Patent Description:
In the following, reference will be made to the European standards EN50129:rev. <NUM>, EN50159:rev. <NUM>, EN50126-<NUM>:rev. <NUM>, EN50126-<NUM>:rev. <NUM>, and EN50128:rev. <NUM>, which are:.

In particular, standard EN50126 defines the methodologies for assigning the safety levels SIL0/<NUM>/<NUM>/<NUM>/<NUM> (with safety level SIL4 indicating the maximum safety level) to the subsystems making up the system in question, based on the results of the safety analysis, and standards EN50128 and EN50129 define the design criteria to be applied to the software and hardware components respectively on the basis of the SIL levels assigned based on said safety analysis results.

In relation to the last of the preceding points, it is clear that it is worthwhile keeping the functions to be developed according to the SIL≥<NUM> safety levels extremely limited and simple.

<FIG> illustrates a known configuration of a train for transporting goods.

A train <NUM> is formed by a locomotive <NUM> pulling a plurality of wagons <NUM>.

The braking system of the train <NUM> installed on the locomotive <NUM> consists of a unit <NUM> for producing, filtering and storing compressed air, which unit is arranged to supply the braking control unit <NUM>, said compressed air being stored at pressure values that normally vary between <NUM> bar and <NUM> bar.

The braking control unit <NUM> supplies a pipe <NUM> known as the "brake pipe. " Said pipe passes along the entire length of the train, and normally consists of rigid segments <NUM> installed on the wagons <NUM> and flexible elements <NUM> installed between the wagons. The flexible elements <NUM> are adapted to ensure the pneumatic continuity of the brake pipe <NUM> in all conditions where the railway route is curved.

On each wagon <NUM>, a braking unit <NUM> is connected to the brake pipe <NUM>, from which it collects compressed air to supply the brake cylinders <NUM> at a pressure that depends on the current pressure value imposed by the braking control unit <NUM> in the brake pipe <NUM>.

<FIG> illustrates the transfer function of the braking unit <NUM> as specified by the UIC (International Union of Railways) standards: the x-axis represents the pressure in the brake pipe <NUM>, and the y-axis represents the braking pressure output from the braking unit <NUM>.

When the pressure in the brake pipe, i.e. the input pressure to the braking unit <NUM>, has a nominal value equal to <NUM> bar, the braking pressure output from the braking unit <NUM> assumes the value of <NUM> bar, i.e. no braking action is carried out.

When the pressure in the brake pipe, i.e. the input pressure to the braking unit <NUM>, has any other value equal to or less than nominal <NUM> bar, the braking pressure output from the braking unit <NUM> assumes the value of <NUM> bar, i.e. the maximum braking pressure is applied, which corresponds to emergency braking.

For pressure values in the brake pipe, i.e. the input pressure to the braking unit <NUM>, of between nominal <NUM> bar and nominal <NUM> bar, the braking pressure output from the braking unit <NUM> assumes linear pressure values of between nominal <NUM> bar and nominal <NUM> bar, except for a minimum pressure interval on the x-axis of approximately the nominal value of <NUM> bar.

<FIG> illustrates a simplified embodiment of the braking control unit <NUM>. In the prior art, the braking control unit <NUM> may assume a variety of more or less complex forms, for example as shown in <FIG>.

A main pipe <NUM> is supplied by a unit <NUM> for producing, filtering and storing compressed air, said compressed air assuming pressure values that normally vary between <NUM> bar and <NUM> bar.

Said main pipe <NUM> supplies a pressure relief valve <NUM> which is intended to supply a group of pneumatic solenoid valves <NUM>, <NUM>, <NUM> with pressure values normally lower than <NUM> bar.

Said pneumatic solenoid valve <NUM> is actuated by an electrical command signal <NUM>, and assumes a first state in which it inhibits the propagation of the supply pressure to the valve <NUM> when the electrical command signal <NUM> does not provide electrical power, and may assume a second state in which it allows the propagation of the supply pressure to the pneumatic solenoid valve <NUM> when the electrical command signal <NUM> provides electrical power.

The electrical command signal <NUM> may be generated by the brake control unit <NUM> or by an external source, the nature of which depends on the general architecture of the locomotive <NUM>.

Said main pipe <NUM> also supplies a pneumatic solenoid valve <NUM>.

Said pneumatic solenoid valve <NUM> is actuated by an electrical command signal <NUM>, and assumes a first state in which it inhibits the propagation of the supply pressure to the relay valve <NUM> when the electrical command signal <NUM> does not provide electrical power, and may assume a second state in which it allows the propagation of the supply pressure to the relay valve <NUM> when the electrical command signal <NUM> provides electrical power.

The pneumatic solenoid valve <NUM> is actuated by an electrical command signal <NUM> and may assume a first state in which it inhibits the propagation of the supply pressure to the pilot chamber <NUM> of the relay valve <NUM> when the electrical command signal <NUM> does not provide electrical power, and may assume a second state in which it allows the propagation of the supply pressure to the pilot chamber <NUM> of the relay valve <NUM> when the electrical command signal <NUM> provides electrical power.

