Classifications

• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B61—RAILWAYS
  • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
  • B61L15/00—Indicators provided on the vehicle or train for signalling purposes
  • B61L15/0018—Communication with or on the vehicle or train
  • B61L15/0027—Radio-based, e.g. using GSM-R
• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B61—RAILWAYS
  • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
  • B61L15/00—Indicators provided on the vehicle or train for signalling purposes
  • B61L15/0018—Communication with or on the vehicle or train
  • B61L15/0036—Conductor-based, e.g. using CAN-Bus, train-line or optical fibres
• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B61—RAILWAYS
  • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
  • B61L15/00—Indicators provided on the vehicle or train for signalling purposes
  • B61L15/0054—Train integrity supervision, e.g. end-of-train [EOT] devices
• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B61—RAILWAYS
  • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
  • B61L25/00—Recording or indicating positions or identities of vehicles or trains or setting of track apparatus
  • B61L25/02—Indicating or recording positions or identities of vehicles or trains
  • B61L25/028—Determination of vehicle position and orientation within a train consist, e.g. serialisation
• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B61—RAILWAYS
  • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
  • B61L15/00—Indicators provided on the vehicle or train for signalling purposes
  • B61L15/0072—On-board train data handling

Definitions

• the present invention relates, in general, to the field of the convoys of vehicles .
• the invention relates to a system for verifying the integrity of a convoy, particularly a railway convoy, including at least two vehicles (at least two railway vehicles in the case of a railway convoy).
• Verifying the integrity of the convoy means verifying that the vehicles RV that make up the convoy T have not disconnected from each other.
• An example of a convoy T whose integrity is not compromised is shown in Figure 2.
• the convoy illustrated is a railway convoy.
• a first section S 1 of the convoy including a leading vehicle H, could in any case remain safely under the manual control of the driver or of any automatic control systems.
• the leading vehicle and the tail vehicle may be defined as a function of the travelling direction D of the convoy, e.g. the leading vehicle may be the first vehicle according to the travelling direction D and the tail vehicle may be the last vehicle according to the travelling direction D.
• a second section S2 of the convoy disconnected from said first section S 1 of the convoy, could be prevented from receiving commands from the driver or from any automatic control systems.
• the second section of the convoy may continue its travel in an uncontrolled manner, generating a considerable safety risk.
• a braking system of a railway convoy comprises a pneumatic line P, also called “brake pipe”, which crosses all the railway vehicles of the railway convoy and which, when said railway convoy is not braked, has a pressure of about 5 bar.
• P pneumatic line
• a more or less marked depression may be created in the brake pipe, so as to achieve a gradual braking of the railway convoy.
• the brake pipe At the moment of detachment of the railway vehicles of the railway convoy, the brake pipe will be interrupted, thus generating a loss of pressure inside it.
• the pressure drop in the line will cause the various braking systems (whose braking force is a function of the pressure in the pipe ) of the railway vehicles to apply the greatest possible braking force.
• the integrity of the railway convoy is verified at the start of the mission by means of an exhaust brake test of the brake pipe .
• the integrity of the convoy is verified both by the driver and by systems positioned on the side of the rail R which interact with the signaling system.
• An example of such known systems is the axle counting system 100.
• An axle counting system is based on the principle of counting the axles A of the railway vehicles engaging a block section.
• a special electromagnetic device 102 may be provided which allows the number of axles A of railway vehicles, including locomotives, which pass on rail R to be counted. If the count is not correct with respect to a number of axles expected for such railway convoy, this clearly means that the integrity of the railway convoy is compromised.
• axle count is illustrated by way of example in Figure 1.
• An object of the present invention is therefore to provide a system for verifying the integrity of a convoy which is highly configurable, which may be implemented directly on board the convoy, which reduces its installation and maintenance costs.
• FIG. 1 illustrates a generic example of an axle counting system according to the prior art
• FIG. 2 illustrates a situation in which a convoy, for example a railway convoy, is in a condition of non-compromised integrity
• FIG. 3 illustrates a situation in which a convoy, for example a railway convoy, is in a condition of compromised integrity
• FIG. 4 illustrates a diagram of a system for verifying the integrity of a convoy according to an embodiment of the invention
• FIG. 5 illustrates an embodiment in which the first control means and the second control means are included in respective braking control units
• FIG. 7 illustrates a further embodiment of a system for verifying the integrity of a convoy.
• the convoy may be a railway convoy.
• such convoy comprises at least a first vehicle RV 1 and a second vehicle RV2.
• a convoy may also include more than two vehicles.
• the railway convoy may include four vehicles.
• the convoy illustrated is a railway convoy.
• the system for verifying the integrity of a convoy includes a first control means 402 arranged to be coupled to the first vehicle RV1, and a second control means 404 arranged to be coupled to the second vehicle RV2.
• the first vehicle RV 1 may be any vehicle among the four vehicles which make up the convoy and the second vehicle RV2 may be any other vehicle among the three remaining vehicles which make up the convoy.
