EP3564089A1

EP3564089A1 - Oil-hydraulic control unit for controlling railway switches and method for performing a safety check on an oil-hydraulic control unit

Info

Publication number: EP3564089A1
Application number: EP18305551.6A
Authority: EP
Inventors: Stefano Bittoni; Andrea BORROMEI-COLOZZI
Original assignee: Alstom Ferroviaria SpA
Current assignee: Alstom Ferroviaria SpA
Priority date: 2018-05-02
Filing date: 2018-05-02
Publication date: 2019-11-06
Anticipated expiration: 2038-05-02
Also published as: RU2019113324A; EP3564089B1

Abstract

Oil-hydraulic control unit (1') comprising:- a pump (6) arranged for sending oil to a pressure unit (8) arranged to pressurize said oil and to send it through a hydraulic circuit towards at least one actuator (20) of a switch (10) of a railway track, said hydraulic circuit comprising preferentially a plurality of canals, the at least one actuator (20) being connected to at least one canal for being operated;- a control device (4) connected to said pump (6) and arranged for controlling the pump (6) based on an activation signal coming from a remote control unit (2) arranged for controlling switch operations of the switch (10);- a timing unit (12) arranged to send control signals to the remote control unit (2) representative of the correct operation of the oil-hydraulic control unit (1');characterized in that the pressure unit (8) comprises at least two valves (16a, 16b) for each group of canals intended to be connected to the at least one actuator (20), the valves (16a, 16b) being arranged so that when a first valve (16a) breaks, a second valve (16b) starts sending the oil flowing in the group of canals towards a reservoir of the oil-hydraulic control unit (1') so that the pressure of the oil going to the at least one actuator (20) decreases, thus regulating the pressure of the oil flowing into said group of canals.

Description

The present invention concerns an oil-hydraulic control unit for controlling railway switches of a railway track and a method for performing a safety check on an oil-hydraulic control unit.
A switch includes two blades lying between diverging outer rails (the stock rails). The switch can be moved laterally into one of two positions to direct a train coming from the blades toward a straight path or a diverging path.
The blades can be moved together one with respect to the other between two extreme positions. In the so called normal position, a blade is in contact with the rail directly adjacent to said blade and the other blade is spaced apart from the rail adjacent thereto. In this case, a train keeps a straight travel. On the contrary, in the so called reverse position, a blade is in a position adhering to the associated rail and the other blade is spaced apart from the rail adjacent thereto. In this case, a train would be diverged from the straight direction into a lateral branch.
Prior art switches are commonly provided with sensors used for verifying that the blades have reached the proper normal or reverse position at the end of each maneuver. These sensors are usually monitoring contacts arranged for closing monitoring circuits so that monitoring signals are generated. The monitoring signals are finally transmitted or read by a remote control unit which controls the switch operations.
Oil-hydraulic actuators have been used in the last years in switches for moving the blades, and they are controlled by oil-hydraulic control units. In particular, the oil-hydraulic actuators receive pressurized oil from the oil-hydraulic control unit through a hydraulic circuit.
A common oil-hydraulic control unit comprises a pump and a device to direct the flood of oil. Prior art discloses also a reversible pump for feeding the hydraulic circuit of the switch thus allowing displacement of the blades from a normal to a reverse position and vice versa through the actuators. The reversible pump is actuated by an electric motor controlled from the remote control unit.
It is known that a safety control has to be performed on an oil-hydraulic control unit in order to check its operation: the so called SIL-4 level (Safety Integrity Level) has to be reached in order to fulfill the safety requirements required for transportation networks and systems. In particular, it is necessary to control the maximum pressure value of the oil sent to the actuators, the actuators producing a force for moving the blades which is function of this pressure. The safety control must therefore check that the oil-hydraulic control unit does not send to the switch, oil having a pressure greater than a predetermined threshold.
In prior art oil-hydraulic control units the safety control on the pressure of the oil transmitted to the actuators is performed through electronic sensors, which send corresponding control signals to the remote control unit.
When both the monitoring signals coming from the switch and the control signals coming from the oil-hydraulic control unit indicate that the maneuver has been correctly performed, the remote control unit allows the passage of the train.
However, the safety control performed in the prior art switches is not enough reliable and presents risk of errors.
Document EP 2418135 discloses an oil-hydraulic control unit of known type. Figure 1 shows a block diagram of an oil-hydraulic control unit 1 of the above-disclosed type connected to a remote control unit 2 arranged for sending to the oil-hydraulic control unit 1 an activation signal for moving the blades of a switch in a predetermined position (normal or reverse) in order to control the switch operations.
The oil-hydraulic control unit 1 comprises an electric motor 4 arranged for controlling a pump 6 arranged in turn for sending oil to a pressure regulation unit 8, this oil being usually stocked in a reservoir (not showed) placed within the oil-hydraulic control unit 1.
The pressure regulation unit 8 is arranged for pressuring the oil and sending it to a switch 10.
The oil-hydraulic control unit 1 further comprises a timing unit 12, in particular a cylinder, connected to the pressure regulation unit 8 and arranged for cutting the power to the electric motor 4 when the switch operation has finished, and for closing control contacts 14 so that corresponding control signals are sent to the remote control unit 2 indicating that the oil-hydraulic control unit 1 has correctly ended its operations, regardless to the correct position of blades, which will be monitored by actuators.
The above disclosed system is based on an hydraulic system to pilot the switch 10. The pressure regulation unit 8 increases the hydraulic pressure in the hydraulic circuit feeding the switch 10 in order to move the actuators of the switch 10, and therefore its blades, so as to reach a final desired position. In case of presence of an obstacle on the railway track, the hydraulic system makes the pressure in the hydraulic circuit increase until the timing unit 12 cuts the power to the electric motor 4 and switches the control contacts 14.
Anyway, this solution limits only the period of time in which the actuators receive the maximum pressure from the power pack, but it doesn't limit the level of pressure transmitted to the switch in case of failures of limitation valves.
One object of the present invention is therefore to provide an oil-hydraulic control unit which is capable to guarantee a safety functioning of a driven switch with a high level of safety and to limit the risks of errors.
A further object of the present invention is to provide an innovative method for performing a reliable safety check on an oil-hydraulic control unit.
These and other objects are achieved by an oil-hydraulic control unit having the characteristics defined in claim 1, and by a method for performing a safety check on an oil-hydraulic control unit having the characteristics defined in claim 6.
Preferred embodiments of the invention are the subject matter of the dependent claims, whose content is to be understood as forming an integral part of the present description.
Further characteristics and advantages of the present invention will become apparent from the following description, provided merely by way of non-limiting example, with reference to the enclosed drawings, in which:

