EA040970B1 - CONTROL DEVICE FOR MONITORING OPERATION OF ANTI-SLIP DEVICE OF RAILWAY BRAKING SYSTEM - Google Patents

Description

Technical field

The invention generally relates to railway braking systems. In particular, the invention relates to a monitoring device for monitoring the operation of an anti-slip device for the braking system of a railway vehicle.

State of the art

In a railway transport system, the coefficient of instantaneous adhesion between a wheel and a rail is the maximum limit of the braking force currently applied to the axles without the wheels of said axles entering the progressive slip phase.

When the axle enters the slipping phase, if the applied braking force is not reduced quickly and properly, then the axle will gradually lose angular velocity until it reaches full lock, followed by immediate overheating and damage due to overheating of the surface of the wheels of said axle at the point of contact of the wheels with rail. It is known that this situation, in addition to a significant increase in the braking distance due to a further decrease in the coefficient of friction, can cause derailment of the vehicle at high operating speeds.

To overcome the previously described disadvantage, pneumatic railway brake systems are equipped with a protection system known as an anti-slip system.

A known anti-slip system is illustrated in FIG. 1 for a four-axle vehicle 102, 103, 104, 105. Brake system 110 generates air brake pressure in response to a brake pressure or brake force request, not shown in FIG. 1 by activating the brake cylinders 111, 112, 113, 114. Each of these brake cylinders is responsible for braking the axles 102, 103, 104, 105, respectively, via the pneumatic supply lines 115, 116. The four blocks 117, 118, 119, 120 anti-slip valves controlled by the anti-slip device 101 are located between the pneumatic supply lines 115, 116 and the respective brake cylinders 111, 122 and 113, 114. The angular velocity sensors 106, 107, 108, 109 determine the angular velocity of the axles 102, 103, respectively 104, 105. Said angular velocity sensors 106, 107, 108, 109 are electrically connected to the anti-slip device 101 and continuously supply an electrical signal representing information about the instantaneous angular velocity of each axis 102, 103, 104, 105. The anti-slip device 101 continuously evaluates the instantaneous linear vehicle speed through operations performed on estimated vehicle speed information th instantaneous linear speed of the axes 102, 103, 104, 105, obtained from the relative measured angular velocities. These operations are known to those skilled in the art, such as, for example, but not exclusively, calculating the average between the four speeds, or the instantaneous maximum value between the four instantaneous linear speeds of the axes 102, 103, 104, 105, or alternatively, as shown in FIG. 3, the maximum value between the four instantaneous speeds 301, 302, 303, 304 associated with the axes 102, 103, 104, 105, and the fifth value calculated by the virtual speed 305 obtained by decreasing the speed value obtained in the previous system sampling cycle, reduced by the maximum allowable deceleration for the vehicle in question multiplied by the sampling period.

By continuously evaluating the differences AV between the estimated instantaneous linear speed of a single axle and the estimated instantaneous linear speed of the vehicle, the anti-slip device 101 determines whether one or more axles have entered a slip phase. If one or more axles have entered the slipping phase, the anti-slip device controls the slipping of said axles by reducing and adjusting the pressure in the brake cylinders associated with the slipping axles accordingly, acting on the valve blocks associated with said slipping axles, by means of known algorithms, for example, those described in EP 3393873, WO 2017175108 preventing said axles from getting into a lock state and trying to get the best braking force by staying in the slip phase.

Each of said anti-slip valve blocks 117, 118, 119, 120 takes the detailed form represented by the pair of pneumatic solenoid valves 220, 221 shown in FIG. 2.

The pneumatic solenoid valves 220, 221 are powered by the anti-slip device 201 via respective switching elements 202, 203. Such switching elements 202, 203 are typically solid state electronic components.

For ease of illustration, in FIG. 2 does not show the connection of the solenoids, ie the electrical coils 204, 205, to ground.

Blocks 117, 118, 119, 120 anti-slip valves can take a total of four states.

The first state is defined as filling and corresponds to the state in which both electro-pneumatic valves are turned off, as shown in FIG. 2: The electro-pneumatic valve 220 provides access to the pressure present in the pneumatic conduit 215 corresponding to the pneumatic conduit 115, 116 in FIG. 1 to brake cylinder 211 corresponding to brake cylinder 111, 112, 113, 114 in FIG. 1, while the pneumatic solenoid valve 221 prevents the brake cylinder 211 and the pneumatic conduit 215 from being emptied into the atmosphere. It's co

- 1 040970 standing is a state of rest or non-intervention of the anti-slip device, since it is actually a direct connection between the brake cylinder 211 and the pneumatic pipeline 215, through which the brake system directly regulates the pressure in the brake cylinder. 211 from zero value to maximum value.

The second state is defined as maintaining and corresponds to the state in which the pneumatic solenoid valve 220 is turned on. In this case, the pressure in the brake cylinder 211 cannot be changed by changing the pressure in the pneumatic line 215. The pneumatic solenoid valve 221 continues to keep the brake cylinder 211 isolated from the atmosphere. In general, the pressure in the brake cylinder 211 remains at its value indefinitely if there are no leaks in the brake cylinder.

The third state is defined as empty and corresponds to the state in which both pneumatic solenoid valves 220, 221 are turned on. In this case, the pressure in the brake cylinder 211 cannot be changed by changing the pressure in the pneumatic line 215. An activated pneumatic solenoid valve 221 vents the brake cylinder 211 to the atmosphere, reducing the pressure in the brake cylinder, possibly to zero.

The fourth state is defined as forbidden and corresponds to the state in which only the pneumatic solenoid valve 221 is turned on. In this case, the pneumatic solenoid valve connects both the brake cylinder 211 and the pneumatic conduit 215 directly to the atmosphere, causing the pressure generated by the brake system to be excessively released to the atmosphere.

In order to systematically avoid the inhibited state, the switching element 203 is connected to the node 206 after the switching element 202. Thus, if the switching element 203 was closed due to improper control of the input circuit or due to its short circuit, it could not activate the pneumatic solenoid valve. 221, if the switching element 202 were not also closed, then the pneumatic solenoid valve 220 would also be turned on, effectively placing the brake cylinder 211 in an empty state, but preventing the pneumatic passage 215 from being excessively vented to the atmosphere.

Various control circuits for pneumatic solenoid valves are known, with a common point at the power supply or at ground, which, however, make it possible to systematically avoid the inhibited state.