• first control means 402 and the second control means 404 may each be or include at least one of at least one controller, at least one processor, at least one microprocessor, at least one microcontroller, at least one PLC, and the like.
• system for verifying the integrity of a convoy also includes at least one communication means N arranged to allow communication between the first control means 402 and the second control means 404.
• the first control means 402 is arranged to determine that the integrity of the convoy T is compromised, when the first control means 402 and the second control means 404 are no longer able to communicate with each other through said at least one communication means N.
• the second control means 404 is arranged to determine that the integrity of the convoy T is compromised, when the first control means 402 and said second control means 404 are no longer able to communicate with each other through said at least one communication means N.
• the fact that the communication between the first control means 402 and the second control means 404 is interrupted is a clear signal that the communication means has been damaged due to the compromise of the integrity of the convoy, or due to the fact that the first control means 402 and the second control means 404 are not arranged with respect to each other within a distance sufficient to ensure that the communication means allows communication between the first control means 402 and the second control means 404.
• the distance between the first control means 402 and the second control means 404 may increase due to the compromise of the integrity of the convoy.
• the first control means 402 may be arranged to be coupled to a leading vehicle H of the convoy and the second control means 404 may be arranged to be coupled to a tail vehicle TA of the convoy.
• the second control means 404 may be arranged to be coupled to a leading vehicle H of the convoy and the first control means 402 may be arranged to be coupled to a tail vehicle TA of the convoy.
• the first control means 402 and the second control means 404 may be arranged to determine the vehicle of the convoy on which they are respectively installed.
• the first control means 402 and the second control means 404 may be arranged to determine the vehicle of the convoy on which they are respectively installed according to a safety integrity level greater than a predetermined minimum safety integrity level.
• the method that the first control means and the second control means may use to determine the vehicle of the convoy on which they are respectively installed may be any known automatic/autonomous determination method of the position in the convoy.
• first control means 402 and the second control means 404 it will not be necessary for the first control means 402 and the second control means 404 to be pre-configured or pre-programmed in order to receive or contain information regarding the vehicle during the installation on board the convoy on which they are installed.
• first control means 402 and the second control means 404 may be pre-configured or pre-programmed to receive or contain information regarding the vehicle on which they are installed.
• the first control means 402 and the second control means 404 will in this case be able to determine the vehicle on which they are respectively installed on the basis of this information. This solution may be used for example for convoys that rarely or do not modify their vehicle composition.
• the first control means may be arranged to send an interrogation message on the at least one communication means N;
• the second control means may be arranged to receive the interrogation message from the at least one communication means N and retransmit a response message on the at least one communication means N.
• the first control means may be arranged to send an interrogation message on the at least one communication means N;
• the second control means may be arranged to receive the interrogation message from the at least one communication means N and retransmit a response message on the at least one communication means N.
• the control means installed in the tail vehicle TA which verifies that it is able to communicate with the leading vehicle H, so as to determine whether the tail vehicle TA itself is still connected to the convoy.
• the first control means may be arranged to determine that the integrity of the convoy is compromised when it does not receive, via the at least one means of communication N, the response message transmitted by the second control means on the at least one communication means N within a predetermined time interval from when the first control means has sent the interrogation message.
• the first control means may be arranged to determine that the integrity of the convoy is compromised when it receives, through the at least one communication means N, the response message transmitted by the second control means but such received response message differs from an expected response message.
• the second control means may be set up to determine that the integrity of the convoy is compromised when it does not receive, via the at least one communication means N, the interrogation message transmitted by the first communication means on the at least one communication means N for more than a waiting interval.
• the second control means may be arranged to determine that the integrity of the convoy is compromised when it receives, through the at least one communication means N, the interrogation message transmitted by the first control means but such received interrogation message differs from an expected interrogation message.
• the waiting time may be a predetermined time.
• the content of the response message may be determined as a function of the content of the interrogation message.
• the response message may be determined on the basis of a generation algorithm known to the first control means and to the second control means.
• the first control means will be able to determine its own expected response message through this algorithm and verify that the response message received in response from the second control means has actually been generated by the second control means through this algorithm, as it matches the expected one.
• the same logic may be applied analogously to the interrogation message as well.
