Abstract:
The invention aims at increasing the availability of doors systems without affecting the reliability of control systems. For this purpose, the invention provides to take advantage of the alternating operation of door systems positioned on either side of the same car. 
     An on-board panel system according to the invention includes associated control panels control means for transmitting authorization signals for the exclusive opening of side doors. The control means combine a low speed signal and a validation side selection signal to carry out, in each environment, opening/closing authorizations of the motor control of its environment and the motor control of the associated environment. 
     Applications to the accessories and the mechanical part of the railway door systems (motors, latch fittings, loudspeakers, etc) as well as their door environment (interface with the communication network).

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application claims priority to European Patent Application No. 07291434.4, filed Nov. 30, 2007, which is incorporated by reference herein. 
     BACKGROUND AND SUMMARY 
     The invention relates to a high availability control method for railway door systems, making it possible, in case of failure, to have the possibility to open and close the doors of a railway car, and also relates to an on-panel system for implementing such a method. The invention applies to the door accessories, in particular to sound output devices for loudspeakers and to latch fittings, as well as to door environments in connection with the railway communication network lines. 
     Here, railway car or car means a rigid unit for railway transportation, an assembly of railway cars connected together and constituting a train set, a tramway or any rail-guided transportation means. A “door system” includes all the control means in particular the control panel, the mechanical means of the door proper, as well as the electromechanical accessories such as sensors, activators; push-buttons, buzzers, loud-speakers, warning lights, limit switch elements etc. 
     Statistically, failures of passenger railway transportation can be attributed to access doors in a proportion of approximately 30 to 40%. Besides, the door control electronics amounts to 40 to 50% of all the failures of such doors. In order to improve such availability, it is known to increase the frequency of the equipment maintenance. Thus, document EP 0 728 894 discloses an emergency control allowing to open the doors in case of a failure of the main power supply. Such type of solution is expensive and requires an increased immobilization of cars. 
     It is also well known to add, to the existing system, a system which is a dual door control means to preserve the control in case of a failure of a system. However, this solution is also expensive and multiplies the number of components to be used. Such multiplication entails a substantially lower reliability, since the risk of failure then increases in the same proportions as the number of components. 
     Thus, the invention aims at increasing the availability of the door systems without affecting the reliability of the control system. For this purpose, the invention provides to take advantage of the alternative operation of the door systems positioned, on either side of a car. More precisely, the object of the invention is to provide a high availability control method for railway door systems of a car, positioned along two opposite longitudinal sides of the car, consisting in detecting a failure control of a first accessory whose opening or closing has been requested, transmitting the failing control to the operational control of at least one associated accessory, positioned along the opposite longitudinal side, and substituting the failing control with said associated operational control. Such a method makes it possible not to duplicate the equipment of a train while keeping a high availability of operation of the doors whose opening or closing has been requested. 
     According to particular embodiments of the method:
         the associated accessories are automatically managed by a mutual checking of the controls through periodical exchanges between both controls and a takeover of an assumed failing control in the absence of a periodical detection, by neutralizing such control and by transferring the opening authorizations to the associated control from a combination between a low speed signal and a validation side selection signal;   the environmental and functionality information of each door are analyzed in order to detect operation anomalies, and if need be, to perform a new substitution;   when the door is provided with a position encoder, the position information may not be sent back to the control of the associated door, for saving time, and the failing door is thus operated, in case of failure, on the basis of position calculation algorithms.       

