EP2559603B1 - Method for testing a secure traction lock of a rail vehicle - Google Patents

Description

Technical area

The present invention relates to a method for testing a secure traction barrier of a rail vehicle.

State of the art

It is known that particularly high safety precautions are required in traffic engineering and thus also in rail vehicles. So when stopping a train is required that this does not start unintentionally jerky from a standstill and thereby possibly brings passengers at risk, which are currently in the area of entry. Such a requirement is realized by means of a so-called traction lock, which must also meet these high demands on the technical reliability: it must be virtually free from so-called systematic errors. In addition, the likelihood of traction lockout failure must be below a defined limit. Nowadays, the probability of failure per hour is required to be in the range of less than or equal to 10 ^-8 to less than 10 ^-7 .

As is known, rail vehicles are usually driven by electric motors, which are fed by a power converter. The control signals for the power converter drive unit generates a rail device of the rail vehicle, usually a microcomputer. It can not be ruled out that this microcomputer is working incorrectly and its software generates erroneous control signals when stopped in a station. Then it can be an unexpected jerky movement of the rail vehicle come, in which passengers of the rail vehicle can take damage. For safety reasons, it is endeavored to avoid such an unintentionally generated traction force with the highest possible safety.

In order to prevent the unwanted implementation of the driving force in a forward or reverse drive in a stationary rail vehicle, there are various approaches.

For one thing, for example, you could open the main switch at each station station driver side and interrupt the power supply. This would be an accidental drive certainly excluded, but at the same time also eliminates the power supply of the ancillaries, which is not desirable.

Another known approach is based on a standstill monitoring. Here, the standstill of the vehicle is monitored electronically, for example by the rotational movement of the wheels is detected by measurement. As soon as a movement change has been detected and this has exceeded a critical threshold value, the energy supply is interrupted, thereby stopping the unwanted movement again. However, this has the disadvantage that a "jerk" of the rail vehicle must first occur in order to detect and prevent it. But this basically leaves a security risk.

Another approach is to electronically prevent the unwanted jerk. In the technical paper " Quantitative safety assessment of a vehicle control "Conference volume ZEVrail Glasers Annalen 131 Proceeding SFT, Graz 2007 , such an electronically acting safe traction lock is described. The high level of safety SIL4 according to EN50126 of this traction lock results u. A. characterized in that acting as a drive signal blocking circuit gate circuit in the Ansteuersignalpfad between Control unit and power converter is arranged, formed two-channel and can be checked by self-test. The power converter can normally be blocked by software and released. For safety reasons, however, there is also this hardware-implemented gate circuit (logical AND). It shuts down the power converter "hard" in the case of a necessary torque prevention time delayed by a few milliseconds to the software lock.

However, such a self-test of the traction lock always runs in such a way that control signals directed by the control unit to the drive unit are generated and it is checked whether their transmission is prevented by the traction lock. In principle, it can not be ruled out that, in the event of a malfunctioning traction lock on the drive unit, control pulses will arrive which cause undesired movement of the rail vehicle.

In principle, however, one endeavors to make such a test - which indeed serves operational safety - as safe as possible.

Furthermore, from the prior art, the European patent application EP 2 133 254 A2 in which a method for requesting safety responses in a rail vehicle is disclosed, wherein a state is detected, in which a safety reaction of a device to be detected.

Presentation of the invention

The present invention is based on the object to provide a method for testing a secure traction lock that runs as safe as possible.

This object is achieved by a method having the features of claim 1. Advantageous embodiments of the invention are defined in the dependent claims.

According to the invention, the test is controlled by a signal of the rail vehicle whose signal state changes shortly before release for travel.

In one embodiment of the method according to the invention, the carrier signal is derived from the operating state of the driving lever of the rail track. A manual operation in the direction of "drive" triggers the self-check.

However, other safety-related signals of the rail vehicle can be used for triggering the function check of the traction lock.

If the check of the traction lock is triggered by the closing signal of all door contacts of the rail vehicle, the function check hardly poses a risk potential for passengers.

However, it can also be advantageous if the trigger signal is derived from a superordinate train control device of the rail vehicle.