In general, in terms of its functional effect, the anti-slip system necessarily reduces the braking force. Obviously, under certain hardware or software failure modes, the anti-slip device can keep the pneumatic solenoid valves 220, 221 constantly on, followed by a complete loss of braking force. To limit the cases of permanently energized valves, European Railway Regulations UIC541-05 Brakes - Specifications for the construction of various brake parts - Wheel Skid Protection (WSP), §1.1.7. - EN15595 Railway applications - Braking - Wheel slide protection §4.2.2. - EN15595 Railway applications Braking Wheel slide protection §4.2. 2) require the introduction of hardware timing devices 210, 212 generating dead time.

These timing devices are introduced to temporarily limit the continuous activation of the pneumatic solenoid valves 210, 212. In particular, the above rules impose a time limit of 10 seconds, which is generally observed by most railway operators. However, there are rail operators who find it appropriate to use times other than those recommended by the above rules.

In FIG. 2 shows the functional implementation of the control system for the anti-slip system. The microprocessor 207 executes axis recognition and control algorithms, such as but not exclusively described in EP 3393873, WO 2017175108, generating appropriate control signals 208, 209 for the switching elements 202, 203.

When microprocessor 207 sets control signal 208 to logic level 1, that is, intending to activate switching element 202, the 0^1 transition of control signal 208 activates timer 210, which in turn sets its output 213 to logic level 1 for the time interval T1 equal to, for example, but not exclusively, 10 s. The logic gate 216 performs an AND function between the control signal 208 and the output signal 213, passing a signal 214 to actually control the closing of the switching element 202 to subsequently turn on the pneumatic solenoid valve 220.

When microprocessor 207 drives control signal 208 to logic 0 before time T1 has elapsed to deactivate pneumatic solenoid valve 220, it puts timing device 210 into the restart state via its R active low input, preparing it for the subsequent 0^1 transition.

- 2 040970

If the command signal 208 remains permanently locked at logic level 1 due to a hardware failure of the microprocessor 207 or due to a software error of the anti-slip control algorithm, then the time T1 counted by the timer 210 will expire, causing the signals 213, 214 to return to logic level 0 followed by a permanent shutdown of the pneumatic solenoid valve 220.

The same happens with the timing device 212 in relation to the pneumatic solenoid valve 221.

In some cases, there is a pressure sensor 222 that indicates to the microprocessor circuit 207 the inlet pressure of the pneumatic solenoid valve 220 via connection 224, and a pressure sensor 223 that indicates to the microprocessor circuit 207 the pressure in the brake cylinder 211 via connection 225.

Known variants of circuits for the implementation of the function of counting the time and the prohibition of commands to turn on the pneumatic solenoid valves 220, 221.

The timing chains shown in Fig. 2 are repeated for each block of anti-slip valves 111, 112, 113, 114.

The solution described above is state of the art, recognized by all railroad operators and railroad safety agencies as a way to reduce the risk that hardware failures or software problems can cause a permanent excessive reduction in air pressure during braking.

In correct operation situations, in order to keep one or more axles 102 ... 105 in a controlled slip state, while the braking state remains in degraded conditions, the anti-slip system performs continuous correction of the pressure applied to one or more brake cylinders 111 ... 114, thus resetting the timing device 210, 212.

However, the use of timing circuits in accordance with the previously described prior art is counterproductive, despite the fact that the anti-slip device performs its function correctly.

The first case is illustrated in Fig. 4. In response to a braking request, the brake system 110 increases the pressure 404 in the brake cylinder 211. Due to the degraded state of adhesion between the wheel 202 and the rail 240, when the axle braking force generated by the pressure 404 exceeds the available traction force, the wheel 202 begins to slip. . The estimated line speed 401 of the axle starts to differ from the line speed 402 of the train at time 403. Immediately, the anti-slip device 201 with its own algorithms activates the emptying phase, causing a 0^1 transition in the control signals 208, 209 to turn on the pneumatic solenoid valves, respectively, 220, 221 From moment 403, the pressure starts to drop, and timing devices 210, 212, activated by transitions 0 ^ 1, start timing, respectively, T1, T2. When the instantaneous calculated axis linear speed 401 enters the tolerance range 405, the anti-slip device 201 switches from the emptying phase to the holding phase, setting the signal 209 to logic level 0 to disable the pneumatic solenoid valve 221. Thus, the timing device 212 is reset. If the instantaneous calculated linear speed 401 remains within the tolerance range 405, then the anti-slip device 201 maintains the maintenance state unchanged. In this case, the timing device 210 continues to operate, reaching the value T1, setting its output 213 to logic 0, turning off the switching element 202, returning the system to the filling state, followed by the final wheel lock.

The second case, shown in Fig. 5 occurs in cases of extremely low friction and axles with very high moments of inertia, for example in the case of axles connected to drive motors via a gearbox.

In response to the braking request, the brake system 110 increases the pressure 504 in the brake cylinder 211. Due to the state of adhesion between the wheel 202 and the rail, when the axle braking force generated by the pressure 504 exceeds the available traction force, the wheel begins to slip. The instantaneous calculated axle line speed 501 begins to differ from the train line speed 502 at time 503. The anti-slip device 201 immediately activates the emptying phase, causing a 0^1 transition in control signals 208, 209 to energize the pneumatic solenoid valves 220, 221, respectively. From the moment 503, the pressure starts to drop, and the timing devices 210, 212, activated by transitions 0 ^ 1, start timing, respectively, T1, T2. Due to the very low adhesion, although the pressure 504 decreases compared to the activation of the emptying phase, the instantaneous calculated linear speed 501 continues to fall, falling well below the tolerance area 505, stopping its decline when the braking force generated by the pressure 504 becomes less than the low force clutch.

In this case, the anti-slip device 201 continues to remain in the emptying phase, waiting for the instantaneous calculated linear speed 501 of the axis to be within the tolerance range. Due to the low friction and high moment of inertia, the instantaneous calculated axis linear velocity 501 starts to increase very slowly with acceleration dv/dt > 0, but very low. In this case, the timing devices 210, 212 continue to operate, reaching the value T1, T2, respectively. In particular, the timing device 210 sets its output 213 to logic 0, turning off the switching element 202, turning off the solenoids 204, 205, returning the system to the filling state, followed by the final blocking of the wheels.

It should be noted that in the case illustrated in FIG. 5, the instantaneous calculated line speed 501 may be out of tolerance 505 due to extremely low friction coupled with slow response times of the pneumatic solenoid valves (220, 221) or due to sudden clutch oscillations not shown in FIG. 5. In both cases, the anti-slip system adjusts the brake cylinder pressure associated with the specified instantaneous calculated linear speed 501, returning it within the tolerance area 405. This is a normal event and is tolerated as long as the instantaneous design line speed 501 is not continuously constant outside tolerance 505 for longer than time TB.

