Abstract:
The vigilance process includes receiving inputs of operator activity and determining the presence or absence of activity inputs during a first delay period. The operator is warned, if activity inputs are absent during the first period. If the warning period expires before being cancelled, a vigilance penalty signal is produced. The brakes are applied for a first predetermined period in response to the vigilance penalty signal.

Description:
CROSS-REFERENCE 
     This application claims the benefit of U.S. Provisional Patent Application No. 60/144,037 filed Jul. 16, 1999 which is incorporated herein by reference. 
    
    
     BACKGROUND AND SUMMARY OF THE INVENTION 
     The present invention relates to rail locomotives and more specifically to a vigilance system within a computer-controlled train brake system. 
     Vigilance Systems are well known within the industry. These are stand along systems that monitor operator activity during locomotive operation. If the operator appears to be incapacitated through an action, the vigilance system will apply a penalty brake by signalling, the brake control system with an electrical or pneumatic signal. Also, dead man pedal switches have been available and used, as well as ATC switches to provide inputs to a penalty process. An example of such a system in a penalty process is illustrated in U.S. Pat. No. 6,042,201. 
     The present system is a vigilance process which is included in an electropneumatic brake controller which controls pneumatic braking in response to brake signals and penalty signals. The vigilance process includes receiving inputs of operator activity and determining the presence or absence of activity inputs during a first delay period. The operator is warned, if activity inputs are absent during the first period. If the warning period expires before being cancelled, a vigilance penalty signal is produced. The brakes are applied for a first predetermined period in response to the vigilance penalty signal. The brakes can be reset in response to a reset input from the operator after expiration of the first braking period. The reset input includes determining that the operator has inputted a full service brake request, a zero propulsion request and a reset request. The brake request is from the brake handle and the propulsion request is from a propulsion handle. 
     Operator activities include one or more of a closed vigilance foot switch, a pressed vigilance button, motion of the propulsion handle and operation of a sander. The warning is cancelled by closing the vigilance foot switch or pressing the vigilance button. The system also includes a mode input and deactivates the vigilance process for a trail mode input. The vigilance process is also deactivated for removal of a key from the system while in a lead mode. The vigilance process is also deactivated for brake cylinder pressure above a predetermined pressure and vehicle speed below a predetermined speed. 
     A fault process is also included. The fault process determines if a fault condition exists and produces a fault penalty if a fault condition exists. The brakes are applied for a second predetermined period in response to a fault penalty signal. The brakes are released in response to a reset input from the operator after expiration of the second braking period. The reset input includes determining that the operator has inputted a full service brake request, a zero propulsion request and a reset request. The faults include one or more of a sensor being out of range, a pressure transducer out of range, an electropneumatic valve failed and an emergency controller switch open fault. 
     The vigilance process may also be deactivated in response to a cut-out input during a safe state. The safe state includes a warning not taking place, the first braking period has expired, a brake cylinder pressure is greater than a predetermined pressure, a vehicle speed is below a predetermined speed and the system is in a trail mode. 
     Other objects, advantages and novel features of the present invention will become apparent from the following detailed description of the invention when considered in conjunction with the accompanying drawings. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is a flow chart of the communication of data and control between systems and process in software according to the present invention. 
     FIG. 2 is a state transition diagram according to the present invention. 
     FIG. 3 is a state transition diagram for switch debouncing. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     The Vigilance System is designed to assure that the vehicle operator remains aware while the vehicle is in motion and in Lead Mode. To do this, the microprocessor controlled air brake system monitors the following inputs and system parameters: 
     
       
         
               
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 Vigilance Push Button 
                 (VIGACK1) 
               
               
                   
                 Vigilance Foot Switch 
                 (VIGACK1) 
               
               
                   
                 TE/BE Handle Motion Indicator 
                 (VIGACK2) 
               
               
                   
                 Sanding Push Button 
                 (VIGACK2) 
               
               
                   
                 Vehicle “No-Motion” Indicator 
               
               
                   
