety-related braking functions such as an emergency brake function, a quick brake function, or a parking brake function.

[0164] For this purpose, the braking system 300 has a security architecture with two different integrity classifications for operating an electromechanical braking system in a rail-related vehicle.

[0165] The electromechanical braking system 300 receives control inputs 218 via the control line interface 204, such as a service brake function initiated by a train driver or an emergency brake function initiated by an emergency brake mechanism.

[0166] Furthermore, the electromechanical braking system 300 obtains vehicle state inputs 220, such as wheel rotation speed detected using sensors, vehicle weight detected via sensors or using manual input, etc., via the control line interface 204.

[0167] Furthermore, the electromechanical braking system 300 obtains braking system state inputs 222, such as the friction element temperature detected using a sensor, the position of the friction element driving means 212, or the brake force unit, via the control line interface 204.

[0168] The electromechanical braking system 300 is supplied with electrical energy via an energy supply interface 202 (energy supply 223).

[0169] The electromechanical braking system 300 has a brake control unit 324 as a functional assembly. This assembly provides a set of functions that provide overall train braking and extension functions as well as local braking and extension functions based on a control input 218, a vehicle state input 220, or a braking system state input 222. The brake control unit 324 is configured to generate at least one control signal or adjustment signal of a force adjustment amount 382 (e.g., clamping force, braking torque), and to generate a switching command 380 in the presence of a switching state, the control signal or adjustment signal may depend on the control input 218, the vehicle state input 220, or the braking system state input 222.

[0170] The brake control unit 324 implements a first functional group 334, which is part of the service brake path 328 and provides, for example, brake functions and optionally extended functions.

[0171] A second functional group 336 is implemented in the brake control unit 324, which is part of the safety brake path 232 and provides a safety brake function or a minimum function of the safety brake function.

[0172] A third functional group 338 is implemented in the brake control unit 324, which implements safety functions 340. The presence of the third functional group 338 is optional. The safety functions are those that can monitor and diagnose other functions, particularly the integrity of the brake path, and, if a switching condition exists, execute a compensation process using the switching process to maintain or restore the safety brake function. The safety functions 340 include, for example, a brake path monitor 341 that monitors the function of the brake path, an actuator monitor 342 that monitors the function of the actuator, a supply monitor 343 that monitors the energy supply, a determination unit 344 that determines whether a switching condition exists, and a data storage function 345 that can record state data or recall and apply immutable control data.

[0173] The brake path monitor 341 is an extension that includes internally contained operating functions, a brake path monitoring function including safety brake functions, and the generation of force adjustment amount 382 with the purpose of generating at least one switching command. The monitoring function here includes at least legally defined monitoring of brake functions or extensions (for example, monitoring of anti-skid functions, see UIC 541-05 Chapter V4.1.5 “Sicherheitsschaltung des Gleitschutzes” and DIN EN 15595 Chapter 5.1.3 “Sicherheitsschaltung (Sicherheitszeit)”).

[0174] The actuator monitor 342 has the function of monitoring the sufficiency of the force adjustment amount 382 in conjunction with the brake force unit 358 by the actuator control unit 348, and also the function of monitoring the status of all functions of the brake force unit 358 with the purpose of protecting the safety brake path 232 and the highly reliable functional part 316, and generating a switching signal in the switching situation. This function may further include a range of functions that monitor the input signal by the first control path 350 of the actuator control unit 348 and, if necessary, conclude that the input signal is invalid or erroneous.

[0175] The supply monitor 343 is a monitoring function for the energy supply unit 370, which, in particular, takes into account the status of the fourth switching unit 378, the external energy supply unit 374, or the buffer memory 372, and uses evaluation logic to generate a switching signal in the switching case.

[0176] The determination unit 344 is a fourth monitoring function that uses at least one of the above-described monitoring functions as an input variable and generates a switching signal 380 in a switching case. This function has the purpose of driving and controlling the switching units 346, 356, 364, and 378 of the brake control unit 324, actuator control unit 348, or brake force unit 358. Furthermore, this function optionally evaluates input quantities (control inputs, vehicle state quantities, braking system state quantities) to determine a requested target state (e.g., a request for safety braking function by the train control track) and to transition the braking system 300 to this state or a defined safe state by generating commands to the function units. Such a switching signal can also be generated outside the braking system and transmitted to the braking system.

[0177] The data storage device 345 is a data storage function that supplies at least one alternative value of the force adjustment amount 382 for at least one input amount of the determination unit 344, thereby storing parameters of the safety brake function, as well as the unit's calibration data or current or past state data, without loss and supplying them to other functions.

[0178] The third functional group 338 is configured, in the switching state, to generate switching commands for the actuator control unit or brake force unit, which will be described later. The presence of the third functional group 338 is optional.

[0179] A first switching unit 346 is implemented in the brake control unit 324, and the first switching unit 346 is configured to provide a control signal or adjustment signal in the case of a trigger by a safety function based on the third functional group 338 of the safety brake path 232, and to form the control signal or adjustment signal by additionally adding a data storage function, or alternatively simply based on a data storage function.

[0180] The electromechanical braking system 300 has an actuator control unit 348 as a functional assembly. This assembly provides a set of functions that provide force generation functionality in the braking path based on a force adjustment amount 382, ​​based on a control input 218, a vehicle state input 220, or a braking system state input 222. The actuator control unit 348 generates at least one manipulated variable 384 (for example, an excitation amount for the principle of electromechanism) as a control signal or adjustment signal, and, if a switching state exists, generates a switching command to at least one brake force unit that receives a control input from the brake control unit 324, with the purpose of realizing the force adjustment amount 382.

[0181] A first control path 350 is implemented in the actuator control unit 348, and the first control path 350 is part of the service brake path 228. The first control path 350 is configured to realize a force adjustment process as part of the service brake function by calculating and evaluating state quantities or process quantities of the brake force unit (e.g., force measurement, position measurement) and providing an operating quantity 384 with low safety integrity.

[0182] A second control path 352 is implemented in the actuator control unit 348, and the second control path 352 is part of the safety brake path 332. The second control path 352 is configured to calculate and evaluate (e.g., force measurement, position measurement) state quantities or process quantities of the brake force unit in order to realize a force adjustment process as part of the safety brake function (e.g., emergency brake, parking brake) by providing an operand 384 with high safety integrity.

[0183] The actuator control unit 348 implements a fourth functional group 354, which implements one or more of the safety functions 340. The fourth functional group 354 is configured to generate switching commands for the brake force unit, which will be described later, in the switching state. The presence of the fourth functional group 354 is optional.

[0184] A second switching unit 356 is implemented in the actuator control unit 348, and the second switching unit 356 is configured to take over or bypass control signals or adjustment signals at any time in the switching case via a second control path (see below) without any reaction. For this purpose, the second switching unit 356 is configured to switch the first control path 350 without any action.

[0185] The electromechanical braking system 300 has a brake force unit 358 as a functional assembly. This assembly provides a set of functions that generate friction brake force based on a control input 218, a vehicle state input 220, or a braking system state input 222.

[0186] The brake force unit 358 incorporates a first functional component 360, which is part of the service brake path 228. The first functional component 360 consists of a mechatronics control unit and an electro- / electronic force generating element (e.g., electromechanical power electronics) with low safety integrity. The first functional component 360 is optional.

[0187] A second functional unit 362 is mounted on the brake force unit 358, and the second functional unit 362 is part of the safety brake path 232. The second functional unit 362 consists of a mechatronics control unit and an electrical or electronic force generating element (e.g., electromechanical power electronics) that has high safety integrity.

[0188] A third switching unit 364 is implemented in the brake force unit 358. The third switching unit 364 is configured to allow the actuator control unit 348 or the brake control unit 324 to select either the service brake path 328 or the safety brake path 332 by reading a switching command 380, and to switch between the two paths without any reaction. For this purpose, the switching unit is configured to switch to an inactive brake path without any action.

[0189] The braking force unit 358 has an extremely reliable functional part 316. The extremely reliable functional part 316 as a whole forms part of both the service brake path 328 and part of the safety brake path 332.

[0190] Optionally, the brake force unit 358 may have other functional parts (e.g., electromechanical, mechanical brake add-on parts, or sensor units) that are jointly available with the first functional part 360 or the second functional part 362 and have functional characteristics that are not lost, or that are configured to be extremely reliable.

[0191] The braking force unit 358 further includes a sensor unit 366 which is used jointly or separately by two control paths to determine the state of the braking force unit 358 (e.g., current, force, position).

