AU2018201894B2

AU2018201894B2 - A safety device for a railway vehicle, a railway vehicle, a method for preserving safety of such a railway vehicle, and associated computer program

Info

Publication number: AU2018201894B2
Application number: AU2018201894A
Authority: AU
Inventors: Laurent Hazard
Original assignee: Alstom Transport Technologies SAS
Current assignee: Alstom Transport Technologies SAS
Priority date: 2017-03-22
Filing date: 2018-03-16
Publication date: 2022-03-10
Anticipated expiration: 2038-03-16
Also published as: TWI791497B; FR3064221A1; BR102018004942A2; CN108706020A; CN108706020B; FR3064221B1; BR102018004942B1; TW201838850A; AU2018201894A1; EP3378725A1

Abstract

This safety device (24) for a railway vehicle (2) is configured to command a braking system (22) of the railway vehicle. It comprises a first detection module for detecting at least one abnormal behavior of the railway vehicle from among a forbidden crossing of a signal light (10, 11) and exceeding a speed limit; a second detection module for detecting at least one internal failure of the safety device; and a command module for sending a command signal to the braking system. The command module is configured to: - if an abnormal behavior is detected, send a command signal for emergency braking according to a first braking level, and - if an internal failure is detected, send a command signal for emergency braking according to a second braking level, the first level being greater than the second level. Figure 1 15 1/2 20 24 2 28 12 26 34 8 10 22--2 304 14 32 1 8 FIG.1 78 6 -0 16 183 24 2 6 4 -46-1 -60 -22 -14- 62 52 40FIG.2

Description

1/2

20 24 2 28

12 26 34 8 10 22--2 304 14

32 18 FIG.1 78 6 -0

16 183

24 2 64

-46-1 -60 -22

-14- 62

52 40FIG.2

AustralianPatents Act.1990

ORIGINAL COMPLETE SPECIFICATION STANDARD PATENT

Invention Title A safety device for a railway vehicle, a railway vehicle, a method for preserving safety of such a railway vehicle, and associated computer program

The following statement is a full description of this invention, including the best method of performing it known to me/us:-

The present invention relates to a safety device for a railway vehicle, the safety device being configured to command a braking system of the railway vehicle. The invention also relates to a railway vehicle, such as a tram, on tires or rails, a light rail vehicle (LRV) or a subway, such as rubber-tired subway, comprising a braking system of the railway vehicle and such a safety device configured to command the braking system. The invention also relates to a method for preserving the safety of the railway vehicle, the method being carried out by such an electronic safety device. The invention also relates to a computer program comprising software instructions which, when executed by a computer, carry out such a method for preserving safety.

The invention relates to the field of the safety of railway vehicles, in particular trams, LRVs or subways, such as rubber-tired subways. The invention in particular relates to automatic train protection (ATP) devices or systems, which are configured to command a braking system of the railway vehicle automatically under certain conditions.

A safety device for a railway vehicle is known, such as an ATP system. This safety device comprises a first detection module configured to detect at least one abnormal behavior of the railway vehicle from among a forbidden crossing of a signal light and exceeding a speed limit; a second detection module configured to detect at least one internal failure of the safety device; and a command module configured to send a command signal to the braking system. The command module is then configured to send a command signal for an emergency brake depending on a maximum braking level, if an abnormal behavior is detected by the first detection module or an internal failure is detected by the second detection module. Also known from document FR 2,949,412 B1 is a railway safety installation allowing the braking of a train traveling along a track when crossing lateral signaling equipment of the track, such as a traffic light, a state of said signaling equipment being controlled remotely from a control station. The railway safety installation comprises a ground device comprising an encoder comprising means for generating telegrams and at least one beacon positioned on the track near the lateral signaling equipment in question, the beacon being able to emit a wireless signal corresponding to a telegram generated by the encoder. The railway safety installation also comprises an onboard device satisfying the ETCS standard, comprising an antenna able to capture a wireless signal emitted by the beacon, and a calculation and actuation unit connected to the antenna, able to

la process the received wireless signal and comprising means for actuating the braking system of the train. When the lateral signaling equipment is in the "stop" state, for example corresponding to a red light of the traffic light, the ground device emits a telegram of the "stop" type compatible with the ETCS standard, and the device on board the train then triggers the braking of the train. However, such a safety device for a railway vehicle is still not very suitable for operation in an urban setting with many obstacles, such as pedestrians, cyclists or cars, notably if the railway vehicle is a tram, a LRV or a rubber-tired subway.