                 TE/BE Position ‘0’ Indicator 
               
               
                   
                 Brake Cylinder Pressure 
               
               
                   
                 Cab Key Switch 
               
               
                   
                   
               
             
          
         
       
     
     An example of a computer controlled locomotive air brake system is the CCBII system available from New York Air Brake Corporation and the system described in Modular Locomotive Brake Controller W098/10967 Published Mar. 19, 1998 and corresponding to U.S. Pat. No. 6,036,284. 
     Under normal operation, the operator is required to press the foot switch or buttons, move the power or propulsion controller or TE/BE handle, or operation of the sander at least once in a preset time period (default 60 seconds, for example). Should the operator fail to comply, a warning buzzer and light will be activated for a preset time period (default 6 seconds). During this warning period, the operator can only cancel the warning by pressing the Vigilance Push Button or Foot Switch. Failing to do this during the warning period will force a penalty brake application. Once the penalty application is induced, there is a minimum waiting period imposed before the operator may reset the penalty (default 120 seconds, for example). When this period has expired, the operator may only reset the penalty by moving the automatic brake handle to the Full Service position, moving the TE/BE handle to Position ‘0’ and pressing the Vigilance Reset Push Button. 
     While in Lead Mode, the Vigilance control system may be “suppressed”, or rendered temporarily inactive by the operator charging Brake Cylinder to more than 25 PSI, for example, OR bringing the vehicle speed to less than 1.5 kph, for example. 
     When a brake control system fault occurs that is defined to cause a penalty (e.g., ER control fault), a penalty application will occur, followed by a waiting period (default 30 seconds). Following this waiting period, the operator may only reset the penalty by moving his automatic brake handle to the Full Service position, moving the TE/BE or propulsion handle to Position ‘0’ and pressing the Vigilance Reset Push Button. 
     The Vigilance Control Process may be disabled by the operator through the use of the cut-out or the Vigilance Enable Switch. Once disabled, Vigilance Control will not monitor operator activity until it is re-enabled with the breaker or switch. The disabled state will only be recognized when the vehicle is in a “safe” state: i.e., after a penalty brake application has been made or when Vigilance is suppressed or the vehicle is in Trail. 
     As shown in FIG. 1, the process is performed on the microprocessor of the locomotive brake system. 
     The Vigilance Foot Switch and Vigilance Push Button are presented to the microprocessor through a single signal input, referred to as “VIGACK 1 ”. The TE/BE Activity indication and Sanding Foot Switch are read by the microprocessor through a single input known as “VIGACK 2 ”. 
     The Vigilance Reset Push Button, VIGACK 1  and VIGACK 2  inputs are conditioned with a debounce process that assures that the switch is opened after it has been closed before another closure is reported to the Vigilance Process. A debounce process is described below and illustrated in FIG.  3 . 
     The TE/BE Zero Position indicator and cut-out switch are already debounced by the Locomotive control system, so that value is read directly by the Vigilance Process. 
     The various values assigned to the Timers will be stored in Non-volatile RAM and may be changed through the Portable Test Unit (PTU). Once changed, they will remain at the new value until they are changed again, the fault log is cleared by the PTU, or new software is installed in the CPU. 
     The Vigilance Process will request Penalty applications though the Penalty Command interface with the Brake Pipe Control process (variable “Penalty”). One method of penalty processing is described in U.S. Pat. No. 6,042,201 incorporated herein by reference. A penalty message or flag is provided to the penalty processor. The vigilance process is on the same processor as the penalty process and other brake control processes. 
     The controller position indicators and the Key-in indicators will be read directly by the Vigilance Control Process. 
     When any of the Timers are set to a non-zero value, there value will be decremented (updated) by the Timer Control Process which is located with the “HandleTimers” process used by the other control processes in the locomotive brake system. 