[0192] The electromechanical braking system 300 has an energy supply unit 370 as a functional assembly. This assembly provides a set of functions for providing energy to the braking system assembly.

[0193] A buffer memory 372 is implemented in the energy supply unit 370. The buffer memory 372 is configured to supply sufficient operating energy to the units of the braking system 300 by enabling a predetermined amount of energy to maintain at least one of the multiple safety brake functions or a minimum of them through at least one complete operation.

[0194] The energy supply unit 370 has an external energy supply unit 374 via an energy supply interface 302. The external energy supply unit 374 provides energy to the assembly of the braking system 300 during normal operation.

[0195] The energy supply unit 370 is equipped with a fifth functional group 376, which implements one or more of the safety functions 340. The fifth functional group 376 is configured to generate switching commands 380 for the brake control unit 324, the actuator control unit 348, or the brake force unit 358 in the switching state. The presence of the fifth functional group 376 is optional.

[0196] The energy supply unit 370 is equipped with a fourth switching unit 378, which, in the event of a supply error or interruption of the external energy supply unit, switches the supply to all units of the braking system 300 to the buffer memory 372 and informs the safety function group of its internal state.

[0197] Based on Figure 5, the security architecture of a third embodiment of the braking system 400 will be described.

[0198] The braking system 400 corresponds to the braking system 300 of the second embodiment. For a description of it and its components, please refer to the second embodiment and Figure 4, unless there is a discrepancy in the following description.

[0199] The braking system 400 according to the third embodiment aims to generate a frictional braking force to decelerate the vehicle mass of the railway vehicle coupling 1, as such a braking system can provide a service brake function as well as safety-related braking functions such as an emergency brake function, a quick brake function, or a parking brake function.

[0200] For this purpose, the braking system 400 has a security architecture with two different integrity classifications for operating an electromechanical braking system in a rail-related vehicle.

[0201] The electromechanical braking system 400 receives control inputs 218 via the control line interface 204, such as a service brake function initiated by a train driver or an emergency brake function initiated by an emergency brake mechanism.

[0202] Furthermore, the electromechanical braking system 400 obtains vehicle state inputs 220, such as wheel rotation speed detected using sensors, vehicle weight detected via sensors or using manual input, etc., via the control line interface 204.

[0203] Furthermore, the electromechanical braking system 400 obtains braking system state inputs 222, such as the friction element temperature detected by a sensor, the position of the friction element driving means 212, or the brake force unit, via the control line interface 204.

[0204] The electromechanical braking system 400 is supplied with electrical energy via an energy supply interface 202 (energy supply 223).

[0205] The electromechanical braking system 400 has a brake control unit 480 as a component that serves as a functional carrier to fulfill the brake control task. The brake control unit 480 is provided as a component with low safety integrity, is part of the service brake path 228, and is housed in the vehicle or vehicle body of the driven vehicle 110 or towing vehicle 150.

[0206] The electromechanical braking system 400 has an actuator 482 as a component that serves as a functional carrier for performing the brake adjustment task. The actuator 482 is provided as a component with high safety integrity, is part of the safety brake path 232, and is housed in a carriage near the friction force generating section.

[0207] The electromechanical braking system 400 has an energy supply unit 484 as a component that acts as a functional carrier for realizing an energy supply unit. The energy supply unit 484 is provided as a component with high safety integrity, is part of the safety brake path 232, and is provided on the vehicle or vehicle body.

[0208] The brake control unit 480 includes a first brake control unit 486 and a first actuator control unit 488. The first brake control unit 486 implements a portion of the brake control unit 324. The first brake control unit 486 implements the brake function of the brake control unit 324, which is part of the service brake path 228, and generates force adjustment amounts 382 (e.g., target cylinder force and reduction signals) to provide to the actuator 482 and the first actuator control unit 488. The first actuator control unit 488 implements a portion of the actuator control unit 348, which is part of the first service brake path 228. The first actuator control unit 488 provides a first manipulated amount 494 in the service brake path 228, which includes the first control path.

[0209] Actuator 482 has a second brake control unit 490 and a second actuator control unit 492. The second brake control unit 490 implements a portion of the brake control unit 324. The second brake control unit 490 implements a second functional group 336 that has the braking function of the brake control unit 324, which is part of the safety brake path 232, generates a force adjustment amount to realize the safety brake function, and obtains a first manipulated amount 494 to realize the service brake function, which is a safety function including a brake path monitor 341, an actuator monitor 342, a determination unit 344, and a data storage device 345. The second actuator control unit 492 implements a portion of the actuator control unit 348, i.e., a portion of the safety brake path 232. The second actuator control unit 492 provides manipulated amounts A496 and B497 in the safety brake path 432. Actuator 482 further has a brake force unit 458 that includes manipulated amounts dependent on the active brake path.

[0210] The energy supply unit 484 includes an energy supply unit 470.

[0211] The energy supply unit 470 includes a supply monitor 343.

[0212] By designing the decision unit 344, which determines which target state of the railway vehicle is read, in combination with the data storage function 345, safety braking functions (e.g., emergency brake, parking brake) can be fully implemented without brake control in error or degradation cases by the actuator 482 and the energy supply unit 484.

[0213] For this purpose, a real-time signal exchange with low safety integrity exists between the brake control unit 480 and the actuator 482, thereby enabling the realization of the first control path of the actuator control unit. In parallel with this, a real-time signal exchange with low safety integrity exists between the energy supply unit 484 and the actuator 482, thereby enabling the transmission of switching commands.

[0214] For this purpose, in the safety brake path 232, at least one force adjustment amount of the brake control unit 480 is directly supplied to the actuator 482 or for implementation by the second control path, but this force adjustment amount is protected by the function of the safety brake path 232 in the second brake control unit 490 in such a way that minimal functionality is guaranteed in error, failure, or degradation scenarios.

[0215] This configuration allows for a qualitatively distinctive function of the first control path of the brake control unit 480, enabling expansion or technical improvements without modifying the actuator 482 and without compromising the integrity of the safety brake path.

[0216] If the brake control unit 480 is configured as a single channel and has low safety integrity, then this configuration requires only high-integrity electronic units in the actuator 482 to perform the safety brake function 340, which includes a second control path for the actuator control unit and a second control path for the brake force unit. This results in a low-cost configuration on the one hand, and a lower overall failure rate for the safety brake function, or especially for minimal functions, because these are supplied per actuator.

[0217] For this reason, in certain modified configurations, the second control path of the braking force unit essentially only has access to the second control path of the actuator control unit.

[0218] Based on Figure 6, the security architecture of a fourth embodiment of the braking system 500 will be described.

[0219] The braking system 500 corresponds to the braking system 400 of the third embodiment. For a description of it and its components, please refer to the second embodiment and Figure 5, unless there is a discrepancy in the following description.

[0220] The electromechanical braking system 500 has a brake control unit 580 as a functional carrier that fulfills the brake control task. The brake control unit 580 is provided as a functional group with low safety integrity, is part of the service brake path 228, and is preferably housed in the vehicle or vehicle body of the driven vehicle 110 or towing vehicle 150.

[0221] The electromechanical braking system 500 has an actuator 582 as a functional carrier that fulfills the brake adjustment task. The actuator 582 is provided as a component of a functional group with high safety integrity, is part of the safety brake path 232, and is preferably housed in a carriage near the friction force generating section.

[0222] The electromechanical braking system 500 has an energy supply unit 584 as a component that acts as a functional carrier for realizing an energy supply unit. The energy supply unit 584 is provided as a functional group with high safety integrity, is part of the safety brake path 232, and is preferably provided in the vehicle or vehicle body.

[0223] The brake control unit 580 includes a first brake control unit 586 and a first actuator control unit 588. The first brake control unit 586 implements a portion of the brake control unit 324. The first brake control unit 586 implements the braking function of the brake control unit 324, which is part of the service brake path 228, and generates force adjustment amounts 382 (e.g., target cylinder force and reduction signals) to provide to the actuator 582 and the first actuator control unit 588. The first actuator control unit 588 implements a portion of the actuator control unit 348. The first actuator control unit 588 provides the manipulated amount in the service brake path, which includes a first control path.

[0224] Actuator 582 has a second brake control unit 590 and a second actuator control unit 592. The second brake control unit 590 implements part of the brake control unit 324. The second brake control unit 590 implements the braking function of the brake control unit 324, which is part of the safety brake path 232, generates a force adjustment amount 382 to realize the safety brake function, and obtains an operating amount to realize the service brake function. The second brake control unit 590 implements the safety function 340, which includes a brake path monitor 341, an actuator monitor 342, a determination unit 344, and a data storage device 345. The second actuator control unit 592 implements part of the actuator control unit 348. The second actuator control unit 592 provides an operating amount in the safety brake path 232. Actuator 582 further has a brake force unit 558 that obtains an operating amount dependent on the active brake path.