Accordingly, there is a need for a safety device for a railway vehicle that is more suitable for such operation in an urban setting. In one aspect of the present invention, there is provided a safety device for a railway vehicle, such as a tram, a LRV or a subway, such as a rubber-tired subway, the safety device being configured to command a braking system of the railway vehicle and comprising: - a first detection module configured to detect at least one abnormal behavior of the railway vehicle from among a forbidden crossing of a signal light and exceeding a speed limit; - a second detection module configured to detect at least one internal failure of the safety device; and - a command module configured to send a command signal to the braking system; the command module being configured to: + if an abnormal behavior is detected by the first detection module, send a command signal for emergency braking according to a first braking level, and + if an internal failure is detected by the second detection module, send a command signal for emergency braking according to a second braking level, the first braking level being strictly greater than the second braking level. With the safety device according to embodiments of the invention, the emergency braking with the maximum braking level, i.e., the emergency braking according to the first braking level, is commanded only if an abnormal behavior of the railway vehicle is detected, namely a forbidden crossing of a signal light or exceeding a speed limit, but not if an internal failure of the safety device is detected. This makes it then possible to limit the risks of injuries to passengers inside the railway vehicle, by commanding the emergency braking according to the first braking level (which is particularly effective to limit a collision speed of the railway vehicle with obstacles, such as pedestrians, cyclists or cars) only when the situation requires it, i.e., in case of abnormal behavior of the railway vehicle, but not in case of detection of a simple internal failure of the safety device, such a detection also sometimes resulting from a false alarm. The safety device may comprise one or more of the following features, considered alone or according to any technically possible combination(s): - the command module is configured to send a command signal for emergency braking according to the first braking level only if an abnormal behavior is detected by the first detection module; - the first braking level includes emergency level 3 or emergency level 4 according to standard EN13452-1; - the second braking level includes emergency level 1 or emergency level 2 according to standard EN13452-1; and - the command module is configured to command a magnetic braking device by sending the command signal for the emergency braking according to the first braking level, the braking system comprising the magnetic braking device. In another aspect of the invention, there is provided a railway vehicle comprising a braking system for the railway vehicle and a safety device configured to command the braking system, wherein the safety device is as defined above. The railway vehicle may be a tram, a LRV or a subway, such as a rubber-tired subway. In another aspect of the present invention, there is provided a method for preserving safety of a railway vehicle, such as a tram, an LRV or a subway, such as a rubber-tired subway, the method being carried out by an electronic safety device and comprising: - detecting at least one event from among an abnormal behavior of the railway vehicle and an internal failure of the safety device, the abnormal behavior of the railway vehicle being a forbidden crossing of a signal light or exceeding the speed limit; - commanding a braking system of the railway vehicle, comprising: + if an abnormal behavior of the railway vehicle is detected, sending the braking system a command signal for emergency braking according to a first braking level, and + if an internal failure of the safety device is detected, sending the braking system a command signal for emergency braking according to a second braking level, the first braking level being strictly greater than the second braking level.

The safety preservation method may comprise the following feature: - during commanding of the braking system, the command signal for emergency braking according to the first braking level is sent to the braking system only if an abnormal behavior is detected. In another aspect of the present invention, there is provided a computer program comprising software instructions which, when executed by a computer, implement a method as defined above.