Another possible embodiment of the method according to the invention may be such that a signal of an external polyline influencing device is used as the safety-relevant signal for triggering the function check of the traction lock. As a result, the functional test can be carried out prior to the drive task and can also be monitored by an external central unit.

It is also possible to deduce the initiation of the self-check of the traction lock from a PWM signal from the drives of the rail vehicle.

It may also be beneficial to use a combination of two or more of these safety-critical signals for triggering a self-test. This can for example, by an AND operation (logical conjunction) of these signals. This can further reduce the risk of passengers being endangered.

Brief description of the drawing

Figur 1

ein Blockschaltbild einer Antriebsteuerung eines Schienenfahrzeugs, in welchem eine durch Hardware realisierten Traktionssperre skizziert ist;

Figur 2

eine zweites Ausführungsbeispiel einer Hardware-Traktionssperre;

Figur 3

ein Impulsdiagramm, welches den erfindungsgemäßen Triggervorgang des Tests Traktionssperre gemäß Figur 1 beziehungsweise Figur 2 veranschaulicht.

To further explain the invention, reference is made in the following part of the description to the drawings, from which further advantageous embodiments, details and further developments of the invention can be found by way of non-limiting embodiment.
It shows:

FIG. 1

a block diagram of a drive control of a rail vehicle, in which a realized by hardware traction lock is outlined;

FIG. 2

a second embodiment of a hardware traction lock;

FIG. 3

a timing diagram which the triggering process according to the invention of the test traction lock according to FIG. 1 respectively FIG. 2 illustrated.

Embodiment of the invention

As already stated in the introduction, a self-test of a traction lock checks whether the forwarding of generated drive signals is actually blocked. For passengers, however, no additional hazard potential may arise from this self-examination.

Before discussing the method according to the invention for testing a safe traction lock, the mode of operation of the traction lock of a rail vehicle is explained in detail in the introduction.

The FIG. 1 shows a block diagram of a section of a drive control of a rail vehicle with a realized in hardware traction lock 1. Such a drive control is usually housed in a guide rail of the rail vehicle. The traction lock 1 consists essentially of a self-test switch 17, a signal path 12, a lock signal read-back channel 15, a delay element 16 and a drive signal blocking circuit 9. The drive unit 22 usually consists of a power converter 11, the electric motors 7 operates. In this case, the power converter 11 receives its drive signals 8 via a drive signal bus 10, which connects the control unit 6 and the drive unit 22. The control signals 8 usually generates a computer, for example a microcomputer in the control unit 6.

As already mentioned, the inverter 11 can be disabled in the normal state by the software in the microcomputer 6 and also released. According to the invention, an electronic traction barrier 1 implemented by hardware is added to this protective measure, the function of which will be explained in more detail below:
The electronic traction lock 1 is supplied with a traction lock request signal 3 generated in a device 2. This device 2 is in operative connection with the drive lever, which is located in the cab of the rail vehicle and is manually operated by the driver in the case of operation. Furthermore, the unit 2, a signal 4 'be supplied, which is obtained, for example, by interrogation of door contacts or other sensors of the rail vehicle. Both signals 4 and 4 'represent a "travel command" and a "trip enable information", respectively; both trigger the generation of a traction-inhibit request signal 3. The request signal 3 passes via a first signal path 5 to the microcomputer 6. A second signal path 12 conducts this Traction lock request signal 3 to a drive signal blocking circuit 9 to. The drive signal blocking circuit 9 is located in the drive signal path 10. The drive signal path 10 serves to transmit the drive signals 8 generated by the microcomputer 6 to the power converter 11.

The drive signal blocking circuit 9 has the task of blocking the forwarding of drive signals if these are generated by the control device 6 during a standstill of the rail vehicle faulty. The drive signal blocking circuit 9 acts as a logical conjunction, that is, it essentially consists of AND gates, which the input side, the traction lock request signal 3 and the drive signals 8 are fed. When the traction lock request signal 3 is supplied to the drive signal blocking circuit 9, it is delayed by the delay element 16, which will be explained in greater detail below.