[0225] The energy supply unit 584 includes a supply monitor 343.

[0226] Furthermore, the electromechanical braking system 500 implements an extension unit 594 equipped with a third brake control unit 596.

[0227] The fourth embodiment is an additional variation of the third embodiment having an extension carrier 594, wherein the third brake control unit 596 performs signal reading, signal processing, or control functions 597 that extend the brake control unit with high safety integrity (e.g., information on the load of one or more parts of the bogie or vehicle or vehicle mass). In a further step, for this purpose, either the original signal, the processed signal, or the control / adjustment signal is provided to another control unit in the form of at least one extension 597 with safety integrity. This enables the subsequent functional chain: In the case of safety braking functions (e.g., emergency brake / quick brake), a highly integrated extension amount (e.g., load) can be provided to the actuator, accompanied by the achieved safety integrity of the identification and transmission of the extension unit, and this actuator can be used in conjunction with the functions present therein (e.g., determination unit or data storage function) to perform braking functions or further extensions (e.g., load modification) in the safety braking path (e.g., modification of brake force value).

[0228] In the case of the regular braking function, the extension amount 598 can be provided to the extension function 597 in the brake control unit 580, thereby realizing the extension function 597 (for example, load correction).

[0229] The extension unit carrier 594 receives a sensor quantity 599 as input. Alternatively or additionally, the extension unit carrier 594 itself may include a sensor and extract sensor data from this sensor. The extension unit outputs an extended quantity 598. The extended quantity 598 may consist of either the sensor data itself or a quantity derived from the sensor data.

[0230] This extension of the first variant achieves an improvement in safety braking functionality, while the complexity of the brake control remains at a low level of safety integrity, making it feasible at low cost. Furthermore, the second brake control unit 590 present in actuator 582 can be used to realize an extended safety braking function with high integrity.

[0231] Based on Figure 7, the first modified form of the fourth embodiment will be described.

[0232] The first variation of the fourth embodiment corresponds to the fourth embodiment. For its description and the description of its components, please refer to the fourth embodiment unless there is a discrepancy in the following description.

[0233] Unlike the fourth embodiment, in which a third brake control unit 596 is provided that handles the extension function unit 594, in the first variation of the fourth embodiment, the extension function units 594' and 594'' are integrated into the first brake control unit, which provides functional groups to the first brake path and the second brake path, respectively, and the extension amount is output in the first brake path and the second brake path and transmitted to the second brake control unit.

[0234] A second modified form of the fourth embodiment will be described based on Figure 8.

[0235] The second variation of the fourth embodiment corresponds to the fourth embodiment. For its description and the description of its components, please refer to the fourth embodiment unless there is a discrepancy in the following description.

[0236] Unlike the fourth embodiment, in which a third brake control unit 596 is provided that handles the extension unit 594, in the second variation of the fourth embodiment, the extension unit 594'' is integrated into the first brake control unit, which provides a functional group for the first brake path, and the extension amount is output in the first brake path and transmitted to the second brake control unit. The second brake control unit can process the extension amount in both the first and second brake paths.

[0237] In the fourth embodiment and its variations, it is explained that the functions and extended functions of the first brake path can be accessed when the switching state is confirmed and the braking system is located within the safety brake path. Therefore, for example, in the safety brake path, it is possible to access the anti-slip functionality from the service brake path without newly implementing this functionality in the safety brake path.

[0238] Based on Figure 9, the security architecture of a fifth embodiment of the braking system 600 will be described.

[0239] The braking system 600 corresponds to the braking system 300 of the second embodiment. For a description of it and its components, please refer to the second embodiment and Figure 4, unless there is a discrepancy in the following description.

[0240] The braking system 600 according to the fourth embodiment aims to generate a frictional braking force to decelerate the vehicle mass of the railway vehicle coupling 1, as such a braking system can provide a service brake function as well as safety-related braking functions such as an emergency brake function, a quick brake function, or a parking brake function.

[0241] The electromechanical braking system 600 has a brake control unit 680 as a component that serves as a functional carrier to fulfill the brake control task. The brake control unit 680 is provided as a functional group with high safety integrity, is part of the service brake path 228 and the safety brake path 232, and is preferably housed in the vehicle or vehicle body of the driven vehicle 110 or towing vehicle 150.

[0242] The electromechanical braking system 600 has an actuator 682 as a component that serves as a functional carrier to perform the brake adjustment task. The actuator 682 is provided as a functional group with high safety integrity, is part of the safety brake path 232, and is preferably housed in a carriage near the friction force generating section.

[0243] The electromechanical braking system 600 has an energy supply unit 684 as a functional carrier for realizing an energy supply unit. The energy supply unit 684 is provided as a functional group with high safety integrity, is part of the safety brake path 284, and is preferably provided in the vehicle or vehicle body.

[0244] The brake control unit 680 includes a first brake control unit 686 and a first actuator control unit 688. The first brake control unit 686 implements a portion of the brake control unit 324. The first brake control unit 686 implements the brake function of the brake control unit 324, which is part of the service brake path 228 and part of the safety brake path 232, and generates force adjustment amounts 382 (e.g., target cylinder force and reduction signals) to provide to the actuator 682 and the first actuator control unit 688. Furthermore, the first brake control unit 686 implements the brake path monitor 341 and actuator monitor 342, which are safety functions 340. The first actuator control unit 688 implements a portion of the actuator control unit 348, i.e., part of the service brake path 228. The first actuator control unit 688 provides a first operating amount 494 in the service brake path, including the first control path.

[0245] Actuator 682 has a second brake control unit 690 and a second actuator control unit 692. The second brake control unit 690 implements part of the brake control unit 324. The second brake control unit 690 implements the braking function of the brake control unit 324, which is part of the safety brake path 232, generating a force adjustment amount to realize the safety brake function and obtaining an operating amount to realize the service brake function. The second brake control unit 690 implements the determination unit 344 and data storage device 345, which are safety functions 340. The second actuator control unit 692 implements part of the actuator control unit 348. The second actuator control unit 692 provides the operating amount in the safety brake path 232. Actuator 682 further has a brake force unit 658 which includes an operating amount dependent on the active brake path.

[0246] The energy supply unit 684 implements an energy supply unit 470 with a supply monitor 343.

[0247] The fundamental realization of the high safety integrity function of the central brake control unit allows safety functions to be individualized, extended, or adapted to project-specific requirements, without requiring adaptation of existing actuator subsections.

[0248] For the purpose of transmitting switching commands, it is necessary to provide corresponding safety-related interfaces in the subsections, the brake control unit and the actuator, for communication transmission with a high degree of safety integrity.

[0249] This variant reduces software costs and complexity in the actuator subsection (which operates in critical / demanding environments).

[0250] Based on Figure 10, the security architecture of a sixth embodiment of the braking system 700 will be described.

[0251] The braking system 700 corresponds to the braking system 300 of the second embodiment. For a description of it and its components, please refer to the second embodiment and Figure 4, unless there is a discrepancy in the following description.

[0252] The braking system 700 according to the second embodiment aims to generate a frictional braking force to decelerate the vehicle mass of the railway vehicle coupling 1, as such a braking system can provide a service brake function as well as safety-related braking functions such as an emergency brake function, a quick brake function, or a parking brake function.

[0253] The electromechanical braking system 700 has a brake control unit 780 as a component that serves as a functional carrier to fulfill the brake control task. The brake control unit 780 is provided as a functional group with high safety integrity, is part of the service brake path 228 and the safety brake path 232, and is preferably housed in the vehicle or vehicle body of the driven vehicle 110 or towing vehicle 150.

[0254] The electromechanical braking system 700 has an actuator 782 as a functional carrier that fulfills the brake adjustment task. The actuator 782 is provided as a component of a functional group with high safety integrity, and is part of the safety brake path 232 and the service brake path 228, and is preferably housed in a carriage near the friction force generating section.

[0255] The electromechanical braking system 700 has an energy supply unit 784 as a functional carrier for realizing an energy supply unit. The energy supply unit 784 is provided as a functional group with high safety integrity, is part of the safety brake path 232, and is preferably provided in the vehicle or vehicle body.

