ES2745498T3 - Procedure to test a safe traction lock of a railway vehicle - Google Patents

Abstract

Procedure for testing a traction lock (1) of a railway vehicle, where the traction lock (1) presents a first signal path (5) to transmit a traction lock request signal (3) to a control unit (6) of the railway vehicle, and a second signal path (12), where a diagnostic device (6, 14, 15, 17, 23, 24) is provided, so that the second signal path (12) can be verified as to its operation by means of a test request signal (13) generated by the control unit (6), where the test request signal (13), by means of the second signal path (12), by On the one hand, it is led to a freely programmable circuit (20) and, on the other hand, with latency in time, it is led to an activation signal blocking circuit (9) by means of a latency element (16), where the programmable circuit (20) and activation signal blocking circuit (9) are arranged in an activation signal path (10) that connects the control unit (6) with a drive unit (22), and where testing is initiated by a signal (4, 4 ') from the railway vehicle, the status of which The signal is modified shortly before enabling to run.

Description

DESCRIPTION

Procedure to test a safe traction lock of a railway vehicle

Technical area

The present invention refers to a method for testing a secure traction lock of a railway vehicle.

State of the art

It is well known that particularly high safety precautions are required in traffic engineering, and thus also in rail vehicles. Thus, when a train stops, it is required that the train does not start to move abruptly from the state of detention, accidentally, probably putting at risk passengers who are precisely in the access area. Such a demand is made by a so-called traction lock which must also meet these high demands for technical reliability. It must practically be free of so-called systematic errors. In addition, the probability of failure of the traction lock must be below a defined limit. Currently, the probability of failure per hour is required to be in the range of minus / equal 10-8, up to less than 10-7.

In a known way, railway vehicles are mostly powered by electric motors that are supplied from a converter. The control signals for the drive unit of the converter are generated by a control unit of the railway vehicle, usually by a micro-computer. Thus, it cannot be excluded that this micro-computer operates in a faulty manner and that its software, in the event of a stop at a train station, generates faulty control signals. A sudden, unexpected movement of the railway vehicle may then occur, in which passengers of the railway vehicle may also be affected. For safety reasons, with the highest possible safety, efforts are made to avoid such a tensile force, produced accidentally.

In the case of a stationary rail vehicle, there are different possible solutions to prevent the unwanted conversion of the driving force to a forward or backward pulse.

On the one hand, for example by means of the conductor, the main switch could be opened at each station stop and the power supply could be interrupted. In this way, an unwanted drive would surely be excluded, but at the same time the supply would also be suppressed. of secondary auxiliary equipment, which is not considered convenient.

Another possible solution is based on monitoring the detention. In this case, the stopping of the vehicle is monitored electronically, for example by detecting the rotational movement of the wheels, using measurement techniques. As soon as a movement modification is detected and it has exceeded a critical threshold value, the power supply is interrupted and due to this the unwanted movement is stopped again. However, this has the disadvantage that a "jolt" of the rail vehicle must first occur in order to detect and prevent it. In this way, however, a security risk remains.

Another possible solution is to electronically prevent unwanted backward movement. In the specialized article "Quantitative Sicherheitsbewertung einer Fahrzeugsteuerung" conference act ZEVrail Glasers, annals 131 conference act SFT, Graz 2007, describes such a safe traction lock, which operates electronically. The high SIL4 safety according to EN50126 of this traction lock, among other things, results from the fact that a door circuit that acts as an activation signal blocking circuit, which is arranged in the activation signal path between the control unit and the converter is designed with two channels and can be verified by self-testing. The converter, in a normal case, can be locked and unlocked by software. For security reasons, however, in addition, there is this gate circuit made in hardware (AND logical). In the case of having to necessarily prevent a rotation torque, it disconnects the "hard" converter with latency in a few milliseconds with respect to the software blocking.

Such a self-test of the traction lock, however, is always carried out in such a way that the control unit generates activation signals directed to the drive unit and checks whether its transmission is impeded by the traction lock. Thus, in principle, it cannot be excluded that in the case of a non-functional traction lock, control pulses arrive at the drive unit, triggering unwanted movement of the railway vehicle.

In principle, however, efforts are made to design such a test - which is naturally useful for operational safety - in the least risky way possible.

Furthermore, from the state of the art, the European patent application EP 2133254 A2 is known, which describes a procedure for requesting safety reactions in a railway vehicle, where a state is detected in which a safety reaction has to be detected of a device.