     The invention also relates to a high availability on-panel control system for the doors of a car, for the implementation of such method. Such system includes mutual checking means for associated control panels in order to transmit authorization signals of the exclusive opening of one of the two series of the opposite side doors, and the checking means combine a low speed signal and a validation side selection signal to perform, in each environment, opening/closing authorizations to the motor control of its system and to the motor control of the associated system. 
     Each door control panel preferably receives door position signals and sends signals for triggering the environmental conditioning devices for example lamps and buzzers, as well as the control means of the driving motor of the corresponding door. The word “panel” means an electronic control unit, dedicated here to the control of a car door and of the accessories of its environment connected to its close perimeter. 
     According to particular embodiments:
         each door control panel receives door position signals and sends signals for triggering the environmental conditioning devices, as well as the control means of the driving motor of the corresponding door;   each door panel comprises switching means between the control means of the motor of a door and control means of the motor of at least one associated door, positioned on an opposite side wall, said position and triggering signals being then capable of being sent to the panel of the associated door in order to transfer the door control to the latter;   the position and triggering signals of a door are digital and transmitted to the associated remote door panel via a signal inlet/outlet module;   a transmission bus performs the transmission of the data from the inlet/outlet module of the panel of a door to the panel of the associated door;   life lines perform a mutual checking by connecting the panel of each door to the panel of each associated door in order to transmit the periodically refreshed control signals;   the triggering of the emergency procedure is generated from a life line continuum;   a filtering time is predetermined between a stoppage of the variation of the line control signal and the triggering of the intervention means on a failing panel by comparing the value of each signal;   the control means on a failing panel comprise means for stopping its power supply, power switches of the corresponding motor to the motor control circuit of the associated operational panel, in connection with the authorization control means for the opening of the doors on the opposite sides and means for locking the direction of motors;   the motor power switches between two associated panels activate, for each panel, an H bridge motor driving circuit having between terminals for selecting the motors to be driven, the takeover terminals being connected to the emergency mode terminals by means of connections, each circuit including the means for locking the direction of motors;   the opening authorizations controlling means are locked by a processing of the door speed and the opening or closing authorization signals for the doors on each side, according to a double, i.e. positive and negative, validation logic suite, in order to make the selection of the takeover of the motorization of a door on one side depend on the validation of an opening authorization on this side.       

     In order to guarantee the continuous operation of the door environment communication networks, the operational panel emulates a “network behavior” of the associated failing panel, either by neutralizing the failing panel or by driving a “bypass” (branching) of the network line at the level of the failing panel, thus keeping the failing panel on. The invention also applies to the accessories of the railway doors, more particularly the information diffusion loudspeakers and the door latch fittings. In the case where accessories are railway door environments loudspeakers, the failing control of a door environment loudspeaker being transferred to the operational control of the loudspeaker of the associated door environment. Advantageously, the control of the failing panel of a door environment loudspeaker is transferred to the control of the associated panel of a emergency loudspeaker of that environment. 
     According to another embodiment, each door control panel and the panel of the associated door have access to the same module sound generation module via transmission buses, each module supplying sound signals to at least one loudspeaker of each door environment, each module being positioned in each door environment. In the case of railway doors electric latch fittings, a switching of the control of each latch fitting, during the transfer of the control in emergency mode, is carried out according to the preceding method and the locking of the controls is carried by a logic gate of opening authorizations of a door system and a control through the logic gate of the opening authorization of the associated environment. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
       Other characteristics and advantages of the invention will appear evident while reading in detail the description of one embodiment which follows and which refers to the appended drawings, which show, respectively: 
       in  FIG. 1 , a schematic view of a door management by two side systems, according to the state of the art; 
       in  FIG. 2 , a schematic view of a door management by a control transfer system according to the present invention; 
       in  FIG. 3 , the diagram of the mutual checking of the door control panels according to the invention; 
       in  FIG. 4 , an assembly of chronograms illustrating the takeover of the control of the failing left panel; 
       in  FIG. 5 , a diagram of the checking of the control of the motor direction of two associated doors in connection with a motor driving circuit; 
       in  FIG. 6 , the preceding diagram during the takeover of the left panel by the right panel control; 
       in  FIG. 7 , a diagram of the opening authorization generation registers; 
       in  FIGS. 8   a  and  8   b , a diagram of the motorization for the opening and closing, during the control of the left panel for the motorization of the left door motor; 
       in  FIGS. 8   c  and  8   d , a diagram of the motorization for the opening and closing, during the takeover by the left panel of the control of the right panel for the motorization of the door motor; 
       in  FIG. 9 , a communication network operation diagram using all the side doors in series associated according to the invention; 
       in  FIGS. 10   a  and  10   b , a diagram illustrating one application of the invention to the management of the loudspeakers of associated doors according to two mountings with or without an external module; and 
       in  FIG. 11 , a diagram illustrating an application of the invention to the electric latch fittings of associated doors. 
     