[0256] The brake control unit 780 has a first brake control unit 786. The first brake control unit 786 implements a portion of the brake control unit 324. The first brake control unit 786 implements the brake function of the brake control unit 324, which is part of the service brake path 228 or part of the safety brake path 232, and generates force adjustment amounts (e.g., target cylinder force and reduction signals) to provide to the actuator 782 and the first actuator control unit 788. Furthermore, the first brake control unit 786 implements a brake path monitor 341, which is a safety function 340.

[0257] The actuator 782 includes a second brake control unit 790, a first actuator control unit 788, and a second actuator control unit 792. The second brake control unit 790 implements a portion of the brake control unit 324. The second brake control unit 790 implements the braking function of the brake control unit 324, which is part of the safety brake path 232, generating a force adjustment amount to realize the safety brake function and obtaining an operating amount to realize the service brake function. The second brake control unit 790 implements the first switching unit 346 and the actuator monitor 342, determination unit 344, and data storage device 345, which are safety functions 340.

[0258] The first actuator control unit 788 implements a portion of the actuator control unit 348. The first actuator control unit 788 provides the manipulated amount in the service brake path, including the first control path.

[0259] The second actuator control unit 792 implements a portion of the actuator control unit 348. The second actuator control unit 792 provides the manipulative amount in the safety brake path 232. Furthermore, the second actuator control unit 792 implements the second switching unit 356. Actuator 782 further has a brake force unit 758 which includes a manipulative amount dependent on the active brake path.

[0260] The energy supply unit 784 implements an energy supply unit 470 and includes a supply monitor 343.

[0261] This embodiment, as a variation of the braking system described in the second embodiment ("Intelligent Power Regulator with Safety Brake Control Unit"), consists of a functional carrier for fulfilling the brake control task, a functional carrier (actuator) for fulfilling the brake adjustment task, and a functional carrier for energy supply. In this variation, the first functional carrier (brake control task) is also assigned a function that provides high safety integrity. The task of providing the manipulated amount is now performed solely by the actuator in all operating functions. The brake control unit now provides only the force adjustment amount for both operating paths.

[0262] In this embodiment, the brake control unit and actuator control unit, which are domains, are respectively assigned to dedicated functional carriers in a closed manner, thereby providing a general-purpose interface. In this variant, all functions with high real-time requirements related to the actuator control domain are no longer transmitted via a communication system between functional carriers, but reside entirely within the actuator. This results in greater robustness and performance of the adjustment function.

[0263] The requirements for the communication system between the brake control unit and the actuator are reduced in terms of real-time performance compared to Examples 4 and 5. This allows for longer distances or information paths to the actuator, and enables structural arrangements of the brake control unit that communicate with the actuator only through a non-dedicated common communication medium.

[0264] For the purpose of transmitting switching commands and safety-related force adjustments, it is necessary to provide corresponding safety-related interfaces in the brake control unit and actuator, which are subsections, for communication transmission with a high degree of safety integrity.

[0265] However, the increasing complexity of the software in the first control path of the actuator control unit leads to increased costs for the actuator function carrier, which must have robust failure behavior against ambient conditions.

[0266] Based on Figure 11, the security architecture of the seventh embodiment of the braking system 800 will be described.

[0267] The braking system 800 corresponds to the braking system 300 of the second embodiment. For a description of it and its components, please refer to the second embodiment and Figure 4, unless there is a discrepancy in the following description.

[0268] The braking system 800 according to the second embodiment aims to generate a frictional braking force to decelerate the vehicle mass of the railway vehicle coupling 1, as such a braking system can provide a service brake function as well as safety-related braking functions such as an emergency brake function, a quick brake function, or a parking brake function.

[0269] The electromechanical braking system 800 has a brake control unit 880 as a functional carrier that fulfills the brake control task. The brake control unit 880 is provided as a component of a functional group having low safety integrity, and is part of the service brake path 228 and the safety brake path 232, and is preferably housed in the vehicle or vehicle body of the driven vehicle 110 or towing vehicle 150 at least once per vehicle or bogie.

[0270] The electromechanical braking system 800 has an actuator 882 as a functional carrier that fulfills the brake adjustment task. The actuator 882 is provided as a component of a functional group with high safety integrity, is part of the safety brake path 232 and the service brake path 228, and is preferably housed in a carriage near the friction force generating section.

[0271] The electromechanical braking system 800 has an energy supply unit 884 as a functional carrier for realizing an energy supply unit. The energy supply unit 884 is provided as a component of a functional group with high safety integrity, is part of the safety brake path 232, and is provided on the vehicle or vehicle body.

[0272] The brake control unit 880 has a first brake control unit 886. The first brake control unit 886 implements a part of the brake control unit 324. The brake function of the brake control unit 324 is implemented by the first brake control unit 886, which is part of the service brake path 228 and generates force adjustment amounts 382 (e.g., target cylinder force and reduction signals) to provide to the actuator 882 and the first actuator control unit 888.

[0273] The actuator 882 includes a second brake control unit 890, a first actuator control unit 888, and a second actuator control unit 892. The second brake control unit 890 implements a portion of the brake control unit 324. The second brake control unit 890 implements the braking function of the brake control unit 324, which is part of the safety brake path 232, generating a force adjustment amount to realize the safety brake function and obtaining an operating amount to realize the service brake function. The second brake control unit 890 implements the first switching unit 346 and the safety function 340, which includes a brake path monitor 341, an actuator monitor 342, a determination unit 344, and a data storage device 345.

[0274] The first actuator control unit 888 implements a portion of the actuator control unit 348. The first actuator control unit 888 provides the manipulated amount in the service brake path, which includes the first control path.

[0275] The second actuator control unit 892 implements a portion of the actuator control unit 348. The second actuator control unit 892 provides the maneuver input in the safety brake path. Furthermore, the second actuator control unit 892 implements the second switching unit 356.

[0276] The actuator 882 further includes a brake force unit 858 which includes an operating amount that depends on an active brake path.

[0277] The energy supply unit 884 implements an energy supply unit 470 and includes a supply monitor 343.

[0278] A seventh embodiment of the braking system ("Intelligent Brake Regulator with Conventional Brake Control Unit") comprises a functional carrier for fulfilling the brake control task, a functional carrier (actuator) for fulfilling the brake adjustment task, and a functional carrier for energy supply. The task of providing the manipulated amount is now performed solely by the actuator in all operating functions. The brake control unit now provides only the force adjustment amount for both operating paths.

[0279] This embodiment is similar to the sixth embodiment, in which the domains of the brake control unit and the actuator control unit are each closedly assigned to dedicated functional carriers, thereby obtaining a general-purpose interface. The functional cost in the actuator now includes all safety-related brake functions across the entire range, which increases the cost, and this must always be adapted when the function changes.

[0280] In this case, a safety-related interface is no longer required between the brake control unit, which is a subsection, and the actuator, for communication transmission with high safety integrity, thereby reducing costs.

[0281] Based on Figure 12, the security architecture of the eighth embodiment of the braking system 900 will be described.

[0282] The electromechanical braking system 900 has an optional brake control unit 980 as a component that serves as a functional carrier for fulfilling the brake control task. The brake control unit 980 is provided as a low safety integrity functional group, is part of the service brake path 228, and is preferably housed in the vehicle or vehicle body of the driven vehicle 110 or towing vehicle 150, per vehicle or bogie, at least once.

[0283] The electromechanical braking system 900 has an actuator 982 as a component that serves as a functional carrier to perform the brake adjustment task. The actuator 982 is provided as a functional group with high safety integrity and is part of the safety brake path 232 and the service brake path 228, and is preferably housed in a carriage near the friction force generating section.

[0284] The electromechanical braking system 900 has an energy supply unit 984 as a component that acts as a functional carrier for realizing an energy supply unit. The energy supply unit 984 is provided as a functional group with high safety integrity, is part of the safety brake path 232, and is preferably provided in the vehicle or vehicle body.

[0285] The brake control unit 980 has a first brake control unit 986. The first brake control unit 986 implements a part of the brake control unit 324. The brake function of the brake control unit 324 is implemented by the first brake control unit 986, which is part of the service brake path 228, and generates force adjustment amounts (e.g., target cylinder force and reduction signals) to be provided to the actuator 982 and the first actuator control unit 988.

[0286] Actuator 982 has a second brake control unit 990, a first actuator control unit 988, and a second actuator control unit 992. The second brake control unit 990 implements part of the brake control unit 324. The second brake control unit 990 implements the brake function of the brake control unit 324, which is part of the safety brake path 232 or the service brake path 228, generates a force adjustment amount to realize the safety brake function, and obtains an operation amount to realize the service brake function. The second brake control unit 990 implements the first switching unit 346 and the brake path monitor 341, actuator monitor 342, decision unit 344, and data storage device 345 that are the safety function 340, as well as the functions and extended functions of the safety brake path 232 (for the extended functions, refer to the fourth embodiment).