The pneumatic solenoid valve <NUM> is actuated by an electrical command signal <NUM> and may assume a first state in which it allows the pressure in the pilot chamber <NUM> of the relay valve <NUM> to be discharged to the atmosphere when the electrical command signal <NUM> does not provide electrical power, and may assume a second state in which it inhibits the discharge of the pressure in the pilot chamber <NUM> of the relay valve <NUM> to the atmosphere when the electrical command signal <NUM> provides electrical power.

The electrical command signals <NUM> and <NUM> are generated by the brake control unit <NUM>.

The brake control unit <NUM> receives a request command <NUM> to apply a pressure value to the brake pipe <NUM>, in a nominal range between <NUM> bar and a maximum value normally between <NUM> bar and <NUM> bar.

The brake control unit <NUM> reduces, maintains and increases the pressure at the outlet <NUM> of the relay valve <NUM> in accordance with the request received from the command <NUM> by modulating the electrical signals <NUM>, <NUM>, powering both the pneumatic solenoid valves <NUM>, <NUM> in order to increase the pressure at the outlet <NUM> of the relay valve <NUM>, de-powering both the pneumatic solenoid valves <NUM>, <NUM> in order to reduce the pressure at the outlet <NUM> of the relay valve <NUM>, de-powering the pneumatic solenoid valve <NUM> and powering the pneumatic solenoid valve <NUM> to keep the pressure at the outlet <NUM> of the relay valve <NUM> constant, and closing the loop for controlling the pressure in the pilot chamber <NUM> by reading a first pressure sensor means <NUM> pneumatically connected to said pilot chamber <NUM>.

A pneumatic solenoid valve <NUM> is positioned between the outlet <NUM> of the relay valve <NUM> and the brake pipe <NUM>. Said pneumatic solenoid valve <NUM> is actuated by an electrical command signal <NUM>, and assumes a first state in which it inhibits the pneumatic connection between the brake pipe <NUM> and the relay valve <NUM> when said electrical command signal <NUM> does not provide electrical power, and assumes a second state in which it allows the pneumatic connection between the brake pipe <NUM> and the relay valve <NUM> when said electrical command signal <NUM> provides electrical power.

In many real applications, depending on the local regulations of different railway operators, only the pneumatic solenoid valve <NUM> or only the pneumatic solenoid valve <NUM> are present in the diagram shown in <FIG>.

A pneumatic solenoid valve <NUM> is pneumatically connected to the brake pipe <NUM>. Said pneumatic solenoid valve <NUM> is actuated by an electrical signal <NUM> that is also defined as an "emergency loop," and assumes a first state in which it inhibits the pneumatic connection between the brake pipe <NUM> and the atmosphere when said emergency loop <NUM> provides electrical power, and assumes a second state in which it allows the pneumatic connection between the brake pipe <NUM> and the atmosphere when said emergency loop <NUM> does not provide electrical power.

The emergency loop <NUM> may be interrupted by one or more contacts <NUM> which are actuated by one or more devices <NUM> which may request emergency braking of the train.

In the presence of events that require emergency braking, said one or more devices <NUM> open the one or more respective contacts <NUM>, thereby interrupting the emergency loop <NUM> and thus bringing the pneumatic solenoid valve <NUM> into its second state.

In this way, the pneumatic solenoid valve <NUM> pneumatically connects the brake pipe <NUM> to the atmosphere, i.e. brings the pressure in the brake pipe <NUM> to the value of nominal <NUM> bar, which corresponds to the pressure value of emergency braking.

In some non-exclusive cases, one or more devices <NUM> may coincide with a transceiver means <NUM> and/or with the brake control unit <NUM>.

Furthermore, the emergency loop <NUM> may be connected to the brake control unit <NUM> which, in the event of a signal <NUM> indicating a request for emergency braking request, i.e. a nonpowered signal, de-energizes the two pneumatic solenoid valves <NUM>, <NUM> to bring the pressure at the outlet <NUM> of the relay valve <NUM> to <NUM> bar, i.e. it further discharges the brake pipe through the relay valve.

Still further, the emergency loop <NUM> may be used to activate the contacts <NUM> in the presence of power, or to disactivate the contacts in the absence of power. In this way, in the absence of power to the signal <NUM>, the contacts <NUM> are positioned in the open condition, thereby de-energizing the two pneumatic solenoid valves <NUM>, <NUM> in order to bring the pressure at the outlet <NUM> of the relay valve <NUM> to <NUM> bar, i.e. to further discharge the brake pipe through the relay valve, in redundancy to the action performed simultaneously by the pneumatic solenoid valve <NUM>.

The action of bringing the pressure of the brake pipe <NUM> to the nominal value of <NUM> bar consequently implies applying the maximum braking pressure corresponding to <NUM> bar to the braking unit <NUM>.

As previously stated, the emergency braking function is required to be developed according to safety level SIL4.

In the prior art, the group of components including the pneumatic solenoid valve <NUM>, the signal <NUM>, the one or more devices <NUM>, the one or more respective contacts <NUM>, the contacts <NUM> and above all their integration constituting the emergency braking application function are developed according to the SIL4 safety level in accordance with the applicable European standards.

