[0001] The present invention concerns an oil-hydraulic control unit for controlling railway
switches of a railway track and a method for performing a safety check on an oil-hydraulic
control unit.
[0002] A switch includes two blades lying between diverging outer rails (the stock rails).
The switch can be moved laterally into one of two positions to direct a train coming
from the blades toward a straight path or a diverging path.
[0003] The blades can be moved together one with respect to the other between two extreme
positions. In the so called normal position, a blade is in contact with the rail directly
adjacent to said blade and the other blade is spaced apart from the rail adjacent
thereto. In this case, a train keeps a straight travel. On the contrary, in the so
called reverse position, a blade is in a position adhering to the associated rail
and the other blade is spaced apart from the rail adjacent thereto. In this case,
a train would be diverged from the straight direction into a lateral branch.
[0004] Prior art switches are commonly provided with sensors used for verifying that the
blades have reached the proper normal or reverse position at the end of each maneuver.
These sensors are usually monitoring contacts arranged for closing monitoring circuits
so that monitoring signals are generated. The monitoring signals are finally transmitted
or read by a remote control unit which controls the switch operations.
[0005] Oil-hydraulic actuators have been used in the last years in switches for moving the
blades, and they are controlled by oil-hydraulic control units. In particular, the
oil-hydraulic actuators receive pressurized oil from the oil-hydraulic control unit
through a hydraulic circuit.
[0006] A common oil-hydraulic control unit comprises a pump and a device to direct the flood
of oil. Prior art discloses also a reversible pump for feeding the hydraulic circuit
of the switch thus allowing displacement of the blades from a normal to a reverse
position and vice versa through the actuators. The reversible pump is actuated by
an electric motor controlled from the remote control unit.
[0007] It is known that a safety control has to be performed on an oil-hydraulic control
unit in order to check its operation: the so called SIL-4 level (Safety Integrity
Level) has to be reached in order to fulfill the safety requirements required for
transportation networks and systems. In particular, it is necessary to control the
maximum pressure value of the oil sent to the actuators, the actuators producing a
force for moving the blades which is function of this pressure. The safety control
must therefore check that the oil-hydraulic control unit does not send to the switch,
oil having a pressure greater than a predetermined threshold.
[0008] In prior art oil-hydraulic control units the safety control on the pressure of the
oil transmitted to the actuators is performed through electronic sensors, which send
corresponding control signals to the remote control unit.
[0009] When both the monitoring signals coming from the switch and the control signals coming
from the oil-hydraulic control unit indicate that the maneuver has been correctly
performed, the remote control unit allows the passage of the train.
[0010] However, the safety control performed in the prior art switches is not enough reliable
and presents risk of errors.
[0011] Document
EP 2418135 discloses an oil-hydraulic control unit of known type. Figure 1 shows a block diagram
of an oil-hydraulic control unit 1 of the above-disclosed type connected to a remote
control unit 2 arranged for sending to the oil-hydraulic control unit 1 an activation
signal for moving the blades of a switch in a predetermined position (normal or reverse)
in order to control the switch operations.
[0012] The oil-hydraulic control unit 1 comprises an electric motor 4 arranged for controlling
a pump 6 arranged in turn for sending oil to a pressure regulation unit 8, this oil
being usually stocked in a reservoir (not showed) placed within the oil-hydraulic
control unit 1.
[0013] The pressure regulation unit 8 is arranged for pressuring the oil and sending it
to a switch 10.
[0014] The oil-hydraulic control unit 1 further comprises a timing unit 12, in particular
a cylinder, connected to the pressure regulation unit 8 and arranged for cutting the
power to the electric motor 4 when the switch operation has finished, and for closing
control contacts 14 so that corresponding control signals are sent to the remote control
unit 2 indicating that the oil-hydraulic control unit 1 has correctly ended its operations,
regardless to the correct position of blades, which will be monitored by actuators.
[0015] The above disclosed system is based on an hydraulic system to pilot the switch 10.
The pressure regulation unit 8 increases the hydraulic pressure in the hydraulic circuit
feeding the switch 10 in order to move the actuators of the switch 10, and therefore
its blades, so as to reach a final desired position. In case of presence of an obstacle
on the railway track, the hydraulic system makes the pressure in the hydraulic circuit
increase until the timing unit 12 cuts the power to the electric motor 4 and switches
the control contacts 14.
