KA/sv 070091WO PCT/EP2009/054311 November 12, 2010 CONTROL DEVICE FOR A RAIL VEHICLE The present invention relates to a control device for a vehicle, in particular a rail vehicle, comprising a traction control system for controlling traction devices of the vehicle, a braking control system for controlling braking devices of the vehicle and a superordinate first vehicle control system for controlling the traction control system and the braking control system by 5 means of a first control path, in particular a data bus system, the first vehicle control system being configured, in a normal operating state of the control device, to control the traction control system and the braking control system in such a way that, in a detected emergency situation, a control action bringing about the activation of the braking devices takes place with priority over a control action bringing about the activation of the traction devices. The 10 invention also relates to a corresponding method for controlling a vehicle. A well known safety concept is realised by means of a vehicle of this type, in which the vehicle is directly brought to a standstill by a braking intervention (for example an emergency braking operation) in a dangerous situation in order to reduce the endangering of the passengers or the surroundings of the vehicle. In this case, the principle of "stop in the event 15 of danger" is also referred to. The braking intervention takes place regardless of whether a driving command or a driving request by the vehicle driver is present (therefore independently of whether the vehicle driver has deflected a drive lever or the like completely or partially from its neutral position). This safety concept has certain disadvantages, however, as in certain dangerous situations, 20 a direct standstill of the rail vehicle should be avoided. For example, if a fire occurs in a rail vehicle in a tunnel, if possible, the rail vehicle should only come to a standstill in the closest railway station or another location with a suitable possibility for the passengers to escape in order to allow a rapid and effective evacuation of the passengers from the area of danger. A generic control device of this type for a rail vehicle is known from DE 10 2005 007 336 Al, 25 in which a superordinate vehicle control system controls the braking control system of the individual braking devices by means of a data bus system. By means of an emergency switch connected to the superordinate vehicle control system, the vehicle driver can inter alia PCT/EP20091054311 KA/sv 070091WO 12 November 2010 2469911.1 (GHMatter) -2 deactivate all previous braking commands by means of the data bus system, therefore also stop a current emergency braking operation and force the vehicle to continue to travel. The problem here is that the previous braking commands are only deactivated once by means of the data bus system but the possible causes preventing onward travel in the 5 control system are not eliminated. These causes may be software or else hardware related. For example, expected signals may be missing at the vehicle control system or permanently faulty or contradictory signals may be present via the data bus. These signals may, for example, be signals reflecting the state of relevant components of the vehicle (for example interrupted green loop, engaged or blocking mechanical brake, opened doors, actuated 10 emergency brake, activated forced brake, failure of the vehicle control system, faults or disruption to the energy supply, a defective setpoint value provider, failure of a plurality of drives etc.), which permanently arrive via the data bus at the vehicle control system and have to be processed there accordingly. In all the above cases mentioned by way of example, the incoming signals at the vehicle 15 control system in the known vehicle lead, during normal operation, to an emergency braking operation and therefore have to be deliberately deactivated in the known control system by a repeated or lasting actuation of the emergency switch. In this case, it is, in particular, provided in the known vehicle that deactivating the braking commands (by a corresponding AND operation of a plurality of signals) can only take place by means of a laborious, 20 deliberate action inevitably to be repeated several times by the driver. This may, particularly in a stressful situation (for example vehicle fire in a tunnel), lead to an excessive demand on the driver. The present invention is therefore based on the object of providing a control device or a method for controlling a vehicle, which does not have the aforementioned drawbacks or only 25 to a lesser extent and, in particular, allows a prevention or interruption of an automatic emergency braking operation in a simple and reliable manner in order to allow onward travel out of a dangerous location. The present invention achieves this object starting from a control device according to the preamble of claim 1 by the features disclosed in the characterising part of claim 1. It also 30 achieves this object starting from a method according to the preamble of claim 24 by the features disclosed in the characterising part of claim 24. PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 2489911_1 (GHMatters) -3 The present invention is based on the technical teaching that a prevention or interruption of an automatic emergency braking operation and, therefore, onward travel from a dangerous location is made possible in a simple and reliable manner if the first superordinate vehicle control system is switched off in a special operation and, apart from the first vehicle control 5 system, a second vehicle control system activated in the special operation is provided which, on the one hand, controls the braking devices and the traction devices by means of a separate control path and, on the other hand, is configured in such a way that it carries out a driving command with priority over a braking command. In other words, onward travel is made possible with the control device according to the 10 invention in that, in the special operating state, the priorities between the control commands "drive" and "brake" are mutually exchanged in comparison to the normal operating state. In this case, when there is a braking command present and a driving command present, the braking command is ignored and only the driving command is carried out, such that it is possible for the vehicle to travel onward. 