The braking application action performed by the integration of the group of components including the pneumatic solenoid valve <NUM>, the signal <NUM>, the one or more devices <NUM>, the one or more respective contacts <NUM> and the contacts <NUM> prevails over any action performed by said brake control unit <NUM>: this solution allows for the development of the brake control unit <NUM> not to exceed the safety level SIL2 according to the standards EN50128 and EN50129.

A pressure switch <NUM> is pneumatically connected to the brake pipe <NUM> and is arranged to generate an electrical command signal <NUM> connected to the traction control unit <NUM>.

When the pressure in the brake pipe <NUM> is greater than <NUM> bar, the pressure switch <NUM> provides power to the command signal <NUM>. When the pressure in the brake pipe <NUM> is equal to or less than <NUM> bar, the pressure switch <NUM> stops power to the command signal <NUM>.

An appropriate circuit <NUM> internal to the traction control unit <NUM> monitors the presence of power to the command signal <NUM>: said circuit <NUM> allows the traction control unit <NUM> to power the traction motors (not shown) when tension is detected on the command signal <NUM> and said circuit <NUM> prevents the traction control unit <NUM> from powering the traction motors (not shown) when no tension is detected on the command signal <NUM>.

This solution prevents the traction control system from powering the motors, i.e. from pulling the train <NUM>, in the presence of an emergency braking request.

In the prior art, the group of components including the pressure switch <NUM>, the command signal <NUM>, the appropriate circuit <NUM> and above all their integration constituting the traction inhibition function in the presence of emergency braking are developed according to the SIL4 safety level in accordance with the applicable European standards.

Growing needs to increase the capacity of rail traffic for the transport of goods requires more traction power. If a single locomotive <NUM> is unable to provide the necessary power, one or more locomotives are added to the train <NUM>.

In <FIG>, by way of non-exclusive example, a second locomotive <NUM> is added in an intermediate position in the train <NUM>. An additional locomotive <NUM> may be added at the end of the train <NUM> as an alternative to the locomotive <NUM> or in addition to the locomotive <NUM>. Further locomotives may be added to the train <NUM>. The further locomotives <NUM>, <NUM> are also provided with their own unit <NUM> for producing, filtering and storing compressed air, which unit is arranged to supply its own brake control unit <NUM> and is connected to the brake pipe <NUM>.

The further locomotives <NUM>, <NUM>, defined as slave locomotives, must be synchronized with the head locomotive <NUM>, defined as the master locomotive, in order to be able to correctly replicate the traction or braking actions performed by the master locomotive <NUM>. For this purpose, the master locomotive <NUM> and the one or more slave locomotives <NUM>, <NUM> communicate with one another by means of a radio communication channel <NUM> or a wired serial communication channel <NUM>. Internal to the master and slave locomotives, a transceiver means <NUM> is arranged to transmit and receive on the communication channel <NUM>, <NUM>. Internal to the master and slave locomotives, said transceiver means <NUM> communicates with the traction control unit <NUM> and with the brake control unit <NUM>, by means of an internal communication means <NUM> that includes, not exclusively, a serial communication channel.

<CIT> describes in detail a communication system between a master locomotive and one or more slave locomotives, and the impact on the operational safety of a train as shown in <FIG> if the radio channel is lost, and claims a method for mitigating the risks in said degraded mode.

A non-exclusive case of said degraded mode is represented by the event in which the master locomotive <NUM> applies emergency braking, simultaneously sends the request to apply the emergency braking to one or more slave locomotives <NUM>, <NUM>, and at the same time one or more slave locomotives <NUM>, <NUM>, currently in a condition in which the brake is not applied, do not receive the request to apply emergency braking, in which case the following sequence of situations occurs:.

The overall result is represented by a train <NUM> in an emergency braking situation where only the front portion of the train is actually able to apply the emergency braking, while the portion of the train near the one or more slave locomotives <NUM>, <NUM> remains in the release condition and the one or more slave locomotives <NUM>, <NUM> continue to push the train, creating a high risk condition of the train <NUM> derailing.

<CIT> claims to prevent the relay valve <NUM> belonging to the one or more slave locomotives <NUM>, <NUM> from supplying the pipe <NUM> if a communication channel <NUM> is lost. In this way, with due time, the pressure would be allowed to drop to <NUM> bar along the entire train, thereby preventing the risky situation described above.

<CIT> neither describes nor claims to which safety levels the devices and related software responsible for risk mitigation actions must be subjected.

It is clear from what has been previously described that the devices and related software responsible for risk mitigation actions, especially related to emergency braking, must be developed according to a SIL≥<NUM> level according to standards EN50128 and EN50129.

In this case, the brake control unit <NUM>, which is responsible for controlling the relay valve <NUM> and the pneumatic solenoid valves <NUM>, <NUM>, must be developed according to a SIL≥<NUM> level according to the standards EN50128 and EN50129.

Given the functional complexity, hardware and software of said brake control unit <NUM>, its development according to a SIL≥<NUM> level according to the standards EN50128 and EN50129 is extremely complex and uneconomical for the reasons set out above.

<CIT> discloses a method of adaptively determining a brake application level for signaling a remote locomotive of a train during a communication loss. <CIT> discloses a pneumatic braking system for a train consist comprising a lead locomotive and one or more remote locomotives. However, the problems mentioned above still remain unresolved.

The object of this invention is therefore that of providing a solution which may be simpler and less expensive to develop.