The invention will now be described, by way of non-limiting example only, with reference to the accompanying drawings, in which:: - figure 1 is a schematic view of a railway vehicle according to an embodiment of the invention, moving along a track - figure 2 is a schematic illustration of the railway vehicle; and - figure 3 is a flowchart of a method for preserving safety of the railway vehicle according to an embodiment of the invention.

In figure 1, a railway vehicle 2 is able to travel along a railroad track 4 that comprises for example two lines of rails 5 and 6, the railway vehicle 2 being able to communicate with a ground system 8. The track 4 is signaled traditionally using, inter alia, lateral signaling equipment, such as first and second signal lights 10, 11, positioned successively on the edge of the track 4. The first light 10 is aligned with a first point M of the track 4 and the second light 11 is aligned with a second point M'. Each signal light 10, 11 is intended to send a visual signal to the driver 12 of the railway vehicle 2. The railway vehicle 2 comprises a reception device 14 configured for receiving signals, preferably wireless, from a beacon 16, 18 associated with a corresponding signal light 10, 11. The railway vehicle 2 comprises a measuring device 20 configured to measure a speed of the railway vehicle or to acquire the speed of the railway vehicle from another measuring apparatus. The railway vehicle 2 comprises a braking system 22 configured to exert a braking force on the railway vehicle 2, the braking system 22 comprising notably a magnetic braking device, not shown, to exert the maximum braking level. The railway vehicle 2 further comprises a safety device 24 configured to command the braking system 22, the safety device 24 for example being an ATP (automatic train protection) system.

The railway vehicle 2 also comprises a man-machine interface 26 connected to the safety device 24. The railway vehicle 2 is preferably a tram, a LRV or a subway, such as a rubber tired subway. Alternatively, the railway vehicle is a rubber-tired tram. In this alternative, only one central guide rail is used. The ground system 8 comprises the first and second signal lights 10, 11, a control station 28 configured to remotely command the change of state of each signal light 10, 11, the control station 28 being connected to the corresponding signal light 10, 11, by a dedicated electrical line 30, to send electrical command signal for the state of the signal light 10, 11. Each respective electrical line 30 is coupled to the signal light 10, 11, via a relay system 32 making it possible to amplify the electrical command signal to perform the state change of the signal light 10, 11. The ground system 8 further comprises, for each signal light 10, 11, an encoder 34 and the beacons 16, 18, i.e. an upstream beacon 16 and a downstream beacon 18. The beacons 16 and 18 are positioned between the lines of rails 5 and 6 of the track 4 and successively, in a movement direction of the railway vehicle 2. At the input, the encoder 34 is connected to the relay system 32 of the link between the control station 28 and the corresponding signal light 10, 11. At the output, the encoder 34 is connected to the upstream beacon 16. Each signal light 10, 11 is able to be in one of the three following distinct states: - a "stop" state, for example corresponding to a red light, indicating to the driver 12 to stop the railway vehicle 2 so that it does not cross the corresponding point M, M'; - a "go" state, for example corresponding to a green light, indicating to the driver 12 that he can cross the point M, respectively the point M' , and proceed on a next segment of the track 4; - a "warning" state, for example corresponding to a yellow light, indicating to the driver 12 that the next signal light on the track 4 is a light currently in the "stop" state. This information indicates to the driver 12 that he must actuate the braking system of the railway vehicle 2 in order to comply with an indication given by the next signal light. The reception device 14 is configured to receive the signals, preferably wireless, from the beacons 16, 18 associated with each signal light 10, 11, in particular an indication relative to a forbidden crossing of a corresponding signal light 10, 11. The reception device 14 includes wireless antenna and transceiver, not shown, configured to receive the wireless signals from the beacons 16, 18.