    
    
     DETAILED DESCRIPTION 
     While referring to  FIG. 1 , the view shown relates to the management system, known by the state of the art, for a local door  10   g , herein called the “left door” because of its position on the left longitudinal side Kg of the railway car rolling in direction D and an associated  10   d  door, the “right door” located on the opposite side Kd of the car. The system includes lines  20   g  and  20   d  for the serial transmission of the authorization signals, for the exclusive opening of the left side doors, among which the door  10   g  and the right side doors, among which the door  10   d , respectively. 
     The transmission means also include a low speed signal line  20   s  in order to validate the transmitted authorizations signals. The transmission means of the signals of each series are coupled to control panels, respectively  30   g  and  30   d , with the corresponding doors  10   g  and  10   d . Each door control panel receives door position signals from the limit contacts and receives from the pushbuttons  40   g  and  40   d . Besides, the panel sends triggering signals for the motor environmental conditioning devices  50   g  and  50   d , by triggering lamps and buzzers, and includes control means for the driving motor, respectively  60   g  and  60   d , of the corresponding door. The equipment (pushbutton, lamp, buzzer, motor, etc.) of each door  10   g ,  10   d , is positioned in the environment  11   g ,  11   d , of such door. 
     The basic means and connections for implementing the invention are illustrated while referring to the example in  FIG. 2 , where the same references indicate the same accessories. In this example, the panels  30   g  and  30   d  and the respective environments  11   g  and  11   d  of the doors  10   g  and  10   d , positioned opposite each other on each side of the car, are associated. For this purpose, each motor control of the panels  30   g  and  30   d  of the door also includes motor power switching means  70   g  and  70   d  between the control connections  7   g  and  7   gd  (respectively  7   d  and  7   dg ) of the motors  60   g  and  60   d  (respectively  60   d  and  60   g ) for driving the associated doors  10   g  and  10   d . The control connections  7   gd  and  7   dg  of a door panel for the motor of an associated door are shown in dotted lines in  FIG. 2 . 
     In this description, the switches can be relays, transistors or any other equivalent commutation accessories. In alternative solutions, doors not positioned opposite each other are associated or else each door is associated to more than one door on the opposite side. 
     Still referring to  FIG. 2 , each door control panel  30   g  and  30   d  receives signals from the corresponding door  10   g  and  10   d  position encoder  31   g  and  31   d , corresponding to the push-buttons  40   g  and  40   d  limit switches. In parallel, each panel  30   g  and  30   d  sends triggering signals to the respective environmental conditioning devices  50   g  and  50   d , lamps and buzzers in the example. In case of failure, the position and triggering signals are transmitted to the panel of the associated door to transfer the failing control to the latter. Such door  10   g  or  10   d  position and triggering digital signals are then transmitted to the panel  30   d  or  30   g  on the associated door  10   d  or  10   g , through a signal inlet/outlet module  31   g , respectively  31   d , and a transmission bus  32   gd , respectively  32   dg.    
       FIG. 3  shows, in a diagram, the mutual checking of the control panels  30   g  and  30   d  of the associated doors, according to the exemplary embodiment. The door opening and closing control signals are managed, in a safe way, by a mutual checking of the door controls through:
         periodical signals Sg and Sd exchanged between both door controls with a periodical refreshment, thus forming “life lines” Lg and Ld, and   in case of acknowledgement of absence of variation of a periodical signal, in a life line mutual checking unit  80 , the takeover of the motor control of the assumed failing panel, by the motor control of the operational panel.       

     The takeover of such control results in:
         the cutting of the power supply to the failing panel  30   g  or  30   d;      the changeover of switches  70   d  and  70   g  to connections  7   dg  or  7   gd  of the control of the motor of the failing control, to transfer the opening/closing management authorizations to the operational control;   the activation of logical processing through the inlet/outlet module  31   g  or  31   d  mounted on the failing door, to the operational panel  30   d  or  30   g.          

