Functional unit having a fallback operating mode for a braking system of a rail vehicle

Abstract

Disclosed is a functional unit (10) for a braking system of a rail vehicle, said functional unit being configured to provide a function of a braking path of the braking system or a function of a portion of a braking path of the braking system. Also disclosed are a braking system, a rail vehicle, and a method.

Description

[0001] DESCRIPTION

[0002] Functional unit with fallback operating mode for a braking system of a rail vehicle

[0003] The present invention relates to a functional unit for a braking system of a rail vehicle according to claim 1, which, due to its design, leads to improved availability of the braking system. Furthermore, the invention relates to a braking system having such a functional unit and to a rail vehicle having such a braking system. Furthermore, the invention relates to a method for operating such a functional unit, such a braking system, and / or such a rail vehicle.

[0004] A variety of brakes and braking systems are used in rail vehicles. These are designed according to different physical principles. On the one hand, there are wear-free brakes, such as recuperative motors, which recover energy from the rail vehicle's movement, which can then be fed into a storage unit for later use or converted into heat via a braking resistor. Another wear-free brake is the eddy current brake. There are also wear-prone brakes. These include friction brakes, which can be designed in different ways. Essentially, a pair of at least two friction components is brought together to create a friction force that produces a braking effect. These include, in particular, electromechanical, pneumatic, and electropneumatic brakes.But a magnetic track brake is also one of the brakes subject to wear.

[0005] These brakes or braking systems are subject to different boundary conditions and are assigned safety integrity levels (SILs), partly based on the components and / or subsystems used by the braking system's functions. Furthermore, the brakes are controlled by control inputs that actuate corresponding brakes via braking paths. These braking paths have intermediate units, each of which has a different SIL. Typically, the unit with the lowest SIL also determines the SIL of the entire braking path. The lower the SIL, the higher the probability of failure of the corresponding unit and thus of the entire braking path. The reliability of the unit in question is thus reduced.

[0006] It is therefore an object of the present invention to provide a possibility with which the availability of the unit and possibly of the entire braking path or even of the entire braking system can be improved.

[0007] This problem is solved by the subject matter of the independent claims. Advantageous further developments are the subject matter of the dependent claims.

[0008] Preferably, a functional unit is provided for a braking system of a rail vehicle. The functional unit is designed to provide a function of a braking path of the braking system or a function in a part of a braking path of the braking system, wherein the functional unit comprises the following:

[0009] - an input interface configured to receive at least one input variable;

[0010] - an output interface configured to output at least one output variable;

[0011] - a first processing unit which is designed to generate at least one first intermediate variable on the basis of the at least one input variable;

[0012] - a second processing unit configured to generate at least one second intermediate variable;

[0013] - an output unit which is designed to generate the at least one output variable from the at least one first intermediate variable and the at least one second intermediate variable and to transmit it to the output interface.

[0014] The functional unit is preferably designed to, depending on a

[0015] Switching command to switch from a first operating mode to a second operating mode, in which the output unit generates the at least one output variable independently of the at least one first intermediate variable.

[0016] Preferably, the output unit is configured to generate the at least one output variable exclusively from the at least one first intermediate variable in the first operating mode. Alternatively, the output unit may be configured to generate the at least one output variable from the at least one first intermediate variable and from at least one further intermediate variable in the first operating mode. The at least one further intermediate variable can be provided by the second processing unit and / or by a further processing unit of the functional unit.

[0017] Advantageously, the functional unit reacts to a fault in the functional unit itself or in the braking system by changing the operating mode in order to continue to enable the provision of functions.

[0018] The switching command itself can be generated by the functional unit itself, and in particular by a monitoring unit, such as a first monitoring unit described later. Alternatively or additionally, it can also be generated by an external source, such as an external monitoring unit. A control unit of the braking system in which the functional unit is provided can also provide the switching command.

[0019] Preferably, the functional unit is configured to generate the switching command from an input status message. The input status message is specified further below.

[0020] The function implemented by the functional unit is essentially realized by outputting or providing at least one output variable. The output variable is made available to the braking system or other functional units of the braking system via the output interface. In the first operating mode, the function is such that the functional unit generates the at least one output variable depending on the at least one input variable and by using, preferably exclusively using, the first processing unit. In the second operating mode, the functional unit continues to provide the at least one output variable, but without using the first processing unit.

[0021] The second processing unit can generate the second intermediate variable based on the at least one input variable that the first processing unit also processes. Alternatively, it can also be provided that the second processing unit uses other input variables or no input variables at all to generate the second intermediate variable. This is advantageous if the input variables that the first processing unit uses to generate the first intermediate variable are faulty or are missing due to a failure of a unit in the braking system. If the second processing unit and / or a further processing unit does not use any input variables, this processing unit can, for example, be designed to output a predetermined value as a corresponding intermediate variable. This can, for example, be seen as a substitute value for the first intermediate variable.

[0022] Preferably, the functional unit can be an electrical or electronic functional unit that performs corresponding functions within part or all of the braking path. However, this should not preclude other configurations of the functional unit, such as the use of highly reliable functional components (e.g., mechanics, hydraulics, pneumatics, etc.).

[0023] The functional unit processes the at least one input variable into corresponding intermediate variables by means of the first and the second processing unit, wherein the output unit generates the at least one output variable on the basis of these intermediate variables, which is then passed to the output interface.

[0024] In addition to the first and second processing units, the functional unit can have at least one further processing unit, which also generates one or more corresponding intermediate variables from the at least one input variable. The change from the first to the second operating mode is triggered, in particular, by the fulfillment of a predetermined change condition via the input status message. The input status message and associated change conditions will be discussed further later.

[0025] In the first operating mode, only the first processing unit can be active, while the second and / or the subsequent processing units can be deactivated. This means that they do not output any corresponding intermediate values. This ensures that the functional unit operates as efficiently as possible.

[0026] However, it can also be provided that the second and / or the further processing unit are activated in the first operating mode. These processing units can generate the corresponding intermediate variables and preferably transmit them to the output unit. However, it can also be provided that no transmission of the intermediate variable(s) generated nevertheless takes place in this first operating mode. If the second processing unit is activated in the first operating mode, this has the advantage of ensuring the most seamless transition possible in the provision of functions by the functional unit, since the intermediate variable of the second and / or the further processing unit has already been generated at the time the operating modes change.

[0027] The output unit can be designed in different ways. It can be a pure pass-through unit, in which an intermediate variable transmitted from a processing unit to the output unit is simply passed through unchanged, i.e. is transmitted unchanged to the output interface, wherein the transmitted intermediate variable functions unchanged as the at least one output variable. It is advantageous if another processing unit, whose intermediate variable is not to be passed through, is deactivated or at least the intermediate variable generated by this processing unit is not transmitted to the output unit. The output unit can, for example, be designed such that in the second operating mode it no longer uses the intermediate variable of the first processing unit as the output variable.The output unit can also be designed as a selection unit in which it actively selects which intermediate variable is used depending on the operating mode or the input status message. The output unit can, for example, be designed such that in the second operating mode it blocks the intermediate variable of the first processing unit and only uses the intermediate variable(s) of the second and / or the further processing unit. The selection can, for example, also be made based on amounts of the corresponding intermediate variables, so that, for example, the larger amount is always selected as the output variable. Alternatively or additionally, the selection can also be made based on diagnostic messages or diagnostic data from the processing units or from an external source, such as another functional unit or an external monitoring unit.

[0028] However, the output unit can also be designed as a superposition unit, in which several intermediate variables generated by the processing units are superimposed. For example, the generated intermediate variables can be added together.

[0029] To change the operating mode, the functional unit can generate a switching command, which is preferably generated by a decision maker that processes the input status message and on the basis of which a decision is made as to whether the operating mode should be maintained or changed.

[0030] The at least one input variable and the at least one output variable may comprise electrical signal variables and / or physical flow variables (e.g. electrical power flow, mechanical torque).