[0016] Anyway, this solution limits only the period of time in which the actuators receive
the maximum pressure from the power pack, but it doesn't limit the level of pressure
transmitted to the switch in case of failures of limitation valves.
[0017] One object of the present invention is therefore to provide an oil-hydraulic control
unit which is capable to guarantee a safety functioning of a driven switch with a
high level of safety and to limit the risks of errors.
[0018] A further object of the present invention is to provide an innovative method for
performing a reliable safety check on an oil-hydraulic control unit.
[0019] These and other objects are achieved by an oil-hydraulic control unit having the
characteristics defined in claim 1, and by a method for performing a safety check
on an oil-hydraulic control unit having the characteristics defined in claim 6.
[0020] Preferred embodiments of the invention are the subject matter of the dependent claims,
whose content is to be understood as forming an integral part of the present description.
[0021] Further characteristics and advantages of the present invention will become apparent
from the following description, provided merely by way of non-limiting example, with
reference to the enclosed drawings, in which:
- Figure 1 shows a block diagram of an oil-hydraulic control unit according to the prior
art;
- Figure 2 is a block diagram of an oil-hydraulic control unit according to the present
invention;
- Figure 3 is a schematic enlarged figure of the oil-hydraulic control unit of figure
2; and
- Figure 4 is a block diagram of the steps of a method for performing a safety check
on an oil-hydraulic control unit according to the present invention.
[0022] Figure 2 shows a block diagram of an oil-hydraulic control unit 1' according to the
present invention, wherein element similar to those of the oil-hydraulic control unit
of the prior art above disclosed have been indicated with the same reference numbers.
[0023] The oil-hydraulic control unit 1' of the present invention includes, in the pressure
regulation unit 8, a valve module 16 which comprises a plurality of redundancy relief
valves disclosed in detail herein below.
[0024] Figure 3 shows a schematic enlarged figure of the oil-hydraulic control unit 1' of
figure 2 wherein same references have been used to identify blocks representing the
above-cited components. The hydraulic circuit of the switch 10 is built with pressurized
modular exits and in figure 3 four blocks 18 correspond to respective hydraulic canals
connecting the oil-hydraulic control unit 1' to actuators of the switch 10 generally
indicated with reference number 20.
[0025] Each actuator or group of actuators of the switch 10 requires advantageously in a
manner per se known two canals or lines for being operated, each canal acting as inlet
or outlet depending on the movement of the actuator.
[0026] Each canal block 18 comprises a first relief valve 16a and a second relief valve
16b which, altogether, represent the valve module 16 of the pressure regulation unit
8.
[0027] Advantageously, the two valves 16a, 16b are arranged in parallel on a same canal.
[0028] The relief valves 16a, 16b are configured to ensure that the level of pressure at
system level increases until it reaches a calibrating value of the relief valves 16a,
16b.
[0029] The relief valves 16a, 16b are per se known and they are arranged so that when one
valve 16a or 16b breaks, the other valve 16b or 16a starts sending the oil flowing
in the canal towards the reservoir so that the pressure of the oil going to the actuators
20 decreases.
[0030] If the pressure of the oil going to the actuators 20 has a value still high enough
to complete a maneuver to the switch 10, notwithstanding the pressure reduction above
disclosed, the remote control 2 cannot identify breakage of the valve 16a or 16b,
and if also the other valve 16b or 16a breaks, the pressure of the oil going to the
actuators increases, the actuators 20 are activated and the remote control 2 cannot
recognize failure of the oil-hydraulic control unit 1'.
[0031] To solve this problem, the relief valves 16a and 16b are arranged so that when the
first valve 16a or 16b breaks and the oil starts going towards the reservoir, the
internal pressure of the oil-hydraulic control unit 1' start decreasing thus not being
able to reach a predetermined minimum value corresponding to the calibrating value
of the relief valves 16a, 16b. If the internal pressure of the oil-hydraulic control
unit 1' does not reach the calibrating value, the timing unit 12 is not activated,
therefore, it does not cut off the power to the electric motor 4 and it does not close
the closing contacts 14. The remote control unit 2 does not therefore receive the
control signals, thus recognizing that a valve 16a or 16b has been damaged.