As already indicated, the signal path to this drive signal blocking circuit 9 can be disturbed, so that undesirable torque formation can not be ruled out with sufficient certainty. In the sense of a higher level of technical reliability, therefore, a continuous check of this signal path 12 takes place. This self-test is triggered whenever the traction-lock request signal 3 changes, eg. B. when the drive lever is operated. The diagnostic device consists essentially of the microcomputer 6, a test request signal lead 14, a reverse signal readback channel 15, and a self-test switch 17 and the delay module 16, a read-back channel 25 of the programmable logic circuit (FPGA) 20. The FPGA module receives the control signals 8 from the control unit 6 via bus section 21. The self-test switch 17 is located at the input of the transmission channel 12, that is in close proximity to the generation of the traction-lock request signal 3, ma W. close to the unit 2. The Delay module 16 is arranged at the other end of the signal path 12, that is to say in local proximity to the drive signal blocking circuit 9. The delay module 16 makes it possible to store or hold a signal value over a predetermined time interval.

The microcomputer 6 generates a test request signal 13 for the purpose of checking each time the traction-lock request signal 3 changes. This test request signal 13 is to briefly simulate a "lock request" for test purposes. This "lock request" passes via the test request signal line 14 to the self-test switch 17. The self-test switch 17 acts as a testable digital input, so that in a functioning signal path 12, the simulated "lock request" on the lock signal read back channel 15 back to the microcomputer 6 is passed.

At the same time, this test request signal 13 is also supplied to a programmable logic module 20 and the delay element 16. The programmable logic device 20, such as an FPGA device is located at the output of the control unit 6 in Ansteuersignalpfad 10. It ensures that the self-tests may only be done at a time in which the correct control of the semiconductor modules in the converter 11 is not compromised. The drive signal blocking circuit 9 is likewise arranged in the drive signal path 10. If the microcomputer 6 nevertheless generates triggering signals 6 in the event of a fault, they pass through the section 21 of the signal path 10 to the FPGA 20, but are converted by this circuit in accordance with the configuration of the FPGA 20 such that the semiconductor switches in FIG Inverter 11 when switching off the phases of the electric drive 7 will not be damaged. This ensures that in the desired prevention of torque formation of the power converter 11 is not damaged. However, should this programmable logic module 20 itself be faulty, then the time delay acts Drive signal blocking circuit 9 and causes a "hard" shutdown of the converter 11. The time delay is given by the time interval (a few milliseconds) of the delay module 16.

By means of the readback channel 23, the signal state at the input of the drive unit 22 is read back by the control unit 6. If the readback signal is inactive, then the traction lock functions 1. In the event of an error, the faulty condition is displayed to the vehicle driver.

The FIG. 2 shows a further embodiment in which, unlike FIG. 1 the second signal path 12 is formed of two channels, a first channel 18 and a second channel 19. Each of these two channels 18, 19, the traction lock request signal 3 is supplied in each case via a current loop according to the rest current principle. The binary input is in each case implemented in series with the switch 17 'or 17''. Like in the FIG. 2 Each of these switches 17 ', 17 "can be controlled by the test request signal 13, that is to say by software. The self-test is again effected by a brief signal interruption in the signal path 12. Here too, the signal read back is signaled by the blocking signal read-back channels 15'. or 15 '' both the FPGA module 20 and the delay element 16 'or 16 "supplied. As already under FIG. 1 executed, comes here in case of failure of the FPGA module 20, the drive signal blocking circuit 9 effect by switching the power converter 11 "hard" away after a predetermined time delay. In order to achieve the highest level of security in the prevention of jerking, it is deliberately accepted that in this error state possibly semiconductor switches in the power converter 11 are damaged.

With the in FIG. 2 illustrated variant can be realized with comparatively little effort an architecture which complies with safety standard SIL 4 of EN50126, but at the same time the probability of the system being found in a functional condition at the time the task is performed is high (availability).