The third case, illustrated in FIG. 6 occurs in cases of a software malfunction of the algorithm or a hardware failure of the microcontroller 207.

In response to a braking request, the braking system 110 increases the pressure 604 in the brake cylinder 211. Due to the low grip condition between the wheel 202 and the rail 240, when the axle braking force generated by the pressure 604 exceeds the available traction force, the wheel starts to slip. The estimated line speed 601 of the axle begins to differ from the line speed 602 of the train at time 603. The anti-slip device 201 immediately activates the emptying phase, causing a 0^1 transition in control signals 208, 208 to turn on the pneumatic solenoid valves, respectively, 220, 221. From time 603 the pressure starts to drop, and the timing devices 210, 212, activated by transitions 0 ^ 1, start timing, respectively, T1, T2. As a consequence of the pressure reduction 604, the instantaneous calculated linear velocity 601 of the axis 202 begins to recover when the positive slope tolerance region 605 is crossed. At the same time, due to an unexpected software or hardware malfunction of the microprocessor 207, the anti-slip device does not respond, the instantaneous calculated linear speed 601 of the axle 202 fully restores the instantaneous linear speed 602 of the vehicle, the pressure does not restore the original value, or at least the value necessary to hold axle 202 under controlled slip conditions. In this case, only when the timing devices 210, 212 have reached the value T1, T2 respectively, in particular the timing device 210, will set its output 213 to logic 0, turning off the switching element 202, de-energizing the solenoids 204, 205, returning the system to a filling state, followed by braking, even if the wheels are blocked. In this particular case, the brake cylinder unnecessarily remains for the entire time T1, T2 without applied brake pressure, while instead, for safety reasons, it would be advisable to restore the brake pressure without waiting for the time T1, T2 to expire.

One way to overcome the first two cases described could be to restart the timing devices before the time T1, T2 has elapsed, effectively forcibly increasing the time T1, T2 and causing program transitions 1^0^1 of the control signals 208, 209, for example, to cause the timing devices to restart, but fast enough to be overridden by the mechanical inertia of the pneumatic solenoid valves 220, 221. In the first case, the anti-slip device can continue to operate in the correct mode of operation; in the second case, the axle 202 will be allowed to recover the instantaneous speed as long as it can reach the tolerance region 405, which allows the anti-slip device to reapply the minimum pressure. In some cases, railway operators have requested an increase in T1, T2 times based on real cases, usually occurring in the autumn-winter period with very low grip situations caused by rotten leaves or snow deposited on the rails over long stretches.

On the other hand, in the third case, it would be desirable to have very short time intervals T1, T2, in order to avoid, especially under emergency braking conditions, a long time without applying pressure to the brake cylinder in the state of a faulty anti-slip device.

When deciding which possible solutions to take, European rules must be taken into account:

EN50126 Railway applications. Specification and demonstration of reliability, availability, maintainability and security (RAMS). Basic requirements and general process (Railway applications. The specification and demonstration of reliability, availability, maintainability and safety (RAMS).

- 4 040970

basic requirements and generic process);

EN50128 Railway applications - Communications, signaling and processing systems - Software for railway control and protection systems;

EN50129 Railway applications. Communication, signaling and processing systems. Electronic signaling systems related to safety (Railway applications. Communication, signaling and processing systems. Safety related electronic systems for signaling).

In particular, the EN50126 standard (as of the latest version published on March 8, 2019) defines a methodology for assigning safety levels SIL0/1/2/3/4 to subsystems based on the results of a safety analysis, while EN50128 and EN50129 (as of the latest version published on 8 March 2019) define the design criteria to be applied to software and hardware components, respectively, based on assigned SIL levels. Based on the application of the previously cited standards, the following statements and concepts can be expressed.

The electronic systems used to implement the service braking function can usually be made in accordance with the provisions dictated by the above standards, limiting said implementation to safety levels no higher than SIL2.

The electronic systems used to implement the emergency braking function may be implemented in accordance with the provisions dictated by the above rules, limiting said implementation to at least SIL3 safety levels.

Modern anti-slip systems are usually manufactured in accordance with the SIL2 levels of the EN50128, EN50129 standards. A possible solution for restarting timers with fast transitions 1^0^1 contradicts the same safety condition that introduces these timers. Only a design made in accordance with SIL > 3 according to EN50128, EN50129, based on proper dimensions of the entire anti-slip system and subsequent rational response, can ensure an adequate and safe introduction of the decision to restart the timing devices during emergency braking.

The complexity of anti-slip algorithms, the fact that they are increasingly using adaptive criteria, makes the development of anti-slip systems in accordance with safety levels SIL > 3 according to EN50128, EN50129 standards extremely difficult and expensive. It is known that the ratio of development complexity and certification cost between SIL < 2 systems and SIL > 3 systems is usually between 1:20 and 1:40. The large amount of parameterization, the complexity of adapting interfaces between anti-slip algorithms, brake control algorithms, synchronization algorithms between air braking and regenerative braking obtained using drive motors, require partial continuous rewriting of anti-slip algorithms followed by costly re-certification of SIL4 EN50128.

In addition, the use of a device designed in accordance with SIL 2 EN50128, EN50129, which is actually used to reduce the braking force for a certain period, is contrary to the normal safety analysis for emergency braking performed in accordance with EN50126. In fact, it is a frequent case that railway operators or safety agencies now request that the anti-slip devices be blocked during emergency braking, which contradicts the need to activate the anti-slip device, especially during emergency braking, since in this situation it is necessary to have all the means to help restore traction and achieve the shortest way to a complete stop.

Thus, in the prior art, it is necessary to avoid performing actions of arbitrary restarting of the timing devices by the anti-slip device itself, applying only the time intervals T1, T2 provided by UIC and EN, additionally agreeing to block the anti-slip device during emergency braking.

The essence of the invention

Thus, the aim of the present invention is to avoid the counterproductive uses of known anti-slip devices with a solution that reduces complexity and development costs.

Thus, the patent describes the use of a control device for a railway anti-slip system. The control device is configured to control the behavior of the corresponding anti-slip system and, by applying direct or indirect influences on the timing devices of the said anti-slip system, as well as to increase its overall safety level in order to achieve the safety levels required by the braking systems during the emergency braking phase. In addition, the intervention of the controlling device in the operation of timing devices is improved.

In addition, the control device can replace the anti-slip system if malfunctions of said anti-slip system occur.

- 5 040970

The above and other objects and advantages are achieved, in accordance with one aspect of the invention, using a control device having the features defined in claim 1 of the claims. Preferred embodiments of the invention are defined in the dependent claims, the content of which is to be understood as an integral part of the present description.

