EP3378725B1 - A safety device for a railway vehicle, a railway vehicle, a method for preserving safety of such a railway vehicle, and associated computer program - Google Patents

Description

The present invention relates to a safety device for a railway vehicle, the safety device being configured to control a braking system of the railway vehicle.

The invention also relates to a railway vehicle, such as a tram, on tires or rails, a light rail vehicle also called LRV (English acronym for Light Rail Vehicle ) or a metro, such as a metro on tires, comprising a braking system of the railway vehicle and such a safety device configured to control the braking system.

The invention also relates to a method for securing the railway vehicle, the method being implemented by such an electronic safety device.

The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement such a security method.

The invention relates to the field of safety of railway vehicles, in particular trams, LRVs or metros, such as rubber-tyred metros. The invention relates in particular to automatic train stopping devices, also called DAAT (acronym for Appareil d'Arrêt Automatique d'un Train), or ATP ( Automatic Train Protection ) systems , which are configured to automatically control a braking system of the railway vehicle under certain conditions.

A safety device for a railway vehicle, such as an automatic stopping device (DAAT) or an ATP system, is known. This safety device comprises a first detection module configured to detect at least one abnormal behavior of the railway vehicle among a prohibited crossing of a traffic light and an exceeding of a speed limit; a second detection module configured to detect at least one internal failure of the safety device; and a control module configured to send a control signal to the braking system.

The control module is then configured to send an emergency braking control signal following a maximum braking level, in the event of detection of abnormal behavior by the first detection module or detection of an internal failure by the second detection module.

The document DE 28 49 008 A1 describes a braking method for a railway vehicle.

The document " Bremskurven für den Hochgeschwindkeitsverkehr mit Funkzugbeeinflussung » by SINGER A. et al, ZEV, DET, Glasers Annalen, Die Eisenbahntechnik 1999, vol. 123, No. 2, pages 53-60 , describes methods for calculating braking curves and monitoring train braking.

We also know from the document FR 2 949 412 B1 a railway safety installation enabling the braking of a train traveling along a track when crossing a trackside signaling equipment, such as a traffic light, a state of said signaling equipment being controlled remotely from a control station. The railway safety installation comprises a ground-based device comprising an encoder comprising means for generating telegrams and at least one beacon arranged on the track in the vicinity of the trackside signaling equipment in question, the beacon being capable of emitting a radio signal corresponding to a telegram generated by the encoder. The railway safety installation also comprises an on-board device meeting the ETCS standard, comprising an antenna capable of capturing a radio signal emitted by the beacon, and a calculation and actuation unit connected to the antenna, capable of processing the received radio signal and comprising means for actuating the train braking system.

When the side signalling equipment is in the "stop" state, corresponding for example to a red light on the traffic light, the trackside device emits a "stop" type telegram compatible with the ETCS standard, and the device on board the train then triggers the braking of the train.

However, such a safety device for a railway vehicle is not always very suitable for operation in an urban environment with numerous obstacles, such as pedestrians, cyclists or even cars, particularly in the case where the railway vehicle is a tram, an LRV or even a rubber-tyred metro.

The aim of the invention is therefore to propose a safety device for railway vehicles which is more suited to such operation in an urban environment.

For this purpose, the invention relates to a safety device according to claim 1.

With the safety device according to the invention, emergency braking with the maximum braking level, i.e. emergency braking following the first braking level, is only triggered if abnormal behaviour of the railway vehicle is detected, i.e. prohibited crossing of a traffic light or exceeding a speed limit, but not if an internal fault in the safety device is detected.

This then makes it possible to limit the risks of injury to passengers inside the railway vehicle, by controlling emergency braking following the first level of braking (which is particularly effective in limiting the collision speed of the railway vehicle with obstacles, such as pedestrians, cyclists or cars) only when the situation requires it, i.e. in the event of abnormal behaviour of the railway vehicle, but not in the event of detection of a simple internal failure in the safety device, such detection also sometimes resulting in a false alarm.

According to other advantageous aspects of the invention, the safety device is according to any one of claims 2 to 5.

The invention also relates to a railway vehicle according to claim 6.

According to another advantageous aspect of the invention, the railway vehicle is according to claim 7.

The invention also relates to a method according to claim 8.

According to another advantageous aspect of the invention, the safety method is according to claim 9.