[0287] The first actuator control unit 988 implements part of the actuator control unit 348. The first actuator control unit 988 provides an operation amount in the service brake path 228 including the first control path 350.

[0288] The second actuator control unit 990 implements part of the actuator control unit 348. The second actuator control unit 990 provides an operation amount in the safety brake path. Further, the second actuator control unit 990 implements the second switching unit 356.

[0289] Actuator 982 further has a brake force unit 958 that includes an operation amount dependent on the active brake path.

[0290] The energy supply unit 984 implements the energy supply unit 470 and includes a supply monitor 343.

[0291] The eighth embodiment of the braking system ("partially integrated / fully integrated intelligent brake regulator") consists of a functional carrier for fulfilling the brake control task, a functional carrier (actuator) for fulfilling the brake adjustment task, and a functional carrier for energy supply. In this variant, the second functional carrier (brake adjustment task) is also assigned the functions of the brake control domain. The task of providing the manipulated variable is now performed solely by the actuator in all operating functions.

[0292] The eighth embodiment is a brake control unit integrated into an actuator, having a localized braking function. This allows the adjustment function of the brake control domain, in addition to the adjustment function of the brake adjustment domain, to operate within a closed functional carrier, providing the advantage of not being dependent on the transmission path and delay of the communication path between functional carriers. This improves the quality of functional fulfillment of the braking function (e.g., anti-slip).

[0293] Furthermore, since the brake control unit 980, which is a functional carrier, is limited to even fewer functions than in the fifth embodiment, it can be completely transferred to a central control function carrier, thereby reducing the number of subsections overall.

[0294] This is accompanied by a significant increase in the complexity of this variant in the failure requirements of the actuator and its associated environmental conditions and safety functions. The process of adapting the software components located within the actuator to project-specific requirements becomes difficult here because they are inseparably located with the safety functions on the functional carrier.

[0295] Based on Figure 13, the security architecture of the ninth embodiment of the braking system 1000 will be described.

[0296] Braking system 1000 corresponds to braking system 300 of the second embodiment. For a description of it and its components, please refer to the second embodiment and Figure 4, unless there is a discrepancy in the following description.

[0297] The braking system 1000 according to the ninth embodiment aims to generate a frictional braking force to decelerate the vehicle mass of the railway vehicle coupling 1, as such a braking system can provide a service brake function as well as safety-related braking functions such as an emergency brake function, a quick brake function, or a parking brake function.

[0298] The electromechanical braking system 1000 has an optional brake control unit 1080 as a component that serves as a functional carrier for fulfilling the brake control task. The brake control unit 1080 is provided as a low safety integrity functional group, is part of the service brake path 228, and is preferably housed in the vehicle or vehicle body of the driven vehicle 110 or towing vehicle 150, per vehicle or bogie, at least once.

[0299] The electromechanical braking system 1000 has an actuator 1082 as a component that serves as a functional carrier to perform the brake adjustment task. The actuator 1082 is provided as a functional group with high safety integrity, is part of the safety brake path 232 and the service brake path 228, and is housed in a carriage near the friction force generating unit. The actuator 1082 has an energy supply unit 1084.

[0300] The electromechanical braking system 1000 has an energy supply unit 1084 as a component that acts as a functional carrier for realizing an energy supply unit. The energy supply unit 1084 is provided as a functional group with high safety integrity, is part of the safety brake path 284, and is preferably provided in the vehicle or vehicle body.

[0301] The energy supply unit 1084 implements an energy supply unit 470 and includes a supply monitor 343.

[0302] The eighth embodiment of the braking system ("partially integrated / fully integrated intelligent brake regulator") consists of a functional carrier for fulfilling the brake control task, a functional carrier (actuator) for fulfilling the brake adjustment task, and a functional carrier for energy supply. In this variant, the second functional carrier (brake adjustment task) is also assigned the functions of the brake control domain. The task of providing the manipulated variable is now performed solely by the actuator in all operating functions.

[0303] The ninth embodiment is a brake control unit integrated into an actuator, having a localized braking function. This allows the adjustment function of the brake control domain, in addition to the adjustment function of the brake adjustment domain, to operate within a closed functional carrier, providing the advantage of being independent of the transmission path and delay of the communication path between functional carriers. This improves the quality of functional fulfillment of the braking function (e.g., anti-slip).

[0304] Furthermore, since the brake control unit 1080, which is a functional carrier, is limited to even fewer functions than in the fifth embodiment, it can be completely transferred to a central control function carrier, thereby reducing the number of subsections overall.

[0305] This is accompanied by a significant increase in the complexity of this variant in the failure requirements of the actuator and its associated environmental conditions and safety functions. The process of adapting the software components located within the actuator to project-specific requirements becomes difficult here because they are inseparably located with the safety functions in the functional carrier.

[0306] Based on Figure 14, the switching process for Examples 2 to 9 will be explained.

[0307] The first brake control unit 1186 has a brake function for the service brake path and is optional. The first brake control unit 1186 receives a control input 1118 as an input and outputs a force adjustment amount 382.

[0308] The second brake control unit 1190 has a function for the safety brake path. Further, the second brake control unit 1190 has a function of the first changeover switch 346. The first changeover switch 346 is configured to perform a switch from the service brake path to the safety brake path or a switch from the safety brake path to the service brake path in the second brake control unit 1190 when receiving a changeover command. The second brake control unit 1190 further includes a data storage device 345. The data storage device 345 is configured to supply an alternative value for forming the force adjustment amount 382 in the case of a failure or error behavior of the first brake control unit 1186. The second brake control unit 1190 further includes a brake path monitor 341, and the brake path monitor 341 is configured to identify an incorrect behavior in the brake function of the first brake control unit 1186 and notify the determination unit 344 of this using a status signal 1196. The second brake control unit 1190 further includes a determination unit 344. The second brake control unit 1190 receives the control input 1118 and the force adjustment amount 382 of the first brake control unit 1186 as inputs and outputs the force adjustment amount 382.

[0309] The first actuator control unit 1188 has a brake function for the service brake path and is optional. The first actuator control unit 1188 receives the force adjustment amount of the first brake control unit 1186 as an input and outputs a first operation amount 494.

[0310] The second actuator control unit 1192 has the function of a safety brake path. Furthermore, the second actuator control unit 1192 has the function of a second switching unit 356. The second switching unit 356 is configured to switch the second actuator control unit 1192 from the service brake path to the safety brake path, or from the safety brake path to the service brake path, upon receiving a switching command 380. The second actuator control unit 1192 further includes an actuator monitor 342, which is configured to identify erroneous behavior of the first actuator control unit 1188 or the second actuator control unit 1192 or the first brake force unit 1186 or the second brake force unit 1190, and notify the decision unit 346 of this. The second actuator control unit 1192 receives the force adjustment amount 380 of the second brake control unit 1190 as input and outputs actuator operating amounts A496 and B497.

[0311] The first brake force unit 1158 has a brake function 360 for the service brake path, which is optional. The first brake force unit 1158 receives an actuator operating amount A496 from the second actuator control unit 1192 as input and outputs a force generation amount 1195. This is the excitation amount of the physical operating principle of brake force generation, for example, the phase current of an electric motor.

[0312] The second brake force unit 1194 has the function of a safety brake path. Furthermore, the second brake force unit 1194 has the function of a third changeover switch 364. The third changeover switch 364 is configured to switch the second brake force unit 1194 from the service brake path to the safety brake path, or from the safety brake path to the service brake path, upon receiving a switching command 380. The second brake force unit 1194 receives the actuator operation amount B497 of the second actuator control unit 1192 as input and outputs a force generation amount.

[0313] A highly reliable functional component 316, such as an electric motor for brake operation, operates according to the force generation amount of the second brake force unit 1194, thereby generating a brake force.

[0314] The energy supply unit 1170 supplies electrical energy to the braking system and has a supply monitor 343, which is configured to identify erroneous behavior or error conditions of the energy supply unit 1170 and the switching process to its internal energy buffer, and to notify the determination unit 344 of this, or the imminent (final) depletion of the energy supply of the integrated energy buffer, using a status signal.