A further object is that of providing a solution in which, in an emergency braking situation, it is not only a front portion of the train that applies the emergency braking, so as to consequently reduce the risk of the train itself derailing.

The aforesaid and other objects and advantages are achieved, according to an aspect of the invention, by a control system for a railway convoy, particularly for the transport of goods, that has the features defined in claim <NUM>. Preferred embodiments of the invention are defined in the dependent claims, the content of which is to be understood as an integral part of this description.

The functional and structural features of some preferred embodiments of a control system for a railway convoy according to the invention will now be described. Reference is made to the appended drawings, in which:.

Before explaining in detail a plurality of embodiments of the invention, it should be clarified that the invention is not limited in its application to the design details and configuration of the components presented in the following description or illustrated in the drawings. The invention is capable of assuming other embodiments and of being implemented or constructed in practice in different ways. It should also be understood that the phraseology and terminology have a descriptive purpose and should not be construed as limiting. The use of "include" and "comprise" and their variations is to be understood as encompassing the elements set out below and their equivalents, as well as additional elements and the equivalents thereof.

<FIG> replicates the braking control system <NUM> that has been shown in <FIG> and previously described, with a new safety unit <NUM> added for the slave locomotives <NUM>, <NUM> in order to monitor and reinforce the safety functions.

The following describes a first embodiment of a control system for a railway convoy <NUM>, particularly for the transport of goods, comprising a plurality of wagons <NUM>, a master locomotive <NUM> placed at the head of the train <NUM> and at least one slave locomotive <NUM>, <NUM> distributed in the railway convoy <NUM>.

The railway convoy <NUM> comprises a brake pipe <NUM> for the service and emergency pneumatic braking of the railway convoy <NUM>. The brake pipe <NUM> extends along the entire railway convoy <NUM>.

The master locomotive <NUM> is arranged to control the pressure in the brake pipe <NUM> and to send traction and/or braking commands to the at least one slave locomotive <NUM>, <NUM> via a radio technology or wired technology communication channel <NUM>, <NUM>.

The at least one slave locomotive <NUM>, <NUM> comprises a transceiver means <NUM> arranged to receive the traction and/or braking commands sent by the master locomotive <NUM> through the communication channel <NUM>, <NUM>. The transceiver means <NUM> is also arranged to re-transmit the traction and/or braking commends to a traction control unit <NUM> and to a brake control unit <NUM> of the at least one slave locomotive <NUM>, <NUM> in order to control the pressure in the brake pipe <NUM>.

The transceiver means may be a transceiver device or transceiver system or transceiver unit or the like.

The traction and/or braking commands are re-transmitted by means of a communication means <NUM> internal to the at least one slave locomotive <NUM>, <NUM>.

The brake control unit <NUM> is arranged to control the pressure in the brake pipe <NUM> by acting on a first pneumatic solenoid valve <NUM> arranged to increase the pressure in a pilot chamber <NUM> of a relay valve <NUM> and on a second pneumatic solenoid valve <NUM> arranged to reduce the pressure in the pilot chamber <NUM> of said relay valve <NUM>.

An inlet of the relay valve <NUM> is arranged to be supplied by a main pipe <NUM> and an outlet of the relay valve <NUM> is arranged to be connected to the brake pipe <NUM>.

The control system for a railway convoy <NUM> includes a safety unit <NUM> associated with the brake control unit <NUM>.

This safety unit <NUM> is arranged to prevent the relay valve <NUM> from supplying the pneumatic brake pipe <NUM> when at least one malfunction condition of the control system for a railway convoy <NUM> occurs.

The at least one malfunction condition of the control system for a railway convoy <NUM> may comprise:.

The aforesaid conditions may clearly also occur simultaneously in any combination thereof.

The brake control unit <NUM> may be developed according to the safety level SIL≤<NUM> according to the standards EN50128 and EN50129 as described above. According to the invention, a safety unit <NUM> may therefore be added that is developed according to a SIL≤<NUM> level according to standards EN50128 and EN50129.

In a first embodiment, the safety unit <NUM> may be arranged to receive a diagnostic signal <NUM> generated by the transceiver means <NUM>. The diagnostic signal <NUM> may be arranged to have a first state in which it indicates that the transceiver means <NUM> is functioning correctly and that the communication with the one or more further locomotives belonging to the railway convoy <NUM> is considered to be established and functioning by the transceiver means <NUM>. The diagnostic signal <NUM> may be arranged to have a second state which indicates that the transceiver means <NUM> is not functioning correctly and that the communication with the one or more further locomotives belonging to the railway convoy <NUM> is not considered to be established and functioning by the transceiver means <NUM>.

The master locomotive <NUM> may send messages at a period T. In accordance with the recommendations of the standard EN50159, the messages sent by the master locomotive <NUM> contain a parameter that is indicative of the message being continuously updated by the master locomotive <NUM>, by way of non-exclusive example a counter which is increased by the master locomotive with each message.

The messages sent by the master locomotive <NUM> are received by the transceiver means <NUM> and immediately propagated therefrom to the brake control unit <NUM> and to the safety unit <NUM> through the communication means <NUM>.