The invention also relates to a computer program according to claim 10.

• la figure 1 est une vue schématique d'un véhicule ferroviaire selon l'invention, se déplaçant le long d'une voie ;
• la figure 2 est une représentation schématique du véhicule ferroviaire ; et
• la figure 3 est un organigramme d'un procédé de mise en sécurité du véhicule ferroviaire selon l'invention.

These characteristics and advantages of the invention will appear more clearly on reading the description which follows, given solely by way of non-limiting example, and made with reference to the appended drawings, in which:

• there figure 1 is a schematic view of a railway vehicle according to the invention, moving along a track;
• there figure 2 is a schematic representation of the railway vehicle; and
• there figure 3 is a flowchart of a method for securing the railway vehicle according to the invention.

On the figure 1 , a railway vehicle 2 is able to travel along a railway track 4 which comprises, for example, two lines of rail 5 and 6, the railway vehicle 2 being able to communicate with a ground system 8. The track 4 is signaled in a conventional manner by means, among other things, of lateral signaling equipment, such as first and second signaling lights 10, 11, arranged successively on the edge of the track 4. The first light 10 is at right angles to a first point M of the track 4 and the second light 11 is at the right of a second point M'. Each signal light 10, 11 is intended to transmit a visual signal to the driver 12 of the railway vehicle 2.

The railway vehicle 2 comprises a receiving device 14 configured to receive signals, preferably radio signals, from a beacon 16, 18 associated with a corresponding signal light 10, 11.

The railway vehicle 2 comprises a measuring device 20 configured to measure a speed of the railway vehicle or to acquire the speed of the railway vehicle from another measuring device.

The railway vehicle 2 comprises a braking system 22 configured to exert a braking force on the railway vehicle 2, the braking system 22 comprising in particular a magnetic braking device, not shown, to exert the maximum braking level.

The railway vehicle 2 further comprises a safety device 24 configured to control the braking system 22, the safety device 24 being for example an automatic stopping device (DAAT - Automatic Train Stopping Device), or an ATP system (from the English Automatic Train Protection ) .

The railway vehicle 2 also includes a human-machine interface 26 connected to the safety device 24.

The rail vehicle 2 is preferably a tram, a LRV or a metro, such as a rubber-tyred metro.

Alternatively, the rail vehicle is a tram on rubber tires. In this variant, only a central guide rail is used.

The ground system 8 comprises the first and second traffic lights 10, 11, a control station 28 configured to remotely control a change of state of each traffic light 10, 11, the control station 28 being connected to the corresponding traffic light 10, 11, by a dedicated electrical line 30, for the transmission of an electrical signal for controlling the state of the traffic light 10, 11. Each respective electrical line 30 is coupled to the traffic light 10, 11, via a relay system 32 for amplifying the electrical control signal to effect the change of state of the traffic light 10, 11.

The ground system 8 further comprises, for each signal light 10, 11, an encoder 34 and the beacons 16, 18, namely an upstream beacon 16 and a downstream beacon 18. The beacons 16 and 18 are arranged between the rail lines 5 and 6 of the track 4 and successively, following a direction of movement of the railway vehicle 2. At the input, the encoder 34 is connected to the relay system 32 of the link between the control station 28 and the corresponding traffic light 10, 11. At the output, the encoder 34 is connected to the upstream beacon 16.

• un état « arrêt », correspondant par exemple à un feu rouge, indiquant au conducteur 12 de stopper le véhicule ferroviaire 2 pour qu'il ne franchisse pas le point M, M' correspondant ;
• un état «passant», correspondant par exemple à un feu vert, indiquant au conducteur 12 qu'il peut franchir le point M, respectivement le point M', et s'avancer sur un tronçon suivant de la voie 4 ;
• un état «attention», correspondant par exemple à un feu jaune, indiquant au conducteur 12 que le prochain feu de signalisation de la voie 4 est un feu se trouvant actuellement dans l'état « arrêt ». Cette information indique au conducteur 12 qu'il doit actionner le système de freinage du véhicule ferroviaire 2 pour respecter une indication donnée par le prochain feu de signalisation.