• the convoy may further comprise at least a third vehicle RV3.
• the system for verifying the integrity of a convoy may include at least a third control means 403 arranged to be coupled to said third vehicle RV3.
• the third control means 403 may be or include at least one of at least one controller, at least one processor, at least one microprocessor, at least one microcontroller, at least one PLC, and the like.
• the third control means 403 may be arranged to determine the vehicle of the convoy on which it is installed.
• the third control means 403 may be arranged to determine the vehicle of the convoy on which it is installed according to a safety integrity level greater than the predetermined minimum safety integrity level.
• the method that the third control means may use to determine the vehicle of the convoy on which it is installed may be any known automatic/autonomous determination method of the position in the convoy.
• the third control means 403 may be pre-configured or preprogrammed to receive or contain information regarding the vehicle on which it is installed. The third control means 403 will then be able to determine the vehicle on which it is installed on the basis of this information.
• the third control means 403 may be arranged to receive the interrogation message sent by the first control means through the at least one communication means N and forward the interrogation message to the second control means through the at least one communication means N;
• the third control means 403 may be arranged to receive the response message sent by the second control means through the at least one communication means N and forward the response message to the first control means through the at least one communication means N.
• the one or more control means installed on the respective intermediate railway vehicles should be “passing” and should not respond to the interrogation message by generating their own response message to be provided to the first control means which generated the interrogation message. If a control means of one of the intermediate railway vehicles responds to the interrogation message it received from the first control means by generating its own response message, i.e. “replacing” the second control means, there would be the risk of undue confirmation of the integrity of the vehicle without real confirmation that the vehicle on which the second control means is installed is still connected to the convoy . Only if the response message is received and it is the expected one is it possible to infer the integrity of the convoy. Any response messages generated by the control means of the intermediate vehicles would be recognized as unexpected messages by the first control means.
• intermediate vehicle I it is possible to mean any vehicle which in the convoy is installed between the leading vehicle and the tail vehicle.
• the second vehicle and the third vehicle RV3 are each an intermediate vehicle I of the convoy.
• the first control means 402 and the second control means 404 may each be implemented according to a safety integrity level greater than a predetermined minimum safety integrity level.
• the third control means 403 may also be implemented according to a safety integrity level greater than a predetermined minimum safety integrity level.
• the first control means 402, the second control means 404 and the third control means 403 may be implemented according to a minimum safety integrity level (SIL), so as to ensure that any lack of communication may not be attributed to their malfunctions or breakdowns.
• SIL minimum safety integrity level
• standard EN50126 defines the methodologies for assigning the SILO/1/2/3/4 safety levels (with safety integrity level SIL4 indicating the maximum safety integrity level) to the subsystems making up the system in question, based on the results of the Safety Analysis, and standards EN50128 and EN50129 define the design criteria to be applied to the Software and Hardware components, respectively, based on the SIL levels assigned based on said Safety Analysis results.
• the at least one communication means may be arranged to allow a communication according to a predetermined safety protocol.
• a predetermined safety protocol may be a protocol commonly referred to as the “black channel” type.
• the communication means may be two or more and may be arranged to be connected together by means of a communication unit.
• the communication means may also be created in accordance with the methodologies specified by standard EN 50159, guaranteeing a high safety integrity level (SIL).
• SIL high safety integrity level
• the first control means 402, the second control means 404 and the third control means 403 may be control means already usually included on board a vehicle and made according to a high safety integrity level SIL.
• the first control means 402 may be included in a braking control unit or braking control module 500, or the second control means 404 may be included in a braking control unit or braking control module 500, or again, the first control means 402 and the second control means 404 may each be included in respective braking control units or braking control module 500.
• the third control means 403 may also be included in a braking control unit or braking control module.
• the first control means 402 and/or the second control means 404 and/or the third control means 403 may each be a control means already on board respective braking control units or modules. In this way, the same control means may be used both to manage the braking of the vehicle and to verify the integrity of the convoy.
• control means and the braking control units or modules are already made according to high integrity safety levels, therefore, they are also suitable to be used for verifying the integrity of the convoy according to the present invention.
• a braking control unit or module may generally be a control means installed on board a vehicle which is responsible for managing the braking means 502 of one or more railway vehicles of the convoy .
• the braking means may be braking devices of one or more braking systems.