To summarize the above, in the presence of at least one of the following cases:.

the safety unit <NUM> considers the global transmission channel, from the master locomotive <NUM> to the local communication channel <NUM> inclusive, to be malfunctioning, and therefore the safety unit <NUM> considers the brake control unit <NUM> to be unable to receive messages from the master locomotive <NUM>, including messages containing the emergency braking application request.

In a further embodiment, the control system for a railway convoy <NUM> for the transport of goods may further comprise a first pressure sensor means <NUM> arranged to be pneumatically connected to the pilot chamber <NUM> of the relay valve <NUM>. The brake control unit, the first pneumatic solenoid valve <NUM>, the second pneumatic solenoid valve <NUM>, the relay valve <NUM> and the first pressure sensor means <NUM> are arranged to perform a function for controlling the pressure in the brake pipe <NUM> of the railway convoy <NUM>.

The control function may be implemented according to known control algorithms based on the presence of a brake control unit, the first pneumatic solenoid valve <NUM>, the second pneumatic solenoid valve <NUM>, the relay valve <NUM> and the first pressure sensor means <NUM>.

In this case, the at least one malfunction condition of the control system for a railway convoy <NUM> may comprise a condition in which at least one of the first electro-pneumatic valve <NUM>, the second pneumatic solenoid valve <NUM>, the valve relay <NUM> and the first pressure sensor means <NUM> is not functioning correctly. In other words, the safety unit <NUM> may also be arranged to prevent the relay valve <NUM> from supplying the pneumatic brake pipe <NUM> when the safety unit detects that the pressure control function in the brake pipe <NUM> of said railway convoy <NUM> is not functioning correctly.

In a second embodiment, the safety unit <NUM> may be arranged to receive a diagnostic signal <NUM> generated by the brake control unit <NUM>. This diagnostic signal <NUM> may be arranged to have a first state in which it indicates that the brake control unit <NUM> is functioning correctly and is able to correctly control the pressure <NUM> at the outlet of the relay valve <NUM>. The diagnostic signal <NUM> may also be arranged to have a second state which indicates that the brake control unit <NUM> is not functioning correctly or is unable to correctly control the pressure <NUM> at the outlet of the relay valve <NUM>.

In fact, the diagnostic signal <NUM> may also be indicative of the state of health of the pneumatic solenoid valves <NUM>, <NUM>, the first pressure sensor means <NUM> and the relay valve <NUM>. Further pressure sensors (not shown in the drawings) that are connected to the brake control unit <NUM>, such as, by way of non-exclusive example, a further pressure sensor means connected directly to the brake pipe <NUM>, may provide further information to said brake control unit <NUM> about the functionality of the elements for controlling the pressure in the brake pipe <NUM>.

In a further embodiment, the control system for a railway convoy may comprise a second pressure sensor means <NUM> pneumatically connected to the brake pipe <NUM> and electrically connected to the safety unit <NUM> by means of an electrical signal <NUM>.

In each embodiment, the first pressure sensor means <NUM> and the second pressure sensor means <NUM> may each be a pressure sensor.

In this case, the safety unit <NUM> may be arranged for:.

The at least one malfunction condition of the control system for a railway convoy may therefore comprise a condition in which the pressure value indicated by the respective traction and/or braking command does not fall within the threshold range that includes the respective pressure value measured through said second pressure sensor means <NUM>.

In other words, if the pressure value read by the second pressure sensor means <NUM> coincides, within a predetermined tolerance value, with the pressure value received in the message sent by the master locomotive <NUM>, the safety unit considers the brake control unit <NUM> and the pneumatic chain composed of the solenoid valves <NUM>, <NUM>, the relay valve <NUM> and the first pressure sensor <NUM> to be functioning correctly.

If the pressure value read by the second pressure sensor means <NUM> falls outside a predetermined tolerance value with respect to the pressure value received in the message sent by the master locomotive <NUM>, the safety unit considers the brake control unit <NUM> and the pneumatic chain composed of the solenoid valves <NUM>, <NUM>, the relay valve <NUM> and the first pressure sensor means <NUM> to not be functioning correctly.

In a further embodiment, the safety unit <NUM> may be arranged for:.

The at least one malfunction condition of the control system for a railway convoy may therefore comprise a condition in which the value measured by the second pressure sensor means <NUM> does not fall within the threshold range including the respective pressure value indicated by the respective traction and/or braking command sent by the master locomotive <NUM> to the at least one slave locomotive.

the safety unit <NUM> considers the brake control unit <NUM>, the pneumatic solenoid valves <NUM>, <NUM>, the relay valve <NUM> and the first pressure sensor means <NUM> to be malfunctioning, i.e. not able to correctly control the pressure at outlet <NUM> of the relay valve <NUM>, in particular during an emergency braking request.

In a further embodiment, the safety unit <NUM> may be arranged to prevent the relay valve <NUM> from supplying the brake pipe <NUM> by means of a pneumatic solenoid valve <NUM> placed between the main pipe <NUM> and the pneumatic inlet of said relay valve <NUM>. The pneumatic solenoid valve <NUM> may be arranged to assume a first state in which it inhibits the propagation of the pneumatic supply pressure from the main pipe <NUM> to the pneumatic inlet of said relay valve <NUM>, and to assume a second state in which it allows the propagation of the pneumatic supply pressure from the main pipe <NUM> to the pneumatic inlet of said relay valve <NUM>. The safety unit <NUM> may therefore be arranged to drive the pneumatic solenoid valve <NUM> in its first state when it must prevent the relay valve <NUM> from supplying the brake pipe <NUM>.