[0315] The decision unit 344 receives all status signals from safety monitors 341, 342, and 343 generated in the system, identifies error responses accordingly, and transmits these error responses to the first switching unit 346 of the brake control unit, the second switching unit 356 of the actuator control unit, or the third switching unit 364 of the brake force unit using a switching command 380. This allows switching from the first brake path to the second brake path or from the second brake path to the first brake path. In this way, the entire braking system can either switch the brake path between the service brake path and the safety brake path, or switch the brake path as intended in the brake control unit, actuator control unit, or brake force unit.

[0316] If the service brake path is active in the second brake control unit 1190, the force adjustment amount of the first brake control unit 1186 is output to the first actuator control unit 1192. If the safety brake path is active in the second brake control unit 1190, the force adjustment amount of the second brake control unit 1190 is output to the second actuator control unit 1192.

[0317] When the service brake path is active in the second actuator control unit 1192, the actuator operation amount of the first actuator control unit 1188 is output to the first brake force unit 1158 and the second brake force unit 1194. When the safety brake path is active in the second actuator control unit 1192, the actuator operation amount of the second actuator control unit 1192 is output to the first brake force unit 1158 and the second brake force unit 1194.

[0318] When the service brake path is active in the second brake force unit 1194, the force generation adjustment amount of the first brake force unit 1158 is output to the highly reliable functional part 316. When the safety brake path is active in the second brake force unit 1194, the force generation adjustment amount of the second brake force unit 1194 is output to the highly reliable functional part 1116.

[0319] If the optional first brake control unit 1186 is not provided, the first changeover switch 346 can be omitted. If the optional first actuator control unit 1188 is not provided, the second changeover switch 356 can be omitted. If the optional first brake force unit 1158 is not provided, the third changeover switch 364 can be omitted. If all optional components are omitted, the braking system can be implemented as a safety brake that provides a safety braking path exclusively.

[0320] Here, the first changeover switch 346 is implemented in the function of the safety brake path of the second brake control unit 1190. Here, the force adjustment amount or modifier calculated in the first brake control unit 1186 is used depending on the function, or is deactivated according to the switching command of the determination unit 344, and in this way a base value for the force adjustment amount is formed from the data storage device 345.

[0321] The second changeover switch 356 switches one of the two inputs to one of the two outputs, as shown in the table below.

[0322] [Table 1]

[0323] There are three cases in which this rule applies. Functional parts / units with low safety integrity must not have direct access to functional / functional groups / units with high safety integrity unless a switching unit disconnects them.

[0324] The third changeover switch 1164, in addition, switches between each force generation path, similar to the second changeover switch 356. Therefore, only the path to which the manipulated variable A / B is actively supplied can access the highly reliable functional part 316.

[0325] Therefore, the braking system is configured such that the safety function of the decision unit receives all status signals from other safety monitors that occur in the system, identifies error responses accordingly, and transmits these error responses to the brake control unit, actuator control unit, or brake force unit switching unit using switching commands, thereby switching from the first brake path to the second brake path or from the second brake path to the first brake path.

[0326] This allows for any combination of the first brake control unit from the first brake path, the second brake control unit from the second brake path, the first actuator control unit from the first brake path, the second actuator control unit from the second brake path, the first brake force unit from the first brake path, and the second brake force unit from the second brake path.

[0327] For example, even if a switching state is confirmed, the first changeover switch 346 can use the functions of the service brake path of the first brake control unit 1186 and may remain in the service brake path to the extent that these functions are still reliable, or in particular, if an error state is confirmed in the data storage device 345. In particular, a mixed mode may exist. If an error exists in the safety brake path and therefore a further safety protection stage is formed, the service brake path may consist of the first brake control unit 1186 as a fallback means to the extent that.

[0328] Similarly, even if a switching state is confirmed, the second changeover switch 346 can use the functions of the service brake path of the first actuator control unit 1188, and can remain in the service brake path to the extent that these functions are still reliable, or in particular, if an error state is confirmed in the safety brake path of the second actuator control unit. In particular, a mixed mode may exist. If an error exists in the safety brake path and therefore a further safety protection stage is formed, the service brake path may consist of the first actuator control unit 1188 as a fallback means to the extent that.

[0329] Similarly, even if a switching state is confirmed, the third changeover switch 364 can use the functions of the service brake path of the first brake force unit 1158 and may remain in the service brake path to the extent that these functions are still reliable, or in particular, if an error condition is identified in the safety brake path of the second brake force unit 1194. In particular, a mixed mode may exist. If an error exists in the safety brake path and a further safety protection stage is formed, the service brake path may consist of the first brake force unit 1158 as a fallback means to the extent that. The same applies to the energy supply unit 1170.

[0330] The switching back to the service brake path can be performed at each selector switch independently of other selector switches. In particular, the brake control unit, actuator control unit, and brake force unit can be configured to use the service brake path, safety brake path, a combination of safety brake paths, a combination of safety brake paths, or a combination of service brake paths.

[0331] The present invention has been described using examples. These examples are essentially illustrative and do not limit the present invention as defined by the claims. As will be apparent to those skilled in the art, deviations from the examples are possible without moving beyond the scope of protection of the claims.

[0332] In this embodiment, the train coupling is implemented as an electric train coupling to which electrical energy is supplied via an overhead line. Alternatively, electrical energy can be supplied to the train coupling via a generator, such as a diesel generator, provided in, for example, a drive vehicle or a towing vehicle.

[0333] In this embodiment, the train coupling 1 is implemented as a train coupling 1 comprising a driven vehicle 110, which is a guide vehicle, and a plurality of towing vehicles 150. Optionally, a plurality of vehicles or all vehicles may be driven, particularly instead of the guide vehicle. Furthermore, one or more towing vehicles may be equipped with pantographs in place of or in addition to the guide vehicle.

[0334] In this embodiment, the control line 128 is configured as a digital data bus. Alternatively, analog control signals can be transmitted via the control line 128. Furthermore, the control line may be implemented in a hierarchically structured communication system. For example, a train coupling communication means may be provided, connected to a vehicle-specific communication means using a gateway means. Furthermore, communication means may be provided redundantly.

[0335] In particular, features from various embodiments can be combined. Therefore, for example, an energy supply unit integrated into an actuator can be adapted for use in all other embodiments.

[0336] The brake control unit is configured to obtain a control input with a braking command, an expansion amount, or a force adjustment amount, and to determine an operating amount or force adjustment amount from these. Furthermore, the brake control unit is configured to output the operating amount or force adjustment amount to an actuator, a brake control unit, an actuator control unit, or a brake force unit.

[0337] The actuator control unit is configured to obtain a force adjustment amount and determine the manipulated amount from the force adjustment amount. Furthermore, the actuator control unit is configured to output the manipulated amount to the actuator, the brake control unit, the actuator control unit, or the brake force unit.

[0338] The braking force unit is configured to receive an input and execute a mechanical braking process.

[0339] The brake control unit, actuator control unit, brake force unit, and energy supply unit are configured to determine the switching state and output a switching signal or switching command in the case of the switching state.

[0340] The brake control unit, actuator control unit, brake force unit, and energy supply unit are configured to receive a switching signal or switching command and, in response to receiving the switching signal or switching command, switch from the first brake path to the second brake path, or from the second brake path to the first brake path, in particular from the service brake path to the safety brake path, or from the safety brake path to the service brake path.

[0341] The conjunctions "und," "oder," and "entweder...oder" are used in a similar sense to logical AND, logical OR (often "und / oder"), or logical exclusive OR. In particular, unlike "entweder...oder," the conjunction "oder" may imply the presence of both operands.

[0342] The enumeration of method steps serves only to list the required method steps in the specification and claims. The enumeration of method steps does not imply a required order or sequence of method steps unless such order or sequence is explicitly stated or is obvious to a person skilled in the art. Furthermore, such enumeration does not imply that they are self-contained.

[0343] The term "Aufweisen" is not intended to be exhaustive in the claims, and there may be further elements and steps.

[0344] The use of the indefinite article "ein" or "eine" does not exclude plural existence, and should be understood as "mindestens ein" or "mindestens eine" unless restricted to "genau ein" or "genau eine".

[0345] Furthermore, in this invention, the following terms shall be understood in the sense described below.

[0346] Electromechanical braking system: A braking system that uses electronic, electrical, and mechanical components to generate deceleration / braking force for a vehicle.

[0347] Brake path: The set of all functions that are active between the control input of the braking system and the generation of frictional braking force, and that form the overall braking function of the system.

[0348] Safety Integrity Level (SIL): Also known as SIL. A safety requirement level compliant with DIN EN61508-2:17.