     The chronograms in  FIG. 4  more precisely explain the succession over time “T” of timing sequences of a takeover of the right panel when the left panel is failing. The interruption of the variation of the periodical refreshment signal Sg of the life line Lg (line L 1 ) at time T 1  causes the triggering of the acknowledgement of a request for help by the control module at time T 2  (edge Fc, line L 2 ) after a filtering duration D 1  equal to  1   s  in the example. A comparison of the value of each periodical signal, Sg in this example, detects an absence of variation. The triggering of the request for help induces at time T 3  after a filtering duration D 2  (equal to 500 ms in the example), the off-powering (edge Ft, line L 3 ) of the failing panel, as well as the taking into account of the management authorization by the operational panel (edge Fa, line L 4 ) and the sending of the motor control connections to the motor control of the operational panel (edge Fl, line L 5 ). 
       FIG. 5  gives in detail, in an exemplary embodiment, the control modules  81   g  ( 61   d ) of the door opening/closing authorization registers, as well as the motors control and driving circuits. Each control module  81   g  (respectively  81   d ) for each door environment  11   g  ( 11   d ) is connected with an “H bridge”  61   g  ( 61   d ) motor driving circuit. Between the H bridge circuit and the motor  60   g  ( 60   d ), a motor  60   g  ( 60   d ) driving switch  70   g  ( 70   d ) makes it possible to switch the control of a door control panel to the associated panel. Each control module  81   g  ( 81   d ) includes registers  8   g  and  8   gd  (respectively  8   d  and  8   dg ) of generation of opening authorization for the local door and the associated door, the authorization registers of the same door environment  8   g  and  8   dg  ( 8   d  and  8   gd ) receiving the information of the authorization signal on the corresponding side  20   g  ( 20   d ) as well as the speed signal information  20   s.    
     The opening authorization registers of the same door system, i.e.  8   g  and  8   dg  (respectively  8   d  and  8   gd ) are adjusted by a specific unit for the mutual takeover  80   g  ( 80   dg ) of each environment  11   g  ( 11   d ) by the associated environment. The authorization registers  8   g  and  8   gd  ( 8   d  and  8   dg ) of the same door environment  11   g  ( 11   d ) are connected to modules for locking the direction of motors  6   g  and  6   gd  ( 6   d  and  6   dg ) of the corresponding H bridge  61   g  ( 61   d ). The switches  70   g  and  70   d  are mounted together via the connections  71  and  72 . Each switch  70   g  ( 70   d ) is dual and includes, in each door environment  11   g  ( 11   d ), a selector of the motor to be driven  7   g  ( 7   d ) between the terminals Bg and Bgd (B and Bdg) and a mode selector  7   gm  ( 7   dm ) between a nominal mode (position P 1 ) and an emergency mode (position P 2 ). 
     During the takeover of a panel by the other panel, the panel  30   g  of the left door by the panel  30   g  of the right door in the example illustrated in  FIG. 6  (which mentions the same accessories described in reference with FIG.  5 ), the mutual takeover unit  80   d  is active. Besides, the motor  60   g  is turned off by the mode selector  7   gm  in emergency mode position (position P 2 ), whereas the motor selector  7   d  is positioned on the motor  60   g  (terminal Bdg). The generation of the side opening authorizations by logic inputs is more particularly explained in detail while referring to  FIG. 7 . The example relates to the takeover of the left door environment  11   g . The left side authorization is generated by the left opening authorization registers  8   g  and  8   dg  which include the setting up of positive and negative combinatory logics, such registers receiving the left authorization information  20   g , as well as the low speed signal  20   s.    
     The positive logic LP combinatory sequence includes, for generating the left side authorization, a switch  8   p  whose inputs are:
         a logic gate “and”  81  whose inputs are: E 1 , the speed signal  20   s ; E 2 , the left door authorization information  20   g  and E 3 , the left side opening authorization digital control information, and   a logic gate “nand”  82  whose inputs are: E 1  and E 3 , the speed signal  20   s  and the digital control information.
 