[0031] The functional provision of the functional unit as a whole can be realized by at least one output variable. Due to the activated operating mode, a processing unit or the functional unit itself can send a message to the braking system or other functional units by means of a status message or output status message.

[0032] - OK: The unit is operating in normal mode;

[0033] - ACUTE OK: The unit is operating in normal mode, but this will be terminated in the foreseeable future;

[0034] - BACKUP: The unit is in emergency mode; - ACUTE BACKUP: The unit is operating in emergency mode, but this will end in the foreseeable future

[0035] - NOK: The unit has failed, the function is no longer provided.

[0036] The second operating mode of the functional unit can be the emergency operating mode. In addition to the OK and NOK states, the other states ACUTE-OK, BACKUP, and ACUTE-BACKUP are optional. The first operating mode of the functional unit can be considered the normal operating mode. Via input status messages, the functional unit can also receive status messages from other, particularly upstream, functional units and respond accordingly.

[0037] Preferably, in the second operating mode, the first processing unit is in a non-interactive state with respect to the output unit and / or the second processing unit and / or other processing units. This prevents the intermediate variables generated by the processing units, on which the output variable is ultimately based, from being influenced by the first processing unit in this operating mode. The first processing unit therefore influences neither one of the intermediate variables nor the processing units whose intermediate variables are used to generate the output variable in this operating mode. The output unit itself is also not influenced by the first processing unit. Alternatively, it can also be provided that the output unit does not take the first intermediate variable into account when generating the output variable.In this way, it is possible to provide the function that the functional unit realizes without using the first processing unit.

[0038] Preferably, the functional unit in the second operating mode has a limited range of functions or an identical range of functions compared to the first operating mode. If the second operating mode is activated or the functional unit is operated in the second operating mode, the output variable is independent of the intermediate variable of the first processing unit and, in general, of the first processing unit as a whole. If the second processing unit and / or at least one further processing unit, which influences the output variable of the functional unit in the second operating mode and thus ultimately assumes function provision, has a reduced range of functions compared to the first processing unit, this also affects the functional unit as a whole.If, for example, the first processing unit is configured to calculate an intermediate variable that is dependent on the at least one input variable, the second processing unit may not be configured to receive the same input variables as the first processing unit. Instead, the second processing unit and / or the at least one further processing unit may be configured to receive only a portion of the input variables of the first processing unit, other input variables that are different from those of the first processing unit, or even no input variables at all. In any case, the second processing unit and / or the at least one further processing unit may be configured to output intermediate variables with lower dynamics or reduced values.If the corresponding processing unit is designed in such a way that it only outputs a predetermined substitute value, this does not have any dynamics because it does not change. In another case, there are no longer any input variables available that are required to execute the functionality, i.e. to generate the corresponding intermediate and / or output variable. In this case, too, the substitute value can be used. Its size or amount can also be limited. This results in an output variable and thus a functionality that then has reduced dynamics and / or a reduced amount compared to the first operating mode, depending on the intermediate variables relevant in the second operating mode.If the functional unit in the second operating mode has an identical range of functions compared to the first operating mode, this can mean that the dynamics and the level of at least one output variable remain unchanged compared to the first operating mode. This can be achieved, for example, by a second and / or additional processing unit that is identical to the first processing unit.

[0039] Functional scope can generally be understood as a dynamic and / or height / amount of a maximum value of a quantity that is generated by a function based on certain boundary conditions such as operating mode and / or input variables.

[0040] In general, it can be provided that in the event of failure or shutdown of the first processing unit, the remaining functioning second processing unit and / or at least one further processing unit increases or maintains its dynamics or functional scope in the second operating mode based on planned reserves. As a result, with increased dynamics of the corresponding processing unit(s), the functional unit can have a dynamic range when generating the at least one output variable that remains the same compared to the first operating mode. Alternatively, the dynamic range of the functional unit can also be reduced, particularly when the intermediate variables are superposed by the output unit. Increasing the dynamics or functional scope can generally mean partial or complete compensation for the reduced dynamics or the reduced functional scope in the second operating mode.However, it can be provided that the increase in the dynamics or functional scope of one or more processing units integrated in the second operating mode is limited in time to avoid damaging the corresponding processing unit. For example, this can be a required electrical current that the processing unit integrated in the second operating mode outputs as an intermediate variable. This can be increased for a limited time. This is associated with overload operation. This is terminated after a predetermined time. Such termination and an associated change in the function of the functional unit can be announced by means of an output status message from the functional unit to the braking system and / or other functional and / or monitoring units.

[0041] If the functional unit is located in a braking path with an upstream functional unit or two functional units, wherein the upstream functional unit already outputs at least one output variable with reduced dynamics and / or reduced functional scope and forwards information about this to the downstream functional unit by means of an input status message, the downstream functional unit can react to this in order not to overload the upstream functional unit and, in turn, switch to an operating mode, such as the second operating mode, in which the downstream functional unit has reduced dynamics and / or a reduced functional scope. An upstream functional unit that outputs an electrical current as an output variable can be mentioned as an example.A functional unit that processes the current, such as a brake actuator of an electromechanical brake, can then be considered a downstream functional unit. While this unit has processing units that are all functioning properly, meaning there is no risk of failure, this actuator can switch to an operating mode that places fewer demands on the dynamics and / or functionality of the upstream functional unit.

[0042] In general, it can be provided that in response to an input status message from an upstream functional unit, which in particular has information about reduced dynamics and / or a reduced functional scope of this upstream functional unit, wherein the upstream functional unit supplies its at least one output variable as the at least one input variable to a downstream functional unit, the downstream functional unit switches to an operating mode in which it itself has reduced dynamics and / or a reduced functional scope in order to place less load on the upstream functional unit. This operating mode can be the second operating mode. The operating mode to which the downstream functional unit switches can be an emergency operating mode.The upstream functional unit may exhibit reduced dynamics and / or reduced functionality due to the failure of individual units of the upstream functional unit. In this case, the downstream functional unit itself can also operate error-free, i.e., each of the units of the downstream functional unit is error-free.

[0043] Preferably, the functional unit has a limited function provision in the second operating mode, in particular a limited remaining duration of the function provision or a limited number of function executions. The remaining duration of the function provision can, for example, be time-based, so that after a predetermined execution time has elapsed, the function provision in the second operating mode is discontinued. Furthermore, the function provision in the second operating mode can also be discontinued upon reaching a predetermined number of function executions.

[0044] In general, when the second operating mode is terminated, the functional unit can be switched off or the functional unit can continue to operate in a third operating mode.

[0045] Preferably, in general, in the case of a function provision with a limited remaining duration, a safe state of the functional unit is assumed before the function provision is terminated, in particular by establishing the safe state with the last output variable. For example, this could be braking the rail vehicle or shutting down the functional unit.

[0046] It is also conceivable that a predetermined reaction is carried out, for example if further diagnostic messages or input status messages are present or absent, the contact parts of a friction brake can be applied and the functional unit can then be switched off. In this case, however, it can also be provided that the contact parts of individual friction brakes are released and the functional unit is then switched off. In this case, the brake actuator controlled by the functional unit or the braking path is excluded from further braking, which prevents a malfunction in this braking path. In principle, the following safety reactions are possible that the functional unit can carry out: if a diagnostic message / input status message, in particular an external one, or a switchover command is present: Carrying out a safety reaction: "Release before failure" or "Apply before failure".If such a diagnostic message / input status message or toggle command is not present: “Apply before failure” or “Release before failure”.

[0047] Preferably, the first operating mode is a normal operating mode of the functional unit. This means that if there is no reason to switch to the second operating mode, for example, due to the input status message, the functional unit will always operate in the first operating mode.