15 This design, on the one hand, has the advantage that, by switching off the first vehicle control system and ultimately the first control path, all the signals or disruptions in the system, which may be the cause of an emergency braking operation, can be rapidly and easily suppressed, so they have no further influence on the control system in this special operation. As they only have to be provided for the special operation (in which optionally 20 damage to individual components of the vehicle is also accepted as long as the reaching of a safe stopping point can be ensured), the second vehicle control system and the components of the second control path may be constructed correspondingly simply and robustly or in a manner not very susceptible to malfunction, so their reliable functioning is easily ensured. Finally, in a simple design of this type, the priority of the driving commands over possible 25 braking commands can be realised in a simple manner. According to one aspect, the present invention therefore relates to a control device for a vehicle, in particular a rail vehicle, with a traction control system for controlling traction devices of the vehicle, a braking control system for controlling braking devices of the vehicle and a superordinate first vehicle control system for controlling the traction control system and 30 the braking control system via a first control path, in particular a data bus system. The first vehicle control system is configured, in a normal operating state of the control device, to control the traction control system and the braking control system in such a way that, in a detected emergency situation, a control action bringing about the activation of the braking PcT/EP2009/054311 KA/sv 070091Wo 12 November 2010 24899111 (GHMatters) -4 devices takes place with priority over a control action bringing about the activation of the traction devices. Furthermore, a second vehicle control system for controlling the traction control system and the braking system via a second control path is provided, the second control path being different from the first control path. The control mechanism is configured 5 to, in a special operating state, deactivate the first vehicle control system and activate the second vehicle control system. The second vehicle control system is in turn configured to, in the special operating state, control the traction control system and the braking control system in such a way that a control action bringing about the activation of the traction devices takes place with priority over a control action bringing about the activation of the braking devices. 10 The described priority of driving commands over to braking commands in the special operating state can basically be realised in any suitable manner as long as it is ensured that, in this special operating state, no activation of the brakes takes place or a release of the brakes place as long as a valid driving command is present. It is preferably provided that a driving command signal to the traction control system triggers an actuation of traction 15 devices of the vehicle and a release command signal to the braking control system triggers a release of braking devices of the vehicle. The second vehicle control system is, in this case, configured in such a way that, upon an incoming driving request in the special operating state, it transmits a driving command signal to the traction control system and a release signal to the braking control system. Onward travel to the next safe stopping position can 20 thereby be ensured in a particularly simple manner. The components of the vehicle which can trigger the emergency braking operation in a dangerous situation or in the case of a disruption in the normal operation of the vehicle, may inter alia include the components of the energy supply devices for the traction devices of the vehicle. In the event of a disruption in this area (for example overheating or a fire) it is 25 possible that one or more of the energy supply devices present are switched off. The traction devices are, in this case, no longer supplied with (sufficient) energy in order to provide the traction power necessary for onward travel. In advantageous variants of the invention, an energy supply device (generally arranged in the vehicle) to supply at least a part of the traction devices of the vehicle is therefore 30 provided and the second vehicle control system is configured in such a way that, in the special operating state, it generates an activation signal to activate the energy supply device at least in the event of an incoming driving request. In other words, in this case, it is ensured in the special operating state that one or optionally more (preferably all) energy supply PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 2489911_1 (GHMatters) -5 devices of the vehicle are activated in order to provide the traction power necessary for onward travel (with adequate safety). It is accepted here that the relevant energy supply device will possibly be damaged here to eliminate danger to the passengers. The activation of the special operating state may take place in any suitable manner. In 5 particular, it may be provided that an automatic activation of the special operating state takes place if, for example, it is ascertained by a corresponding detection of the position of the vehicle and/or the surroundings of the vehicle that no safe evacuation of the vehicle is possible at the current site of the vehicle. In other preferred variants of the control device according to the invention it is provided that the special operating state can be activated 10 manually to generally allow the vehicle driver, who is generally comprehensively trained and experienced, to take the decision about this. The first control path and the second control path may basically be designed in any suitable manner. In preferred variants of the control device according to the invention, the first control path comprises a data bus system, with which, in the normal operating state, a particularly 15 advantageous controlling of the traction devices, the braking devices and optionally further devices of the vehicle is possible. Additionally or as an alternative it is preferably provided that the second control path comprises a direct signal line between the second vehicle control system and at least one component of the traction devices or the braking devices to be controlled in the special 20 operating state. Owing to this direct connection between the second vehicle control system and the relevant component to be controlled, a particularly robust connection that is not very susceptible to faults is ensured and which, in the special operating state, ensures reliable control of the relevant component. The direct connection may exist only to individual components of the traction devices and/or 25 the braking