• the first control means 402 and the second control means 404 may be arranged to determine the vehicle of the convoy on which they are respectively installed by means of a physical or hardware coding implemented by optical technology means.
• the third control means 403 may be arranged to determine the vehicle of the convoy on which it is respectively installed by means of a physical or hardware coding implemented by optical technology means.
• control means may also be provided, which, when they determine to be installed on an intermediate vehicle, may similarly perform the message forwarding function performed by the third control means.
• the control means arranged on the intermediate vehicles may forward the messages received to each other, until the messages transmitted by the first control means reach the second control means, and vice versa.
• the messages may be forwarded between the various control means according to an order defined according to the position along the convoy of the vehicle on which they are respectively installed. For example, if the first control means is installed in the leading vehicle, the interrogation message may be transmitted, via the communication means, to the control means installed on the second vehicle in running order.
• the control means installed on the second vehicle in running order once the interrogation message has been received, will be able to forward it, via the communication means, to the control means installed on the third vehicle in running order.
• the forwarding may proceed in the same way for the further control means until the interrogation message has reached the second control means.
• the response message may follow the reverse path until it reaches the first control means.
• the forwarding order may be a predetermined order.
• the communication means may include at least two redundant communication channels, and at least one of such communication channels may be a communication network 600. These communication channels may be wired or wireless.
• first control means 402 and the second control means 404 may be arranged to determine the vehicle of the convoy on which they are respectively installed by means of a software coding implemented by means of a process of sequential recognition of nodes of said communication means.
• the third control means 403 may be arranged to determine the vehicle of the convoy on which it is respectively installed by means of a software coding implemented by means of a process of sequential recognition of nodes 602 of the at least one communication means N.
• the communication means form the communication network 600 and this communication network may include one or more network nodes 602.
• the first control means 402 may be arranged to transmit, through the at least one communication means N, the interrogation message according to a first predetermined periodicity.
• the first control means 402 and the second control means 404 may be arranged to transmit, through said at least one communication means, the respective communication messages used for the integrity verification according to a predetermined periodicity.
• the first control means 402 may be arranged to update, according to a second periodicity, the interrogation message, and said second control means 404 is arranged to update, according to a third periodicity, the response message.
• the first, second and third periodicities may be different or equal to each other.
• first control means 402 and the second control means 404 may be arranged to update, according to a specific second periodicity, the communication messages used for the integrity verification.
• a safety check has been carried out which ensures that the first control means 402 and the second control means 404, even if blocked in a fault condition, continue to transmit a previous message, thus nullifying the integrity verification of the convoy.
• the first control means 402 and the second control means 404 may each be arranged to perform at least one predetermined safety action.
• the at least one predetermined safety action may include the actuation of at least braking means of the first vehicle RV 1 or of the second vehicle RV2, to which the first control means 402 and the second control means 404 are respectively associated.
• the braking means may be of any type, for example pneumatic, electromechanical, electronic, mechanical, mechatronic, friction, etc.
• the first control means 402 may be arranged to send an alarm message to the third control means 403.
• the second control means 404 may be arranged to send an alarm message to the third control means 403.
• the third control means 403 may therefore be arranged to perform at least one predetermined safety action when it receives an alarm message from the first control means and/or from the second control means.
• the at least one predetermined safety action may include the actuation of at least braking means of the third vehicle RV3, with which the third control means 403 is associated.
• the braking means may be of any type, for example pneumatic, electromechanical, electronic, mechanical, mechatronic, friction, etc.
• the advantage achieved is that of having implemented a system for verifying the integrity of a convoy which is highly configurable, which may be implemented directly on board the convoy, which reduces its installation and maintenance costs.

Landscapes

• Engineering & Computer Science (AREA)
• Mechanical Engineering (AREA)
• Train Traffic Observation, Control, And Security (AREA)
• Valves And Accessory Devices For Braking Systems (AREA)
• Regulating Braking Force (AREA)
• Electric Propulsion And Braking For Vehicles (AREA)
• Traffic Control Systems (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=74556987

Family Applications (1)

Country Status (7)

Family Cites Families (7)

• 2020
  • 2020-11-12 IT IT102020000027089A patent/IT202000027089A1/it unknown
• 2021
  • 2021-11-12 JP JP2023527746A patent/JP2023551392A/ja active Pending
  • 2021-11-12 CN CN202180075999.4A patent/CN116648397A/zh active Pending
  • 2021-11-12 KR KR1020237016918A patent/KR20230128265A/ko unknown
  • 2021-11-12 US US18/252,182 patent/US20230415798A1/en active Pending
  • 2021-11-12 WO PCT/IB2021/060501 patent/WO2022101842A1/en active Application Filing
  • 2021-11-12 EP EP21819963.6A patent/EP4244116A1/en active Pending

Also Published As

Similar Documents

Legal Events