[0048] The second operating mode is preferably an emergency operating mode of the functional unit. This means that the functional unit switches to an emergency operating mode triggered by the input status message. This can be the case if there is an error in the functional unit itself, in particular in the first processing unit, so that the functional unit can no longer fulfil its function. In this case, switching to the second operating mode is a way of continuing to make the function available, if necessary to a limited extent. Alternatively or additionally, another reason for switching to the second operating mode can also be that the at least one input variable that the first processing unit needs to generate the first intermediate variable is not available or is faulty. In this case, the reason for the switch orThe error does not occur within the functional unit. Given complete and correct input variables, the functional unit would still be able to provide at least one output variable required to implement the function. However, this is no longer possible because the corresponding input variables are not available. In this case, switching to the second operating mode as an emergency operating mode is also advisable.

[0049] Preferably, the functional unit comprises a first monitoring unit configured to generate the input status message. The first monitoring unit may be part of the first, the second and / or the at least one further

[0050] processing unit. However, it can also be designed separately.

[0051] Preferably, the first monitoring unit is designed to generate the input status message and / or the switching command based on at least one of the following data:

[0052] - diagnostic data of the first processing unit;

[0053] - diagnostic data of the second processing unit;

[0054] - external control inputs;

[0055] - specifications from monitoring units of other functional units or higher hierarchical levels;

[0056] Diagnoses or commands for a safety response from monitoring units of other functional units or higher hierarchy levels.

[0057] When using diagnostic data from the first processing unit, this can be data that the first processing unit generates as part of a self-diagnosis. If an error occurs in the first processing unit that prevents further function provision involving the first processing unit, this can be reported to the first monitoring unit, which then generates an input status message, which triggers a switch to the second operating mode.

[0058] The use of diagnostic data from the second processing unit may involve data that the second processing unit has collected as part of a

[0059] Self-diagnosis is created by itself. If there is an error in the second processing unit that prevents further function provision involving the second processing unit, this can be reported to the first monitoring unit, which then generates an input status message. This can be used to switch to the first operating mode, if possible; this can be done if the first operating mode can be operated without the second processing unit; or this can be used to switch to a third operating mode, if possible, or to deactivate the functional unit. The third operating mode can be used primarily if the functional unit cannot be operated in either the first or second operating mode.

[0060] The use of diagnostic data from the second processing unit can alternatively or additionally mean that this is data that the second processing unit creates as part of a diagnosis of the first processing unit. If there is an error in the first processing unit that prevents further function provision involving the first processing unit, this can be reported to the first monitoring unit, which generates an input status message on the basis of which a switch to the second operating mode occurs, if possible. The first monitoring unit can in particular be part of the second processing unit. It can also be provided that the first and second processing units have monitoring units, which then diagnose and monitor their own processing unit and / or the other processing unit.

[0061] External control inputs can originate, for example, from a user, particularly the rail vehicle driver. For example, the driver can make a control input that, when transferred to the input status message, causes a corresponding operating mode change of the functional unit.

[0062] It is also possible for specifications from monitoring units of other functional units to be processed. These can, in particular, be output status messages from these functional units. Output status messages are explained in more detail below.

[0063] Furthermore, specifications can also come from other or higher hierarchical levels, which, for example, act as decision-makers or higher-level monitoring units in the braking system that monitor several functional units.

[0064] Preferably, the input status message can comprise information that an upstream functional unit or a processing unit of an upstream functional unit, on which at least one of the at least one input variable depends, is in a normal operating mode, which is about to end. This information can, for example, originate from an output status message of the upstream functional unit or its corresponding processing unit. This message informs the functional unit that, after the upstream functional unit or its processing unit has ended its normal mode, one or more input variables that the functional unit receives via the input interface and that are directly or indirectly influenced by the upstream functional unit or a processing unit of the upstream functional unit may change.If, for example, the corresponding input variable is no longer available when the upstream functional unit or the processing unit of the upstream functional unit ends the normal operating mode, or is not available in the required quality, granularity or dynamics that the first processing unit of the functional unit requires in particular, the functional unit can take measures upon receipt of this information in order to continue operation in the second operating mode, i.e. independently of the first processing unit, as soon as the upstream functional unit or its processing unit ends the normal operating mode.In this case, a seamless transition from the first to the second operating mode is possible without a sudden and unannounced termination of the normal operating mode of the upstream functional unit or the processing unit of the upstream functional unit having to trigger the termination. If the second processing unit and / or another processing unit that supplies relevant intermediate variables for the at least one output variable in the second operating mode is switched off in the first operating mode, the corresponding processing unit can be activated after receiving this information and before the normal operation of the upstream functional unit or the processing unit of the upstream functional unit is switched off in order to reduce the response time when changing operating mode and thus increase the availability of the functional unit.

[0065] The input status message can preferably comprise information that an upstream functional unit, on which at least one of the at least one input variable depends, is in an emergency operating mode. In this case, the normal operating mode of this upstream functional unit has already ended. The functional unit is preferably designed to interpret whether, due to the emergency operating mode of this upstream functional unit, at least one of the input variables of the functional unit is influenced in such a way that the functional unit itself must switch to the second operating mode. If, for example, the upstream functional unit no longer provides the corresponding input variable, the switch to the second operating mode occurs if the first processing unit absolutely depends on this input variable.If the required input variable is still available, but the upstream functional unit has a reduced range of functions (e.g., the upstream functional unit only outputs a constant substitute value), the functional unit is designed to decide for itself whether to remain in the first operating mode or switch to the second operating mode. This decision can be made by the functional unit evaluating the corresponding input variable from the upstream functional unit depending on the situation (e.g., by comparing the change in this input variable over time), or the functional unit automatically switches to the second operating mode depending on whether or not the emergency operating mode is activated in the upstream functional unit.

[0066] Preferably, the input status message can include information that an upstream functional unit or a processing unit of an upstream functional unit, on which at least one of the at least one input variable depends, has failed, is switched off, or is no longer available. In this case, the upstream functional unit or the processing unit of the upstream functional unit no longer provides any input variables. Preferably, the functional unit then switches to the second operating mode, in which it provides the function regardless of the corresponding input variable.

[0067] Preferably, the input status message can include information that an upstream functional unit or a processing unit of an upstream functional unit, on which at least one of the at least one input variable depends, is in a normal operating mode without this mode being terminated shortly. In this case, the functional unit will preferably remain in the first operating mode, or this message will preferably not trigger a switch to the second operating mode of the functional unit.

[0068] Preferably, the functional unit has an output status message interface, wherein the functional unit is configured to output an output status message via the output status message interface. The output status message can be a message that the functional unit outputs to inform other functional units of the braking system and / or the braking system itself about a status of the functional unit.

[0069] Preferably, the functional unit is designed to generate the output status message, in particular by a second monitoring unit.

[0070] Preferably, the output status message is created based on at least one of the following data:

[0071] - diagnostic data of the first processing unit;

[0072] - diagnostic data of the second processing unit;

[0073] - external control inputs;

[0074] - specifications from monitoring units of other functional units or higher hierarchical levels;

[0075] - the operating mode of the functional unit.

[0076] When diagnostic data from the first processing unit is used, this can be data that the first processing unit creates as part of a self-diagnosis. If there is an error in the first processing unit that prevents further function provision involving the first processing unit, this can be reported to the first and / or second monitoring unit, which uses this to generate an output status message. When diagnostic data from the second processing unit is used, this can be data that the second processing unit creates as part of a self-diagnosis. If there is an error in the second processing unit that prevents further function provision involving the second processing unit, this can be reported to the first and / or second monitoring unit, which uses this to generate an output status message.

[0077] However, the use of diagnostic data from the second processing unit can alternatively or additionally also mean that the data is generated by the second processing unit as part of a diagnosis of the first processing unit. If an error occurs in the first processing unit that prevents further functional provision involving the first processing unit, this can be reported to the first and / or second monitoring unit, which then generates an input status message.

[0078] Preferably, diagnostic data of the first processing unit is generated by the first processing unit, and diagnostic data of the second processing unit is generated by the second processing unit. For this purpose, the corresponding processing unit preferably has a correspondingly configured monitor unit. However, it can also be provided that the processing units, i.e., at least the first and second processing units, monitor and / or diagnose each other. For this purpose, the corresponding processing unit preferably has a correspondingly configured monitor unit.