devices. However, it is preferably provided that the second control path in each case comprises a rigidly connected signal line between the second vehicle control system and all the components of the traction devices or the braking devices to be controlled in the special operating state. As a result, even in the case of a failure of individual components of the traction devices or the braking devices, reliable control of the remaining, (at least 30 sufficiently) functioning components of the traction devices and the braking devices is ensured. PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 249911_1 (GHMatters) -6 The signals of the second vehicle control system can be transmitted via a single signal line of the second control path to the traction device or the traction devices of the vehicle. However, in one variant with a plurality of separate traction devices it is preferably provided that the second control path comprises a first signal line and a second signal line, the first signal line 5 being connected to a first fraction of the traction devices and the second signal line being connected to a second fraction of the traction devices. Owing to this multi-strand connection, even in the event of a disruption in the area of one of the two signal lines, it can be ensured that an adequate number of traction devices can still be reliably controlled. It goes without saying in this context that, in other variants of the invention, more than two 10 signal lines may of course be led to more than two fractions of the traction devices. It is also, of course, obvious that in other variants of the invention, a redundant arrangement of the signal lines may be provided and therefore at least two parallel signal lines are provided for at least one of the traction devices. The distribution of the traction devices over the signal lines may basically take place in any 15 suitable manner. The first fraction of the traction devices preferably comprises at least 50% of the traction devices of the vehicle. It is further preferably provided that the first fraction of the traction devices and/or the second fraction of the traction devices comprises a fraction of the traction devices, the added traction power of which is sufficient to continue to move the vehicle in the event of a failure of the other fraction of the traction devices. This ensures that 20 the vehicle, even with the failure of the other of fraction of the traction devices, can still be moved to a safe stopping place. In further advantageous variants of the invention it is provided that the first fraction of the traction devices and/or the second fraction of the traction devices comprises a fraction of the traction devices, the added traction power of which is sufficient to continue to move the 25 vehicle upon the blocking of at least one fraction of the braking devices, in particular all the braking devices, of the vehicle. The two signal lines may basically be arranged in any suitable manner in the vehicle. In order to reduce the risk of a simultaneous disruption of both the signal lines, it is preferably provided that the first signal line and the second signal line are arranged spatially separated 30 and/or separated from one another in terms of signal technology. With regard to the spatial separation, it may, for example, be provided that the first signal line is arranged on one vehicle side and the second signal line on the other vehicle side. As a result, the probability PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 245991 1_1 (GHMatters) -7 is increased that in the event of damage to one of the signal lines, control commands or control signals can continue to be transmitted via the other signal line. With regard to the control of the braking devices, the procedure in the special operation may be analogous to the control of the traction devices. The signals of the second vehicle control 5 system can accordingly be transmitted via a single signal line over the second control path to the braking device or the braking devices of the vehicle. However, in a variant with a plurality of separate braking devices it is in turn preferably provided that the second control path comprises a third signal line and a fourth signal line, the third signal line being connected to a first fraction of the braking devices and the fourth signal line being connected to a second 10 fraction of the braking devices. The distribution of the braking devices over the signal lines may in turn basically take place in any desired manner. It is preferably in turn provided that the first fraction of the braking devices comprises at least 50% of the braking devices of the vehicle. It is also advantageous here for the above-mentioned reasons that the first signal line and the second 15 signal line are arranged spatially separated and/or separated from one another in terms of signal technology. Likewise, an arrangement with more than two circuits and/or a redundant arrangement of the signal lines may again also be provided here. Also with regard to the controlling of the energy supply devices of the vehicle, in the special operation, the procedure may be analogous to the controlling of the traction devices. The 20 signals of the second vehicle control system may accordingly be transmitted via a single signal line of the second control path to the energy supply device or the energy supply devices of the vehicle. However, in a variant with a plurality of separate energy supply devices it is preferably in turn provided that the second control path comprises a fifth signal line and a sixth signal line, the fifth signal line being connected to a first fraction of the energy 25 supply devices and the sixth signal line being connected to a second fraction of the energy supply devices. The division of the energy supply devices over the signal lines may in turn basically take place in any suitable manner. It is preferably in turn provided that the first fraction of the energy supply devices comprises at least 50% of the energy supply devices of the vehicle. It 30 is also advantageous here for the above-mentioned reasons that the fifth signal line and the sixth signal line are arranged spatially separated and/or separated from one another in terms of signal technology. PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 2469911_1 (GHM.tt.r) -8 In preferred variants of the invention, a so-called "dead man function" is provided. For this purpose, the second vehicle control system is configured in such a way that, in the special operating state, a driving request is cancelled again after a first time span since the occurrence of the driving request if the driving request is not renewed. If the driving request 5 is cancelled, the traction devices can then be simply switched off. In order to prevent the cancellation of the driving request, the vehicle driver, for example, can not keep the drive lever generating the driving request constantly in a deflected position, but from time to time has to move it back into its neutral position and then deflect it again in order to renew the driving request and therefore to continue the journey. 