Each traffic light 10, 11 is capable of being in one of the following three distinct states:

• a “stop” state, corresponding for example to a red light, indicating to the driver 12 to stop the railway vehicle 2 so that it does not cross the corresponding point M, M';
• a “passing” state, corresponding for example to a green light, indicating to driver 12 that he can cross point M, respectively point M', and move onto a following section of track 4;
• an “attention” state, corresponding for example to a yellow light, indicating to driver 12 that the next traffic light on track 4 is a light currently in the “stop” state. This information indicates to driver 12 that he must activate the braking system of railway vehicle 2 to comply with an indication given by the next traffic light.

The receiving device 14 is configured to receive the signals, preferably radio signals, from the beacons 16, 18 associated with each traffic light 10, 11, in particular an indication relating to a prohibited crossing of a corresponding traffic light 10, 11. The receiving device 14 comprises an antenna and a radio transmitter-receiver, not shown, configured to receive the radio signals from the beacons 16, 18.

The receiving device 14 is also configured to receive an indication relating to a speed limit in force in the geographical area where the railway vehicle 2 is located. This indication relating to the speed limit is also received in the form of one or more radio signals.

The beacons, respectively upstream 16 and downstream 18, are configured to emit short-range radio signals. The presence of the second beacon 18, also called downstream beacon, downstream of the first beacon 16, also called upstream beacon, makes it possible to orient track 4 in a simple manner in a single direction of travel corresponding to the order of the upstream beacons 16, then downstream 18. For example, a railway vehicle 2 traveling on a track parallel to track 4, but having an opposite direction of travel does not take into account the radio signals emitted by the beacons 16 and 18, because it first receives a signal from the downstream beacon 18, then from that of the upstream beacon 16.

The measuring device 20 is known per se and is configured to measure the speed of the railway vehicle, in particular its instantaneous speed, or to acquire said speed of the railway vehicle 2 from another measuring device, such as a receiver of a satellite positioning system, also called a GNSS receiver (from the English Global Navigation Satellite System ) .

The braking system 22 is also known per se and is configured to brake the railway vehicle 2. The braking system 22 comprises in particular the magnetic braking device, which is capable of exerting a braking force on the railway vehicle 2 corresponding to a maximum braking level.

The 24 security device, also visible on the figure 2 , comprises a first detection module 40 configured to detect at least one abnormal behavior of the railway vehicle among a prohibited crossing of a traffic light 10, 11 and an exceeding of a speed limit.

The safety device 24 comprises a second detection module 42 configured to detect at least one internal failure of the safety device 24, and a control module 44 configured to send a control signal to the braking system 22.

The safety device 24 comprises an acquisition module 46 configured to acquire an authorization to cross a corresponding traffic light 10, 11, this authorization to cross being for example received by a voluntary action of the driver.

The safety device 24 is for example of a level at least equal to SIL 2 (from the English Safety Integrity Level 2 ) according to standards NF EN 50126, NF EN 50128 and NF EN 50129.

In the example of the figure 2 , the safety device 24 is implemented at least partially in the form of wired logic, the first detection module 40 comprising a first comparator 50, a second comparator 52 and an OR logic gate 54, and the control module 44 comprising a first control loop 60 equipped with one or more first switches 62, such as normally closed switches, and a second control loop 64 separate from the first control loop 60, the second control loop 64 being equipped with one or more second switches 66, such as normally open switches.

In addition or as a variant, the security device 24 further comprises an information processing unit, not shown, formed for example by a processor and a memory associated with the processor. According to this variant, the first detection module 40, the second detection module 42, the control module 44 and the acquisition module 46 are for example each produced in the form of software executable by the processor. The memory of the information processing unit is then able to store a first detection software configured to detect at least one abnormal behavior of the railway vehicle among a prohibited crossing of a traffic light 10, 11 and an exceeding of a speed limit, a second detection software configured to detect at least one internal failure of the safety device 24, a control software configured to send a control signal to the braking system 22 and an acquisition software configured to acquire an authorization to cross a corresponding traffic light 10, 11. The processor of the information processing unit is then able to execute the first detection software, the second detection software, the control software and the acquisition software.

In a variant not shown, the first detection module 40, the second detection module 42, the control module 44 and the acquisition module 46 are each produced in the form of a programmable logic component, such as an FPGA ( Field Programmable Gate Array ) , or in the form of a dedicated integrated circuit, such as an ASIC ( Applications Specific Integrated Circuit ) .