[0079] External control inputs can originate, for example, from a user, particularly the rail vehicle driver. For example, the driver can make a control input that, when transferred to the input status message, causes a corresponding operating mode change of the functional unit.

[0080] It is also possible for specifications from monitoring units of other functional units to be processed. These can, in particular, be output status messages from these functional units. Furthermore, specifications can also originate from other or higher hierarchical levels, which, for example, act as decision-makers or higher-level monitoring units in the braking system that monitor multiple functional units.

[0081] Finally, the current operating mode of the functional unit can also be used as a basis for creating the output status message.

[0082] Preferably, the output status message contains at least one piece of information on the following:

[0083] - the operating mode of the functional unit;

[0084] - the available range of functions of the functional unit;

[0085] - limited functionality provision;

[0086] - a state of the first and / or second processing unit.

[0087] With information about the operating mode, the functional unit is able to inform other functional units or the braking system as a whole about the current operating mode by sending the output status message.

[0088] If the functional unit is in the second operating mode, downstream functional units can react accordingly; at least one output variable provided via the output interface, or the associated function of the functional unit, should not be able to be processed by the downstream functional unit without a reaction, such as a change of operating mode.

[0089] Information about the available range of functions of the functional unit behaves similarly to information about the operating mode. This also enables downstream functional units to react accordingly if the at least one output variable provided via the output interface, or the associated function of the functional unit, cannot be processed by the downstream functional unit without a reaction, such as a change of operating mode, due to a currently reduced range of functions. As already described above, the range of functions can be limited, particularly in the second operating mode, or the same as that of the first operating mode. Information about a limited range of functions can also be used by downstream functional units to prepare accordingly for an imminent failure of the functional unit or one of its processing units.The limited function provision can be included in the output status message in particular by a limited or remaining time period for the function provision or by a limited or remaining number of function executions.

[0090] Furthermore, the information about a state of the first and / or second processing unit or also about the functional unit may include the following:

[0091] Preferably, the output status message can include information that the functional unit or a processing unit of the functional unit is in a normal operating mode, which is about to end. This message can inform a downstream functional unit that, after the normal mode of the functional unit or its processing unit has ended, one or more input variables for the downstream functional unit may change, which the downstream functional unit receives via the input interface and which are directly or indirectly influenced by the functional unit or a processing unit of the functional unit.

[0092] Preferably, the output status message may include information indicating that the functional unit is in an emergency operating mode. In this case, the normal operating mode, in particular the first operating mode, of this functional unit has already been terminated.

[0093] Preferably, the output status message can comprise information about the fact that the functional unit or a processing unit of the functional unit has failed, is switched off, or is no longer available. In this case, the functional unit or the processing unit of the functional unit no longer provides any output variables or intermediate variables. Preferably, the output status message can comprise information about the fact that the functional unit or a processing unit of the functional unit is in a normal operating mode without this mode being terminated shortly. In this case, the functional unit will preferably remain in the first operating mode, or this message will preferably not trigger a change to the second operating mode of the functional unit.

[0094] Preferably, the first and second monitoring units are identical or implemented as a single component. This component can be part of the first or second processing unit or be provided separately in the functional unit.

[0095] Preferably, the first processing unit has no security integrity, or a security integrity that is lower or equal to that of the second processing unit. This advantageously results in improved availability of the second processing unit. The second processing unit can function as a backup for the first processing unit, with the functional scope of the first processing unit generally being greater than that of the second processing unit, while the availability of the first processing unit is reduced compared to the second processing unit.

[0096] Preferably, the output unit has a safety integrity level that is equal to or higher than that of the second processing unit. This ensures that the functional unit can also provide functionality in the second operating mode with a comparatively high SIL if the first processing unit, with its comparatively low SIL, no longer influences the output variable in the second operating mode.

[0097] The functional unit is preferably designed as a brake control unit, an actuator control unit, a braking force generation unit or a power supply unit.

[0098] A brake control unit is the set of functions for providing train-wide and / or local functions in the braking path based on control inputs or vehicle state variables or braking system state variables. An actuator control unit is the set of functions for providing force generation functions in the braking path based on force control variables. A braking force generation unit is the set of functions for generating friction braking force based on actuation variables. An energy supply unit is the set of functions for providing an energy supply to components of the braking system.

[0099] In a further embodiment of the functional unit, processing units upstream of the output unit can be divided into a chain of processing units, creating provision paths for a function / output variable. In this case, messages from the diagnostics / monitors of the processing units are provided to the monitor of the preceding processing unit or to the first monitor / decision-maker in the chain. The processing units thus form a chain or cascade of functional units.

[0100] The second processing unit preferably has a structure or an identical function to the first processing unit, wherein it is designed to generate the at least one second intermediate variable based on the at least one input variable. In this case, the second processing unit represents a unit that can be designed identically to the first processing unit and / or that provides an identical function. An identical function means that the second intermediate variable, which the second processing unit generates from the at least one input variable, is identical in dynamics and value range to the first intermediate variable, which the first processing unit generates from the at least one input variable. The actual structure of the second processing unit can be the same as that of the first processing unit or different therefrom.If the function of the second processing unit is identical to that of the first processing unit, the generation of the at least one output variable in the second operating mode is identical to the generation of the at least one output variable in the first operating mode. Only the first processing unit no longer influences the generation of the at least one output variable in the second operating mode.

[0101] Preferably, a braking system for a rail vehicle is provided which has a braking path in which a first functional unit as described above is arranged or which is formed by a first functional unit as described above.

[0102] Preferably, the braking system comprises a braking system monitoring unit that monitors the first functional unit and is configured to generate and transmit an input status message to the functional unit. The input status message comes from the braking system monitoring unit located outside the first functional unit.

[0103] The braking system preferably has at least one second functional unit provided in the or a further braking path, wherein the braking system monitoring unit is designed to evaluate the output status messages of the first and second functional units and to carry out error pattern recognition. If several functional units have an identical error or failure, due to which they switch to the second operating mode or due to which they are only active in normal operating mode with a limited range of functions or for a limited time, the braking system monitoring unit can identify a cause for this and, if necessary, send an input status message to all functional units in the braking system that are likely to be affected by the cause, so that they can carry out appropriate measures, such as switching to the second operating mode.

[0104] It may be advantageous if, when an error pattern is detected, an operating mode is adopted which aims to prevent the error from recurring. This can be the second operating mode. However, it can also be the case that the first operating mode is retained and merely the function is restricted. For this purpose, the first processing unit can output intermediate variables with lower dynamics, limited values, or a limited availability. It is clear to a person skilled in the art that the above description of the functional unit(s) and in particular the above-described interaction of the described functional unit with an upstream or downstream or otherwise described functional unit are to be viewed as, in particular, physical and / or functional, embodiments of the braking system described here.The above description of the functional unit(s) can therefore also be seen as a concretization and further development of the braking system described here.

[0105] The braking system, in particular the braking system monitoring unit, or the functional unit can be configured to generate a command or switching command, depending on the status of the processing units or functional units, with which the braking system, the corresponding functional unit, or a processing unit switches to a safe state (safety reaction). This is preferably triggered or entered when it is foreseeable that a specific operating mode that deviates from the normal mode is about to end (e.g., ACUTE BACKUP).

[0106] The functional unit or the braking system is preferably designed to carry out the safety reaction before the corresponding operating mode is terminated and no corresponding safety reaction can be carried out any more.

[0107] Preferably, a rail vehicle is provided with a braking system as described above.

[0108] Preferably, a method is provided. The method is suitable for operating a functional unit as described above, a braking system as described above, or a rail vehicle as described above. The method comprises the following steps:

[0109] - Operating the functional unit in the first operating mode;

[0110] - Receiving an input status message;

[0111] - Switching to the second operating mode if the input status message contains a predetermined change condition; - Operating the functional unit in the second operating mode.

[0112] It is clear to a person skilled in the art that the information provided above in the description of the functional unit, the braking system and the rail vehicle can be analogously viewed as method features that can be used to concretize the method disclosed here.