Description of the Invention

The object of the present invention is to provide a procedure to test a safe traction lock, which is carried out in the least risky way possible.

This object is solved by a method with the characteristics of claim 1. Advantageous variants of the invention are defined in the dependent claims.

According to the invention, testing is controlled by a signal from the railway vehicle, the signal status of which is changed shortly before it is enabled to go.

In a variant of the method according to the invention, the carrier signal is derived from the actuation state of the railway track control lever. A manual actuation in the "run" direction activates the self-test.

However, other safety-relevant signals from the rail vehicle can also be used to trigger the traction lock function check.

If the traction lock check is triggered by the closing signal for all rail vehicle door contacts, the performance check assumes little risk potential for passengers. However, it may also be advantageous if the start signal is derived from a higher-order train control device of the railway vehicle.

In another possible variant of the method according to the invention, it can be provided that as a safety-relevant signal, to activate the traction lock function check, a signal from a device of an integrated linear train control system is used . Thanks to this, the operation test can be carried out before the start command and it can also be monitored from an external control unit.

It is also possible to deduce the activation of the self-test of the traction lock from a PWM signal of the drives of the railway vehicle.

It may also be convenient to use a combination of two or a plurality of these safety-critical signals to trigger a self-test. The aforementioned can take place for example by means of a AND connection (logical conjunction) of these signals. This can further reduce the risk of endangering passengers.

Brief description of the drawing

In order to continue with the explanation of the invention, reference is made in the following part of the description to the drawings, where other advantageous variants, particularities and improvements of the invention can be seen by means of a non-limiting embodiment example.

The figures show:

Figure 1: a block diagram of a drive controller of a railway vehicle, in which a traction lock performed by means of hardware is generally represented;

Figure 2: a second example of execution of a traction lock - hardware;

Figure 3: a pulse diagram illustrating the initiation process according to the invention of the test block of the traction block, according to figure 1, as well as according to figure 2.

Execution of the invention

In the way already mentioned in the introduction, in a self-test of a traction lock it is verified whether the transmission of generated activation signals is indeed blocked. For passengers, however, no additional risk potential should be caused by such self-testing.

Before approaching the method according to the invention for testing a secure traction lock, by way of introduction the mode of operation of the traction lock of a railway vehicle is explained in detail.

Figure 1 shows a block diagram of a sector of a drive controller of a railway vehicle with a traction lock 1 made in hardware. Such a drive controller is usually placed in a railway vehicle control apparatus. Traction lock 1 essentially consists of a self-test switch 17, a signal path 12, a lock signal re-read channel 15, a latency element 16 and a lock circuit of the activation signal 9. The drive unit 22 usually consists of a converter 11 that drives electric motors 7. The converter 11 receives its activation signals 8 through an activation signal bus 10 that connects the control unit 6 and the drive unit 22. The trigger signals 8 are usually generated by a computer, for example by a micro-computer in the control unit 6.

In the manner explained in the introduction, the converter 11, in the normal state, can be locked and also unlocked by the software in the micro-computer 6. According to the invention, an electronic traction lock 11 is added to this protection measure. by hardware, whose operation is explained in detail below. The electronic traction lock 1 is supplied with a traction lock request signal 3 generated by a device 2. That device 2 is in an active connection with the control lever located in the driver's cabin of the railway vehicle and, if necessary, it is manually operated by the driver of the vehicle. In addition, a signal 4 'can be supplied to unit 2, for example obtained by sampling the door contacts or by other sensors of the railway vehicle. Both signals 4 and 4 'represent a "run command" as well as a "run enable information"; the two initiate generation of a traction lock request signal 3. Request signal 3 reaches microcomputer 6 via a first signal path 5. A second signal path 12 conducts that traction lock request signal 3 to an activation signal blocking circuit 9. The activation signal blocking circuit 9 is located in the activation signal path 10. The activation signal path 10 is used for the transmission of activation signals 8, generated by the micro-computer 6, towards the converter 11.

The activation signal blocking circuit 9 has the function of blocking the transmission of activation signals when they are generated in a defective way by the control device 6, during a stop of the railway vehicle. The activation signal blocking circuit 9 acts as a logical conjunction, that is to say that it essentially consists of logic elements Y, to which, on the input side, the traction blocking request signal 3 and the Activation 8. As the traction lock request signal 3 is routed to the activation signal lock circuit 9, it is delayed by the latency element 16, which is explained in detail later.