The human-machine interface 26 is connected to the safety device 24, and comprises, for example, a screen, not shown, for displaying information readable by the driver 12 of the railway vehicle 2, as well as a loudspeaker, not shown, for emitting different warning tones.

The encoder 34 is configured to receive, from the relay system 32, a secondary electrical signal corresponding to the electrical signal controlling the state of the corresponding traffic light 10, 11. The encoder 34 is then configured to process this secondary electrical signal and generate a frame of bits corresponding to the current state of the corresponding traffic light 10, 11 with which the encoder 34 is associated. The frame, or series of bits, is transmitted to the upstream beacon 16 which is capable of transmitting a radio signal corresponding to the frame generated by the encoder 34.

The first detection module 40 is configured to detect a prohibited crossing of a traffic light 10, 11 or an exceeding of a speed limit.

The first detection module 40 comprises, for example, the first comparator 50 capable of comparing, on the one hand, a signal received from the receiving device 14 relating to the state of the corresponding traffic light 10, 11, as well as whether or not this traffic light 10, 11 has been crossed by the railway vehicle 2, and on the other hand, the authorization or not to cross the traffic light 10, 11, acquired by the acquisition module 46, in order to detect a possible prohibited, i.e. unauthorized, crossing of the corresponding traffic light 10, 11.

The first detection module 40 comprises, for example, the second comparator 52 capable of comparing, on the one hand, a signal received from the receiving device 14 relating to the speed limit in force in the geographical area where the railway vehicle 2 is located, and on the other hand, the speed of the railway vehicle 2 received from the measuring device 20, in order to detect a possible exceeding of the speed limit.

The first detection module 40 further comprises the OR logic gate 54 connected to the output of the first and second comparators 50, 52, the OR logic gate 54 then delivering as output a signal indicating at least one abnormal behavior of the railway vehicle 2 among a prohibited crossing of a corresponding traffic light 10, 11 and an exceeding of a speed limit. The output of the OR logic gate 54 in this case forms the output of the first detection module 40.

The second detection module 42 is configured to detect at least one internal failure in the safety device 24. Such an internal failure results for example from a fault observed during an internal self-test in the safety device 24, during a software integrity test, or even during a hardware monitoring test for the supervision of the software activity and/or the power supply of the safety device 24.

According to the invention, the control module 44 is configured to send an emergency braking control signal according to a first braking level, in the event of detection of abnormal behavior by the first detection module 40, and to send an emergency braking control signal according to a second braking level, in the event of detection of an internal failure by the second detection module 42, the first braking level being strictly greater than the second braking level.

The control module 44 is preferably configured to send an emergency braking control signal following the first braking level only in the event of detection, by the first detection module 40, of abnormal behavior of the railway vehicle 2.

The control module 44 is for example configured to control the magnetic braking device, by sending the emergency braking control signal following the first braking level.

The first braking level is emergency level 3 or emergency level 4 according to EN13452-1. The first braking level is preferably emergency level 3 or emergency level 4 according to EN13452-1.

Emergency level 3 corresponds, according to standard EN13452-1, to a deceleration of between 2.8 ms ^-2 and 5 ms ^-2 with a maximum jerk of 8 m/s ³ . The emergency level 4 corresponds, according to the EN13452-1 standard, to a deceleration between 2.8 ms ^-2 and 4 ms ^-2 with a maximum jerk of 8 m/s ³ .

The second braking level is Emergency Level 1 or Emergency Level 2 according to EN13452-1. The second braking level is preferably Emergency Level 1 or Emergency Level 2 according to EN13452-1.

Emergency level 1 corresponds, according to standard EN13452-1, to a deceleration of between 1.2 ms ^-2 and 2.5 ms ^-2 with a maximum jerk of 4 m/s ³ . Emergency level 2 corresponds, according to standard EN13452-1, to a deceleration of between 1.2 ms ^-2 and 2.5 ms ^-2 with a maximum jerk of 4 m/s ³

The control module 44 comprises, for example, the first control loop 60 equipped with two first switches 62, such as normally closed switches, for controlling the emergency braking according to the first braking level.

The control module 44 comprises, for example, the second control loop 64 distinct from the first control loop 60, the second control loop 64 being equipped with two second switches 66, such as normally open switches, for controlling the emergency braking following the second braking level, of a value strictly lower than that of the first braking level.