Figure 1 shows a block diagram of an oil-hydraulic control unit according to the prior art;
Figure 2 is a block diagram of an oil-hydraulic control unit according to the present invention;
Figure 3 is a schematic enlarged figure of the oil-hydraulic control unit of figure 2; and
Figure 4 is a block diagram of the steps of a method for performing a safety check on an oil-hydraulic control unit according to the present invention.

Figure 2 shows a block diagram of an oil-hydraulic control unit 1' according to the present invention, wherein element similar to those of the oil-hydraulic control unit of the prior art above disclosed have been indicated with the same reference numbers.
The oil-hydraulic control unit 1' of the present invention includes, in the pressure regulation unit 8, a valve module 16 which comprises a plurality of redundancy relief valves disclosed in detail herein below.
Figure 3 shows a schematic enlarged figure of the oil-hydraulic control unit 1' of figure 2 wherein same references have been used to identify blocks representing the above-cited components. The hydraulic circuit of the switch 10 is built with pressurized modular exits and in figure 3 four blocks 18 correspond to respective hydraulic canals connecting the oil-hydraulic control unit 1' to actuators of the switch 10 generally indicated with reference number 20.
Each actuator or group of actuators of the switch 10 requires advantageously in a manner per se known two canals or lines for being operated, each canal acting as inlet or outlet depending on the movement of the actuator.
Each canal block 18 comprises a first relief valve 16a and a second relief valve 16b which, altogether, represent the valve module 16 of the pressure regulation unit 8.
Advantageously, the two valves 16a, 16b are arranged in parallel on a same canal.
The relief valves 16a, 16b are configured to ensure that the level of pressure at system level increases until it reaches a calibrating value of the relief valves 16a, 16b.
The relief valves 16a, 16b are per se known and they are arranged so that when one valve 16a or 16b breaks, the other valve 16b or 16a starts sending the oil flowing in the canal towards the reservoir so that the pressure of the oil going to the actuators 20 decreases.
If the pressure of the oil going to the actuators 20 has a value still high enough to complete a maneuver to the switch 10, notwithstanding the pressure reduction above disclosed, the remote control 2 cannot identify breakage of the valve 16a or 16b, and if also the other valve 16b or 16a breaks, the pressure of the oil going to the actuators increases, the actuators 20 are activated and the remote control 2 cannot recognize failure of the oil-hydraulic control unit 1'.
To solve this problem, the relief valves 16a and 16b are arranged so that when the first valve 16a or 16b breaks and the oil starts going towards the reservoir, the internal pressure of the oil-hydraulic control unit 1' start decreasing thus not being able to reach a predetermined minimum value corresponding to the calibrating value of the relief valves 16a, 16b. If the internal pressure of the oil-hydraulic control unit 1' does not reach the calibrating value, the timing unit 12 is not activated, therefore, it does not cut off the power to the electric motor 4 and it does not close the closing contacts 14. The remote control unit 2 does not therefore receive the control signals, thus recognizing that a valve 16a or 16b has been damaged.
Each pressurized exit of the hydraulic circuit, thanks to the redundancy of the relief valves 16a, 16b, is responsible for moving the external actuators at a specific and controlled pressure value. In case of a failure of any of the relief valves 16a, 16b, the maximum pressure achieved by the respective canal, and therefore by the overall system, is lower than the pressure needed to maneuver the blades.
The control contacts 14 are therefore not closed and the corresponding control signal is not sent to the remote control unit 2. The remote control unit 2 can therefore detect a failure in the oil-hydraulic control unit 1'.
Advantageously, the remote control unit 2 is configured to detect that a relief valve 16a, 16b has been damaged if the activation signal has been sent to the switch 10 and, after a predetermined time starting from the sending of said activation signal, no control signals have been received back.
In the following a method for performing a safety check on an oil-hydraulic control unit will be disclosed with reference to figure 4, which shows a block diagram of such a method.
In a first step 100 an oil-hydraulic control unit 1 as above disclosed is provided. Then, in a step 102, oil is sent into the hydraulic circuit at a very low level of pressure.
At a step 104, the blades are moved by the actuators 20 until they reach an obstacle thus stopping their movement.
At a step 106, the value of the oil pressure into the hydraulic circuit starts increasing until it reaches the calibrating value, i.e. a predetermined first threshold value set by the relief valves 16a, 16b.
If the first relief valve 16a is failed, the second relief valve 16b keeps, at a step 108, the pressure lower than the predetermined first threshold value, therefore, the level of pressure inside the hydraulic circuit cannot increase anymore, so it can never reach a second threshold value set by a cylinder valve of the timing unit 12. Advantageously the second threshold value is equal to the first threshold value.
At step 110 the timing unit 12 remains inactive because the cylinder valve remains closed; as a result, the timing unit 12 does not cut the power to the electric motor 4 and does not close the control contacts 14, thus allowing the remote control unit 2 to detect, at step 112, failure of the oil-hydraulic control unit 1', thus performing a safety check.
Clearly, the principle of the invention remaining the same, the embodiments and the details of production can be varied considerably from what has been described and illustrated purely by way of non-limiting example, without departing from the scope of protection of the present invention as defined by the attached claims.