Brief description of the drawings

The functional and structural features of some preferred embodiments of the electronic control system for emergency and service braking, in accordance with the invention, will now be described. Reference will be made to the accompanying drawings, in which FIG. 1 shows a known anti-slip system;

fig. 2 - functional version of the control system of the anti-slip system;

fig. 3 - the trend of the instantaneous speed of the axes and the calculated virtual speed;

fig. 4 are explanatory graphs of a first counterproductive case of prior art timing schemes;

fig. 5 are explanatory graphs of a second counterproductive case of prior art timing schemes;

fig. 6 are explanatory diagrams of a third counterproductive case of prior art timing schemes;

fig. 7 and 8 respectively, embodiments of the control device;

fig. 9 - continuous exchange of acknowledgment signals of the controlling device with the anti-slip system to check the correctness of the reaction of the anti-slip device; and fig. 10 shows by way of example the exchange of information between the control device and the anti-slip system when the connection means consists of a communication channel.

Detailed description

Before explaining in detail the many embodiments of the invention, it should be noted that the invention is not limited in its application to the details of construction and configuration of components presented in the following description or shown in the drawings. The invention may have other embodiments and be carried out or practiced in various ways. It should also be understood that the phraseology and terminology are for descriptive purposes and should not be construed as limiting. The use of the words include and contain and their variations implies the inclusion of elements quoted after them and their equivalents, as well as additional elements and their equivalents.

The first embodiment of the monitoring device 701, 801 for monitoring the operation of the anti-slip device 703, 803 of the railway brake system is described below.

The anti-slip device is designed to receive signals of instantaneous speeds from at least two axes 102, ..., 105, to control the pressure in the brake cylinders 111, ..., 114 associated with the axes 102, ..., 105, using blocks (117 ... 120) of solenoid valves to prevent blocking of the axles (102 ... 105) and to control the slipping of the specified axles (102 ... 105) by regulating the pressure in the brake cylinders (111, ..., 114) associated with axes 102, ..., 105 using blocks 117, ..., 120 electrovalves.

Each electrovalve block 117, ..., 120 contains two pneumatic solenoid valves 220, 221. Each pneumatic solenoid valve 220, 221 contains a timing device 210, 212, 726, 727, 826, 827, configured to measure the power supply time of the corresponding pneumatic solenoid valve 220, 221, and generating a signal for turning off the respective pneumatic solenoid valve 220, 221 if the measured power-on time of the respective pneumatic solenoid valve 220, 221 exceeds a predetermined preloaded time value T1, T2.

The control device 701, 801 is configured to obtain the instantaneous estimated linear speeds 301, ..., 304 associated with the axes 102, ..., 105 controlled by the anti-slip device 703, 803, compare the instantaneous calculated linear speeds 301, ..., 304, associated with the axes 102, ..., 105, with the linear reference speed (306) of the railway vehicle, monitor the state of the pressures in the brake cylinders 111, ..., 114.

The control device 701, 801 is also configured to determine, for each axis in the slip phase, whether the anti-slip device 703, 803 is operating correctly or not, depending on predetermined operating conditions, including predetermined trends of each of the estimated instantaneous linear speeds 301 , . 102, ..., 105.

In addition, the controller 701, 801 is configured to support,

- 6 040970 reduce or cancel the pre-loaded time value T1, T2 in at least one of the timers 726, 727, 826, 827 associated with the axes 102, ... 105, in the slip phase, during the execution of the counting of the specified loaded times T1, T2 by said timing devices 726, 727, 826, 827 when the controller 701, 801 determines that the anti-slip device 703, 803 is not working properly.

Thus, the control device 701, 801 is intended to act directly or indirectly on the timing devices.

Preferably, the control device 701, 801 is further configured to maintain or increase the preloaded time value T1, T2 in at least one timer 726, 727, 826, 827 while said preloaded times T1, T2 are being counted by said devices 726, 727, 826, 827 timing associated with the axes 102 ... 105 in the phase of slip, when the controller determines that the device 703, 803 anti-slip is working correctly.

Preferably, it can be determined that the anti-slip device 703, 803 is operating correctly if the axles in the slip state assume one of the following predetermined operating conditions:

the estimated instantaneous linear speed 401 of the axes is included in the tolerance range 405 for at least a predetermined time TP1;

the calculated instantaneous linear velocity 501 of the axes is characterized by having an instantaneous acceleration exceeding a predetermined acceleration threshold As for at least a predetermined time TP2.

The tolerance area 405, 505, 605 may be dependent on the linear speed reference 402, 502, 602.

Preferably, it can be determined that the anti-slip device 703, 803 does not operate correctly if at least one axle in the slip state assumes one of the following predetermined operating conditions:

the instantaneous pressure value 604 of the brake cylinder associated with said at least one axle in the slipping state corresponds to the holding state in which the brake cylinder pressure value is maintained constant, or the emptying state in which the brake cylinder pressure value is zero, simultaneously with the instantaneous a line speed value 606 associated with said instantaneous pressure 604, characterized in that it is nominally equal to the line speed reference of the vehicle 602 for a given time TP3;

an instantaneous pressure value 604 of a brake cylinder associated with said at least one axle in a slipping state corresponds to a holding or emptying state, simultaneously with an instantaneous linear velocity value 607 associated with said instantaneous pressure 604, characterized by development outside the tolerance zone 605 with acceleration below a predetermined value As for a predetermined time TP3.

Preferably, it can be determined that the anti-slip device 703, 803 does not work correctly if the continuous control procedure between the controller 701, 801 and the anti-slip device 703, 803 is set incorrectly.

The continuous control procedure may include exchanging a first master signal 901 generated by the controller 701, 801 and received by the anti-creep device 703, 803 and a second slave signal 902 generated by the anti-creep device 703, 803 and received by the controller 701, 801.

The master signal 901 has continuous logic state transitions S1, ..., Sn defined by the controller 701, 801, and the slave signal has the response logic state transitions A1, ..., An generated by the anti-slip device 703, 803 in response to the S1 transitions. , ..., Sn of the main signal 901.

The logic response state transitions A1,..., An must occur within the time TOK starting from the corresponding transition S1,..., S3 of the main signal 901, so that said anti-slip device 703, 803 is considered to be operating correctly.

Alternatively, the continuous control procedure may include continuously generating information requests 1030 generated by the control device 701, 801 and received by the anti-slip device 703, 803, and responses 1031 to information requests 1030.

Responses 1031 are generated by the anti-slip device 703, 803 and received by the controller 701, 801. Requests for information are received by the controller 801, 803 randomly from a predetermined list 1020 preloaded into the controller's non-volatile memory 801, 803.