[0113] The invention is described below using preferred embodiments with the aid of the attached drawings.

[0114] They show:

[0115] Fig. 1 a braking system with several functional units;

[0116] Fig. 2 shows a first embodiment of a functional unit;

[0117] Fig. 3 shows a second embodiment of a functional unit;

[0118] Fig. 4 a concrete implementation of a functional unit; and

[0119] Fig. 5a and Fig. 5b two finite state machines.

[0120] Fig. 1 shows a braking system with several functional units.

[0121] A braking system 1 is shown, which has a brake control unit 2, an actuator control unit 3, a braking force generation unit 4 and a power supply unit 5 as functional units.

[0122] The braking force generating unit 4 is further divided into a braking force unit 4a and highly reliable functional parts 4b.

[0123] In the drawing, input variables 6 are transferred to the braking system 1 from the left.

[0124] These can be control inputs, vehicle state variables, brake system state variables, or power supply variables. These input variables 6 are then transmitted to functional units 2, 3, 4, and 5 as required. This means that vehicle state variables such as speed, acceleration, etc. are transmitted, for example, but not necessarily exclusively, to brake control unit 2. Control inputs such as a target deceleration or a user's braking or emergency braking request are transmitted, for example, but not necessarily exclusively, to brake control unit 2.

[0125] Brake system state variables, such as contact and application forces, piston or brake pressures, braking torques, and rotational speeds, are transmitted, for example, but not necessarily exclusively, to the brake control unit 2 and / or to the actuator control unit 3. Energy supply variables, such as a charge state or temperature of an energy storage device, are transmitted, for example, but not necessarily exclusively, to the energy supply unit 5.

[0126] The functional units 2, 3, 4, 5 then provide their function, as described above, based on the respective transmitted input variables.

[0127] In the illustration, braking system 1 itself also forms a functional unit as described above. The functional unit receives input variables 6 as described. These are processed by braking system 1, which then provides an output variable 7, in this case, an application or contact force of a contact part of a friction brake, in order to achieve a braking effect. In this view, functional units 2, 3, 4, and 5 serve as subunits of the higher-level functional unit "braking system" 1.

[0128] The functional units 2, 3, 4, 5 are further divided into further processing units, which are not shown here.

[0129] It is now intended that the illustrated functional units 2, 3, 4, 5 and / or the braking system 1 itself output status messages 8 (also referred to above in the description of the functional unit as "output status message"). The status messages 8 of the individual functional units 2, 3, 4, 5 of the braking system 1 can, in particular, relate to individual processing units or be consolidated into a status of the processing unit as a whole.

[0130] For example, the following status states are conceivable for the processing unit and / or functional unit:

[0131] - OK: The unit is operating in normal mode;

[0132] - ACUTE OK: The unit is operating in normal mode, but this will be terminated in the foreseeable future;

[0133] - BACKUP: The unit is in emergency mode; - ACUTE BACKUP: The unit is operating in emergency mode, but this will end in the foreseeable future

[0134] - NOK: The unit has failed, the function is no longer provided.

[0135] The second operating mode of a functional unit 2, 3, 4, or 5 can be the emergency operating mode. In addition to the OK and NOK states, the other states ACUTE-OK, BACKUP, and ACUTE-BACKUP are optional.

[0136] With regard to the status of a functional unit 2, 3, 4, 5 or of the braking system 1 itself, it can be provided that a consolidated status is formed from the corresponding status messages of the subordinate units. This means that when considering braking system 1, a status of braking system 1 can be formed from the status messages of functional units 2, 3, 4, 5. These can correspond to those described above. It can be provided that the status message of braking system 1 always corresponds to the worst status message (in order from best to worst: OK, ACUTE OK, BACKUP, ACUTE BACKUP and NOK). For example, if actuator control unit 3 is in BACKUP status and the other functional units 2, 4, 5 are in OK status, the status message of braking system 1 can also be set to BACKUP.

[0137] Fig. 2 shows a first embodiment of a functional unit 10.

[0138] Shown here are a first processing unit 11 and a second processing unit 12. The first processing unit 11 and the second processing unit 12 process input variables that are sent from the left to the processing units 11, 12 via an input interface 13. For this purpose, the functional units have processing functions 11a, 12a. On the basis of these input variables, the first processing unit 11 generates a first intermediate variable 14 and the second processing unit 12 generates a second intermediate variable 15. These intermediate variables 14, 15 are sent to an output unit 16, which, on the basis of the received intermediate variables 14, 15, generates at least one output variable 17, which is then output via an output interface 18 of the functional unit 10, whereby the function provision by the functional unit 10 to the braking system is realized.

[0139] The processing units 11, 12 further have diagnostic functions 11b, 12b with which they can carry out self-diagnoses and provide diagnostic data obtained therefrom.

[0140] The functional unit 10 can be operated in a first operating mode and in a second operating mode. In the second operating mode, the output variable 17 is generated by the output unit 16 independently of the at least one first intermediate variable 14.

[0141] In the example shown, the output unit 16 is designed as a switching unit. This means that in the first operating mode, it sends the first intermediate variable 14 and in the second operating mode, it sends the second intermediate variable 15 to the output interface 18. This means that in the first operating mode, the first processing unit 11 fulfills the function of the functional unit 10, and in the second operating mode, the second processing unit 12 fulfills the function of the functional unit 10.

[0142] In the example shown, the output unit 16 is assigned to the second processing unit 12. The output unit 16 and the second processing unit 12 are configured here with a higher SIL than the first processing unit 11. The first operating mode, in which the first processing unit 11 influences the output variable 17 through its intermediate variable, is therefore implemented with a lower SIL. However, it is ensured that when switching to the second processing unit 12 occurs, this occurs with a higher SIL and the associated higher level of safety.

[0143] In the example shown, the first operating mode is the normal operating mode and the second operating mode is an emergency operating mode.

[0144] Furthermore, a first monitoring unit 19 is shown, which in this embodiment is assigned to the functional unit of the second processing unit 12. The first monitoring unit 19 receives diagnostic data from a diagnostic function 20 of the first processing unit 11 and a diagnostic function 21 of the second processing unit 12. Additionally or alternatively, the monitoring unit 19 can be designed to perform a target and actual value comparison for the first intermediate variable 14 and / or the second intermediate variable 15 in order to be able to determine whether the function provision is error-free or faulty based on the input variables entered, or is generally present, or whether the provision / quality / performance generally corresponds to the function specification. The first monitoring unit 19 can in particular be designed to monitor components of the first processing unit 11 and the second processing unit 12.

[0145] Should corresponding components fail or threaten to fail, the first monitoring unit 19 can be configured to take appropriate precautions to continue providing the functionality of the functional unit 10. For this purpose, the first monitoring unit 19 can generate a switching command that causes the output variable 17 created by the output unit 16 to no longer depend on the first processing unit 14.

[0146] The output unit 16 can be designed as a switching unit or selection unit that switches or selects between the first intermediate variable 14 and the second intermediate variable 15 depending on the switching command, so that the output variable 17 then depends only on the selected intermediate variable 14, 15. However, the output unit 16 can also be designed as a superposition unit, in which the intermediate variables 14, 15 generated by the processing units 11, 12 are superimposed. For example, the generated intermediate variables 14, 15 can be added to the output variable 17, so that in the event of a failure of the processing unit 11, only a safe minimum variable is provided by the processing unit 12.

[0147] The functional unit 10, in particular the first monitoring unit 19, can also be designed to create input status messages, for example from the received diagnostic data of the first and second processing units 14, 15, data from other hierarchy levels 28 of the braking system in which the functional unit 10 is provided. However, it can also be provided that such input status messages are sent to the functional unit 10 externally, in particular from another hierarchy level 28. A hierarchy level can be seen as higher hierarchy levels or lower hierarchy levels, which function, for example, as a decision-maker or higher-level monitoring unit 26 in the braking system and monitor several functional units. The input status message can be an evaluation of further diagnoses or monitors of a lower or higher system hierarchy level oralong the functional chain of a braking path that is subordinate to this observation unit. This can inform functional unit 10 that the safe provision of the function of an upstream functional unit is only possible for a limited period of time or functional scope, and that a failure reaction at the higher hierarchical level is therefore optionally necessary in order to still be able to assume the safe state. This can ultimately result in the creation of the above-mentioned switching command if it is ensured that the safe state or a required SIL is maintained.