The reception device 14 is also configured to receive an indication relative to a speed limit in force in the geographical zone where the railway vehicle 2 is located. This indication relative to the speed limit is also received in the form of one or several wireless signals. The respectively upstream 16 and downstream 18 beacons are configured to emit short-range wireless signals. The presence of the second beacon 18, also called downstream beacon, downstream from the first beacon 16, also called upstream beacon, makes it possible to orient the track 4 simply in a single travel direction corresponding to the order of the upstream, then downstream beacons 16, 18. For example, a railway vehicle 2 traveling on a track parallel to the track 4, but having an opposite direction of travel, will not account for wireless signals emitted by the beacons 16 and 18, since it first receives a signal from the downstream beacon 18, then from the upstream beacon 16. The measuring device 20 is known in itself and is configured to measure the speed of the railway vehicle, in particular its instantaneous speed, or to acquire said speed of the railway vehicle 2 from another measuring apparatus, such as a receiver of a satellite positioning system, also called GNSS (Global Navigation Satellite System) receiver. The braking system 22 is also known in itself and is configured to brake the railway vehicle 2. The braking system 22 comprises in particular the magnetic braking device, which is able to exert a braking force on the railway vehicle 2 corresponding to a maximum braking level. The safety device 24, also visible in figure 2, comprises a first detection module 40 configured to detect at least one abnormal behavior of the railway vehicle from among a forbidden crossing of a signal light 10, 11 and exceeding a speed limit. The safety device 24 comprises a second detection module 42 configured to detect at least one internal failure of the safety device 24, and a command module 44 configured to send a command signal to the braking system 22. The safety device 24 comprises an acquisition module 46 configured to acquire authorization to cross a corresponding signal light 10, 11, this crossing authorization for example being received through a voluntary action by the driver. The safety device 24 is for example of a level at least equal to SIL 2 (Safety Integrity Level 2) according to standards NF EN 50126, NF EN 50128 and NF EN 50129. In the example of figure 2, the safety device 24 is made at least partially in wired logic connection, the first detection module 40 comprising a first comparator 50, a second comparator 52 and an OR logic gate 54, and the command module 44 comprising a first command loop 60 equipped with one or several first switches 62, such as switches that are normally closed, and a second command loop 64 separate from the first command loop 60, the second command loop 64 being equipped with one or several second switches 66, such as switches that are normally open. Additionally or alternatively, the safety device 24 further comprises an information processing unit, not shown, for example formed by a processor and a memory associated with the processor. According to this alternative, the first detection module 40, the second detection module 42, the command module 44 and the acquisition module 46 are for example each made in the form of software executable by the processor. The memory of the information processing unit is then able to store a first detection software configured to detect at least one abnormal behavior of the railway vehicle from among a forbidden crossing of a signal light 10, 11 and exceeding a speed limit, a second detection software configured to detect at least one internal failure of the safety device 24, a command software configured to send a command signal to the braking system 22, and an acquisition software configured to acquire authorization to cross a corresponding signal light 10, 11. The processor of the information processing unit is then able to execute the first detection software, the second detection software, the command software and the acquisition software. In an alternative that is not shown, the first detection module 40, the second detection module 42, the command module 44 and the acquisition module 46, are each made in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array), or in the form of a dedicated integrated circuit, such as an ASIC (Applications Specific Integrated Circuit). The man-machine interface 26 is connected to the safety device 24, and for example includes a screen, not shown, for displaying information readable by the driver 12 of the railway vehicle 2, as well as a speaker, not shown, for emitting different warning tones. The encoder 34 is configured to receive, from the relay system 32, a secondary electrical signal corresponding to the electrical command signal of the state of the corresponding signal light 10, 11. The encoder 34 is then configured to process this secondary electrical signal and to generate a bit frame corresponding to the current state of the corresponding signal light 10, 11 with which the encoder 34 is associated. The bit frame, or series, is sent to the upstream beacon 16, which is able to emit a wireless signal corresponding to the frame generated by the encoder 34. The first detection module 40 is configured to detect a forbidden crossing of a signal light 10, 11 or exceeding a speed limit. The first detection module 40 comprises for example the first comparator 50 able to compare, on the one hand, a signal received from the reception device 14 relative to the state of the corresponding signal light 10, 11, and the crossing or non-crossing of this signal light 10, 11 by the railway vehicle 2, and on the other hand, the authorization or non authorization to cross the signal light 10, 11, acquired by the acquisition module 46, in order to detect any forbidden, i.e. unauthorized, crossing of the corresponding signal light 10, 11. The first detection module 40 comprises for example the second comparator 52 able to compare, on the one hand, a signal received from the reception device 14 relative to the speed limit in force in the geographical zone where the railway vehicle 2 is located, and on the other hand, the speed of the railway vehicle 2 received from the measuring device 20, in order to detect any excess of the speed limit. The first detection module 40 further includes the OR logic gate 54 connected at the output of the first and second comparators 50, 52, the OR logic gate 54 then delivering, as output, a signal indicating at least one abnormal behavior of the railway vehicle 2 from among a forbidden crossing of a corresponding signal light 10, 11 and exceeding of a speed limit. The output of the OR logic gate 54 in this case forms the output of the first detection module 40. The second detection module 42 is configured to detect at least one internal failure of the safety device 24. Such an internal failure for example results from a fault observed during an internal self-test of the safety device 24, a software integrity test, or a monitoring test of the hardware in order to supervise the software activity and/or the power supply of the safety device 24. According to an embodiment of the invention, the command module 44 is configured to send a command signal for emergency braking according to a first braking level, if an abnormal behavior is detected by the first detection module 40, and to send a command signal for emergency braking according to a second braking level, if an internal failure is detected by the second detection module 42, the first braking level being strictly greater than the second braking level. The command module 44 is preferably configured to send a command signal for emergency braking according to the first braking level only if an abnormal behavior of the railway vehicle 2 is detected by the first detection module 40. The command module 44 is for example configured to command the magnetic braking device by sending the command signal for the emergency braking according to the first braking level. The first braking level comprises emergency level 3 or emergency level 4 according to standard EN13452-1. The first braking level is preferably emergency level 3 or emergency level 4 according to standard EN13452-1.