The responses 1031 are calculated independently by the anti-slip device 703, 803 and the controller 701, 801.

The anti-slip device 703, 803 is considered to be operating correctly as long as the controls

- 7 040970 The steering device sees a match between the answer calculated by itself and the answer 1031 sent by the anti-slip device.

In a further aspect, the pressure status of the brake cylinder 111, ..., 114 can be monitored directly by pressure sensors 222, 223 specific to each anti-slip valve block 117, ..., 120 associated with each brake cylinder 111, .. ., 114. One of the two pneumatic solenoid valves 220, 221 may be a filling pneumatic solenoid valve 220. The pressure sensors 222, 223 can respectively indicate the brake pressure in front of each electromagnetic pneumatic valve 220 filling blocks 117, ..., 120 anti-slip valves and the pressure in each brake cylinder 111, ..., 114.

Preferably, monitoring the state of the pressure in the brake cylinder 111, ..., 114 can be carried out indirectly by monitoring the state of the control signals 208, 209 related to each anti-slip valve block 117, ..., 120 associated with each brake cylinder 111, . .., 114.

In a further aspect, the preloaded time value T1, T2 may be greater than or equal to zero seconds and less than ten seconds.

The controller 701, 801 may preferably be configured to calculate the linear reference speed 306, 402, 502, 602 of the railway vehicle through operations performed at the instantaneous speeds 301, ..., 304 of the axles 102, ..., 105 and at least at least one computed virtual speed 305.

The controller 701, 801 may be further configured to calculate the linear reference speed 306, 402, 502, 602 of the respective rail vehicle with operations performed on additional instantaneous axle speeds associated with additional controllers or anti-slip devices associated with the or by railroad train. Additional control devices and anti-slip devices can be connected to the control device 701, 801 via a communication network.

The above additional speeds can be transmitted by EN50159 generating devices through the specified communication network in accordance with a security level equal to or greater than the security level used to design the 701, 801 control device.

In yet another additional aspect, the control device 701, 801 may be configured to send commands to the anti-slip device 703, 803. The commands are commands that require logical transitions to the control outputs 208, 209 and are sent through the connection means 750, 850. The connection means 750 , 850 can thus connect the control device 701, 801 to the anti-slip device 703, 803. Connecting means 750, 850 may include one or more digital signals or a communication channel. A plurality of digital hardware signals can provide a simple exchange of handshake signals.

The communication channel may be, for example, but not exclusively, RS232, RS485, CAN.

Preferably, the control device 701 can be configured to re-read the current value of the residual time from the timing devices 726, 727 of each anti-slip valve block 117, ..., 120 and to reload these timing devices 726, 727 with a value higher than one re-reading, in case it is intended to extend the remaining time to be counted. Alternatively, the control device 701 may be configured to reload said timing devices 726, 727 with a value less than one reread, or zero, in case it is intended to implement a reduction or zeroing of the remaining time to be counted.

The control device may be configured to re-read the current value of the remaining time of the internal counters 828, 829 associated with the timing devices 826, 827 of each anti-slip valve block 117, ..., 120;

if it is intended to extend the remaining time for counting, restart the timing devices 826, 827 associated with the corresponding axis 112, ..., 115, and reload the internal counters 828, 829 associated with the devices. 826, 827 timing pre-loaded values T1, T2 time inherent in the devices 826, 827 timing;

if it is intended to reset the remaining time for counting, restart the timing devices 826, 827 associated with the corresponding axis 112, ..., 115, and reset the internal counters 828, 829 associated with the timing devices 826, 827.

Preferably, the controller 701, 801 may be configured to indirectly restart the timing devices 726, 727, 826, 827 causing a pressure change 404 sufficient to cause the instantaneous calculated linear velocity 401 to be output.

- 8 040970 from the area of 405 tolerances. Change 401 pressure can be obtained by acting on the corresponding signals 720, 721, 820, 821.

Preferably, the control device 701, 801 can be configured to block the anti-slip device 703, 803 with appropriate signals 720, 721, 820, 821 to directly actuate the anti-slip valves 117, ..., 120 through additional signals 732, 733, 832, 833 for the anti-slip algorithm to work.

Preferably, the control device 701, 801 can be configured to block the anti-slip device 703, 803 using the appropriate signals 720, 721, 820, 821 and to directly control the blocks 117, ..., 120 of the anti-slip valves through additional signals 732, 733, 832, 833 for the anti-blocking algorithm to work.

Preferably, the controller 701, 801 may include a watchdog 706, 806 to monitor the correct operation of the controller 701, 801. The watchdog 706, 806 has a switching element 710, 810 placed in series on the supply branch of the solenoids 714, 715, 814, 815 inherent in blocks 117, ..., 120 anti-slip valves. The switching element 710, 810 can be set in the closed state by the watchdog 706, 806 when the watchdog 706, 806 sees the correct operation of said controller 701, 801. The switching element 710, 810 can be set in the open state by the watchdog 706, 806, when the watchdog 706, 806 detects that the controller 701, 801 is not working properly.

The control device may further comprise an emergency switch element 704, 804 placed in parallel with the switching element 710, 810. The failover element 704, 804 may be in a closed state when the alarm request signal 705, 805 is in an inactive state and in an open state when the alarm request signal 705, 805 is active.

Preferably, the control device 701, 801 is designed in accordance with SIL levels > 3 in relation to EN50128 and EN50129 standards. In addition, the above additional speeds will be generated by generating devices in accordance with EN50128, EN50129 standards in accordance with a level equal to or greater than the safety level used to design the control device 701, 801.

In a further aspect, the controller 701, 801 may be implemented by redundant microprocessor circuits, or by redundant programmable logic circuits, or by at least one microprocessor circuit and at least one programmable logic circuit.

Preferably, timing devices 726, 727 and accompanying logic functions 722, 723, 734, 735 may be implemented within the controller. Functions equivalent to the timing devices 726, 727 and the accompanying logic functions 722, 723, 734, 735 may be implemented via program code or within programmable logic circuits.

Fig. 7 and 8 depict some non-exclusive examples of embodiments.

One exemplary embodiment is detailed below.

The controller 701, 801 receives two or more instantaneous speed signals 702, 802 of the axles 102, 103, 104, 105 from speed sensors 106, 107, 108, 109. For example, but not exclusively, through the method previously described and illustrated in FIG. 4, the controller 701, 801 calculates the instantaneous line speed of the vehicle in real time. Also, not shown in FIG. 7, 8, the controller 701, 801 is connected via a communication bus to other on-board systems, such as, for example, but not limited to, other controllers or anti-slip devices, from which it can receive information about the speed of other axles.