In other words, the safety unit <NUM> may be arranged to actuate the open or closed state of the pneumatic solenoid valve <NUM> by means of the electrical command signal <NUM>. By actuating the pneumatic solenoid valve <NUM> in the open condition, the safety unit <NUM> allows the pneumatic solenoid valve <NUM> to be able to increase the pressure in the pilot chamber <NUM>, i.e. it allows the relay valve <NUM> to increase the pressure in the brake pipe <NUM>. By actuating the pneumatic solenoid valve <NUM> in the closed condition, the safety unit <NUM> prevents the pneumatic solenoid valve <NUM> from being able to increase the pressure in the pilot chamber <NUM>, i.e. it prevents the relay valve <NUM> from increasing the pressure in the brake pipe <NUM>. Said safety unit <NUM> is arranged to actuate the open or closed state of the pneumatic solenoid valve <NUM> by means of the electrical command signal <NUM>. By actuating the pneumatic solenoid valve <NUM> in the open condition, the safety unit <NUM> allows the inflow of air from the main pipe <NUM> to the relay valve <NUM>, thereby allowing the relay valve <NUM> to increase the pressure in the brake pipe <NUM>. By actuating the pneumatic solenoid valve <NUM> in the closed condition, the safety unit <NUM> prevents the inflow of air from the main pipe <NUM> to the relay valve <NUM>, thereby preventing the relay valve <NUM> from increasing the pressure in the brake pipe <NUM>. The safety unit <NUM> is arranged to control the open or closed state of the pneumatic solenoid valve <NUM> by means of the electrical command signal <NUM>. By actuating the pneumatic solenoid valve <NUM> in the open condition, the safety unit <NUM> allows the relay valve <NUM> to function properly in controlling the pressure in the brake pipe <NUM>. By actuating the pneumatic solenoid valve <NUM> in the closed condition, the safety unit <NUM> isolates the relay valve <NUM>, i.e. it prevents the relay valve <NUM> from increasing or decreasing the pressure in the brake pipe <NUM>.

<FIG> illustrates further solutions for being able to inhibit the relay valve <NUM> from producing pressure variations on the brake pipe <NUM>.

The safety unit <NUM> may preferably be arranged to prevent the relay valve <NUM> from supplying the brake pipe <NUM> by means of a first electro-pneumatic module <NUM>. The first electro-pneumatic module <NUM> may include a first pneumatic inlet connected to the main pipe <NUM>, a second pneumatic inlet connected to the brake pipe <NUM> and a pneumatic outlet connected to the inlet of said relay valve <NUM>. The first electro-pneumatic module may be arranged for:.

In this case, the safety unit <NUM> may be arranged to drive the first electro-pneumatic module <NUM> in its second state when it must prevent the relay valve <NUM> from supplying and discharging the brake pipe <NUM>.

In one realization example, the safety unit <NUM> may be arranged to control the state of the first electro-pneumatic module <NUM> by means of the electrical command signal <NUM>. In a first state, the electro-pneumatic module <NUM> may pneumatically connect the inlet of the relay valve <NUM> to the main pipe <NUM>, thereby allowing the relay valve <NUM> to increase the pressure at its outlet <NUM>, i.e. at the brake pipe <NUM>. In a second state, the first electro-pneumatic module <NUM> may pneumatically connect the inlet of the relay valve <NUM> to the brake pipe <NUM>, making the supply inlet coincide with the outlet of the relay valve <NUM>, thereby preventing the relay valve <NUM> from producing pressure variations at its outlet <NUM>, i.e. at the brake pipe <NUM>.

Preferably, in addition or as an alternative to the first electro-pneumatic module <NUM>, the safety unit <NUM> may be arranged to prevent the relay valve <NUM> from supplying and discharging the brake pipe <NUM> by means of a second electro-pneumatic module <NUM>. The second electro-pneumatic module <NUM> may include a first pneumatic inlet connected downstream of the first pneumatic solenoid valve <NUM> arranged to increase the pressure in the pilot chamber <NUM> of said relay valve <NUM> and downstream of the second pneumatic solenoid valve <NUM> arranged to reduce the pressure in the pilot chamber <NUM> of said relay valve <NUM>, a second pneumatic inlet connected to the brake pipe <NUM>, and a pneumatic outlet connected to the pilot chamber <NUM> of said relay valve <NUM>. The second electro-pneumatic module may be arranged for:.

In this case, the safety unit <NUM> may be arranged to drive said second electro-pneumatic module <NUM> in its second state when it must prevent the relay valve <NUM> from supplying and discharging the brake pipe <NUM>.