10 In a further preferred variant, the second vehicle control system is furthermore configured in such a way that, in the special operating state, an activation of the braking devices takes place after a second time span since the occurrence of a driving request when the driving request is not renewed. In order to prevent the activation of the braking devices, the vehicle driver thus, for example, can not constantly hold the drive lever generating the driving 15 request in a deflected position, but has to move it back into its neutral position from time to time and then deflect it again in order to renew the driving request and, therefore, to continue the journey without a braking intervention. This can ensure that after a certain time without renewal of the driving request, an emergency braking operation is carried out in order to automatically bring the vehicle to a standstill in the event of a failure of the vehicle driver. 20 The braking devices may be activated before the cancellation of the driving request (with, for example, the switching-off of the traction devices resulting thereof). However, it is preferably provided that the second time span is longer than the first time span, so the driving command is firstly cancelled before the braking intervention takes place. In preferred variants of the control device according to the invention, the "dead man function" 25 (in other words the monitoring of the ability of the vehicle driver to act) may be realised by means of a time counter, which, in the special operating state, cancels the driving command after a first time span. A time counter of this type may be realised both by a software solution and by a hardware solution. The time counter may be designed to cancel a driving command after a certain previously fixed time span, for example after 30 seconds. The 30 vehicle may then be in a rolling state. If the vehicle driver is able to act, he can renew the driving command by a deliberate switching action and thus reset the time counter. A switching action of this type may be PCT/EP2009/054311 KAlsv 070091WO 2489911_1 (GHMatters) 12 November 2010 -9 realised, for example, in that the drive lever is set in its neutral position (zero position) for a specific time span (for example 0.5 s) and is then deflected again. It is obvious, however, that, in other variants of the present invention, other switching actions or the like may be provided. 5 In further variants with the above described automatic braking intervention, a time relay may be provided, which, in the second operating state, as described, automatically activates the function "brake" after a second time span. The second time span may be set here in such a way that the latter is significantly longer than the first time span. For example, the first time span may be 30 s and the second time 10 span 45 s. However, it is obvious that other time spans can be selected and adapted to the special requirements of the vehicle and the surroundings. In preferred variants of the control device according to the invention, the second vehicle control system comprises at least one actuating element, which is configured, in the special operating state, to generate control commands for the traction control system and/or the 15 braking control system. This is preferably the drive lever, which the vehicle driver also uses in the normal operating state. In further preferred variants of the control device according to the invention, the second vehicle control system comprises a door actuating element, which is configured to generate control commands for at least one door control unit in the special operating state. This door 20 actuating element may in turn be connected analogously to the manner described above for the traction devices etc. via one or more separate signal lines to one or more door control units. The present invention furthermore relates to a vehicle, in particular a rail vehicle with a control device according to the invention. The above-described variants and advantages can 25 be realised to the same extent with this vehicle, so reference is merely made to the above statements. The present invention finally relates to a method for controlling a vehicle, in particular a rail vehicle, in which traction devices of the vehicle are controlled by a traction control system, braking devices of the vehicle are controlled by a braking control system and the traction 30 control system and the braking control system are controlled by a superordinate first vehicle PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 24a9911_1 (GHMatter) -10 control system via a first control path, in particular a data bus system, the first vehicle control system, in a normal operating state, controlling the traction control system and the braking control system in such a way that, in a detected emergency situation, a control action bringing about the activation of the braking devices takes place with priority over a control 5 action bringing about the activation of the traction devices. In a special operating state, the first vehicle control system is deactivated and a second vehicle control system is activated, the second vehicle control system controlling the traction control system and the braking control system via a second control path, which is different from the first control path, and the second vehicle control system, in the special operating state, controlling the traction control 10 system and the braking control system in such a way that a control action bringing about the activation of the traction devices takes place with priority over a control action bringing about the activation of the braking devices. The variants and advantages described above in conjunction with the control device according to the invention can be realised using this method, so reference is merely made to the above statements. 