Since the calculated instantaneous linear speed of the vehicle plays a direct role in the analysis of the state of the monitored anti-slip system, the conditional calculation function has the same level of security that the control device 701, 801 must obey. For this reason, the transmission of information about the speed of axles belonging to other on-board systems is also must be carried out in accordance with the procedures described for the same levels of security to which the control device 701, 801 is subject, in accordance with the European standard EN50159 Railway applications - Communications, signaling and processing systems - Communications related to safety in transmission systems.

The same two or more instantaneous speed signals 752, 852 of the axles 102, 103, 104, 105 are received by the anti-slip device 703, 803 to execute the anti-slip algorithm. Alternatively, the instantaneous speed signals 752, 852 may be generated and transmitted by the controller 701, 801 to the anti-slip device 703, 803 as a reproduction of the instantaneous speed signals 702, 802. As a further alternative, the instantaneous speed signals 752, 852 may be generated by the controller.

- 9 040970 PTO 701, 801 and transmitted to the anti-slip device 703, 803 through the connecting means 750, 850.

The emergency brake signal 705, 805 may be in an inactive state to indicate that there is no emergency brake request, it is in an active state to indicate that there is an emergency brake request.

The switching element 704, 804 is in the closed state when the emergency brake signal 705, 805 is inactive. The switching element 704, 804 is in the open state when the emergency brake signal 705, 805 is active.

The watchdog function 706, 806 maintains its output 711, 811 at logic level 1 while said watchdog function 706, 806 confirms that the watchdog 701, 801 is operating correctly and switches its output 711, 811 to logic level 0 when the specified watchdog circuit 706, 806 confirms the incorrect operation of the control device 701, 801.

In the correct operating state, since the output 711,811 is at logic level 1, the controller 701, 801 can close the switching element 710, 810, setting the internal signal 708, 808 to logic level 1. The switching element 710, 810 is opened by the signal 709, 809 when the internal signal 708, 808 is driven to logic level 0 by the controller 701, 801, or when the watchdog 706, 806 detects an error in the controller 701, 801.

Safety systems designed in accordance with EN50126 require a safe state, or a state in which the design safety target is guaranteed in the presence of a fault that renders the safety system itself completely ineffective.

In an anti-skid system controlled by a higher level safety system, the safe state is, for example, but not exclusively, the state of the system locking during emergency braking.

The parallelism of the switching elements 710, 704 or 810, 804 constitutes a safe state of the system: if a failure occurs on the control device 701, 801 that prevents it from performing safe control actions, according to which the anti-slip system 703, 803 can operate during emergency braking, the watchdog the circuit causes the switching element 710 to open, allowing the emergency brake signal 705, 805 to de-energize the solenoids 714, 715 or 814, 815, to open the switch 704, 804, putting the entire system in the anti-slip function inhibit state during emergency braking. If it is desired to block the anti-slip function even during service braking, if the supervisor 701, 801 experiences a failure that prevents it from performing safe monitoring actions, the signal 730, 830 is connected to the signal 709, 809 respectively. Thus, the watchdog 706 , 806 blocks the anti-slip device 703, 803 also during service braking by opening the switching element 731, 831 when a fault is detected in the control device 701, 801.

The switching element 712, 812 is functionally equivalent to the switching element 202 used to energize the solenoid 715, 815 corresponding to the solenoid 204 of the pneumatic solenoid valve 220. The switching element 713, 813 is functionally corresponding to the switching element 203 used to energize the solenoid 714, 814, corresponding to the solenoid 205 of the pneumatic solenoid valve 221.

The timing devices 726, 727 are digital counters whose counting is synchronized by a clock not shown in the drawing. Their content can be read or modified by the controller 701 via the bi-directional buses 724, 725, respectively.

The timing devices 826, 827 are analog type monostable devices. To know the remaining time to be counted by the two timing devices 826, 827, the controller 801 simulates the behavior of said timing devices 826, 827 using two program counters 828, 829. The two program counters 826, 827 are preloaded with time nominally corresponding to time T1, T2 counting of the respective timing devices 826, 827. The control signals 208, 209 are read by the controller 801. When the command signal combinations 208, 818 and 209, 819 are operated by starting or restarting the respective timing devices 826, 827 through the respective logic gates 824, 825, the controller 801 performs the same operations with the two respective program counters 826, 827, thus having continuous real-time information about the timing status of the respective timing devices 826, 827.

The controller 701, 801 typically keeps signals 732, 733 or 832, 833 at logic level 0, making OR logic gates 734, 735 or 834, 835 transparent to the outputs of AND logic gates 722, 723 or 822, 823.

The controller 701, 801 typically supports signals 720, 721 or 820, 821 on lo

- 10 040970 logic level 1 to allow AND gates 722, 723 or 822, 823, respectively, to operate according to the status of other input signals to the specified logic gates 722, 723 or 822, 823. When signals 720, 721 or 820, 821 are supported control device 701, 801 at logic level 1, and the signals 732, 733 or 832, 833 are maintained at logic level 0, the anti-slip device 703, 803 acts on the timing devices 726, 727 or 826, 827 and on the switching elements 712, 713 or 812, 813 in a manner similar to that described for the circuit in FIG. 2.

At any time, for example, when the control device 701, 801 detects a malfunction in the anti-slip device 703, 803, the control circuit 701, 801 may decide as a first decision to block the anti-slip system by opening contact 731, 831 using signals 730, 830 or by signal translation 818, 819, or 720, 721, or 820, 821 to logic level 0. In addition, the controller 701, 801 may decide to replace the anti-slip device 703, 803 by blocking the anti-slip device 703, 803 by translating signals 720, 721 or 820 , 821 to logic level 0 and directly controlling the state of the solenoids 715, 714 or 815, 814 by directly controlling the switching elements 712, 713 or 812, 813 through the corresponding signals 733, 732 or 833, 832. In this case, the algorithm used by the control device 701 , 801 can be of a very simplified type to make EN50128 SIL > 3 certification easier, e.g. p, a simple calculation algorithm sensitive to changes in instantaneous axle speed, and with an instantaneous axle speed threshold below which the anti-slip valve block is placed in an empty state for a time sufficient to prevent wheel lockup.

The controller 701, 801 can continuously monitor the operation of the anti-slip device 703, 803 by comparing the individual behavior of the instantaneous linear speed of each axle 102, 103, 104, 105 with the vehicle's linear reference speed, and simultaneously monitor the status of each air pressure applied to the brake cylinder, specific for each axis 102, 103, 104, 105.

In addition, the controller 701, 801 can monitor the operation of the outputs 208, 209 of the anti-slip device 703, 803.