[0148] Furthermore, the drawing shows status messages 8 (output status messages) which are sent externally by the first processing unit 11 and the second processing unit 12. They can be generated by an optional second monitor unit (not shown) or by the first monitor unit 19 and sent externally to other functional units, the braking system or other hierarchy levels or monitor units. Their content has already been presented above; therefore, reference is made to the above explanations, in particular with regard to Fig. 1 and the general description. In this exemplary embodiment, the status messages 8 originate from the two processing units 11, 12 and can in particular provide information about the status or condition of the respective processing unit 11, 12.However, it can also be provided that alternatively or additionally only status messages are sent centrally from the functional unit 10 and not to processing units 11, 12.

[0149] Fig. 3 shows a second embodiment of a functional unit 10.

[0150] The functional unit 10 shown here has a first processing unit 11 and a second processing unit 12. Compared to the embodiment of Fig. 2, both processing units 11, 12 are designed with the same SIL and, in particular, provide identical functions within the functional unit 10. In this case, they are constructed equivalently and they supply a first intermediate variable 14 and a second intermediate variable 15 to an output unit 16, which generates an output variable 17 therefrom and transmits it to an output interface 18 of the functional unit 10. The intermediate variables 14, 15 are generated by the corresponding processing functions 11a and 12a of the processing units 11, 12. To create the intermediate variables 14, 15, the processing units 11, 12 process input variables that are sent from the left to the processing units 11, 12 via an input interface 13. The input variables have already been shown in their entirety in Fig.1. The functional unit 10 receives at least a selection or subset of these input variables.

[0151] The first processing unit 11 and the second processing unit 12 have a first monitor unit 22 and a second monitor unit 23, respectively.

[0152] The first processing unit 11 and the second processing unit 12 have a first shutdown unit 24 and a second shutdown unit 25, respectively. These can be part of the respective monitor unit 22, 23 or, as shown in the drawing, can be formed separately.

[0153] The monitoring units 22, 23 can make decisions about the operating mode of the functional unit 10, in particular based on data they obtain from the diagnosis of the associated processing unit 11, 12, the shutdown units 24, 25, and external sources. In particular, this can be an input status message originating from an external source, such as an external monitoring unit 26 shown. The content of the input status message has already been explained above. For this purpose, reference is made in particular to the general description.

[0154] The functional unit 10, in particular the monitoring units 22, 23, are designed to make a decision about the operating mode of the functional unit from the received data and in particular from the input status message. According to a second operating mode, the output variable 17 is generated in the second operating mode independently or without reaction from the at least one first intermediate variable 14 by the output unit 16. This can mean that the first processing unit 11 is switched off by the switch-off unit 24 reacting accordingly to a switch-over or switch-off command, which can originate in particular from one of the monitoring units 22, 23. However, it can also be provided that the output unit 16 no longer takes the first intermediate variable 14 into account when generating the output variable 17 in response to the switch-over command.

[0155] In this example shown, a second operating mode is equated with the first processing unit 11 having no further influence on the output variable 17. However, since the processing units 11, 12 are designed with the same SIL or with the same functionality, it can also be provided that in the second operating mode, another processing unit, e.g., the second processing unit 12 or possibly another processing unit, is switched off or that its intermediate variables have no influence on the output variable 17 by controlling the output unit 16 accordingly.

[0156] In general and independent of this embodiment, for functional units with multiple processing units of the same or identical functionality, it can apply that in the second operating mode, one and not necessarily the first of these processing units is switched off, or the output variable is independent or non-interactive from the corresponding intermediate variable by controlling or switching the output unit accordingly. In the drawing, the arrow connections between the switch-off units 24, 25 and the monitor units 22, 23 also indicate that switching commands and status messages can be exchanged via these connections, so that each monitor unit 22, 23 also knows the switching state of the other switch-off unit 24, 25.

[0157] The output unit 16 can be designed here as a superposition unit or selection unit, which processes the intermediate variables 14, 15 accordingly.

[0158] In particular, it can be provided that the first processing unit 11 and the second processing unit 12 are operated simultaneously. In this case, when switching to the second operating mode, it may be sufficient to switch off the processing unit 11, 12 that is no longer intended to influence the output variable 17. As a rule, this is the first processing unit 11. In this embodiment, however, this is not mandatory, since the first processing unit 11 and the second processing unit 12 have the same structure. The functionality of the functional unit 10 would be retained even if the second processing unit 12 is switched off.

[0159] In particular, if multiple processing units 11, 12 simultaneously supply contradictory intermediate variables 14, 15 to the output unit 16, the output unit may also have a decision pattern as to which intermediate variable 14, 15 it will further process or whether the provision of the output variable 17 will be terminated. In this case, the functional unit may output an output status message NOK.

[0160] The functional unit 10 and in particular the monitoring units 22, 23 can also be designed to generate input status messages, for example from the diagnostic data of the first and second processing units 14, 15, of other hierarchy levels of the braking system in which the functional unit 10 is provided. However, it can also be provided that such input status messages are sent to the functional unit 10 externally, in particular from another hierarchy level. A hierarchy level can be considered to be higher hierarchy levels or lower hierarchy levels, which, for example, function as a decision maker or higher-level external monitoring unit 26 in the braking system and monitor several functional units. The input status message can contain an evaluation of further diagnostics or monitoring units of a lower or higher system hierarchy level or along the functional chain of a braking path that is subordinate to this observation unit.This allows the functional unit 10 to be informed that the safe provision of the function of an upstream functional unit is only possible for a limited period of time or functional scope, and thus a failure reaction at the higher hierarchical level is necessary in order to still be able to assume a safe state for the braking system. This can ultimately result in the creation of the aforementioned switchover command if it is ensured that the safe state or a required SIL is maintained. Alternatively, a command for a safety reaction or for a failure reaction can be created via the higher hierarchical level, which the functional unit 10 processes.

[0161] Furthermore, the drawing shows status messages 8 (output status messages) which are sent externally by the first processing unit 11 and the second processing unit 12. They can be generated by the monitoring units 22, 23 and sent outwards to other functional units, the braking system or other hierarchy levels or monitoring units. Their content has already been presented above; therefore, reference is made to the above explanations, in particular with regard to Fig. 1 and the general description. In this exemplary embodiment, the status messages 8 originate from the two processing units 11, 12 and can provide information in particular about the status or state of the respective processing unit 11, 12. However, it can also be provided that, alternatively or additionally, only status messages are sent centrally from the functional unit 10 and not to processing units 11, 12.

[0162] In the embodiment shown in Fig. 3, the second operating mode of the

[0163] Functional unit 10 may be in an emergency mode. The emergency mode may be characterized by the fact that the properties of the function provision are limited (dynamics, maximum value, remaining duration, remaining number of operations, etc.).

[0164] In emergency operating mode, it can be provided that the second processing unit 12 and / or further processing units are caused to increase their dynamics or their functional scope by a command from the respective monitor / decision maker with the aim of at least partially compensating for the loss of dynamics or functional scope that accompanies the functional unit 10 due to the failed processing unit.

[0165] Fig. 4 shows a concrete implementation of a functional unit.

[0166] The embodiment shown is based on the embodiment shown in Fig. 3.

[0167] The functional unit 10 is designed here as an actuator or braking force generation unit 4 (see Fig. 1). The objective of the functional unit 10 is to actuate a reliable application force of the contact pressure part of a friction brake as the output variable 16. For this purpose, the functional unit 10 is divided into a braking force unit 4a, which can be controlled and varied, and the highly reliable functional parts 4b, which ultimately provide the output variable 18 in the required form.