As already explained in the introduction, the signal path to that activation signal blocking circuit 9 can fail, so that undesired formation of a rotating torque cannot be excluded with sufficient certainty. In the sense of higher technical reliability, therefore, a continuous verification of that signal path 12 takes place. That self-test will start whenever the traction lock request signal 3 is changed, for example when it is actuated the control lever. The diagnostic device essentially consists of the microcomputer 6, an input line for the test request signal 14, a re-reading channel for the blocking signal 15, as well as a self-test switch 17 and the latency module 16, of a re-reading channel 25 of the programmable logic circuit (FPGA) 20. The FPGA module receives the activation signals 8 from the control unit 6, through the bus section 21. The switch self-test 17 is located at the entrance to transmission channel 12, i.e. in spatial proximity with respect to the generation of the traction lock request signal 3, otherwise expressed, near unit 2. The latency module 16 is arranged at the other end of signal path 12, that is, in spatial proximity with respect to the activation signal blocking circuit 9. Latency module 16 enables storage, as well as maintenance of a va signal lor, for a predetermined time interval.

The microcomputer 6, for the purpose of verification, at each modification of the pull lock request signal 3 generates a test request signal 13. That test request signal 13 consists in the fact that short deadline, in order to test, a "blocking request" is simulated. This "blocking request", through the test request signal line 14, reaches the self-test switch 17. The self-test switch 17 acts as a digital input that can be controlled, so that in the case of a signal path 12 capable of operation the simulated "lock request" is led back to microcomputer 6, via the re-read channel of lock signal 15.

At the same time, that test request signal 13 is also routed to a programmable logic module 20 and latency element 16. Programmable logic module 20, for example an FPGA module, is located at the output of control unit 6 , in the activation signal path 10. It ensures that the self-tests can only take place at a time when the correct activation of the semiconductor modules in the converter 11 is not compromised. Triggering of the activation signal 9 is also arranged in the activation signal path 10. If, in the event of a failure, by the microcomputer 6, in spite of this, a generation of activation signals 6 occurs, then they, through section 21 of signal path 10, reach FPGA 20, but from that circuit, in correspondence with the configuration of FPGA 20, they are converted so that the semiconductor switches in the converti Inverter 11 is not damaged by disconnecting the phases of the electric drive 7. This ensures that in the case of the desired avoidance of the formation of torque, the converter 11 is not damaged. However, if that programmable logic module 20 were also defective, then the activation signal blocking circuit 9 acts temporarily delayed and activates a "hard" disconnection of the converter 11. The time latency is predetermined by the time interval. (a few milliseconds) from latency module 16.

Via the re-read channel 23, the status of the signal at the input of the drive unit 22 is re-read by the control unit 6. If the re-read signal is inactive, then the traction lock 1 works. In the event of a failure, the faulty status is displayed to the driver of the vehicle.

FIG. 2 shows another exemplary embodiment in which, unlike FIG. 1, the second signal path 12 is made up of two channels, a first channel 18 and a second channel 19. The pull lock request signal 3, respectively by means of a current loop, is led to each of these two channels 18, 19, according to the principle of quiescent current. The binary input is respectively made in series with respect to switch 17, as well as 17 ''. As illustrated in Figure 2, each of these switches 17 ', 17' 'can be activated by means of the test request signal 13, that is, by software. The self-test takes place again by briefly interrupting the signal in signal path 12. Also in this case the reread signal, via the blocking signal re-reading channels 15 ', as well as 15' ', is led both to the FPGA module 20, as well as to the latency element 16 ', as well as 16' '. As already explained in relation to figure 1, also in the event of a failure of the FPGA module 20, the activation signal blocking circuit 9 acts here, disconnecting the "hard" converter 11 after a predetermined time latency. . In order to achieve a maximum of safety by preventing backward movement, in a convenient manner, account is taken of the fact that in this fault state the semiconductor switches in converter 11 are likely to be damaged. With the variant shown in Figure 2 , with a comparatively low investment, an architecture corresponding to the SIL 4 safety level of the EN50126 standard can be carried out, where however, at the same time, the probability that the system, when fulfilling its function, is very high is very high find in a state with working capacity (availability).