The outputs S 1   g  and S 1   d  of the flip-flops  8   p  supply the values of the left side opening authorization level in a positive logic.
       

     The negative logic Ln combinatory sequence also includes a flip-flop  8   n  whose inputs are a gate “or”  83  and a gate “and”  84 . The inputs of gates  83  and  84  are identical to those of the positive logic gates. The output S 2   g  and S 2   d  of the flip-flops  8   n  supply the values of the left side opening authorization level, in negative logic. 
     The  FIGS. 8   a  and  8   b  illustrate a motorization diagram, respectively during the opening and the closing, upon the motor control of the left door motor  60   g  by the left panel motor control, i.e. during the nominal control of the left door motor. On the contrary, the  FIGS. 8   c  and  8   d  show a motorization diagram respectively for the opening and the closing, after the takeover of the motor control of the right door motor  60   d  by the left panel control. The switch  70   d  of the right environment  11   d  of the right door is switched to activate, if need be, the right door motor control emergency mode  60   d  and the switch  70   g  of the environment  11   g  of the left door is in the motor  60   g  driving position. 
     The motorization for the opening of the left door by the left panel  30   g  is illustrated in  FIG. 8   a . In this Figure are shown, in the environment  11   g  of the left door, the transistors T 1  to T 7  of the H bridge control circuit, the transistors being in the on- or the off-state, depending on the state of logic gates P 11  to P 15 . The transistors T 1  and T 7  are dedicated to the left and right sides closing control and the transistors T 1  to T 6  to the left and right sides opening control. 
     More particularly, the transistors T 3  and T 4  use the left opening authorization in positive and negative logic to control the opening of the left door, and the transistors T 5  and T 6  use the right opening authorization to control the opening of the right door. Both series of transistors, T 3 -T 4  and T 5 -T 6 , are mounted in parallel. The motor is supplied by the continuous current supply terminal Vcc and the grounding “M”. 
     During the motorization of the opening of the left environment  11   g , the closing transistors T 1  and T 7  are in off-state and the transistors controlling the opening of the left door T 3  and T 4 , in positive and negative logic, as well as transistor T 2  are in the on-state (arrows {right arrow over (F)} 1  and {right arrow over (F)} 2 ). The transistors for the opening of the right door by the left panel T 5  and T 6 , are in emergency mode. Under this condition, the motor  60   g  rotates in the direction corresponding to the direction of the arrow {right arrow over (F)} g . The  FIGS. 8   b ,  8   c  and  8   d  show the same accessories as those in  FIG. 8   a  with the same reference signs. 
     During the motorization for the closing of the left door  60   g  by the left panel  30   g  ( FIG. 8   b ):
         the closing transistors T 1  and T 7  are in the on-state ({right arrow over (F)} 3  and {right arrow over (F)}′ 3 ) and   the left door opening controlling transistors T 2 , T 3  and T 4  are in the OFF-state.
 
Then the motor rotates in the closing direction corresponding to the arrow {right arrow over (F)}′ g , i.e. in the direction opposite the previous direction corresponding to the opening.
       

     Upon the transfer of the right door  60   d  motor control to the left panel  30   g , the switch  70   g  is in the position for driving the right door motor  60   d  and the opening and closing motorizations are triggered as follows:
         upon the right motor  60   d  opening ( FIG. 8   c ) motorization (arrow {right arrow over (F)} d , the closing transistors T 1  and T 7  as well as the left door opening control transistors T 3  and T 4 , in positive and negative logic, are in the OFF-state or in emergency mode; the opening transistors T 2  (right door control), T 5  and T 6  (opening authorizations in positive and negative logic) are in the ON-state (arrows {right arrow over (F)} 5  and {right arrow over (F)} 6 );   upon the motor  60   d  closing ( FIG. 8   d ) motorization (arrow {right arrow over (F)}′ d ), the for the left door closing control transistors T 1  and T 7  (arrows {right arrow over (F)} 7  and {right arrow over (F)} 8 ) are in the ON-state, whereas the opening control transistors T 2 , T 3  to T 6  are in the OFF-state or in emergency mode. The motor  60   d  then rotates in the closing direction corresponding to the arrow {right arrow over (F)}′ d , io.e. in the direction contrary to the previous direction corresponding to the opening.       