According to standard EN13452-1, emergency level 3 corresponds to a deceleration comprised between 2.8 m.s-2 and 5 m.s-2 with a maximum jerk of 8m/s 3 . According to standard EN13452-1, emergency level 4 corresponds to a deceleration comprised between 3 2.8 m.s-2 and 4m.s-2 with a maximum jerk of 8m/s The second braking level comprises emergency level 1 or emergency level 2 according to standard EN13452-1. The second braking level is preferably emergency level 1 or emergency level 2 according to standard EN13452-1. According to standard EN13452-1, emergency level 1 corresponds to a deceleration comprised between 1.2 m.s-2 and 2.5 m.s-2 with a maximum jerk of 4m/s 3 . According to standard EN13452-1, emergency level 2 corresponds to a deceleration comprised between 1.2 m.s-2 and 2.5 m.s-2 with a maximum jerk of 4 m/s 3

. The command module 44 comprises for example the first command loop 60 equipped with two first switches 62, such as switches that are normally closed, to command the emergency braking according to the first braking level. The command module 44 comprises for example the second command loop 64, separate from the first command loop 60, the second command loop 64 being equipped with two second switches 66, such as switches that are normally open, to command the emergency braking according to the second braking level, with a value strictly lower than that of the first braking level. The command module 44 has for example a reverse activation logic from one command loop to the other, the first loop 60 comprising switches 62 that are normally closed and the second loop 64 comprising switches 66 that are normally open. In the example of figure 2, the first command loop 60 is dedicated to commanding the braking system 22 with implementation of the magnetic braking device, and the second command loop 64 is dedicated to commanding the braking system 22 without implementing the magnetic braking device. The use of two separate command loops 60, 64 makes it possible to differentiate first and second separate braking levels in the command interface. Furthermore and preferably, the first command loop 60 and the second command loop 64 cannot be activated at the same time, so as not to command the braking system 22 with both the first braking level and the second braking level at the same time.

The operation of the railway vehicle 2, and in particular of the safety device 24, will now be explained using figure 3, showing a flowchart of the safety method of the railway vehicle according to an embodiment of the invention.