The pressure state of the brake cylinder 211 can be observed as the difference between the brake pressure 215 read by the sensor 222 and the pressure in the brake cylinder 211 read by the pressure sensor 223.

The state of filling, indicating full braking, corresponds to the pressure value in the brake cylinder 211, nominally equal to the pressure 215 braking.

The hold state corresponds to a pressure value in the brake cylinder 211 that is constant and less than the brake pressure 215. In particular, those skilled in the art will know that the difference between the brake pressure 215 and the pressure in the brake cylinder 211 indicates the amount of friction at the point of contact between the axle. and rail, that is, the greater the difference, the lower the coefficient of friction.

The emptying state, indicating the complete release of the brake, corresponds to zero pressure in the brake cylinder 211.

In the absence of pressure sensors 222, 223, the pressure state of the brake cylinder 211 can be obtained from the state of the control signals 208, 209 in accordance with the definitions originally provided, i.e., the filling state corresponds to turning off both pneumatic solenoid valves, the holding state corresponds to turning on only the pneumatic solenoid valve 220, the emptying state corresponds to the simultaneous actuation of the pneumatic solenoid valves 220, 221.

For each axle 102 . each axis 102, ..., 105, the controller 701, 801 may decide not to intervene or extend, reduce, restart the time T1, T2 associated with each block 117, ..., 120 valves in accordance with the correct operation or detected malfunctions .

Cases in which the controller may decide not to intervene or extend the time T1, T2 are presented, for example, but not exclusively, in FIG. 4 and 5.

The monitor may decide not to intervene when the instantaneous line speed 607 stays outside the region 604 for more than TB.

The case in which the controller may decide to reduce or restart the time T1, T2 is represented, for example, but not exclusively, in FIG. 6.

The controller 701 may increase the time T1, T2 of the timers 726, 727, respectively, for example, but not exclusively, by reading the remaining time in the timers 726, 727 via tires 724, 725, respectively, and by reloading into the specified devices 726, 727 timing of the time value exceeding the remaining

- 11 040970 time. The control device 701 can reduce the time T1, T2 of the timing devices 726, 727, for example, but not exclusively, by reading the remaining time in the timing devices 726, 727 using buses 724, 725, respectively, and by reloading into these devices 726, 727 countdown time value less than the remaining time, or zero value.

The controller 801 can increase the times T1, T2 of the timers 826, 827, respectively, for example, by directly restarting the timers with a fast transition 1^0^1 performed for the signals 818, 819. In this case, the timers will reset the time, respectively, T1, T2.

The controller 801 can reset the times T1, T2 of the timers 826, 827, respectively, for example, by directly resetting the timers 826, 827 on a permanent basis via a permanent 1^0 transition performed for signals 818, 819.

In the second mode, the controller 701, 801 can indirectly restart the time T1, T2, causing minimal destabilization of the system, so that the anti-slip circuit 703, 803 itself directly restarts the timing devices 726, 727 or 826, 827. The controller 701, 801 can destabilize the system, causing an empty condition by turning on the signals 732, 733 or 832, 833 for a time sufficient to cause a decrease in pressure in the brake cylinder 221, this reduction being sufficient to derive the calculated linear speed 401 for the top of the 405 tolerance area. At this point, the anti-slip device, if active and functioning correctly, will respond by placing the system in the filling state, acting on the signals 208, 209 and restarting the timing devices 726, 727 or 826, 827. In addition, the anti-slip device will cause the estimated linear speed 401 to fall within the tolerance area 405 . The controller 701, 801 determines the correct response of the anti-slip device 703, 803 by monitoring the outputs 208, 209 of the anti-slip device 703, 803.

In addition, the controller 701, 801 can cause the anti-slip device 703, 803, by requesting the anti-slip device 701, 801 itself, to perform a 1^0^1 transition at outputs 208, 209 upon request made through the communication means 750, 850. This method is especially useful in the case shown in FIG. 5, where the anti-slip device tends to permanently hold its outputs 208, 209 in logic state 1 until the calculated axis linear speed 501 falls within tolerance 505. Any other method previously described would cause the timing devices 726, 727 or 826, 826 to re-trigger to increase the time, but would not result in a transition of the outputs 208, 209 such that the controller 701, 801 checks the life status of the device 703 , 803 anti-slip.

In the case illustrated in FIG. 7, by observing a system failure, the controller 701, 801 can decide to immediately and permanently reapply brake pressure by acting on the available signals without waiting for the devices 726, 727 or 826, 827 to make time T1, T2 expire.

In addition, the control device can replace the anti-slip device as described above, blocking the anti-slip device 703, 803, setting the signals 720, 721 or 820, 821 to logic level 0 and directly monitoring the state of the solenoids 715, 714 or 815, 814 by direct control switching elements 712, 713 or 812, 813 via signals 733, 732 or 833, 832, respectively.

The schemes in Fig. 7 or 8 are specific to each valve block 117, 118, 119, 120 associated with the anti-slip device 101, 703, 803 and the control device 701, 801.

One way to reinforce the criteria according to which the controller 701, 801 considers the correct behavior of the anti-slip system 703, 803 is that the controller 701, 801 implements a continuous handshake signal exchange with the anti-slip system 703, 803 using the connecting means 750, 850, checking the correct reaction of the anti-slip device.

If the connecting means 750, 850 consists of discrete hardware communication signals, in FIG. 9 shows an illustrative, but not exclusive, way: a digital signal 901 belonging to a set of discrete signals 750, 850 is generated by the controller 701, 801 and received by the anti-slip device 703, 803. A digital signal 902 belonging to a set of discrete signals 750, 850 is generated by the anti-slip device 703, 803 and received by the controller 701, 801. The signal 901 is generated, for example, but not exclusively, at a variable frequency. Signal 902 is generated in response to signal 901, i.e. the anti-slip device 703, 803 responds by changing the logic state of signal 902 A1, A2, ... An for each change S1, S2 ... Sn of the logic state of signal 901. Anti-slip device 703, 803 monitors the 901 signal and makes changes to Al, A2, ... An exclusively through software