     The process or operation of the Vigilance System will be explained in reference to the transition state diagram of FIG.  2 . 
     Init State 
     The initialization or Init State is only entered from CPU reset. This State assures that all internal variables in the control process are set to a proper value. Once these internal variables have been initialized, the Vigilance Process will enter the Delay State, transition T 0 . 
     Delay State 
     The primary state, the Delay State, has a preset period normally set at 60 seconds, for example, (which may be adjusted though the PTU). This cycle is automatically restarted whenever the vigilance process detects one of a number of external inputs, (derived from other vehicle control functions under the driver&#39;s control, transition A 1 . The presence of which automatically infers that the driver has taken some positive action and is therefore vigilance. These control functions include: 
     1. Movement of the driver&#39;s power controller or propulsion handle. 
     2. Operation of the sander. 
     3. Operation of the vigilance acknowledge push button or pedal. 
     In normal circumstances, provided that the driver is periodically performing some positive action, the Delay State will be continually reset and will never run to completion, transition A 1 . Only if the driver fails to perform such an action within the Delay State period, either because no change to vehicle operating conditions has been required within that period, or because he has become incapacitated, will the delay cycle period expire. 
     When such an event occurs, the Action State will be initiated, including audible and visual warnings to the driver, transition T 6 . From the Delay State, the system can also transition to the Isolated State transition T 1  or to the suppressed state isolate T 3  for the conditions to be described below. 
     Isolate State 
     When the vehicle has been placed into Trail Mode, or when it is Lead Mode and the key has been removed, the Vigilance Process will enter the Isolate State. The Isolated State can be entered from the delay state, transition T 1  or from the suppressed state, transition T 20 . During this State, no operator activity or faults will be monitored. The Vigilance Process will remain in the Isolate State as long as the vehicle is in Trail Mode. 
     Cutout State 
     During the Cutout State, no operator activity or faults will be monitored. The Cut-out State may be entered only when the cut-out circuit breaker or cut-out switch is set indicating a vigilance cut-out condition and the vigilance process is in the following states: 
     Delay (transition T 16 ) 
     Isolate (transition T 15 ) 
     Suppress (transition T 17 ) 
     Brake Waiting (after penalty application completed) (transition T 19 ) 
     Fault Waiting (after penalty application completed) (transition T 18 ) 
     When the cut-out condition is no longer activated, the system enters the Delay State, transition T 21 . 
     Suppress State 
     Provision is included within the unit to suppress the operation of the vigilance system when, for example, the vehicle is stationary and continual proof of driver vigilance is not required. Vigilance suppress is initiated by an external input to the system, derived from a vehicle speed sensor or brake cylinder pressure transducer. Vigilance may only be suppressed during the Delay State, that is, when the vehicle is operating normally. For example, if the brake cylinder pressure is above 25 PSI or the speed is less than 1.5 kp, suppress state is initiated from the Delay state, transition T 3 . 
     In addition, to permit the vigilance system to be disabled on a slave locomotive in multiple unit operation, the vigilance is also automatically suppressed whenever both cab reversers are set to the Off position. In other words, when the vehicle is in Trail Mode. 
     If the vehicle speed and brake cylinder pressure reach are above preset levels, then the suppressed state cycles back to the Delay State (transition T 9 ). As previously discussed, this would require, for example, brake cylinder pressure of less than 25 PSI and an engine speed greater than 1.5 kph. If a fault occurs, then the Suppressed State will transition to the fault timing state (T 10 ). If the cut-out condition is detected, the Suppressed State will transition to the cut-out state, transition T 17 . 
     Action State 
     The Action State is entered whenever the Delay State timer expires, transition T 6 . This indicates that no driver action has been detected for the length of the delay cycle period. The length of the warning period of the Action State is normally set at 6 seconds, for example, which is adjustable through the PTU. 