[0168] In the functional unit 10, two independent processing units 11, 12 for generating a torque ("torque generation unit") are connected to each other via a common rotor / stator (output unit 16) as a superposition unit to generate an output torque on a mechanical shaft. The shaft drives a drive train 27 or a mechanical arrangement for converting the torque into a reliable application force of the contact pressure part of a friction brake.

[0169] In the event of an individual error in a first of the two processing units 11, 12, the error is detected by the respective internal monitoring unit 22, 23 of the respective processing units 11, 12, and the function is safely shut down. The unit's output status message 8 changes from OK to NOK.

[0170] As a result, the provision of the torque function and ultimately the clamping force may continue to be provided by the second or non-switched-off processing unit, possibly with limited functionality.

[0171] The second or non-deactivated processing unit 12 (or its monitoring unit 23 or decision-making function) receives at least the status of the shutdown unit 24 or further diagnostics (e.g., the monitoring unit 22) of the first processing unit 11 and can, if necessary, output a safety reaction for the second torque function or place it in the emergency operating state and, if necessary, adjust or increase the behavior of the output torque with the aim of at least partially compensating for the loss of the deactivated unit 12 for the behavior of the functional unit 4. The emergency operating state can also be characterized by an operating mode that protects the system.

[0172] With the first processing unit 11 switched off, the functional unit 10 shown is in the second operating mode.

[0173] After reaching a first limit of the functionality of the emergency operating state (number of actuations, time, temperature or other factors and possibly a combination of these factors), the status 8 of the second processing unit 12 changes from OK to ACUTE OK, thus signaling that its function provision or the operation of the second processing unit 12 will be discontinued shortly.

[0174] The optional external monitoring unit 26, which is higher-level than the functional unit 10, can now use this message until a second limit is reached in order to command or initiate a suitable safety reaction based on the totality of the diagnostic status of the entire system or several observation units. This can be, for example, a) the opening and deactivation of the pressing part or b) the closing or setting a certain force and deactivation of the pressing part. When the second limit is reached, the second processing unit 12 receives and accepts a final command from the higher-level monitoring unit 26 directly or in converted form from the monitoring unit 22 or from the monitoring unit 23 and then transfers the second processing unit 12 from the emergency operating state to a final, predefined safe state.As a result, the output status message of the second processing unit 12 is changed from AKUT-OK to NOK, and the provision of functions by the functional unit 10 ends. This can also occur in the absence of an explicit command.

[0175] Fig. 5a and Fig. 5b show two finite state machines 100, 200 for the functional unit 10 (superordinate) and processing units 11, 12 (subordinate), as shown, for example, in Figs. 2 to 4. The state machine for the functional unit 10 is marked with the reference numeral 100, the state machine for the processing units 11, 12 is marked with the reference numeral 200.

[0176] The state machine for processing units 11, 12 is instantiated twice during execution. These state machines indicate which external inputs (e.g., from monitors / switching commands) can be provided and how the two state machines interact. For example, an error in the processing unit leads to an emergency operating mode of the functional unit, etc.

[0177] The following states are shown:

[0178] Regular 101, 201

[0179] Emergency operation (=BACKUP) 102, 202

[0180] Acute emergency operation (ACUTE BACKUP) 103, 203

[0181] • Safe state 1 (failure direction for NOK / Not OK) 104, 204

[0182] • Safe state 2 (failure direction for NOK / Not OK) 105, 205

[0183] The drawings show that both state machines 100, 200, after the respective units have been commissioned (reference numerals 106, 206), receive requests and states from the left in the drawing. These can originate from the previously described monitoring units 19, 22, 23, 26 and / or from other units or sources. In particular, request signals and state information from other processing units (for state machine 100 of the functional unit) or request signals (for state machine 200 of the processing unit) can be transferred via these.

[0184] First, the state machine 200 of Fig. 5b is described. If the corresponding processing unit is error-free or if there is no other request to enter a safe state, the state machine 200 is in normal mode 201. If a request to enter emergency operation is entered from the left, the processing unit switches to emergency operation mode 202 and outputs a corresponding status message 8, which can be processed by other functional units or the braking system in general. The processing unit leaves this state 202 when a first limit is reached. This can, for example, be a predetermined operating time or a predetermined number of function executions. The state machine 200 then switches to state 203. Here, the emergency operation mode is acute, i.e., it is about to end. This can, in turn, be output by means of a corresponding status message 8.In both states 202 and 203 the functionality of the corresponding.

[0185] Processing unit limited compared to state 201. The functional scope of the two states 202 and 203 is identical. The only difference is that state 203 is time-limited. If a second limit, which defines the end of state 203, is then reached, the state machine changes to the safe state 1, 204 (enable torque) or the safe state 2, 205 (set & fix torque), depending on which request is entered into the state machine from the left. Both states 204, 205 are situation-dependent and dependent on the functionality of the processing unit. The states shown here refer to the embodiment of Fig. 4. If, for example, the state cannot be influenced by means of an external specification, then only a safe state can exist, into which the state machine 200 changes.If errors are directly detected by the processing unit underlying the state machine 200, or if these errors or failures are detected by an external source, a switchover command can also be used to directly switch from the normal mode 201 to the safe state 1, 204 or the safe state 2, 205. Each state assumed by the state machine 200 and thus the corresponding processing unit can be output via corresponding status messages 8.

[0186] The state machine 100 of Fig. 5a, which relates to the functional unit comprising the processing unit, is as follows.

[0187] The functional unit operates in normal mode 101. If information is input from the left into the state machine 100 that one of the processing units is no longer in normal mode 201 (here now in the safe state 1, 204), while the other processing unit(s) are still in normal mode 201, the state machine 100 switches to state 102 and is thus, depending on a processing unit that is no longer in normal mode 201, in emergency operation mode 202. The functional unit can return from this state as soon as all processing units are back in normal mode 201. If the processing unit that was still in normal mode 201 switches to emergency operation mode or further, as described, to the acute emergency operation mode 203, the state machine 100 also switches to an acute emergency operation mode 103, which is time-limited.This ends when the last processing unit changes from the acute emergency operating mode 203 to state 204 or 205, e.g. due to a switching command or because the limit for state 203 is reached.

[0188] Accordingly, the state machine 100 changes to the safe state 1, 104 or to the safe state 2, 105. The state of the state machine 100, or the state of the associated functional unit, can be communicated externally to other functional units or the braking system via a corresponding status message 8. If errors in both processing units are directly detected by the functional unit underlying the state machine 100, or if these errors or failures are detected by an external source, a changeover command can also be used to directly switch from the normal mode 101 to the safe state 2, 105.

[0189] Furthermore, within the scope of this invention, the following terms may be understood in the meaning specified below. Electromechanical braking system - A braking system that provides the ability to generate a deceleration braking force of a vehicle using electronic, electrical, and mechanical components.

[0190] Electro-pneumatic braking system - A braking system that provides the ability to generate a deceleration braking force of a vehicle using electronic, electrical and pneumatic components.

[0191] Braking path - Sum of all functions that are active between the control inputs of the braking system and the generation of the friction braking force, and that produce the system-wide braking functions.

[0192] Safety integrity level (SIL), safety requirement level according to DIN EN 61508-2:17. Highly reliable functional parts (also split functional parts) are functions as part of the braking path, which are based on proven, captive functional mechanisms (e.g., mechanical brake calipers) and which have inherent safety properties.

[0193] Decision maker function - Function that is set up to receive status signals from the monitoring units occurring in the system and then determine an error reaction.

[0194] Brake control unit - set of functions for providing train-wide and / or local functions in the braking path based on control inputs or vehicle state variables or braking system state variables.

[0195] Actuator control unit - set of functions for providing force generation functions in the braking path based on force control variables.

[0196] Brake force generation unit - A set of functions for generating frictional braking force based on actuation variables. Actuator - An assembly configured to perform the functions of the brake control unit, the actuator control unit, and the brake force unit.