     An application of the invention relates to the management of various communication networks (CAN, LON, MVB, ETHERNET, PROFINET, etc), carried out by the door environment of the railway lines when a panel control is failing, as illustrated while referring to  FIG. 9 . The communication is managed along the various systems  11   g  and  11   d  (of the doors  10   g  and  10   d ) mounted in series. The panels  30   g  and  30   d  control the doors  10   g  and  10   d  through controls  7   g  and  7   d.    
     In order to take into account the management of the communication in network  90 , an operational panel  30   d  emulates the “network behavior” of an associated failing panel  30   g  according to the previous method. The failure of the panel is materialized by a cross on the corresponding connection  7   g . The takeover materialized by the arrow {right arrow over (F)} 9  then secures such an emulation in order to secure a continuous management. In the case of a “daisy chain” ETHERNET or PROFINET wiring, the assisted panel remains ON in order to provide a bypass (a branching) of the network line at the subscriber level. 
     While referring to the  FIGS. 10   a  and  10   b , the application of the invention to the management of the loudspeakers of associated doors is illustrated by two examples. The solution shown in  FIG. 10   a  assumes that each environment  11   g  ( 11   d ) of the panel  30   g  (respectively  30   d ) integrates a sound generation module and has two sound output devices Sg 1  and Sg 2  (respectively Sd 1  and Sd 2 ). The outlets of each panel supply a local loudspeaker Hg (Hd), and an emergency loudspeaker Hgd (Hdg) located in the environment of the associated door. The takeovers on the loudspeakers in case of failure are performed in this example, by the same transmission mechanisms as for the motors: a panel  30   g  ( 30   d ) controls the emergency loudspeaker of the associated door. 
     As an alternative, only one loudspeaker per door is provided and the emergency equipment relates to the failing control of a loudspeaker. In this case, the control of the loudspeaker is transmitted to the operational control of the panel of the associated door. 
     According to another exemplary embodiment ( FIG. 10   b ), the associated panel  30   g  and panel  30   d , have access to two sound generation modules, Mg and Md, localized in each system  11   g  ( 11   d ) of each door. The transmission of the panel control signals to the sound generation modules is carried out by dedicated transmission buses  12   g  ( 12   d ). The module Mg supplies two loudspeakers HP 1  and HP 2  for the left door, and the module Md the loudspeakers HP 3  and HP 4  for the right door. Each module provides sound signals to at least one loudspeaker of the corresponding door. In nominal mode, each panel  30   g  ( 30   d ) controls the corresponding sound generation module Mg (Md). In the emergency mode, the control of the failing panel  30   g  ( 30   d ) is transmitted to the control of the associated panel  30   d  ( 30   g ) via the portion drawn in dotted lines in  FIG. 10   b , of the corresponding bus  12   d  ( 12   g ). 
     Another application relates to the electric latch fittings of the associated doors  10   g  and  10   d , while referring to  FIG. 11 . Each system  11   g  ( 11   d ) for a door is provided with a latch fitting control switch  13   g  ( 13   d ) Seg (Sed) of the corresponding door. In nominal mode, the control of the latch fitting Seg (Sed) via the logic gate  14   g  ( 14   d ) utilizing the opening positive and negative authorization is carried out by the corresponding panel. 
     In emergency mode, the latch fitting control Seg (Sed), via the switching of the selector S 13  of the switch  13   g  ( 13   d ) is dedicated to the associated doors system control panel  11   d  ( 11   g ). The control is carried out through the logic gate  15   d  ( 15   g ), the logic gate  15   d  ( 15   g ) using the double positive and negative authorization logic corresponding to the arrow {right arrow over (F)} 10g  ({right arrow over (F)} 10d ). 
     The invention is not limited to the exemplary embodiments described and shown. For example, it is thus possible to provide an adaptation of the invention more particularly to the opening/closing of car inner doors, to air-conditioning motors and to a car brake control.