     In order to maintain normal vehicle operation, the driver must now operate the Vigilance Acknowledge pedal or push button before the warning period of the action timer expires, to prove positively that he has not become incapacitated. The monitoring in the time period is represented by transition state A 2 . 
     Once reset or cancelled in this manner, system operation reverts to the Delay State, transition T 5 , and normal vehicle operation is maintained. 
     If a fault occurs during an Action State, the Fault State is initiated by transition T 11 . If the action timer expires, the Brake Timing State is entered, transition T 14 . 
     Fault State 
     The operation of the vigilance system is continuously monitored by its own built in test routines. If, at any time, a condition is detected which could lead to unsafe system operation, a brake application is immediately initiated, and a fault indication is given. In addition to the vigilance fault, Penalty Reduction is defined as a 1.6 Bar reduction below Temporary Release. Temporary Release is defined as Release plus result of Assimilation. Faults are any electronic air brake faults that result in a penalty application. 
     The following fault conditions will cause a Fault Penalty Application: 
     1. Automatic handle frequency out of acceptable range. 
     2. ER Transducer out of range. 
     3. BP Transducer out of range. 
     4. AD Board Reference voltage out of range. 
     5. ER Supply failure. 
     6. ER Exhaust failure. 
     7. MVER failure. 
     8. Emergency Controller switch open fault. 
     The Fault State has a preset period normally set at 30 seconds, for example, (adjustable through the PTU), during which period the brake application cannot be canceled. This is the Fault Timing state. 
     Only after the expiration of the Fault State timing can the Fault Waiting State entered transition, T 12 . After removal of the condition that caused the fault and provided that the power controller or propulsion handle has been set to the Off position or zero propulsion request and the Automatic Brake Handle of the active controller placed into the Full Service Position, an attempt can be made by the driver to reset the fault condition, and resume normal vehicle operation using the Vigilance Reset push button. 
     Fault Timing State 
     Upon entry into the Fault Timing State, Delay State (transition T 8 ), the Suppressed State (transition T 10 ) and the Action State (transition T 11 ), the brake application has been initiated. During this state, the timer is monitored until it expires. Only then will the Vigilance Control process enter the Fault Waiting State, transition T 12 . 
     Fault Waiting State 
     Only during the Fault Waiting State does the Vigilance Control Process begin looking for a reset of the fault condition or operator input. Once the conditions are favorable, the brake application and penalty will be removed and the process will return to the Delay State for normal operation, transition T 7 . 
     An exception to the normal inputs is made when the Cut-out circuit breaker, or cut-out switch is set indicating a Vigilance Cutout condition, in which case the Vigilance Control Process will enter the Cutout State, transition T 18 . 
     Brake State 
     The Brake State is initiated if the operator fails to respond to the audible and visual warnings before the expiration of the Action State timer, transition T 14 . A brake application is immediately initiated. There are two sub-states to the Brake State: the Brake Timing State and the Brake Waiting State. 
     Brake Timing State 
     The Brake State has a preset period normally set at 2 minutes, for example, (adjustable through the PTU), during which period the brake application can not be canceled. This ensures that the vehicle is brought to a complete standstill. 
     Brake Waiting State 
     After the expiration of the Brake Timing State timer, the Brake Waiting State is entered, transition T 13 . After the power controller or propulsion handle has been set to the Off position or zero propulsion request and the Automatic Brake Handle of the active controller placed into the Full Service Position, the vigilance system can be reset using the Vigilance Reset push button. The brake application is then released, the audible and visual warnings are canceled, and normal vehicle operation may be re-established, normally to the delay state, transition T 4 . If a cut-out condition is detected, then the transition is to the cut-out state transition T 19 . 
     
