Train safety is an important issue in the United States and throughout the world. This is true for both passenger trains and for freight trains. Although movement of a train can be directed by a computerized train system in some instances, the movement of the vast majority of trains is directed by a human operator. Reliance on a human operator necessarily creates the possibility of mistakes being made by that operator, and these mistakes can and often do lead to unsafe conditions and, in the worst case, accidents and loss of life and property.
One aspect of train safety is ensuring that trains do not exceed maximum allowable speeds. Maximum allowable speeds can include: 1) upper limits on train speed that may be applicable throughout an entire rail system; 2) permanent maximum speed limits applicable to a certain specific sections of track; and 3) temporary speed restrictions that may be applicable throughout an entire rail system (e.g., a lower speed on hot summer days when there is a possibility of track buckling) or a portion of a rail system (e.g., a restriction on a particular section of track that is undergoing repairs).
A second aspect of train safety is avoiding collisions between trains. Train operators are typically authorized by a signaling system or a dispatcher to move a train from one area (sometime referred to in the art as a “block”) to another. The operator is expected to move the train in only those areas for which the train has been authorized to travel. When an operator moves a train outside an authorized area, the possibility that the train may collide with another train that has been authorized to move in the same area arises.
Concern over operator error in complying with speed restrictions and limits on authorized movement has led to a number of systems that attempt to prevent such operator errors. Early versions of such systems, such as the cab signal system, involve the transmission of signal information into a locomotive via a signal transmitted over an electrical power line through which the train receives electrical power for movement. Such systems will take preventive action (e.g., a “penalty” brake application) when the train is moving outside the authorized area. However, this can lead to unsafe conditions because the preventive action does not occur until after the authorized movement limit has been violated.
Other, more sophisticated systems, such as the TRAIN SENTINEL™ system marketed by the assignee of this application, Quantum Engineering, Inc., anticipate when a train will violate a limit on a movement authorization or exceed a speed limit, and take preventive action prior to a violation to ensure that the limit on a movement authorization or the speed limit is not violated. However, this system requires significant onboard computing capability.
An important issue with such train control systems is whether or not they are sufficiently reliable. A relevant industry standard is the IEEE 1483 “Standard for Verification of Vital Functions in Processor-Based Systems Used in Rail Transit Control.” This standard includes a definition of what is necessary for a train control system to be considered as “vital.”
The present invention will be discussed with reference to preferred embodiments of end of train units. Specific details, such as types of positioning systems and time periods, are set forth in order to provide a thorough understanding of the present invention. The preferred embodiments discussed herein should not be understood to limit the invention. Furthermore, for ease of understanding, certain method steps are delineated as separate steps; however, these steps should not be construed as necessarily distinct nor order dependent in their performance.
In one aspect of the invention, a speed profile is constructed for an entire train trip. The speed profile includes a maximum allowable speed at which the train is allowed to travel at each point of the entire trip, taking into account the ability of the train to comply with speed reductions encountered during the trip. At points in the trip in which the train's speed must be reduced (e.g., at the end point of the trip or at a point in the trip at which a temporary speed restriction results in a decrease of the maximum allowable speed), the speed profile does not simply make a sharp transition at the point in which reduced speed becomes effective. Rather, the speed in the speed profile gradually reduces from the higher speed to the lower speed starting at a point at which the train must begin braking in order to be traveling at the lower speed when the train reaches the point at which the lower speed limit becomes effective. The speed profile may also be lower than a maximum allowable speed in areas of track corresponding to steep downhill grades where a train's brakes may not have sufficient capacity to prevent a train traveling at a maximum allowable speed on an upper portion of a downhill grade from accelerating above the maximum allowable speed on a lower portion of the downhill grade. At the end of the trip, the speed profile gradually decreases to zero to ensure that the train is at zero speed (i.e., the train is stopped) prior to reaching the limit of its authority.
The braking curves (the portions of the speed profile during which the speed is gradually reduced from a higher speed to a lower speed) may be calculated using any method known in the art. In some embodiments, a worst case assumption is made for the weight and speed of the train, the number of cars on the train, the types of brakes on the cars, and the elevation and the grade of the track on which the train is traveling. In other embodiments, one or more sensors are used in order to determine more accurate values for these braking curve parameters. The weight of the train may be entered by the operator at the start of the trip. The speed of the train may be determined through use of a rotation sensor/tachometer attached to an axle or wheel of the train. The grade of the track may be determined through use of a GPS system or rotation sensor dead reckoning system to determine the location of the train coupled with a track database that uses position as an index to return a track grade corresponding to the index.
At a point in the trip at which the maximum allowable speed increases, the speed profile makes a sharp change in some embodiments, which allows the train to accelerate at its maximum allowable rate. In other embodiments, the speed profile may rise gradually from the lower speed to the higher speed, which in effect limits the rate at which the operator can accelerate the train. One reason for doing this is to encourage the operator to conserve fuel by avoiding rapid accelerations.