The control module 44 has, for example, reverse activation logic from one control loop to the other, the first loop 60 having normally closed switches 62 and the second loop 64 having normally open switches 66.

The first control loop 60 is, in the example of the figure 2 , dedicated to the control of the braking system 22 with implementation of the magnetic braking device, and the second control loop 64 is dedicated to the control of the braking system 22 without implementation of the magnetic braking device.

The use of two separate control loops 60, 64 allows differentiation in the control interface of the first and second separate braking levels.

Furthermore and preferably, the first control loop 60 and the second control loop 64 cannot be activated simultaneously, so as not to simultaneously control the braking system 22 with both the first braking level and the second braking level.

The operation of the railway vehicle 2, and in particular of the safety device 24, will now be explained using the figure 3 representing a flowchart of the method for securing the railway vehicle according to the invention.

During an initial step 100, the first detection module 40 monitors the information received from the receiving device 14, on the one hand, and from the measuring device 20, on the other hand, in order to detect any abnormal behavior of the railway vehicle 2, this abnormal behavior being a prohibited crossing of a traffic light 10, 11 or an exceeding of a speed limit, i.e. an excess of speed.

The first detection module 40 compares in particular the speed of the railway vehicle 2, in particular its instantaneous speed, provided by the measuring device 20 with the corresponding speed limit provided by the receiving device 14, and signals, to the control module 44, any possible exceeding of this speed limit.

The first detection module 40 also compares the various information received from the reception device 14 with that provided by the acquisition module 46, in order to verify, in the event of crossing a corresponding traffic light 10, 11, that such crossing was indeed authorized.

The second detection module 42 monitors, also during step 100, results of tests internal to the security device 24, in particular the results of internal self-tests, software integrity test(s) and/or hardware monitoring test(s), in order to detect a possible internal failure of the security device 24. If necessary, the second detection module 42 signals, to the control module 44, a possible internal failure of the security device.

In the event of detection of at least one event among abnormal behavior of the railway vehicle 2 on the part of the first detection module 40 and an internal failure of the safety device on the part of the second detection module 42, the safety method moves on to the next step 110 in order to control the braking system 22 of the railway vehicle as a function of the detected event.

In the event of detection of abnormal behavior by the first detection module 40, the control module 44 then sends to the braking system 22 a signal for controlling emergency braking according to the first braking level, the first braking level being for example emergency level 3 or 4 according to standard EN13452-1.

In the event of detection of only an internal failure in the safety device by the second detection module 42, the control module 44 then sends, to the braking system 22, a signal for controlling emergency braking according to the second braking level, the second braking level being strictly lower than the first braking level, the second braking level being for example emergency level 1 or 2 according to standard EN13452-1.

Alternatively, the safety device 24 further comprises a third detection module, not shown, configured to detect an anomaly not requiring braking with maximum efficiency, such as a state of attention of the driver corresponding to a drop in the driver's attention below a predetermined threshold. Such a state of attention is, for example, determined by a monitoring device which monitors the state of the driver, i.e., for example, the driver's movements. In this alternative, in the event of detection of only a drop in the driver's attention below the predetermined threshold, by the third detection module, the control module 44 then sends, to the braking system 22, a signal for controlling emergency braking according to the second braking level, the second braking level being strictly lower than the first braking level, the second braking level being, for example, emergency level 1 or 2 according to standard EN13452-1.

Thus, the safety device 24 and the safety method according to the invention make it possible to control the braking system 22 to have braking with maximum efficiency only when an actual danger is detected, such as prohibited crossing of a traffic light 10, 11 or exceeding the corresponding speed limit. Indeed, such braking with maximum efficiency presents a risk for the passengers in the railway vehicle 2, in particular a risk of falling and/or injury.

On the other hand, when the safety device 24 detects only an internal failure in the safety device, resulting for example from a self-test fault, such a signaling of a failure being moreover sometimes a false alarm, the safety device 24 and the safety method according to the invention make it possible to control the braking system 22 to have braking with moderate efficiency in order to reduce the risk incurred by the passengers in the railway vehicle 2, in particular the risk of falling.