15 In further preferred embodiments of the invention, at least one fault of the rail vehicle can be detected by a suitable detector device. Advantageously, faults can be detected, which, in the normal operating state, may result in a rail vehicle which is no longer capable of travelling. Examples of such faults are the faults already mentioned at the outset, in other words, for example, missing or contradictory signals, interrupted green loop, blocking brakes, opened 20 doors, emergency driver braking, imminent forced braking, failure of the vehicle control system, faults in the voltage supply or a defective setpoint value provider. A fire may also be a cause, as a fire alarm can deactivate the voltage supply. In the case of faults, which continue to allow a driving operation, the driving operation can also be maintained in the normal operating state. A detector device may comprise suitable sensor and evaluation units 25 in order to be able to detect the respective disturbance and be able to classify it. The fault can preferably be signalled to the vehicle driver by suitable devices. In particular, a fault which leads to the inability of the vehicle to travel can be indicated. Both optical and acoustic display means may be used. The vehicle driver can then directly and appropriately react to the respective fault and, if necessary, activate the special operating state. 30 In preferred variants of the invention, the highest speed of the rail vehicle in the special operating state may be limited to a predeterminable value (for example 50 km/h). Furthermore, in the special operating state, a signal to retract a current collector may be blocked, for example, so the voltage supply continues to be ensured. PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 2489911_1 (GH)JMtens) - 11 Further preferred embodiments of the invention become apparent from the dependent claims or the following description of preferred exemplary embodiments, respectively, which refers to the accompanying drawings. It is shown in: Figure 1 a schematic view of a preferred exemplary embodiment of a rail vehicle 5 according to the invention with a preferred exemplary embodiment of a control device according to the invention; Figure 2 a flowchart of a preferred exemplary embodiment of a control method according to the invention, which can be used in the rail vehicle from Figure 1. Figure 1 shows a schematic view of a preferred exemplary embodiment of a vehicle 10 according to the invention in the form of a rail vehicle 101 with a preferred exemplary embodiment of a control device 102 according to the invention. The vehicle 101 comprises a plurality of carriages 101.1 coupled to one another, which are supported on a series of driven bogies 103.1 to 103.4 (optionally in addition to a series of non-driven bogies). A traction control system 104.1 to 104.4 of the control device 102 is associated with each 15 driven bogie 103.1 to 103.4. The respective traction control system 104.1 to 104.4 controls the traction devices (not shown) of the associated bogie 103.1 to 103.4. The driven bogies 103.1 to 103.4 are divided into two bogie groups, with which a respective energy supply device 105.1 or 105.2 is associated. Thus, the first energy supply device 105.1 supplies the traction devices of the first bogie 103.1 and the second bogie 103.2, while 20 the second energy supply device 105.2 supplies the traction devices of the third bogie 103.3 and the fourth bogie 103.4. For this purpose, the energy supply devices 105.1 and 105.2 are in each case connected to a current collector 106.1 or 106.2, of which, in normal operation (depending on the primary direction of travel) only one is brought into contact with an overhead contact line 107. 25 A braking control system 108.1 or 108.2 of the control device 102, which controls the braking devices of the associated bogies, is furthermore associated with each bogie group. Thus, the braking devices of the first bogie 103.1 and the second bogie 103.2 are controlled by the first braking control system 108.1, while the braking devices of the third bogie 103.3 and the fourth bogie 103.4 are controlled by the second braking control system 108.2. PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 2469911_1 (GHMattrs) -12 It is obvious here that, in other variants of the invention, a division into more than two bogie groups may be provided, with which a respective separate energy supply device and/or a separate braking control system is then associated. It is also obvious that in other variants of the invention, it can also be provided that a separate energy supply device and/or a separate 5 braking control system can be provided for each driven bogie. The control device 102 comprises a superordinate first vehicle control system 109.1, which, in the normal operation or normal operating state of the vehicle 101, is connected via a first control path in the form of a data bus 110 (for example a so-called vehicle bus or MVB, respectively) to the traction control systems 104.1 to 104.4, the energy supply devices 105.1 10 and 105.2 and the braking control systems 108.1 to 108.4. The control device 102 controls the vehicle 101 according to a preferred variant of the control device according to the invention, as shown in Figure 2. The method is firstly started in a step 112.1 and passes to normal operation in a step 112.2. In the normal operation of the vehicle 101, this superordinate first vehicle control system 15 109.1 controls the traction control systems 104.1 to 104.4, the energy supply devices 105.1, 105.2 and the braking control systems 108.1 to 108.4. The control takes place here as a function of the inputs of the vehicle driver, which the latter actuates, for example, from the driver's control panel 111, which in normal operation is also connected via the data bus 110 to the first vehicle control system 109.1. 20 In normal operation, the first vehicle control system 109.1 receives from the traction control systems 104.1 to 104.4, the energy supply devices 105.1, 105.2, the braking control systems 108.1 to 108.4 and optionally from further sensors (not shown) arranged in or on the vehicle (for example temperature sensors, fire alarms, door sensors, emergency braking switches etc.), information about the current state of the respective component. This information can 25 be transmitted via the data bus 110 or a separate connection to the first vehicle control system 109.1. Using this state information about the components of the vehicle 101, decisions are made about controlling the respective components of the vehicle 101 in the first vehicle control system 109.1. In the vehicle 101, in normal operation, a sufficiently known safety concept is 30 realised, according to which, in a series of constellations representing a dangerous situation, the first vehicle control system 109.1 decides to carry out an emergency braking operation. PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 