-

Claims (4)

functions integrated into the program execution process, related to the anti-slip function, completely freed from execution when an interrupt is called. The control device 701, 801 considers that the health state of the anti-slip device 703, 803 is correct when a change in the logic state Al, A2, ... of the signal 902 is detected in response to a change in the logic state S1, S2, ... Sn of the signal 901 for maximum TOK time. If the connecting means 750, 850 consists of a communication channel, an illustrative, but not exclusive, method is represented by the communication shown in FIG. 10. The control device 701, 801 has a list 1020 of n requests for information available to be sent to the anti-slip device 703, 803. Requests for information provide, for example, but not exclusively, requests for information related to system state variables, the responses of which are not known in advance, but can be obtained in real time from both the control device 701, 801 and the anti-slip device 703, 803. The controller 701, 801 performs a sequence 1001 of operations cyclically, for example, but not exclusively, with a variable frequency, at step 1002, a random number is generated in the range 0-n, where n corresponds to the maximum number of possible requests for information, and the request for information is taken from the list of 1020 requests information. At step 1003, the control device 701, 801 sends a request for information to the anti-slip device 703, 803 via a communication channel constituting the connecting means 750, 850. In step 1012, the anti-slip device 703, 803 processes the response to the received information request. In step 1013, the anti-slip device 703, 803 sends the processed response to the control device 701, 801. In step 1004, the controller 701, 801 in turn processes the response to the request for information taken in step 1002 from the list of requests for information 1020. In step 1005, the control device 701, 801 checks the correspondence between the response it has processed and the response processed by the anti-slip device 703, 803. In both cases described, if the control device 701, 801 detects an incorrect response on the part of the anti-slip device 703, 803, it may decide to immediately restart the time T1, T2 and disable the operation of the anti-slip device 703, 803 by opening the switching element 701, 801 or by translating the signals 720 , 721, 820, 821 to logic state 0. The functions described in FIG. 7 and 8 may be implemented in various alternative embodiments. The control circuit 701, 801 may be implemented by one or more microprocessors, or by one or more FPGA circuits, or by an assembly formed by a microprocessor and an FPGA circuit, in accordance with such an architecture in which the integration of the control circuit 701, 801 with anti-slip system results in an overall safety level of the anti-slip function SIL > 3 according to EN50126. The functionality corresponding to the portion of the circuitry contained within dashed line 760 may optionally be fully implemented in software in the microprocessors or FPGAs that make up controller 701. The switching elements 704, 710, 731 or 804, 810, 831 may be relays or solid state devices. The limitations of the embodiment shown above constitute the presently preferred embodiment, but may be changed without departing from the broader scope defined in the main claim. The advantage thus obtained is that a solution is obtained which eliminates the counterproductive cases associated with known anti-slip devices, thanks to a solution having complexity and lower costs. Various aspects and embodiments of the method for implementing the control device according to the invention have been described. It is understood that each embodiment may be combined with any other embodiment. Moreover, the invention is not limited to the embodiments described, but may vary within the scope defined by the appended claims. CLAIM 1. A control device (701, 801) for monitoring the operation of the anti-slip device (703, 803) of the railway brake system, while the specified anti-slip device is configured to - 13 040970 receiving instantaneous speed signals of at least two axes (102, ..., 105); pressure control in the brake cylinders (111, ..., 114) associated with the specified axes (102, ..., 105), by means of blocks (117, ..., 120) electrovalves; prevention of blocking of the axles (102, ..., 105) and control of slipping of the specified axles (102, ..., 105) by controlling the pressures in the brake cylinders (111, ..., 114) associated with the specified axles (102, . .., 105), by means of said blocks (117, ..., 120) of electrovalves, each block of said blocks (117, ..., 120) of electrovalves containing two pneumatic solenoid valves (220, 221); wherein each pneumatic solenoid valve (220, 221) has a timing device (210, 212, 726, 727, 826, 827) configured to measure the power supply time to the corresponding pneumatic solenoid valve (220, 221), each block is configured to generate a signal that turns off the specified corresponding pneumatic solenoid valve (220, 221) if the measured time of power supply to the corresponding pneumatic solenoid valve (220, 221) exceeds a predetermined preloaded time value (T1, T2), and the control device ( 701, 801) is configured to obtain the estimated instantaneous linear speeds (301, ..., 304) associated with the axes (102, ..., 105) controlled by said anti-slip device (703, 803); comparing said estimated instantaneous linear speeds (301, ..., 304) associated with the axles (102, ..., 105) with a linear reference speed (306) of the railway vehicle; monitoring the state of pressure in the brake cylinders (111, ..., 114); determining for each axis in the slip phase whether the specified anti-slip device (703, 803) is working correctly or not, depending on predetermined operating conditions, including predetermined trends of each of the calculated instantaneous linear speeds (301, ..., 304) associated with the axles (102, ..., 105) in the slip phase, relative to the reference linear speed (306) of the railway vehicle, in combination with each of the pressures in the brake cylinders (111, ..., 114) associated with the axles (102, ..., 105); maintenance, reduction or cancellation of the preloaded time value (T1, T2) in at least one of the devices (726, 727, 826, 827) of the timing associated with the axes (102, ..., 105) in the slip phase, during the timing of the counting of said preloaded time (T1, T2) by said timing devices (726, 727, 826, 827) when the control device (701, 801) determines that the anti-slip device (703, 803) is not working properly. 2. The control device (701, 801) according to claim 1, further configured to maintain or increase the preloaded time value (T1, T2) in at least one timer (726, 727, 826, 827) during counting of the specified preloaded time (T1, T2) by the specified timing devices (726, 727, 826, 827) associated with the axes (102, ..., 105) in the slip phase, when the specified controller determines that the anti-slip device (703 , 803) works correctly. 3. A control device (701, 801) according to any one of claims 1 or 2, which determines that said anti-slip device (703, 803) is operating correctly if the axles in the slip state accept one of the following predetermined operating conditions: the calculated instantaneous linear speed (401) of the axes falls within the region (405) of acceptable values, at least for a predetermined time (TP1); the calculated instantaneous linear speed (501) of the axes is characterized by the presence of an instantaneous acceleration exceeding the predetermined acceleration threshold (As) for at least a predetermined time (TP2). 4. A control device (701, 801) according to any one of the preceding claims, wherein it is determined that said anti-slip device (703, 803) does not operate properly if at least one axle in the slip state assumes one of the following predetermined operating conditions: the instantaneous pressure value (604) of the brake cylinder associated with said at least one axle in the slipping state represents a holding state in which the brake cylinder pressure value is kept constant, or an emptying state in which the brake cylinder pressure value is zero, simultaneously with an instantaneous line speed value (606) associated with said instantaneous pressure (604), which is characterized in that it is nominally equal to the vehicle's line speed reference (602) for a predetermined time (TP3); an instantaneous pressure value (604) of a brake cylinder associated with said at least one axle in a slip state represents a holding or emptying state simultaneously with an instantaneous linear velocity value (607) associated with said instantaneous pressure (604), which is characterized by a change beyond region (605) of acceptable values with acceleration less than the set value (As) for a predetermined time -