[0349] Safety braking function: Also referred to as a braking function with a high degree of safety integrity. A local or train-wide function of the braking system (e.g., emergency brake, parking brake) that has high safety requirements. A safety braking function is a braking function that has a higher level of safety than the service brake function.

[0350] Safety braking path: Also referred to as the second braking path. A braking path as a series of functions that, as a whole, achieves a braking process with high safety integrity, that is, implements at least one safety braking function.

[0351] (Highly integrated) minimal function: A function as a component / subgroup of a safety brake function that possesses extremely high safety integrity, is not affected by or operated by other (braking) functions, especially extensions, and does not depend on other (braking) functions, especially extensions, for the fulfillment of its function.

[0352] A highly reliable functional component (also known as a segmented functional component). It functions as a component of the brake path, based on a well-established, indestructible functional mechanism (e.g., a mechanical brake caliper), and possessing inherent safety characteristics.

[0353] Service braking function: Also known as a braking function with a lower safety integrity level. It is a local or train-wide function of the braking system that provides a conventional, typically initiated by the train driver, adaptive braking function that meets general safety requirements. Service braking functions have a lower safety integrity level than safety braking functions.

[0354] Service braking path: Also called the first braking path. A braking path as a series of functions that achieve a braking process with low safety integrity as a whole.

[0355] Extensions: Extending basic braking functions with measures to improve quality (e.g., anti-slip, load correction), local or train-wide functionality of the braking system.

[0356] Safety functions: Functions that monitor and diagnose the integrity of other functions (especially the brake path) and, if necessary, perform compensation processes using a switching process to maintain or restore safe braking functions. In particular, there are safety monitoring functions such as brake path monitor, actuator monitor and supply monitor, and other safety functions such as determination unit and data storage function.

[0357] Determination unit: A safety function configured to receive all status signals of the safety monitoring function occurring in the system, identify error responses accordingly, and thereby transmit these error responses to at least one switching unit using switching commands.

[0358] Switching Unit: A functional group that, upon receiving a switching command, switches between the service brake path and the safety brake path, or between the safety brake path and the service brake path, in the brake control unit, actuator control unit, or brake force unit.

[0359] Brake path monitor: A safety monitoring function that monitors physical parameters related to the safety of the brake path and transmits status signals to the decision unit via the brake path. In particular, the brake path monitor is configured to identify erroneous behavior in the braking function of the first brake control unit.

[0360] Actuator Monitor: A safety monitoring function that monitors physical parameters related to the safety of the actuator and transmits status signals to the decision unit via the actuator. In particular, the actuator monitor is configured to identify erroneous behavior of the first or second actuator control unit or the first or second brake force unit.

[0361] Supply Monitor: A safety monitoring function that monitors physical parameters related to the safety of the energy supply of the braking system and transmits status signals to the decision unit via the energy supply unit. In particular, the supply monitor is configured to identify erroneous behavior or error conditions of the energy supply unit and the switching process to the internal energy buffer, and to notify the decision function of this, or the imminent (final) depletion of the energy supply of the integrated energy buffer, using status signals.

[0362] Data storage function: In the event of a failure / malfunction of the first brake control unit, the remaining safety function is configured to supply alternative values ​​for forming the force adjustment amount and to supply them to the actuator control unit as actual values ​​based on the switching signal of the determination unit.

[0363] Brake control unit: A set of functions that provide overall train braking and extended functions, as well as local braking and extended functions, along the braking path, based on control inputs, vehicle state variables, or braking system state variables.

[0364] Actuator control unit: A set of functions for providing force generation functionality in the braking path based on the force adjustment amount.

[0365] Brake force unit: A set of functions for generating frictional braking force based on the manipulated input.

[0366] Brake control unit: An assembly configured to perform the functions of a brake control unit, and optionally, additionally, the functions of an actuator control unit.

[0367] Actuator: An assembly configured to perform the functions of a brake control unit, actuator control unit, and brake force unit.

[0368] Extension carrier: An assembly configured to provide extended functionality.

[0369] Force adjustment amount: An open-loop control amount or closed-loop control amount, as well as an open-loop control amount or steering amount belonging thereto, that directly or indirectly expresses the requirements of the brake path that generate force (e.g., cylinder force) in the coordinate system related to the brake regulator, and includes, for example, reduction signals, adjustment amounts for quality improvement, etc., that should be considered when adjusting this force.

[0370] Manipulated variable: An open-loop or closed-loop controlled variable supplied to the electromechanical process or operating principle of the present invention to define and require a unique state of motion, force, or position, or a similar state characteristic (e.g., parking brake).

[0371] Energy supply unit: A set of functions that provide energy to the braking system assembly. [Explanation of symbols]

[0372] 1. Railway vehicle coupling 110 Driven vehicles 112 Driving means, electric motor 114 Driven axle 116 Drive wheels 118 rails 120 Pantograph 122 Overhead line 123 Storage Battery 124 Driver's cab of a driven vehicle 126 Electrical supply lines 128 Control Line 140 Connection section 150 Towing Vehicles 154 Undriven shaft 156 Undriven wheels 160 Final vehicle 162 Driver's cab of the last vehicle 200 Braking System (First Embodiment) 202 Energy supply interface 204 Control Line Interface 206 Movable friction elements, rotary friction elements, brake discs 208 Brake Caliper 210 Static friction elements, brake shoes 212 Friction element driving means, brake actuator motor 214 Spindle drive unit 216. Highly reliable functional parts 218 Control Inputs 220 Vehicle status input 222 Braking System State Input 223 Energy supply 224 Brake control unit 226 First control path 228 Service Brake Route 230 Second control path 232 Safety Brake Route 234 Brake force unit 236 First functional part, first path force generation 238 Second functional part, second path force generation 239 Friction braking force, pressing force 300 Braking System (Second Embodiment) 316. Highly reliable functional parts 324 Brake control unit 334 First functional group of brake control unit for brake function and extension function 336 Second functional group of brake control unit for safety braking function 338 Third functional group of the brake control unit for safety functions 340 Safety Features 341 Brake Path Monitor 342 Actuator Monitor 343 Supply Monitor 344 Decision Section 345 Data storage function 346 First switching unit of the brake control unit 348 Actuator Control Unit 350 First control path 352 Second control path 354 Fourth functional group of actuator control unit for safety functions 356 Second switching unit of the actuator control unit 358 Brake force unit 360 First functional part 362 Second Functional Part 364 Third switching unit of the braking force unit 366 sensors 370 Energy supply units 372 buffer memory 374 External energy supply unit 376 Fifth functional group of the energy supply unit for safety functions 378 Fourth switching unit of the energy supply unit 380 Switching Instruction 382 Force adjustment amount 384 Manipulated amount 386 Brake energy supply 400 Braking System (Third Embodiment) 458 Brake force unit 470 Energy supply units 480 Brake Control Unit 482 Actuators 484 Energy Supply Department 486 First brake control unit 488 First actuator control unit 490 Second brake control unit 492 Second actuator control unit 494 First manipulated amount 495 Second control amount 496 Manipulated amount A 497 Manipulated amount B 500 Braking System (Fourth Embodiment) 558 Brake force unit 580 Brake Control Unit 582 Actuator 586 First brake control unit 588 First actuator control unit 590 Second brake control unit 592 Second actuator control unit 594 Extension Carrier 594' Extension Unit (Service Brake Path) 594'' Extension Unit (Safety Brake Path) 594''' Extension unit (usual brake path) 596 Third brake control unit 597 extensions 598 Expansion amount 599 Sensor Quantity 600 Braking System (Fifth Embodiment) 658 Brake force unit 670 Energy Supply Unit 680 Brake Control Unit 682 Actuator 684 Energy Supply Department 686 First brake control unit 688 First Actuator Control Unit 690 Second brake control unit 692 Second actuator control unit 700 Braking System (Sixth Embodiment) 758 Brake force unit 780 Brake Control Unit 782 Actuator 784 Energy Supply Department 786 First brake control unit 788 First Actuator Control Unit 790 Second brake control unit 792 Second actuator control unit 800 Braking System (Seventh Embodiment) 858 Brake force unit 880 Brake Control Unit 882 Actuator 884 Energy Supply Department 886 First brake control unit 888 First Actuator Control Unit 890 Second brake control unit 892 Second actuator control unit 900 Braking System (Eighth Embodiment) 948 Actuator Control Unit 980 Brake Control Unit 982 Actuator 984 Energy Supply Department 986 First brake control unit 988 First Actuator Control Unit 990 Second brake control unit 992 Second actuator control unit 1000 Braking System (9th Embodiment) 1080 Brake Control Unit 1082 Actuator 1084 Energy Supply Department 1118 Control Input 1158 First braking force unit 1170 Energy supply unit 1186 First brake control unit 1188 First Actuator Control Unit 1190 Second brake control unit 1192 Second actuator control unit 1194 Second braking force unit 1195 Force generation amount