[0032] Each pressurized exit of the hydraulic circuit, thanks to the redundancy of the relief
valves 16a, 16b, is responsible for moving the external actuators at a specific and
controlled pressure value. In case of a failure of any of the relief valves 16a, 16b,
the maximum pressure achieved by the respective canal, and therefore by the overall
system, is lower than the pressure needed to maneuver the blades.
[0033] The control contacts 14 are therefore not closed and the corresponding control signal
is not sent to the remote control unit 2. The remote control unit 2 can therefore
detect a failure in the oil-hydraulic control unit 1'.
[0034] Advantageously, the remote control unit 2 is configured to detect that a relief valve
16a, 16b has been damaged if the activation signal has been sent to the switch 10
and, after a predetermined time starting from the sending of said activation signal,
no control signals have been received back.
[0035] In the following a method for performing a safety check on an oil-hydraulic control
unit will be disclosed with reference to figure 4, which shows a block diagram of
such a method.
[0036] In a first step 100 an oil-hydraulic control unit 1 as above disclosed is provided.
Then, in a step 102, oil is sent into the hydraulic circuit at a very low level of
pressure.
[0037] At a step 104, the blades are moved by the actuators 20 until they reach an obstacle
thus stopping their movement.
[0038] At a step 106, the value of the oil pressure into the hydraulic circuit starts increasing
until it reaches the calibrating value, i.e. a predetermined first threshold value
set by the relief valves 16a, 16b.
[0039] If the first relief valve 16a is failed, the second relief valve 16b keeps, at a
step 108, the pressure lower than the predetermined first threshold value, therefore,
the level of pressure inside the hydraulic circuit cannot increase anymore, so it
can never reach a second threshold value set by a cylinder valve of the timing unit
12. Advantageously the second threshold value is equal to the first threshold value.
[0040] At step 110 the timing unit 12 remains inactive because the cylinder valve remains
closed; as a result, the timing unit 12 does not cut the power to the electric motor
4 and does not close the control contacts 14, thus allowing the remote control unit
2 to detect, at step 112, failure of the oil-hydraulic control unit 1', thus performing
a safety check.
[0041] Clearly, the principle of the invention remaining the same, the embodiments and the
details of production can be varied considerably from what has been described and
illustrated purely by way of non-limiting example, without departing from the scope
of protection of the present invention as defined by the attached claims.
1. Oil-hydraulic control unit (1') comprising:
- a pump (6) arranged for sending oil to a pressure unit (8) arranged to pressurize
said oil and to send it through a hydraulic circuit towards at least one actuator
(20) of a switch (10) of a railway track, said hydraulic circuit comprising preferentially
a plurality of canals, the at least one actuator (20) being connected to at least
one canal for being operated;
- a control device (4) connected to said pump (6) and arranged for controlling the
pump (6) based on an activation signal coming from a remote control unit (2) arranged
for controlling switch operations of the switch (10);
- a timing unit (12) arranged to send control signals to the remote control unit (2)
representative of the correct operation of the oil-hydraulic control unit (1');
characterized in that the pressure unit (8) comprises at least two valves (16a, 16b) for each group of
canals intended to be connected to the at least one actuator (20), the valves (16a,
16b) being arranged so that when a first valve (16a) breaks, a second valve (16b)
starts sending the oil flowing in the group of canals towards a reservoir of the oil-hydraulic
control unit (1') so that the pressure of the oil going to the at least one actuator
(20) decreases, thus regulating the pressure of the oil flowing into said group of
canals.
2. Oil-hydraulic control unit (1') according to claim 1, wherein the timing unit (12)
is connected to the control device (4) and arranged to cut off the power of the control
device (4) based on the pressure of the oil going to the switch (10).
3. Oil-hydraulic control unit (1') according to claim 1 or 2, wherein the valves (16a,
16b) are configured so that when the first valve (16a) breaks, the internal pressure
of the oil-hydraulic control unit (1') start decreasing thus not being able to exceed
a predetermined minimum value, the predetermined value being below a threshold value
for which the timing unit (12) is configured to send the control signals to the remote
control unit (2), the remote control unit (2) thus detecting that a valve (16a, 16b)
has been damaged in function of the reception or not of said control signals.
4. Oil-hydraulic control unit (1') according to any of the preceding claims wherein the
two valves (16a, 16b) are arranged in parallel on a same canal.