[0197] Braking force unit - set of functions for generating friction braking force based on actuation variables.

[0198] Force control variable - control or regulating variable which either directly or indirectly represents a requirement of the braking path to generate a force in a coordinate system relevant to the brake actuator (e.g. cylinder force), as well as associated control or manipulation variables such as reduction signals, adjustment variables for quality improvement, etc. to be taken into account when setting this force.

[0199] Actuation variable - control or regulating variable which is made available for the existing electromechanical process or the operating principle in order to define and request a unique movement, force or position state or similar state properties (e.g. parking brake).

[0200] Power supply unit - set of functions for providing power to components of the braking system.

[0201] Processing unit - set of functions within a functional unit which generates at least one intermediate variable and which can be switched to at least one output variable of the functional unit without any reaction in an operating mode of the functional unit.

[0202] LIST OF REFERENCE SYMBOLS

[0203] 1 braking system

[0204] 2 brake control unit

[0205] 3 Actuator control unit

[0206] 4 Braking force generation unit

[0207] 4a Brake force unit

[0208] 4b highly reliable functional parts

[0209] 5 Power supply unit

[0210] 6 input variables

[0211] 7 Output variable

[0212] 8 Status message (output status message)

[0213] 10 functional unit

[0214] 11 first processing unit

[0215] 11a Processing function

[0216] 11 b Diagnostic function

[0217] 12 second processing unit

[0218] 12a Processing function

[0219] 12b Diagnostic function

[0220] 13 Input interface

[0221] 14 first intermediate size

[0222] 15 second intermediate size

[0223] 16 Output unit

[0224] 17 Output variable

[0225] 18 Output interface

[0226] 19 first monitor unit

[0227] 22 Monitor unit

[0228] 23 Monitor unit

[0229] 24 shutdown unit

[0230] 25 Shutdown unit

[0231] 26 external monitor unit

[0232] 27 Drivetrain other hierarchy level

[0233] 100 state machines

[0234] 101 Normal Mode

[0235] 102 Emergency operating mode 103 Emergency operating mode acute

[0236] 104 safe condition 1

[0237] 105 safe condition 1

[0238] 106 switch on

[0239] 200 State machine 201 Normal mode

[0240] 202 Emergency operating mode

[0241] 203 Emergency operating mode acute

[0242] 204 safe condition 1

[0243] 205 safe state 2 206 switch on

Claims

PATENT CLAIMS 1. Functional unit (10) for a braking system (1) of a rail vehicle, which is designed to provide a function of a braking path of the braking system (1) or a function in a part of a braking path of the braking system (1), comprising: - an input interface (13) designed to receive at least one input variable (6); - an output interface (18) designed to output at least one output variable (17); - a first processing unit (11) which is designed to generate at least one first intermediate variable (14) on the basis of the at least one input variable (6); - a second processing unit (12) designed to generate at least one second intermediate variable (15); - an output unit (16) which is designed to generate the at least one output variable (17) from the at least one first intermediate variable (14) and the at least one second intermediate variable (15) and to transmit it to the output interface (18), wherein the functional unit (10) is designed to switch from a first operating mode to a second operating mode as a function of a switching command, in which second operating mode the output unit (16) generates the at least one output variable (17) independently of the at least one first intermediate variable (14).

2. Functional unit (10) according to claim 1, wherein the functional unit (10) is designed to generate the switching command from an input status message.

3. Functional unit (10) according to one of the preceding claims, wherein the first processing unit (11) in the second operating mode is in a non-interactive state with respect to the output unit and the second processing unit (12), or wherein the output unit (16) does not take into account the at least one first intermediate variable (14) when generating the output variable (17).

4. Functional unit (10) according to one of the preceding claims, wherein the functional unit (10) in the second operating mode has a limited range of functions or an identical range of functions compared to the first operating mode.

5. Functional unit (10) according to one of the preceding claims, wherein the functional unit (10) in the second operating mode has a limited function provision, in particular a limited remaining duration of the function provision or a limited number of function executions.

6. Functional unit (10) according to one of the preceding claims, wherein the first operating mode is a normal operating mode of the functional unit and the second operating mode is an emergency operating mode of the functional unit (10).

7. Functional unit (10) according to one of claims 2 to 6, wherein the functional unit (10) has a first monitor unit (19, 22, 23) which is designed to create the input status message.

8. Functional unit (10) according to claim 7, wherein the first monitor unit (19, 22, 23) is designed to To create an input status message based on at least one of the following data: - diagnostic data of the first processing unit (11); - diagnostic data of the second processing unit (12); - external control inputs; - Specifications from monitoring units (26) of other functional units or higher hierarchy levels (28).

9. Functional unit (10) according to one of the preceding claims, wherein the input status message may comprise one of the following information: - an upstream functional unit or a processing unit of an upstream functional unit, of which at least one of the at least one input variable, is in a normal operating mode and is about to terminate; - an upstream functional unit on which at least one of the at least one input variable depends is in an emergency operating mode; - an upstream functional unit or a processing unit of an upstream functional unit on which at least one of the at least one input variable depends has failed, is switched off or is no longer available.

10. Functional unit (10) according to one of the preceding claims with an output status message interface (18), wherein the functional unit (10) is designed to output an output status message (8) via the output status message interface (18).

11. Functional unit (10) according to one of the preceding claims, wherein the functional unit (10) is designed to create the output status message (8), in particular by a second monitor unit.

12. Functional unit (10) according to claim 10 or 11, wherein the output status message (8) is created on the basis of at least one of the following data: - diagnostic data of the first processing unit (11); - diagnostic data of the second processing unit (12); - external control inputs; - specifications of monitoring units (26) of other functional units or higher hierarchical levels (28); - the operating mode of the functional unit (10).

13. Functional unit (10) according to one of claims 10 to 12, wherein the output status message (8) contains at least one piece of information about the following: - the operating mode of the functional unit (10); - the available range of functions of the functional unit (10); - limited functionality provision; - a state of the first and / or second processing unit (11, 12).

14. Functional unit (10) according to one of claims 7 to 13, wherein the first and second monitor units are identical.

15. Functional unit (10) according to one of the preceding claims, wherein the first processing unit (11) has no safety integrity or has a lower or equal safety integrity compared to the second processing unit (12).

16. Functional unit (10) according to one of the preceding claims, wherein the output unit (16) has a security integrity that is equal to or higher than that of the second processing unit (12).

17. Functional unit (10) according to one of the preceding claims, wherein the functional unit (10) is a brake control unit (2), an actuator control unit (3), a braking force generation unit (4) or a power supply unit (5).

18. Functional unit (10) according to one of the preceding claims, wherein the second processing unit (12) has a structure or an identical range of functions to the first processing unit (11) and is designed to generate the at least one second intermediate variable (14) on the basis of the at least one input variable.

19. Braking system (1) for a rail vehicle with a braking path in which a first functional unit (10) according to one of claims 1 to 18 is arranged or which is formed by a first functional unit (10) according to one of claims 1 to 18.

20. Braking system (1 ) according to claim 19, with a brake system monitor unit (26) which monitors the first functional unit (10) and is designed to generate an input status message and transmit it to the functional unit (10).

21. Braking system (1) according to claim 20, wherein the braking system (1) has at least one second functional unit (10), in particular according to one of claims 1 to 18, which is provided in the or a further braking path, wherein the braking system monitor unit (26) is designed to evaluate the output status messages (8) of the first and second functional unit (10) and to carry out error pattern recognition.

22. Rail vehicle with a braking system (1) according to one of claims 19 to 21.

23. A method for operating a functional unit (10) according to one of claims 1 to 18, a braking system (1) according to one of claims 19 to 21 or a rail vehicle according to claim 22, comprising the steps: - operating the functional unit (10) in the first operating mode; - Receiving an input status message; - Switching to the second operating mode if the input status message contains a predetermined switching condition; - Operating the functional unit (10) in the second operating mode.

Images