Claims

Oil-hydraulic control unit (1') comprising:
- a pump (6) arranged for sending oil to a pressure unit (8) arranged to pressurize said oil and to send it through a hydraulic circuit towards at least one actuator (20) of a switch (10) of a railway track, said hydraulic circuit comprising preferentially a plurality of canals, the at least one actuator (20) being connected to at least one canal for being operated;

- a control device (4) connected to said pump (6) and arranged for controlling the pump (6) based on an activation signal coming from a remote control unit (2) arranged for controlling switch operations of the switch (10);

- a timing unit (12) arranged to send control signals to the remote control unit (2) representative of the correct operation of the oil-hydraulic control unit (1');
characterized in that the pressure unit (8) comprises at least two valves (16a, 16b) for each group of canals intended to be connected to the at least one actuator (20), the valves (16a, 16b) being arranged so that when a first valve (16a) breaks, a second valve (16b) starts sending the oil flowing in the group of canals towards a reservoir of the oil-hydraulic control unit (1') so that the pressure of the oil going to the at least one actuator (20) decreases, thus regulating the pressure of the oil flowing into said group of canals.
Oil-hydraulic control unit (1') according to claim 1, wherein the timing unit (12) is connected to the control device (4) and arranged to cut off the power of the control device (4) based on the pressure of the oil going to the switch (10).
Oil-hydraulic control unit (1') according to claim 1 or 2, wherein the valves (16a, 16b) are configured so that when the first valve (16a) breaks, the internal pressure of the oil-hydraulic control unit (1') start decreasing thus not being able to exceed a predetermined minimum value, the predetermined value being below a threshold value for which the timing unit (12) is configured to send the control signals to the remote control unit (2), the remote control unit (2) thus detecting that a valve (16a, 16b) has been damaged in function of the reception or not of said control signals.
Oil-hydraulic control unit (1') according to any of the preceding claims wherein the two valves (16a, 16b) are arranged in parallel on a same canal.
Oil-hydraulic control unit (1') according to any of the preceding claims, wherein the remote control unit (2) is configured for detecting that a valve has been damaged if after a predetermined time starting from the sending of the activation signal, no control signals have been received.
Method for performing a safety check on an oil-hydraulic control unit comprising the steps of:
- providing (100) an oil-hydraulic control unit (1') according to any of the preceding claims;

- sending (102,) oil into the hydraulic circuit;

- moving blades (104) of the switch (10);

- increasing (106) the value of the oil pressure into the hydraulic circuit until it reaches a predetermined threshold value;

- if the first valve (16a) is failed, keeping (108), thanks to the second valve (16b), the pressure lower than the threshold value;

- maintaining (110) the timing unit (12) inactive so as not to send the control signals to the remote unit (2);

- detecting (112), through the remote control unit (2), a failure of the oil-hydraulic control unit (1'), thus performing a safety check.
Method for performing a safety check on an oil-hydraulic control unit according to claim 6, wherein the timing unit (12) remains inactive thus not cutting the power to the control device (4).