In one realization example, the safety unit <NUM> may be arranged to control the state of the second electro-pneumatic module <NUM> by means of an electrical command signal <NUM>. In a first state, the second electro-pneumatic module <NUM> may pneumatically connect the pilot chamber <NUM> to the pneumatic solenoid valves <NUM>, <NUM> and to the first pressure sensor means <NUM>, thereby allowing the brake control unit <NUM> to regularly control the pressure at the outlet <NUM> of the relay valve <NUM>, i.e. at the brake pipe <NUM>. In a second state, the second electro-pneumatic module <NUM> pneumatically connects the pilot chamber <NUM> to the brake pipe <NUM>, making the control inlet coincide with the outlet of the relay valve <NUM>, thereby preventing the relay valve <NUM> from producing pressure variations at its outlet <NUM>, i.e. at the brake pipe <NUM>.

In a further aspect, the safety unit <NUM> may be arranged to generate a command signal <NUM> for actuating the contact <NUM>. By actuating said contact <NUM> in a closed position, the safety unit <NUM> allows the traction control unit <NUM> to operate according to the state assumed by the electrical control signal <NUM>, or by the pressure switch <NUM>, as described above. By actuating said contact <NUM> in an open position, the safety unit <NUM> brings the electrical control signal into the condition in which it inhibits traction torque being applied to the traction control unit <NUM>.

The safety unit <NUM> may be arranged to generate a command signal <NUM> for controlling the contact <NUM>. By actuating said contact <NUM> in the open position, the safety unit <NUM> interrupts the emergency loop <NUM> by bringing the pneumatic emergency solenoid valve <NUM> into the state in which it connects the brake pipe <NUM> to the atmosphere, thereby reducing the pneumatic pressure in the brake pipe <NUM> to <NUM> bar.

Furthermore, interrupting the emergency loop <NUM> opens the contacts <NUM> by de-powering the pneumatic solenoid valves <NUM>, <NUM>, thereby forcing the relay valve <NUM> to reduce the pneumatic pressure in the brake pipe <NUM> to <NUM> bar, in an action parallel to the emergency valve <NUM>.

In yet a further embodiment, the safety unit <NUM> may be arranged to be able to prevent the relay valve <NUM> from supplying and discharging the brake pipe <NUM> by means of a pneumatic solenoid valve <NUM> located between the outlet <NUM> of the relay valve <NUM> and the brake pipe <NUM>. The pneumatic solenoid valve <NUM> may be arranged to have a first state in which it inhibits the pneumatic connection between the outlet <NUM> of the relay valve <NUM> and the brake pipe <NUM>. The pneumatic solenoid valve is arranged to have a second state in which it allows the connection between the outlet <NUM> of the relay valve <NUM> and the brake pipe <NUM>. The safety unit <NUM> may drive the pneumatic solenoid valve <NUM> in its first state in order to be able to prevent the relay valve <NUM> from supplying and discharging the brake pipe <NUM>.

Moreover, in a further embodiment, the safety unit <NUM> may be arranged to control a pneumatic emergency solenoid valve <NUM> pneumatically connected to the brake pipe <NUM>. The pneumatic emergency solenoid valve <NUM> may be arranged to assume a first state in which it inhibits the pneumatic connection between the brake pipe <NUM> and the atmosphere, and to assume a second state in which it allows the pneumatic connection between the brake pipe <NUM> and the atmosphere. The safety unit <NUM> may be arranged to actuate said pneumatic emergency solenoid valve <NUM> in its second state in the presence of a request for application of emergency braking from the master locomotive <NUM>.

In yet a further embodiment, the safety unit <NUM> may be arranged to control a pneumatic emergency solenoid valve <NUM> pneumatically connected to the brake pipe <NUM>. The pneumatic emergency solenoid valve <NUM> may be arranged to assume a first state in which it inhibits the pneumatic connection between the brake pipe <NUM> and the atmosphere, and to assume a second state in which it allows the pneumatic connection between the brake pipe <NUM> and the atmosphere. The safety unit <NUM> may be arranged to actuate the pneumatic emergency solenoid valve <NUM> in its second state when the communication channel <NUM>, <NUM> and the communication means <NUM>, i.e. the global communication channel <NUM>, <NUM>, <NUM>, <NUM>, are not functioning correctly and/or in the presence of a pressure variation in the brake pipe <NUM>, which variation indicates emergency braking in progress.

In light of the embodiments and examples described above, in at least one of the following cases:.

said safety unit <NUM> may prevent the relay valve from increasing the pressure in the brake pipe <NUM> by performing at least one of the following actions:.

The solution described above advantageously prevents the one or more slave locomotives <NUM>, <NUM> from hindering the master locomotive <NUM> from applying braking, particularly emergency braking along the railway convoy <NUM> if, for at least one of the reasons listed above, the brake control unit <NUM> associated with said one or more slave locomotives is unable to replicate the braking command, particularly emergency braking.

In the presence of an emergency braking request issued by the master locomotive <NUM> and received by the safety unit <NUM> at the same time as the brake control unit <NUM>, said safety unit opens the contact <NUM>, de-energizing the emergency valve <NUM> and making it assume its second state in which it allows the pneumatic connection between the brake pipe <NUM> and the atmosphere, thereby applying emergency braking. Furthermore, opening the contact <NUM> results in the de-energization of the pneumatic solenoid valves <NUM>, <NUM>, with consequent discharge of the brake pipe <NUM> by the relay valve <NUM>.