It is important to ensure that the speed profile is vital. There are several methods that can be used to accomplish this. One method, which is particularly useful in embodiments in which the computing power of the control system onboard the locomotive is limited, is to generate the speed profile on multiple wayside computers, cross check the speed profiles generated on these multiple computers with each other, and then transmitting the verified speed profile to the control system on the locomotive in a vital manner.
In addition to ensuring that the speed profile is vital, it is also necessary to ensure that a vital control system is in place to enforce compliance with the speed profile. In a preferred embodiment, the control system utilizes vital circuits such as those described in U.S. Pat. Nos. 4,368,440 and 3,527,986 to ensure that a signal from a respective axle drive speed sensor is functioning correctly. The speed sensors provide a signal that is indicative of a speed of the train, which can be compared to a maximum allowable speed as indicated by the flight plan discussed above. Preferably, two separate axle drive speed sensors are utilized, each on a different axle.
The results from the axle drives are correlated to each other and against a speed indicated by or derived from a GPS receiver using two redundant speed comparators. The GPS receiver signal is preferably determined to be vital using one or more of the methods described in co-pending U.S. patent application Ser. No. 11/835,050, filed Aug. 7, 2007 and entitled “METHODS AND SYSTEMS FOR MAKING A GPS SIGNAL VITAL,” which is incorporated in its entirety by reference herein.
If the speed of the train is determined to exceed the speed profile, corrective action is taken. This corrective action can include warnings to the operator and, if the operator does not act in response to the warnings, can also include an emergency brake activation. An emergency brake activation may be accomplished using, for example, a P2A valve as is known in the art. Such valves are vital in that electrical power must be applied to the valve in order to keep the valve closed to prevent an emergency brake application. In this manner, any disruption to the power supply to the P2A valve results in an emergency brake application. In some embodiments, a voltage not in use elsewhere on the train is used to supply power to the P2A valve. The power supply may be under control of redundant watchdog timers configured such that the absence of a signal from the speed comparator circuits prior to the expiration of a timeout period will result in the disabling of the power supply, which in turn will deenergize the P2A valve thereby triggering an emergency brake application.
Each of the axle drive sensors 100, 200 is preferably connected to a respective vital circuit 101, 201. The function of the vital circuits 101, 201 is to ensure to the extent possible that the sensors are operating correctly. The primary concern with the sensors 100, 200 is that they do not erroneously indicate a zero speed or a speed lower than the true speed. Indications of speeds in excess of the true speed are undesirable because they may result in unnecessary emergency brake applications or may require the train operator to operate the train more slowly than necessary, but false indications of speeds in excess of the true speed are tolerable because they will not result in an unsafe situation as would false zero speeds. In embodiments in which the sensors 100, 200 are of the axle generator type, vital circuits such as those described in U.S. Pat. No. 4,368,440, 4,384,250, or 3,527,986, or other vital circuits may be used (those of skill in the art will recognize that other types of circuits are used with other types of sensors such as the optical sensors discussed above). Such circuits pass an alternating current signal from an oscillator through the stator of the axle drive generator to determine whether the axle drive stator is good. These circuits cannot ensure that the mechanical connections from the sensor to the axle and from the axle to the wheel are intact, but this is accounted for by the use of two separate axle sensors on two different axles and by correlation of the axle sensor signals with the additional vital GPS signal as discussed above.
The speeds indicated by the sensors 100, 200 are each input to each of two redundant speed comparators 300, 301. The speed comparators 300, 301 are preferably implemented using microprocessors or other data processing elements. The microprocessor in speed comparator 300 is preferably of a different type, and preferably from a different manufacturer, than the microprocessor in speed comparator 301. Also input to the speed comparators 300 and 301 is a vital GPS signal from GPS vitality circuit 500. The GPS vitality circuit 500 is connected to two GPS receivers 501 and 502. The GPS vitality circuit 500 may be implemented using a microprocessor or other data processing circuit, and may include a memory for storing a track database as described in the above-referenced co-pending commonly owned U.S. patent application Ser. No. 11/835,050. The GPS vitality circuit 500 may be a implemented on the same microprocessor as one of the speed comparator circuits 300, 301 or may be implemented on a separate microprocessor. A memory (e.g., a magnetic disk storage device or other memory, preferably but not necessarily non-volatile) 400 with the speed profile is also connected to each of the speed comparators 300, 301.