2469911_1 (GHMattems) -13 A constellation of this type, which represents a dangerous situation and therefore triggers an emergency braking operation, may be provided in the presence of a series of signals or signal combinations (for example overheating of a component, the response of a fire alarm, interrupted green loop, engaged or blocking mechanical brake, opened doors, actuated 5 emergency brake, activated forced brake, failure of the vehicle control system, fault or disruption of the energy supply, defective setpoint value provider, failure of a plurality of drives etc.). If the first vehicle control system 109.1 determines a dangerous situation of this type, the vehicle 101 is brought directly to a standstill by a braking intervention in order to reduce an 10 endangering of the passengers or the surroundings of the vehicle. In this case, the principle is also referred to as "stop in the event of danger". The braking intervention then takes place regardless of whether a driving command or a driving request is present from the vehicle driver by means of the control panel 111, therefore also regardless of whether the vehicle driver has deflected the drive lever 111.1 completely or partially from its neutral position (as 15 indicated in Figure 1 by the dashed contour 113). This safety concept has the disadvantage, however, that in certain dangerous situations, a direct standstill of the vehicle 101 should be avoided. If, for example, a fire occurs in the vehicle 101 in a tunnel, the vehicle should as far as possible only come to a standstill in the closest railway station or at another location with a suitable possibility for the passengers to 20 escape in order to allow a rapid and effective evacuation of the passengers from the danger zone. In order to allow the onward journey of the vehicle 101 in a dangerous situation of this type, it is provided that the vehicle driver can switch over into a special operating state or special operation by means of an actuating element 114 (which can be actuated deliberately and 25 preferably not inadvertently). In the course of the control method it is therefore checked in a step 112.3 whether a corresponding switching signal is present at the actuating element 114 and therefore a switch should be made into special operation. If this is not the case, there is a return to step 112.2. Otherwise, in a step 112.4, the first vehicle control system 109.1 is deactivated and a second vehicle control system 109.2 (in 30 the present example, integrated in the driver's control panel 111) of the control device 102 is activated. PCT/EP2009/054311 KA/sv 070091Wo 12 November 2010 24899111 (GHMAters) - 14 The second vehicle control system 109.2 is connected via a second control path 115, which is different from the data bus 110 (first control path), to the traction control systems 104.1 to 104.4, the energy supply devices 105.1, 105.2, the braking control systems 108.1, 108.2 and the current collectors 106.1, 106.2. The connection takes place here, in each case, by 5 means of a rigidly connected signal line 115.1 to 115.8. In the second control path 115, in the present example, a respective two-strand connection is realised for each control type controlled by the second vehicle control system 109.2 (traction control system, control system of an energy supply device, braking control system, control system of a current collector etc.). However, it goes without saying that, in other variants of 10 the invention, (optionally depending on the control type) any other number of control strands may be realised depending on the addressed control type. In the present example, the first traction control system 104.1 and the second traction control system 104.2 are connected by the first signal line 115.1 to the second vehicle control system 109.2, while the third traction control system 104.3 and the fourth traction control 15 system 104.4 are connected by the second signal line 115.2 to the second vehicle control system 109.2. The first signal line 115.1 and the second signal line 115.2 are separated from one another spatially (for example installed on different sides of the vehicle 101) and in terms of signal technology, so that, on the one hand, a disruption in one signal line 115.1 or 115.2 does not impair the other signal line 115.2 or 115.1 and, on the other hand, the 20 probability is reduced of an external disruption affecting both signal lines 115.1 and 115.2. Analogously, in the present example, the first braking control system 108.1 is connected by the third signal line 115.3 to the second vehicle control system 109.2, while the second braking control system 108.2 is connected by the fourth signal line 115.4 to the second vehicle control system 109.2. The third signal line 115.3 and the fourth signal line 115.4 are 25 in turn separated from one another spatially (for example installed on different sides of the vehicle 101) and in terms of signal technology, so they do not influence one another in the above-described manner and the probability of a joint impairment by an external disruption is reduced. In a comparable manner, in the present example, the control system of the first energy 30 supply device 105.1 is connected by the fifth signal line 115.5 to the second vehicle control system 109.2, while the control system of the second energy supply device 105.2 is connected by the sixth signal line 115.6 to the second vehicle control system 109.2. The fifth PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 249911_1 (GHManers) -15 signal line 115.5 and the sixth signal line 115.6 are in turn separated from one another spatially (for example installed on different sides of the vehicle 101) and in terms of signal technology, so they do not influence one another in the above-described manner and the probability of a joint impairment by an external disruption is reduced. 5 In an analogous manner, in the present example, the control system of the first current collector 106.1 is finally connected by the seventh signal line 115.7 to the second vehicle control system 109.2, while the control system of the second current collector 106.2 is connected by the eighth signal line 115.8 to the second vehicle control system 109.2. The seventh signal line 115.7 and the eighth signal line 115.8 are in turn separated from one 10 another spatially (for example installed on different sides of the vehicle 101) and in terms of signal technology, so they do not influence one another in the above-described manner and the probability of a joint impairment by an external disruption is reduced. The described switching off of the first vehicle control system 109.1 and the first control path 110 and the activation of the second control mechanism 109.2 and the second control path 15 with the above-described rigidly connected configuration means that, on the one hand, all the signals, which lead, in normal operation, to an emergency braking operation, can be directly suppressed and therefore no longer impair the further control or have to be processed in the framework of this control. Therefore the control system in special operation can be constructed particularly simply and robustly. 