Claims

1. A braking system (500) for railway vehicles, The braking system (500) comprises a brake control unit (580), an extension unit carrier (594), an actuator (582), a first brake path (228) from a function that is active between the control input of the braking system (500) and the generation of a braking force, and a second brake path (232) from a function that is active between the control input (218, 1118) of the braking system (500) and the generation of a braking force. The brake control unit (580) is, A first brake control unit (586) configured to provide a braking function and output a first force adjustment amount, The system includes a first actuator control unit (588) configured to provide a function for generating friction braking force based on the first force adjustment amount and to output a first control amount, The actuator (582) is A second brake control unit (590) is configured to provide a braking function and output a second force adjustment amount, A second actuator control unit (592) is configured to provide a function for generating a friction brake force based on the second force adjustment amount and to output a second control amount, The system includes a brake force unit (558) configured to provide a function of generating friction brake force based on the first or second operating amount, The braking system (500), in particular the braking force unit (558), further has a first group of segmented functional parts which are part of the first braking path (228) and part of the second braking path (232), and are configured to generate a frictional force such that the railway vehicle is decelerated. Braking system (500).

2. The first brake path (228) is configured to provide a brake function with low safety integrity, The second brake path (232) is configured to provide a brake function with high safety integrity, The braking system (500) according to claim 1, wherein the braking function having low safety integrity has a lower safety level than the braking function having high safety integrity.

3. The braking system (500) according to claim 1, wherein the extension carrier (594) is configured to provide a braking function for the second brake path (232).

4. The braking system (500) according to claim 1, wherein the extension carrier (594) is configured to receive or generate a sensor amount (599) or to output an extension amount (598).

5. The first brake control unit (586) is configured to receive an expansion amount (598) and output a force adjustment amount. The first actuator control unit (588) is configured to receive a force adjustment amount and output an operation amount, The second brake control unit (590) is configured to receive a force adjustment amount and an expansion amount (598), as well as optionally an additional switching command (380), and to output the force adjustment amount or the switching command (380). The second actuator control unit (592) is configured to receive a force adjustment amount and a switching command (380) and output an operating amount or a switching command (380), or The braking system (500) according to claim 1, wherein the brake force unit (558) is configured to receive a switching command (380) or an operation amount.

6. The first brake control unit (586) and the first actuator control unit (588) are configured to provide the braking function of the first brake path (228), The second brake control unit (590) and the second actuator control unit (592) are configured to provide the braking function of the second brake path (232), The braking system (500) according to claim 1, wherein the braking force unit (558) is configured to provide a braking function for the first braking path (228) or the second braking path (232).

7. The braking system (500) further comprises an energy supply unit (470), the energy supply unit (470) configured to supply energy, in particular electrical energy, to the components of the braking system (500) for the operation of the braking system (500), as described in claim 1.

8. The braking system (500) according to claim 7, wherein the first brake control unit (586), the second brake control unit (590), the first actuator control unit (588), the second actuator control unit (592), the energy supply unit (470), or the brake force unit (558) are configured to receive a switching command (380) and to switch from the first brake path (228) to the second brake path (232) or from the second brake path (232) to the first brake path (228) upon receiving the switching command (380).

9. The braking system (500) according to claim 7, wherein the first brake control unit (586), the second brake control unit (590), the first actuator control unit (588), the second actuator control unit (592), the energy supply unit (470), or the brake force unit (558) each has a switching unit (346, 356, 364, 378) that determines a switching state and outputs a switching command (380) when a switching state is determined.

10. The braking system (500) according to claim 7, wherein the braking system (500) is configured to perform a safety function (340).

11. The braking system (500) according to claim 10, wherein the safety function (340) is a safety function (340) from a group of safety functions (340) which include a brake path monitor, actuator monitor, supply monitor, determination unit (344), and data storage function (345).

12. The energy supply unit (470) is configured to perform the safety function (340) of the supply monitor, The braking system (500) according to claim 11, wherein the second brake control unit (590) is configured to perform the brake path monitor, the actuator monitor, the data storage function (345), and the safety function (340) of the determination unit (344).

13. The braking system (500) according to claim 1, wherein the braking force unit (558) is configured to obtain an input and control the first group of the functional parts so that the railway vehicle is decelerated.

14. It is a railway vehicle, A braking system (500) according to any one of claims 1 to 13 is provided. Railway vehicles.

15. A braking method using the braking system (500) described in Claim 1, a) Step a) The brake control unit (580) provides a brake function by the first brake control unit (586). b) step b) the first brake control unit (586) outputs a first force adjustment amount. c) Step c) Based on the first force adjustment amount from step b), the brake control unit (580) provides a brake function that generates a friction brake force by the first actuator control unit (588). d) step d) outputting a first manipulated amount by the first actuator control unit (588) e) Step e) Providing a brake function by an extension unit in the extension carrier (594) f) Step f) The actuator (582) provides a braking function by the second brake control unit (590). g) step g) the second brake control unit (590) outputs a second force adjustment amount. h) step h) providing a brake function in the actuator (582) that generates a friction brake force by the second actuator control unit (592) based on the second force adjustment amount from step g), i) step i) the second actuator control unit (592) outputs a second manipulated amount. j) A brake function is provided which generates a friction brake force by the brake force unit (558) based on the first operating amount from step d) or the second operating amount from step i). k) Providing a first brake path (228) having a function of being active between the control inputs (218, 1118) of the braking system (500) and the generation of braking force k) and l) Providing a second brake path (232) having a function of being active between the control inputs (218, 1118) of the braking system (500) and the generation of braking force l) It has Braking method.

16. The first brake path (228) from step k) is configured to provide a brake function with low safety integrity, The braking method according to claim 15, wherein the second brake path (232) from step l) is configured to provide a braking function with high safety integrity.

17. Step a), step c), step e), step f), step h), or step j) a) a step of providing the brake function of the first brake path (228) or a) A step of providing the braking function of the second brake path (232) a) The braking method according to claim 15 or 16, comprising:

18. The braking method according to claim 15 or 16, wherein the braking function from step e) is the braking function of the second braking path (232).

19. moreover, m) step of receiving the sensor amount (599) by the extension function carrier (594), The braking method according to claim 15 or 16, wherein step n) is provided, which involves processing the sensor amount (599) from step m) with the extension function carrier (594).

20. moreover, The braking method according to claim 15 or 16, wherein the step o) is provided by the extension carrier (594) to output an extension amount (598).

21. Furthermore, at least one of the following steps, namely, p) step p) receiving the expansion amount (598) by the first brake control unit (586) q) step q) the first brake control unit (586) outputs the first force adjustment amount. r) step r) receiving the first force adjustment amount by the first actuator control unit (588) s) step s) the first actuator control unit (588) outputs the first manipulated amount. t) step t) receiving the first force adjustment amount or extension amount (598) by the second brake control unit (590) u) step u) the second brake control unit (590) outputs the second force adjustment amount or switching command (380). v) The second actuator control unit (592) receives the second force adjustment amount or switching command (380) v) w) step w) the second actuator control unit (592) outputs the second manipulated amount or switching command (380) The braking method according to claim 15 or 16, wherein step x) is indicated by the brake force unit (558) receiving a switching command (380) or the first operating amount or the second operating amount.

22. moreover, a) A step in which a switching command (380) is obtained by the first brake control unit (586), the second brake control unit (590), the first actuator control unit (588), the second actuator control unit (592), the energy supply unit (470), or the brake force unit (558). yb) The braking method according to claim 15 or 16, further comprising step yb) of switching from the first brake path (228) to the second brake path (232), or from the second brake path (232) to the first brake path (228), in the first brake control unit (586), the second brake control unit (590), the first actuator control unit (588), the second actuator control unit (592), the energy supply unit (470), or the brake force unit (558).

23. moreover, za) Step za) Determine the switching state using the first brake control unit (586), the second brake control unit (590), the first actuator control unit (588), the second actuator control unit (592), the energy supply unit (470), or the brake force unit (558). zb) The braking method according to claim 15 or 16, further comprising step zb) outputting a switching command (380) by the first brake control unit (586), the second brake control unit (590), the first actuator control unit (588), the second actuator control unit (592), the energy supply unit (470), or the brake force unit (558) when the switching state is required.

Images