The speed comparators 300, 301 ensure that the speeds indicated by each of the axle sensors 100, 200 and the speed from the GPS vitality circuit 500 are correlated. In some embodiments, this is done by simply comparing the speeds and ensuring that they are within an acceptable error of each other. In other embodiments, more sophisticated methods are used. These methods may include accounting for areas in which wheel slippage may occur (e.g., where the grade of the track is significant) such that excessive speeds from one of the axle sensors 100, 200 do not trigger an error. If the speeds from any of the three speed inputs do not correlate, corrective action is taken. In some embodiments, the corrective action may include warning the operator that there is an apparent malfunction and, if the operator does not respond, initiating an emergency brake application. Other forms of corrective action may also be used, and some embodiments include track databases that indicate areas in which the GPS receiver is unable to receive transmissions from the GPS satellites.
The speed comparators 300, 301 also determine a calculated train speed using the inputs from the axle sensors 100, 200 and the GPS vitality circuit 500 and compare this calculated train speed to the speed profile in the memory 400. If the calculated train speed exceeds the speed from the speed profile corresponding to the present position of the train, corrective action is taken. (The present position of the train may be determined in any number of ways, including by using the position reported by the GPS receivers 501, 502, by integrating speed from the axle sensors 100, 200, through the use of a transponder system, or any combination of the foregoing. The aforementioned U.S. patent application Ser. No. 11/835,050 includes several methods that may be utilized to determine train position accurately.) In some embodiments, the corrective action includes warning the operator and, if the train speed is not reduced below the corresponding speed in the speed profile, an emergency brake application is triggered as described below.
The speed comparators 300, 301 must each send a periodic reset to a corresponding one of two watchdog timers 302, 303 to prevent them from timing out. The watchdog timers 302, 303 may be implemented as simple counters in some embodiments. This message is preferably transmitted at short intervals, such as every 10 milliseconds. If either of the watchdog timers 302, 303 fails to receive one of these periodic reset pulses from the corresponding speed comparators 300, 301, a timeout occurs resulting in an interruption of power from the power supply 705 to the P2A valve 600, thereby triggering an emergency brake application. In the event that one of the speed comparators 300, 301 determines that the operator has failed to reduce the speed of the train to a speed below the corresponding speed from the speed profile, the speed comparator 300, 301 initiates an emergency brake application by not sending a reset pulse to the corresponding watchdog timer 302, 303.
Each of the watchdog timers 302, 303 is connected to a power supply 705. If either of the watchdog timers 302, 303 signals the power supply that it has timed out (which may be due to a failure of one of the speed comparators 300, 301 or may be because the operator has not reduced the speed of the train to the allowable speed indicated by the speed profile), the power supply 705 is configured to interrupt the supply of power to the P2A valve 600 to cause an emergency brake application. In some embodiments, the power supply 705 is configured to produce a unique voltage not used elsewhere on the train to reduce the possibility that a short results in the unintended application of power to the P2A valve 600.
As discussed above, the speed profile is stored in the memory 400. Calculating the speed profile and storing it in the memory is accomplished in a number of different ways in various embodiments, one of which is illustrated in the system 20 of
As discussed above, the speed profile includes a maximum allowable speed for the train along each point of the trip, and this maximum allowable speed may be less than the posted maximum allowable speed. Preferably, the wayside processors 450, 460 are manufactured by different manufacturers and are preferably running different software. The speed profiles calculated by each of the two wayside processors 450, 460 are compared to each other by the wayside integration processor 470. If the two speed profiles do not match, an error is declared. If the two speed profiles do match, one of the speed profiles is transmitted in a message via the wayside transceiver 480 to a transceiver 420 onboard the train. The message received by the onboard transceiver 420 is processed by an onboard processor 410. This processing includes, at a minimum, verifying that the checksum for the message is correct by an onboard processor 410 (which may be a separate processor or may be performed by one of the other processors discussed above in connection with
A particular embodiment of a vital system for ensuring that a train does not exceed a maximum allowable speed as it moves along a track has been shown above. Those of skill in the art will recognize that numerous variations on the embodiment shown above are possible. Such variations include using less than all of the redundancy discussed above. For example, alternative embodiments may use a single GPS receiver rather than two GPS receivers, or a single axle sensor rather than two axle sensors. Different types of components may also be used (e.g., inertial navigation systems rather than GPS receivers, or optical axle sensors rather than electromagnetic axle drive generators). A single watchdog timer driven be each of the speed comparator circuits is employed in some embodiments. In yet other embodiments, a single speed comparator is utilized. It will be apparent to those of skill in the art that numerous other variations in addition to those discussed above are also possible. Therefore, while the invention has been described with respect to certain specific embodiments, it will be appreciated that many modifications and changes may be made by those skilled in the art without departing from the spirit of the invention. It is intended therefore, by the appended claims to cover all such modifications and changes as fall within the true spirit and scope of the invention.
Furthermore, the purpose of the Abstract is to enable the U.S. Patent and Trademark Office and the public generally, and especially the scientists, engineers and practitioners in the art who are not familiar with patent or legal terms or phraseology, to determine quickly from a cursory inspection the nature and essence of the technical disclosure of the application. The Abstract is not intended to be limiting as to the scope of the present invention in any way.