20 After the changeover to special operation, a check is made in step 112.5 whether a driving request by the vehicle driver is present in that the latter accordingly deflects the drive lever 111.1. If this is the case, the second control mechanism 109.2, in a step 112.6, transmits a respective release signal by the signal lines 115.3 and 115.4 to the respective braking control system 108.1 and 108.2, which cancels any braking signal present at the braking control 25 systems 108.1 and 108.2 and (with intact signal processing in the braking control systems 108.1 and 108.2 and intact braking devices) leads to a release of the braking devices of all the bogies 103.1 to 103.4. The second control mechanism 109.2 furthermore in each case sends a driving signal by means of the two signal lines 115.1 and 115.2 to the traction control systems 104.1 to 104.4, 30 which cancels any switch-off signal present at the traction control systems 104.1 to 104.4 and (with intact signal processing in the traction control systems 104.1 to 104.4 and intact PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 24699111 (GHMatters) - 16 traction devices) leads to an activation and actuation of the traction devices of the bogies 103.1 to 103.4. In other words, in special operation, a reversal of the priorities is hereby realised between a driving request or a driving signal, respectively, and a braking request or a braking signal, 5 respectively. This can, in the simplest case, be realised in that it is prevented that a braking signal (however caused) is passed to the braking control systems 108.1 and 108.2 as long as a driving signal for the traction control systems 104.1 to 104.4 is present at the signal lines 115.1 and 115.2. A driving request activating the traction devices is thus in each case treated with priority over a braking request activating the braking devices. The onward travel 10 of the vehicle 101 triggered deliberately and (as will be explained below in more detail) in a sustained manner by the vehicle driver, in special operation, therefore has absolute priority over a braking request, however triggered. The second control mechanism 109.2, on the one hand, furthermore sends a respective activation signal via the two signal lines 115.5 and 115.6, triggered by the driving request, to 15 the energy supply devices 105.1 and 105.2, which cancels any switch-off signal present at the energy supply devices 105.1 and 105.2 and leads to an activation of the energy supply devices 105.1 and 105.2 (with intact signal processing in the control systems of the energy supply devices 105.1 and 105.2 and intact energy supply devices 105.1 and 105.2). On the other hand, the second control mechanism 109.2, triggered by the driving request, 20 furthermore sends a respective activation signal via the two signal lines 115.7 and 115.8 to the control systems of the current collectors 106.1 and 106.2, which cancels any switch-off signal present at the control systems of the current collectors 106.1 and 106.2 and, leads to an activation of the current collectors 106.1 and 106.2 and a locking of the current collectors 106.1 and 106.2 in their extended position (contact with the overhead contact line 107) (with 25 intact signal processing in the control systems of the current collectors 106.1 and 106.2 and intact current collectors 106.1 and 106.2). All these measures ensure in an advantageous manner that the functioning traction devices of the bogies 103.1 to 103.4 are activated and by means of the functioning current collectors 106.1, 106.2 and the energy supply devices 108.1, 108.2 are supplied with energy. In 30 addition it is ensured that the functioning braking devices are released so the vehicle 101 can continue to be driven. PCT/EP2009/054311 KAlsv 070091WO 12 November 2010 2489911_1 (GHMatters) -17 In the present example, the distribution of the traction devices over the first signal line 115.1 and the second signal line is selected such that in each case 50% of the traction devices of the vehicle 101 are controlled by means of one of the two signal lines 115.1 and 115.2. It goes without saying, however, that in other variants of the invention, another distribution may 5 also be provided. As was already explained above, the distribution is preferably carried out in such a way that, if the traction devices which are controlled by one of the signal lines fail, the added traction power of the traction devices, which are controlled by the other signal line, is sufficient to continue to move the vehicle. This ensures that the vehicle can still be moved to a safe stopping place even if one fraction of the traction devices fails. 10 In the present example, the added traction power of the traction devices controlled by the first signal line 115.1 is sufficient to continue to move the vehicle if all the braking devices of the vehicle 101 block. The same applies to the added traction power of the traction devices controlled by the second signal line 115.2. It is thus ensured that the vehicle 101 can still be moved to a safe stopping place even in the event of failure of 50% of the traction devices and 15 completely blocking brakes (even if at a correspondingly low speed). The distribution of the braking devices over the signal lines 115.3 and 115.4 takes place in an analogous manner, so, in each case, 50% of the braking devices of the vehicle 101 are controlled by one of the two signal lines 115.3 and 115.4. Something comparable applies to the division of the energy supply devices 105.1, 105.2 or the current collectors 106.1, 106.2 20 over the signal lines 115.5, 115.6 or 115.7, 115.8. With the above-described measures in the step 112.6, in special operation with a sufficient number of intact components of the vehicle 101, it is made possible to travel onward to a safe stopping point. It is accepted here inter alia that, eventually, individual endangered or already damaged components of the vehicle 101 will undergo (further) damage by their 25 further use in special operation. However, this is accepted with regard to the paramount elimination of the danger to the passengers of the vehicle 101. By