As is apparent from the above, the increase of the reliability and the protection of the power converter 11 are achieved only by hardware. It is not necessary to change the algorithm in the microcomputer 6 or its hardware. In a vehicle approval, therefore, the safety analysis of the added modules is relatively simple. In the realization of the device according to the invention, a probability of failure of less than 10 ^-8 can be achieved with comparatively little effort.

In order to enable the most risk-free self-test of the above-described traction lock, according to the invention the function check of the traction lock is controlled by a signal of the rail vehicle whose signal state changes shortly before the release of the drive.

In FIG. 3 is a pulse diagram drawn showing the triggering operation of the test according to the invention as a function of time t. The test 27 of the traction lock 1 is triggered in this example, when the state of the signal 4 and the signal 4 'of high (standstill) changes to low (driving).

The change of the signal state 4, for example, by manual operation of the driving lever (see FIG. 1 ).

Basically, however, any safety-relevant signal of the rail vehicle is suitable as a carrier signal in which changes the signal state shortly before the drive release.

The signal 4 'represents, for example, the closed state of all door contacts of the rail vehicle.

The signal 4 'can also originate from a higher-level train control device of the rail vehicle.

The triggering of the functional check can also come from an external line-influencing device (LZB).

It is also possible to connect several safety-relevant signals via a logical AND and to derive the trigger signal for a self-test.

Another possibility for triggering the self-test can be done by a PWM signal of the rail vehicle. In this case, the change of the signal state is realized by a change of the PWM coding.

Although the invention has been further illustrated and described in detail by the embodiments illustrated above, the invention is not limited by the disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

Compilation of the reference numbers used

1

traction lock

2

Device for generating a traction-lock request signal

3

Traction power demand signal

4, 4 '

Signal of the rail vehicle (for example, travel lever or drive release signal "Greenline")

5

first signal path

6

Control unit of the rail vehicle

7

electric motor

8th

control signal

9

Drive signal blocking circuit

10

Ansteuersignalpfad

11

power converters

12

second signal path

13

Test request signal

14, 14 ', 14 "

Test request signal supply line

15, 15 ', 15 "

OFF signal readback channel

16, 16 ', 16 "

delay

17, 17 ', 17 "

Self-test switch

18

first channel

19

second channel

20

programmable logic circuit (FPGA)

21

Section of 10

22

drive unit

23

Readback channel of the drive

24

Readback Channel Programmable Logic Circuit (FPGA)

25

Readback signal of the control

26

Readback signal programmable logic circuit

27

Traction Lock Test 1

Claims (8)

1. Method for testing the traction lock (1) of a rail vehicle, wherein
   the traction lock (1) has a first signal path (5) in order to transmit a traction lock request signal (3) to a control unit (6) of the rail vehicle, and a second signal path (12), wherein a diagnostic device (6, 14, 15, 17, 23, 24) is provided, such that the second signal path (12) can be checked for proper functioning by means of a test request signal (13) generated by the control unit (6), in that the test request signal (13) is fed via the second signal path (12) on the one hand to a freely programmable circuit (20) and on the other hand by means of a delay element (16) to a drive signal blocking circuit (9) with a time delay, wherein the programmable circuit (20) and the drive signal blocking circuit (9) are arranged in a drive signal path (10) connecting the control unit (6) to a drive unit (22), and wherein the test is triggered by a signal (4, 4') from the rail vehicle, the signal state of which changes just before the movement release.
2. Method according to claim 1, characterised in that the signal (4) is derived from the operating state of the throttle of the rail vehicle.
3. Method according to claim 1, characterised in that the signal (4') is derived from a safety-related signal from the rail vehicle.
4. Method according to claim 3, characterised in that the closing signal of all door contacts of the rail vehicle is used as a safety-related signal.
5. Method according to claim 3, characterised in that a signal from a superordinate train operation device of the rail vehicle is used as a safety-related signal.
6. Method according to claim 3, characterised in that a signal from an external continuous automatic train control device is used as a safety-related signal.
7. Method according to claim 1, characterised in that the signal (4') is derived from a PWM signal from the rail vehicle.
8. Method according to claim 3, characterised in that the signal (4') is derived from a logical conjunction of several safety-critical signals from the rail vehicle.

Images