       
         
               
             
               
               
               
               
               
             
           
               
                   
               
               
                 State Transition Matrix for FIG. 2 
               
             
          
           
               
                 Transi- 
                   
                   
                 Old 
                 New 
               
               
                 tion 
                 Input/Event 
                 Output/Action 
                 State 
                 State 
               
               
                   
               
               
                 T0 
                 Power Up 
                 Set Delay timer = Delay Timer 
                 Init 
                 Delay 
               
               
                   
                   
                 Value 
               
               
                 T1 
                 Unit switched to 
                 &lt;&gt; 
                 Delay 
                 Isolate 
               
               
                   
                 Trail OR Lead with no 
               
               
                   
                 key inserted 
               
               
                 T2 
                 Unit switched to Lead 
                 Set Delay Timer = Delay Timer 
                 Isolate 
                 Delay 
               
               
                   
                 AND key inserted 
                 Value 
               
               
                 T3 
                 BC pressure &gt; 25 PSI OR 
                 &lt;&gt; 
                 Delay 
                 Suppress 
               
               
                   
                 speed &lt; 1.5 kph 
               
               
                 T4 
                 Brake handle of 
                 Clear Vigilance Penalty bit, 
                 Brake 
                 Delay 
               
               
                   
                 selected cab in Full 
                 set Delay Timer = Delay Timer 
                 Waiting 
               
               
                   
                 Service AND TE/BE 
                 Value, Turn K6 OFF 
               
               
                   
                 handle in position 
               
               
                   
                 ‘0’ AND Vigilance 
               
               
                   
                 Reset P/B activated 
               
               
                   
                 AND No Penalty Faults 
               
               
                   
                 active 
               
               
                 T5 
                 Foot switch pressed 
                 Set Delay Timer = Delay Timer 
                 Action 
                 Delay 
               
               
                   
                 OR Push Button 
                 Value, turn K6 OFF 
               
               
                   
                 pressed 
               
               
                 T6 
                 Delay timer expires 
                 Set Delay Timer = Action 
                 Delay 
                 Action 
               
               
                   
                   
                 Timer Value, turn K6 ON 
               
               
                 T7 
                 Fault cleared AND 
                 Clear Vigilance Fault 
                 Fault 
                 Delay 
               
               
                   
                 Power Controller set 
                 Penalty Bit, set Delay 
                 Waiting 
               
               
                   
                 to OFF position AND 
                 Timer = Delay Timer Value 
               
               
                   
                 Push Button pressed 
               
               
                 T8 
                 Fault occurs 
                 Set Vigilance Fault Penalty 
                 Delay 
                 Fault 
               
               
                   
                   
                 bit, set Reduction 
                   
                 Timing 
               
               
                   
                   
                 Timer = Fault Timer Value 
               
               
                 T9 
                 BC pressure ≦ 25 PSI AND 
                 Set Delay Timer = Delay Timer 
                 Suppress 
                 Delay 
               
               
                   
                 speed ≧ 1.5 Kph 
                 Value 
               
               
                 T10 
                 Fault occurs 
                 Set Vigilance Fault Penalty 
                 Suppress 
                 Fault 
               
               
                   
                   
                 bit, Set Reduction 
                   
                 Timing 
               
               
                   
                   
                 Timer = Fault Timer Value 
               
               
                 T11 
                 Fault occurs 
                 Set Vigilance Fault Penalty 
                 Action 
                 Fault 
               
               
                   
                   
                 Bit, set Reduction 
                   
                 Timing 
               
               
                   
                   
                 Timer = Fault Timer Value, 
               
               
                   
                   
                 turn K6 OFF 
               
               
                 T12 
                 Reduction timer 
                 &lt;&gt; 
                 Fault 
                 Fault 
               
               
                   
                 expires 
                   
                 Timing 
                 Waiting 
               
               
                 T13 
                 Reduction timer 
                 &lt;&gt; 
                 Brake 
                 Brake 
               
               
                   
                 expires 
                   
                 Timing 
                 Waiting 
               
               
                 T14 
                 Action timer expires 
                 Set Reduction Timer = Penalty 
                 Action 
                 Brake 
               
               
                   
                   
                 Timer Value, Set Vigilance 
                   
                 Timing 
               
               
                   
                   
                 Penalty bit 
               
               
                 T15 
                 Cutout Condition 
                 &lt;&gt; 
                 Isolate 
                 Cutout 
               
               
                   
                 Detected 
               
               
                 T16 
                 Cutout Condition 
                 &lt;&gt; 
                 Delay 
                 Cutout 
               
               
                   