5. Oil-hydraulic control unit (1') according to any of the preceding claims, wherein
the remote control unit (2) is configured for detecting that a valve has been damaged
if after a predetermined time starting from the sending of the activation signal,
no control signals have been received.
6. Method for performing a safety check on an oil-hydraulic control unit comprising the
steps of:
- providing (100) an oil-hydraulic control unit (1') according to any of the preceding
claims;
- sending (102,) oil into the hydraulic circuit;
- moving blades (104) of the switch (10);
- increasing (106) the value of the oil pressure into the hydraulic circuit until
it reaches a predetermined threshold value;
- if the first valve (16a) is failed, keeping (108), thanks to the second valve (16b),
the pressure lower than the threshold value;
- maintaining (110) the timing unit (12) inactive so as not to send the control signals
to the remote unit (2);
- detecting (112), through the remote control unit (2), a failure of the oil-hydraulic
control unit (1'), thus performing a safety check.
7. Method for performing a safety check on an oil-hydraulic control unit according to
claim 6, wherein the timing unit (12) remains inactive thus not cutting the power
to the control device (4).
Amended claims in accordance with Rule 137(2) EPC.
1. Oil-hydraulic control unit (1') comprising:
- a pump (6) arranged for sending oil to a pressure unit (8) arranged to pressurize
said oil and to send it through a hydraulic circuit towards at least one actuator
(20) of a switch (10) of a railway track, said hydraulic circuit comprising a plurality
of canals, the at least one actuator (20) being connected to at least two canals of
said plurality of canals for being operated;
- a control device (4) connected to said pump (6) and arranged for controlling the
pump (6) based on an activation signal coming from a remote control unit (2) arranged
for controlling switch operations of the switch (10);
- a timing unit (12) arranged to send control signals to the remote control unit (2)
representative of the correct operation of the oil-hydraulic control unit (1');
characterized in that the pressure unit (8) comprises at least two valves (16a, 16b) for the at least two
canals intended to be connected to the at least one actuator (20), the valves (16a,
16b) being arranged so that when a first valve (16a) breaks, a second valve (16b)
starts sending the oil flowing in the at least two canals towards a reservoir of the
oil-hydraulic control unit (1') so that the pressure of the oil going to the at least
one actuator (20) decreases, thus regulating the pressure of the oil flowing into
said at least two canals, wherein the timing unit (12) is connected to the control
device (4) and arranged to cut off the power of the control device (4) based on an
increase of the value of the pressure of the oil going to the switch (10).
2. Oil-hydraulic control unit (1') according to claim 1, wherein the valves (16a, 16b)
are configured so that when the first valve (16a) breaks, the internal pressure of
the oil-hydraulic control unit (1') start decreasing thus not being able to exceed
a predetermined minimum value, the predetermined value being below a threshold value
for which the timing unit (12) is configured to send the control signals to the remote
control unit (2), the remote control unit (2) thus detecting that a valve (16a, 16b)
has been damaged in function of the reception or not of said control signals.
3. Oil-hydraulic control unit (1') according to any of the preceding claims wherein the
two valves (16a, 16b) are arranged in parallel on a same canal.
4. Oil-hydraulic control unit (1') according to any of the preceding claims, wherein
the remote control unit (2) is configured for detecting that a valve has been damaged
if after a predetermined time starting from the sending of the activation signal,
no control signals have been received.
5. Method for performing a safety check on an oil-hydraulic control unit comprising the
steps of:
- providing (100) an oil-hydraulic control unit (1') according to any of the preceding
claims;
- sending (102,) oil into the hydraulic circuit;
- moving blades (104) of the switch (10);
- increasing (106) the value of the oil pressure into the hydraulic circuit until
it reaches a predetermined threshold value;
- if the first valve (16a) is failed, keeping (108), thanks to the second valve (16b),
the pressure lower than the threshold value;
- maintaining (110) the timing unit (12) inactive so as not to send the control signals
to the remote unit (2);
- detecting (112), through the remote control unit (2), a failure of the oil-hydraulic
control unit (1'), thus performing a safety check.
6. Method for performing a safety check on an oil-hydraulic control unit according to
claim 5, wherein the timing unit (12) remains inactive thus not cutting the power
to the control device (4).