As can be seen from the aforementioned, the increased reliability and protection of the converter 11 are achieved exclusively by hardware. It is not necessary to modify the algorithm in microcomputer 6 or its hardware. In the case of a vehicle rating, therefore, the technical analysis regarding the safety of the added components is comparatively simple. By making the device according to the invention, with a comparatively low investment, a failure probability of less than 10 8 can be achieved.

In order to enable a self-test, as far as possible without risks, of the traction lock explained above, according to the invention, the verification of the operation of the traction lock is controlled by a signal from the railway vehicle, the signal status of which changes shortly before. of the empowerment of the march.

Figure 3 shows a pulse diagram showing the test activation process, according to the invention, as a function of time t. Testing 27 of traction lock 1, in this example, starts when the state of signal 4 and signal 4 'changes from high (stop) to low (run).

The change in the state of the signal 4 can be activated, for example, by manual actuation of the control lever (see figure 1).

In principle, however, any safety-relevant signal from the railway vehicle is suitable as a carrier signal, in which the state of the signal is changed shortly before the gear is enabled.

The signal 4 'represents for example the closed state of all the door contacts of the railway vehicle.

The signal 4 ', however, can also come from a higher-order train control device of the railway vehicle.

The activation of the performance check can also come from an external device of the integrated train linear control system (LZB).

It is also possible to link a plurality of safety-relevant signals using a logical AND, and on that basis, deduce the start signal for a self-test.

Another possibility for activating the self-test can be via a PWM signal from the rail vehicle. In that case, the change of the signal state is made by a change of the PWM encoding.

Although the invention was illustrated and described in detail by means of the exemplary embodiments set forth above, the invention is not limited by the examples described, and the expert can deduce from these other variations, without leaving the scope of protection of the invention.

List of reference symbols used

1 Traction lock

2 Device for generating a pull lock request signal

3 Traction lock request signal

4, 4 ’Rail vehicle signal (eg control lever or" Greenline "driving enable signal) 5 First signal route

6 Rail vehicle control unit

7 Electric motor

8 Activation signal

9 Activation signal blocking circuit

10 Trigger signal path

11 Converter

12 Second signal path

13 Test request signal

14, 14 ’, 14" Test request signal input line

15, 15 ’, 15" Block signal re-reading channel

16, 16 ’, 16" Latency Element

17, 17 ’, 17" Self Test Switch

18 First Channel

19 Second Channel

20 Programmable Logic Circuit (FPGA)

21 Section of 10

22 Drive unit

23 Activation re-read channel

Re-Read Channel - Programmable Logic Circuit (FPGA) Activation Re-Read Signal

Programmable logic circuit re-read signal Traction lock test 1

Claims (8)

1. Procedure for testing a traction lock (1) of a railway vehicle, where the traction lock (1) has a first signal path (5) to transmit a traction lock request signal (3) to a unit control (6) of the railway vehicle, and a second signal path (12), where a diagnostic device (6, 14, 15, 17, 23, 24) is provided, so that the second signal path (12 ) can be verified as to its operation by means of a test request signal (13) generated by the control unit (6), where the test request signal (13), through the second signal path (12) , on the one hand, it is led to a freely programmable circuit (20) and, on the other hand, with time latency, it is led to an activation signal blocking circuit (9) by means of a latency element (16), where the programmable circuit (20) and the activation signal blocking circuit (9) are arranged in an activation signal path (10) that connects the control unit (6) with an actuation unit (22), and where the testing is initiated by a signal (4, 4 ') of the railway vehicle, whose state of the signal is changed shortly before enabling to run. Method according to claim 1, characterized in that the signal (4) is derived from the state of actuation of the control lever of the railway vehicle. Method according to claim 1, characterized in that the signal (4 ') is derived from a signal, relevant in terms of safety, of the railway vehicle. Method according to claim 3, characterized in that as a signal, relevant to safety, the closing signal of all the door contacts of the railway vehicle is used. 5. Method according to claim 3, characterized in that as a signal, relevant to safety, a signal from a higher-order train control device of the railway vehicle is used. Method according to claim 3, characterized in that as a signal, relevant to safety, a signal from a higher-order train control device of the railway vehicle is used. Method according to claim 1, characterized in that the signal (4 ') is derived from a PWM signal from the railway vehicle. Method according to claim 3, characterized in that the signal (4 ') is derived from a logical conjunction of a plurality of signals, critical to safety, of the railway vehicle.