If globally the communication channel is not able to transmit the emergency braking request from the master locomotive <NUM> to the brake control unit <NUM> or safety unit <NUM> associated with the at least one slave locomotive <NUM>, <NUM>, the safety unit <NUM> is able to identify that the application of emergency braking is in progress by observing the behavior of the pressure variations in the brake pipe <NUM> by means of the second pressure sensor means <NUM> and using suitable algorithms described in <CIT>.

When emergency braking is in progress, the safety unit <NUM> may for example open the contact <NUM> by means of the signal <NUM>, thereby locally replicating emergency braking according to the procedure described above, or according to the procedure described in <CIT>.

This solution advantageously accelerates the application of emergency braking by contributing to the rapid reduction of the pressure in the brake pipe <NUM>, even when the communication channel is unable to transmit the emergency braking request to the brake control unit <NUM>, or when the brake control unit <NUM> is unable to reduce the pressure in the brake pipe <NUM> by means of the relay <NUM>.

When emergency braking is in progress, the safety unit <NUM> may for example open the contact <NUM> by means of the signal <NUM>, thereby preventing the traction control unit <NUM> from powering the traction motors.

This solution advantageously accelerates the inhibition of the traction unit <NUM> in advance of the pressure switch <NUM> intervening (which would intervene only when the pressure in the brake pipe has dropped below <NUM> bar), thereby reducing the longitudinal stresses on the railway convoy <NUM>.

By comparison with <CIT>, this invention offers the advantage of separating the functions of normal braking operation, communication with the TCMS (train control monitoring system) and interfacing with the driver, which functions are carried out, according to the prior art, by the brake control unit <NUM>, from the functions of monitoring and guaranteeing emergency braking, which are assigned to the safety unit <NUM>. Separating the functions makes it possible to maintain the development of the brake control unit <NUM> at a safety level SIL≤<NUM>, and to localize developing the appropriate safety level SIL ≥<NUM> on the safety unit <NUM>, thereby reducing the impact of cost of development.

A further advantage of this invention is that it is possible to update the technology of existing locomotives for distributed traction functionality, as illustrated in <FIG>.

It is in fact sufficient to add a safety unit <NUM> and an appropriate transceiver means <NUM> to the braking system present on the current locomotives illustrated in <FIG>, and to make limited changes to the electrical part of the system, without having to intervene on the pneumatic part as illustrated in many of the previously reported solutions, or without having to re-develop the hardware and software components of the brake control unit <NUM> at SIL≥<NUM> level.

The safety unit <NUM> may be developed according to a safety level higher than the safety level of the associated brake control unit <NUM>. For example, the safety unit <NUM> may be developed according to a safety integrity level SIL ≥<NUM>.

The safety unit <NUM> may be made according to an architecture including one or more microprocessors, or according to an architecture including one or more programmable devices, or according to an architecture including one or more programmable devices and one or more microprocessors.

Claim 1:
Control system for a railway convoy (<NUM>), particularly for the transport of goods, comprising a plurality of wagons (<NUM>), a master locomotive (<NUM>) placed at the head of the railway convoy (<NUM>) and at least one slave locomotive (<NUM>, <NUM>) distributed in the railway convoy (<NUM>);
the railway convoy (<NUM>) comprising a brake pipe (<NUM>) for the service and emergency pneumatic braking of said railway convoy (<NUM>), the brake pipe (<NUM>) extending along the entire railway convoy (<NUM>);
wherein:
- the master locomotive (<NUM>) is arranged to control the pressure in the brake pipe (<NUM>) and to send traction and/or braking commands to said at least one slave locomotive (<NUM>, <NUM>) by means of a radio technology or wired technology communication channel (<NUM>) (<NUM>),
- the at least one slave locomotive (<NUM>, <NUM>) comprises a transceiver means (<NUM>) arranged to receive the traction and/or braking commands sent by the master locomotive (<NUM>) through the communication channel (<NUM>, <NUM>), said transceiver means (<NUM>) being further arranged to re-transmit, by means of a communication means (<NUM>) internal to said at least one slave locomotive (<NUM>, <NUM>), the traction and/or braking commands to a traction control unit (<NUM>) and to a brake control unit (<NUM>) of said at least one slave locomotive (<NUM>, <NUM>) in order to control the pressure in the brake pipe (<NUM>);
the brake control unit (<NUM>) being arranged to control the pressure in the brake pipe (<NUM>) by acting on a first pneumatic solenoid valve (<NUM>) arranged to increase the pressure in a pilot chamber (<NUM>) of a relay valve (<NUM>) and on a second pneumatic solenoid valve (<NUM>) arranged to reduce the pressure in the pilot chamber (<NUM>) of said relay valve (<NUM>);
an inlet of said relay valve (<NUM>) being arranged to be supplied by a main pipe (<NUM>) and an outlet of said relay valve (<NUM>) being arranged to be connected to said brake pipe (<NUM>);
the control system for a railway convoy (<NUM>) being characterized in that it includes a safety unit (<NUM>) associated with said brake control unit (<NUM>), said safety unit (<NUM>) being arranged to prevent the relay valve (<NUM>) from supplying the brake pipe (<NUM>) when at least one malfunction condition of the control system for a railway convoy (<NUM>) occurs.