During an initial step 100, the first detection module 40 monitors the information received from the reception device 14, on the one hand, and from the measuring device 20, on the other hand, in order to detect any abnormal behavior of the railway vehicle 2, this abnormal behavior being a forbidden crossing of a signal light 10, 11 or exceeding the speed limit, i.e., an excessive speed. The first detection module 40 compares notably the speed of the railway vehicle 2, in particular its instantaneous speed, provided by the measuring device 20, with the corresponding speed limit provided by the reception device 14, and signals any excess of this speed limit to the command module 44. The first detection module 40 also compares the various pieces of information received from the reception device 14 with those provided by the acquisition module 46 in order to verify, if a corresponding signal light 10, 11 is crossed, that such a crossing was indeed authorized. The second detection module 42 also monitors, during step 100, results of internal tests of the safety device 24, in particular the results of internal self-tests, software integrity tests and/or monitoring tests of the hardware, in order to detect any internal failure of the safety device 24. If applicable, the second detection module 42 signals any internal failure of the safety device to the command module 44. If at least one event from among an abnormal behavior of the railway vehicle 2 being detected by the first detection module 40 and/or an internal failure of the safety device being detected by the second detection module 42, the safety method goes to the next step 110 in order to command the braking system 22 of the railway vehicle depending on the detected event. If an abnormal behavior is detected by the first detection module 40, the command module 44 then sends the braking system 22 a command signal for emergency braking according to the first braking level, the first braking level being for example emergency level 3 or 4 according to standard EN13452-1. If only an internal failure of the safety device is detected by the second detection module 42, the command module 44 then sends the braking system 22 a command signal for emergency braking according to the second braking level, the second braking level being strictly lower than the first braking level, the second braking level for example being emergency level 1 or 2 according to standard EN13452-1. Alternatively, the safety device 24 further comprises a third detection module, not shown, configured to detect an anomaly not requiring braking with maximum efficiency, such as an attention state of the driver corresponding to a drop in the driver's attention below a predetermined threshold. Such an attention state is for example determined by a standby device that monitors the state of the driver, for example the movements of the driver. In this alternative, if only a drop in the driver's attention below a predetermined threshold is detected by the third detection module, the command module 44 then sends the braking system 22 a command signal for emergency braking according to the second braking level, the second braking level being strictly lower than the first braking level, the second braking level for example being emergency level 1 or 2 according to standard EN13452-1. Thus, the safety device 24 and the safety preservation method according to embodiments of the invention make it possible to command the braking system 22 in order to have braking with maximum efficiency only when an actual danger is detected, such as a forbidden crossing of a signal light 10, 11 or an excess of the corresponding speed limit. Indeed, such braking with maximum efficiency entails a risk for the travelers in the railway vehicle 2, in particular a risk of fall and/or injury. However, when the safety device 24 detects only an internal failure of the safety device, for example resulting from a self-test fault, such a signal of a failure being besides sometimes a false alarm, the safety device 24 and the safety preservation method according to embodiments of the invention make it possible to command the braking system 22 in order to have braking with moderate efficiency in order to reduce the risk incurred by travelers located in the railway vehicle 2, in particular the risk of falling. The safety device 24 and the safety preservation method according to embodiments of the invention then make it possible to reduce the number of emergency braking operations with maximum efficiency that are untimely, in particular to decrease the number of untimely, or unwarranted, braking operations with emergency level 3 or 4 according to standard EN13452-1. One can then see that the safety device 24 and the safety preservation method according to the invention are more suitable for operation in an urban setting with many obstacles, such as pedestrians, cyclists or cars, notably if the railway vehicle 2 is a tram, a LRV or a rubber-tired subway. While various embodiments of the present invention have been described above, it should be understood that they have been presented by way of example only, and not by way of limitation. It will be apparent to a person skilled in the relevant art that various changes in form and detail can be made therein without departing from the spirit and scope of the invention. Thus, the present invention should not be limited by any of the above described exemplary embodiments. The reference in this specification to any prior publication (or information derived from it), or to any matter which is known, is not, and should not be taken as an acknowledgment or admission or any form of suggestion that that prior publication (or information derived from it) or known matter forms part of the common general knowledge in the field of endeavor to which this specification relates. Throughout this specification and the claims which follow, unless the context requires otherwise, the word "comprise", and variations such as "comprises" and "comprising", will be understood to imply the inclusion of a stated integer or step or group of integers or steps but not the exclusion of any other integer or step or group of integers or steps.