carrying out the above-described measures in step 112.6, which (with an adequate number of intact components of the vehicle 101) lead to onward travel of the vehicle 101, a check is made in a step 112.7 whether a first time span Z1, for example 30 s, has passed 30 since the last renewal of the driving request from the vehicle driver. The renewal of the driving request in the present example takes place in that the vehicle driver returns the PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 24899111 (GHMatter) - 18 deflected drive lever 111.1 back into its neutral position (zero position) shown in Figure 1 and then deflects it again into a driving position (contour 113 in Figure 1). If the first time span Z1 has passed without renewal of the driving request, the second vehicle control system 109.2, in a step 112.8, sends a traction stop signal by means of the 5 signal lines 115.1 and 115.2 to the traction control systems 104.1 to 104.4, which leads to a deactivation of the traction devices. A check is then made in a step 112.9 whether, since the last renewal of the driving request by the driver, a second time span Z2 has passed, the second time span Z2 being greater than the first time span Z1 (and being, for example, 45 s). If this is the case and if no further 10 relevant inputs from the vehicle driver have been actuated at the driver's control panel 111, the second vehicle control system 109.2, in a step 112.10 sends, by means of the signal lines 105.3 and 105.4, a respective braking signal to the braking control systems 108.1 and 108.2, which leads to an activation of the braking devices and therefore an emergency braking operation. 15 In other words, a so-called dead man function is realised by means of the steps 112.7 to 112.10, by means of which, in the event of a failure of the vehicle driver, after activation of the special operation it is ensured that the vehicle cannot travel on in an uncontrolled manner. It is finally checked in a step 112.11 whether the method sequence should be ended. If this 20 is the case, the method sequence is ended in a step 112.12. Otherwise, a return is made to the step 112.5. A renewed transition to normal operation (return to step 112.2) is not provided in the present example. Rather, after a one-off activation of the special operation, a corresponding maintenance of the vehicle 101 has to take place. It is obvious, however, that, in other variants of the invention, optionally after a corresponding checking step, a 25 return of this type to the step 112.2 may also be provided. It may be provided that, in special operation, the signals "door release" and "vehicle at standstill" are always applied by the second vehicle control system 109.2 to the door control units (not shown in Figure 1) of the doors of the vehicle 101, so the doors can be opened at any time to allow a rapid evacuation of the passengers. PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 2469911_1 (GHMattes) -19 If, in special operation, a location is reached which allows the passengers to climb out safely, for example a station or an emergency exit in a tunnel, the vehicle driver can cancel the driving request at any time and generate a braking command which the second vehicle control system 109.2 sends by means of the signal lines 115.3, 115.4 to the braking control 5 systems 108.1, 108.2 in order to bring the vehicle 101 to a standstill by means of the braking devices. Finally, the second vehicle control system 109.2, triggered by a corresponding input of the vehicle driver at a standstill, can transmit an opening signal to the door control units, so the doors open and it is possible for the passengers to climb out safely. 10 The second vehicle control system 109.2 is configured in the present example in such a way that it merely comprises one or more simple actuating devices which apply a signal, in accordance with the above explanations, to the respective signal line 115.1 to 115.8. In this case, simple, preferably rigidly connected logic modules can be used to realise the above described signal operations, conditions and queries (dead man function etc.) 15 In other words, a microprocessor-assisted control system (which is frequently also called an electronic control system) is thus dispensed with for the second vehicle control system 109.2 in the present example. For the special operation, this ensures a particularly economic, robust control, not very susceptible to faults, of the decentralised control mechanisms of the vehicle components to be controlled (in other words, here, the traction control systems 104.1 20 to 104.4, the control mechanisms of the energy supply devices 105.1, 105.2, the braking control systems 108.1, 108.2 and the control mechanisms of the current collectors 106.1, 106.2). These decentralised control mechanisms are in turn typically configured as microprocessor assisted (electronic) control mechanisms and process the signals of the second vehicle 25 control system 109.2 supplied by means of the signal lines 115.1 to 115.8 in the corresponding manner. A further advantage of this design is that the safety of this system (from the second vehicle control system 109.2 and the signal lines 115.1 to 115.8) can be tested and demonstrated particularly easily so the control system according to the invention is also particularly 30 advantageous with regard to the authorisation of a vehicle equipped therewith. PCT/EP2009/054311 KA/sv 070091WO 12 November 2010 2469911_1 (GHMatts) - 20 It is obvious, however, that in other variants of the invention, a completely or partially microprocessor-assisted control system can also in turn be used for the second vehicle control system if a correspondingly high security against failure can be ensured. As can also be inferred from Figure 1, the vehicle 101, at its other vehicle end, has a further 5 driver's cab with a further driver's control panel 116 which is designed in an analogous manner to the driver's control panel 111 and is connected to the remaining components of the control mechanism 102. Likewise also provided in this further driver's cab is an actuating mechanism 117, which is designed in an analogous manner to the actuating mechanism 114 and is connected to the remaining components of the control mechanism 102. 10 The present invention was described above exclusively by means of an example of a rail vehicle. It is obvious however, that the present invention can also be applied to any other vehicles, in which a corresponding special operation can be required to avert dangers to the passengers or passers-by outside the vehicle. PcT/EP2009/054311 KA/sv 070091WO 12 November 2010 2489911_1 (GHMitters)