The safety device 24 and the safety method according to the invention then make it possible to reduce the number of emergency braking operations with maximum efficiency which are untimely, in particular to reduce the number of untimely or unjustified braking operations of emergency level 3 or 4 according to standard EN13452-1.

It is then understood that the safety device 24 and the safety method according to the invention are more suited to operation in an urban environment with numerous obstacles, such as pedestrians, cyclists or even cars, particularly in the case where the railway vehicle 2 is a tram, an LRV or even a rubber-tyred metro.

Claims (10)

1. A safety device (24) for a rail vehicle (2), such as a tramway, an LRV or an underground train, such as a rubber-tyred underground train, the safety device (24) being configured to control a system (22) for braking the rail vehicle (2) and comprising:

   - a first detection module (40) configured to detect at least one abnormal behaviour of the rail vehicle (2) from prohibited crossing of a traffic light (10, 11) and exceeding a speed limit;

   - a second detection module (42) configured to detect at least one failure internal to the safety device (24);

   - a control module (44) configured to send a control signal to the braking system (22); characterised in that the control module (44) is configured to:

   - in case of detection of an abnormal behaviour by the first detection module (40), send a signal for controlling emergency braking according to a first braking level, said first braking level being the maximum braking level, and

   - in case of detection of an internal failure by the second detection module (42), send a signal for controlling emergency braking according to a second braking level,

   the first braking level being strictly higher than the second braking level.
2. The safety device (24) according to claim 1, wherein the control module (44) is configured to send a signal for controlling the emergency braking according to the first braking level only in case of detection of an abnormal behaviour by the first detection module (40).
3. The safety device (24) according to claim 1 or 2, wherein the first braking level includes the emergency level 3 or the emergency level 4 according to standard EN13452-1,

   the emergency level 3 corresponding, according to standard EN13452-1, to a deceleration between 2.8 m.s^-2 and 5 m.s^-2 with a maximum jerk of 8 m/s³,

   the emergency level 4 corresponding, according to standard EN13452-1, to a deceleration between 2.8 m.s^-2 and 4 m.s^-2 with a maximum jerk of 8 m/s³.
4. The safety device (24) according to any of the preceding claims, wherein the second braking level includes the emergency level 1 or the emergency level 2 according to standard EN13452-1,

   the emergency level 1 corresponding, according to standard EN13452-1, to a deceleration between 1.2 m.s^-2 and 2.5 m.s^-2 with a maximum jerk of 4 m/s³,

   the emergency level 2 corresponding, according to standard EN13452-1, to a deceleration between 1.2 m.s ² and 2.5 m.s^-2 with a maximum jerk of 4 m/s³.
5. The safety device (24) according to any of the preceding claims, wherein the control module (44) is configured to control a magnetic braking device through sending the signal for controlling the emergency braking according to the first braking level, the braking system (22) including the magnetic braking device.
6. A rail vehicle (2) comprising a system (22) for braking the rail vehicle (2) and a safety device (24) configured to control the braking system (22),
   characterised in that the safety device (24) is according to any of the preceding claims.
7. The rail vehicle (2) according to claim 6, wherein the rail vehicle (2) is a tramway, an LRV or an underground train, such as a rubber-tyred underground train.
8. A method for ensuring the safety of a rail vehicle (2), such as a tramway, an LRV or an underground train, such as a rubber-tyred underground train, the method being implemented by an electronic safety device (24) and comprising:

   - detecting (100) at least one event from an abnormal behaviour of the rail vehicle (2) and a failure internal to the safety device (24), the abnormal behaviour of the rail vehicle (2) being prohibited crossing of a signal light (10, 11) or exceeding of a speed limit;

   - controlling (110) a system (22) for braking the rail vehicle (2), including:

   + in case of detection of an abnormal behaviour of the rail vehicle (2), sending to the braking system (22) a signal for controlling emergency braking according to a first braking level, the first braking level being the maximum braking level, and

   + in case of detection of an internal failure of the safety device (24), sending to the braking system (22) a signal for controlling emergency braking according to a second braking level,

   the first braking level being strictly higher than the second braking level.
9. The method according to claim 8, wherein, when controlling (110) the braking system (22), the signal for controlling the emergency braking according to the first braking level is sent to the braking system (22) only in case of detection of an abnormal behaviour.
10. A computer program including software instructions that, when executed by a computer, implement a method according to claim 8 or 9.