Claims

THE CLAIMS DEFINING THE INVENTION ARE AS FOLLOWS:

1. A safety device for a railway vehicle , such as a tram, a LRV or a subway, such as a rubber-tired subway, the safety device being configured to command a braking system of the railway vehicle and comprising: - a first detection module configured to detect at least one abnormal behavior of the railway vehicle from among a forbidden crossing of a signal light and exceeding a speed limit; - a second detection module configured to detect at least one internal failure of the safety device; - a command module configured to send a command signal to the braking system; wherein the command module is configured to: - if an abnormal behavior is detected by the first detection module, send a command signal for emergency braking according to a first braking level, and - if an internal failure is detected by the second detection module, send a command signal for emergency braking according to a second braking level, the first braking level being strictly greater than the second braking level.

2. The safety device according to claim 1, wherein the command module is configured to send a command signal for emergency braking according to the first braking level only if an abnormal behavior is detected by the first detection module.

3. The safety device according to claim 1 or 2, wherein the first braking level includes emergency level 3 or emergency level 4 according to standard EN13452-1, emergency level 3 corresponding, according to standard EN13452-1, to a deceleration comprised between 2.8 m.s-2 and 5 m.s-2 with a maximum jerk of 8 m/s 3

emergency level 4 corresponding, according to standard EN13452-1, to a deceleration comprised between 2.8 m.s-2 and 4 m.s-2 with a maximum jerk of 8 m/s 3 .

4. The safety device according to any one of the preceding claims, wherein the second braking level includes emergency level 1 or emergency level 2 according to standard EN13452-1, emergency level 1 corresponding, according to standard EN13452-1, to a deceleration comprised between 1.2 m.s-2 and 2,5 m.s-2 with a maximum jerk of 4 m/s 3

emergency level 2 corresponding, according to standard EN13452-1, to a deceleration comprised between 1.2 m.s-2 and 2,5 m.s-2 with a maximum jerk of 4 m/s 3 .

5. The safety device according to any one of the preceding claims, wherein the command module is configured to command a magnetic braking device by sending the command signal for the emergency braking according to the first braking level, the braking system comprising the magnetic braking device.

6. A railway vehicle comprising a braking system for the railway vehicle and a safety device configured to command the braking system, wherein the safety device is according to any one of the preceding claims.

7. The railway vehicle according to claim 6, wherein the railway vehicle is a tram, a LRV or a subway, such as a rubber-tired subway.

8. A method for preserving safety of a railway vehicle, such as a tram, an LRV or a subway, such as a rubber-tired subway, the method being carried out by an electronic safety device and comprising: - detecting at least one event from among an abnormal behavior of the railway vehicle and an internal failure of the safety device, the abnormal behavior of the railway vehicle being a forbidden crossing of a signal light or exceeding the speed limit; - commanding a braking system of the railway vehicle, comprising: + if an abnormal behavior of the railway vehicle is detected, sending the braking system a command signal for emergency braking according to a first braking level, and + if an internal failure of the safety device is detected, sending the braking system a command signal for emergency braking according to a second braking level, the first braking level being strictly greater than the second braking level.

9. The method according to claim 8, wherein, during commanding of the braking system, the command signal for emergency braking according to the first braking level is sent to the braking system only if an abnormal behavior is detected.

10. A computer program comprising software instructions which, when executed by a computer, carry out a method according to claim 8 or 9.