                 Detected 
               
               
                 T17 
                 Cutout Condition 
                 &lt;&gt; 
                 Suppress 
                 Cutout 
               
               
                   
                 Detected 
               
               
                 T18 
                 Cutout Condition 
                 Clear Vigilance Fault 
                 Fault 
                 Cutout 
               
               
                   
                 Detected 
                 Penalty Bit 
                 Waiting 
               
               
                 T19 
                 Cutout Condition 
                 Clear Vigilance Penalty Bit 
                 Brake 
                 Cutout 
               
               
                   
                 Detected 
                   
                 Waiting 
               
               
                 T20 
                 Unit switched to 
                 &lt;&gt; 
                 Suppress 
                 Isolate 
               
               
                   
                 Trail OR Lead with no 
               
               
                   
                 key inserted 
               
               
                 T21 
                 Cutout Condition No 
                 Set Delay Timer = Delay Timer 
                 Cutout 
                 Delay 
               
               
                   
                 Longer Active 
                 Value 
               
               
                 A1 
                 TE/BE handle movement 
                 Set Delay Timer = Delay Timer 
                 Delay 
                 Delay 
               
               
                   
                 Or Sanding Button 
                 Value 
               
               
                   
                 pushed OR Vigilance 
               
               
                   
                 Push Button pressed 
               
               
                   
                 OR Foot pedal pushed 
               
               
                 A2 
                 Vigilance push button 
                 K6 ON 
                 Action 
                 Action 
               
               
                   
                 NOT pressed AND Foot 
               
               
                   
                 pedal NOT pushed AND 
               
               
                   
                 Delay timer NOT 
               
               
                   
                 expired 
               
               
                   
               
             
          
         
       
     
     The debounce process for the Pushbuttons and foot switches will be run each time the button or foot switch is polled (read by the vigilance process). This process will assure that only one “ON” condition will be reported for each switch press. This is essential a “button-up” scheme—that is, the reported value will only change after a buttons-up condition is detected. 
     As shown in FIG. 3, the initial state is INIT. The transition from the initial state to an off-state is after power up/reset. As long as the input is off, the off-state is maintained as illustrated by transition A 1 . When the switch input is on, the state is transitioned from the off-state to the on-state, transition T 1 . As long as the input stays in the on-state, the value returns to on as illustrated by transition A 2 . When the input changes from on to off, the transition from state is transitioned from the on-state to the off-state, transition T 2 . Thus, multiple on-states cannot be detected if there is not any intervening off-state. 
     
       
         
               
             
               
               
               
               
               
               
             
           
               
                   
               
               
                 State Transition Matrix For FIG. 3 
               
             
          
           
               
                   
                 Transi- 
                   
                   
                 Old 
                 New 
               
               
                   
                 tion 
                 Input/Event 
                 Output/Action 
                 State 
                 State 
               
               
                   
                   
               
               
                   
                 T0 
                 Power 
                 Set return value 
                 Init 
                 Off 
               
               
                   
                   
                 up/reset 
                 to OFF 
               
               
                   
                   
                 (first 
               
               
                   
                   
                 invocation) 
               
               
                   
                 T1 
                 Input changes 
                 Set return value 
                 Off 
                 On 
               
               
                   
                   
                 to ON 
                 to ON 
               
               
                   
                 T2 
                 Input changes 
                 Set return value 
                 On 
                 Off 
               
               
                   
                   
                 to OFF 
                 to OFF 
               
               
                   
                 A1 
                 Input still 
                 Set return value 
                 Off 
                 Off 
               
               
                   
                   
                 OFF 
                 to OFF 
               
               
                   
                 A2 
                 Input still 
                 Set return value 
                 On 
                 On 
               
               
                   
                   
                 ON 
                 to ON 
               
               
                   
                   
               
             
          
         
       
     
     Although the present invention has been described and illustrated in detail, it is to be clearly understood that the same is by way of illustration and example only, and is not to be taken by way of limitation. The spirit and scope of the present invention are to be limited only by the terms of the appended claims.