The wheel slide protection (WSP) is considered an interoperability system and then regulated according to the TSI LOC & PAS. For the detailed requirements, concerning WSP, the TSI refers to the specific European standard: the EN 15595. To briefly introduce, the WSP system is in charge of the modulation of the braking force in case of degraded wheel-rail adhesion that could lead to axles slide and, if not mitigated, to wheels lock. The WSP control’s logic is based on the acquisition of the angular velocities of the axles producing, as output, the partialisation of the braking force. In case of pneumatic brake, this partialisation is obtained through a couple of solenoid valves (“HOLD” and “VENT”) driven by electrical commands coming from WSP control unit. According to the configuration of these commands, the WSP units can select three states: - “Filling state”, allowing a direct connection between the brake cylinder and the pneumatic conduit through which the brake system directly controls the pressure to the brake cylinder - “Holding state”: the pressure in the brake cylinder cannot be changed by pressure variations in the pneumatic conduit. The “VENT” solenoid valve continues to keep the brake cylinder isolated from the atmosphere. Overall, the pressure to the brake cylinder maintains its value indefinitely, unless pneumatic leakages. - “Venting state”: the pressure in the brake cylinder cannot be changed by pressure variations in the pneumatic conduit. The “VENT” solenoid valve connects the brake cylinder to the atmosphere, reducing the pressure to the brake cylinder, possibly down to zero. The potential to control the braking effort makes the WSP a safety critical system. Errors on the microprocessor or software bugs on the algorithm can potentially lead to unlimited brake release. For this reason, the EN 15595 requires that WSP is equipped with a watchdog function that shall be independent from WSP control algorithm and processor. The watchdog function shall inhibit the WSP intervention in case the brake is continuously released longer than 10 seconds or in case the brake effort is maintained constant, below the demand, longer than 15 seconds. The watchdog function is typically realized with electrical time-out circuits acting directly on the valve’s command lines, downstream the WSP microprocessor, that force the commands to zero in case the timeout is exceeded. After timeout intervention, the resulting pneumatic configuration corresponds to “filling state”. However, the use of the timing circuits according to the prior art exhibits counter-productive cases despite the fact that WSP device is performing its function correctly. For instance, in cases of extremely low adhesion, the axles with high moments of inertia (e.g., axles connected to the drive motors through a gear reducer) could require long time to recover their angular speed when brake is released. If the time required is longer than prescribed timeout, the WSP is inhibited by the watchdog function and the axle will lock, with consequent wheel flat. To overcome the abovementioned safety concerns and to ensure that WSP control algorithm can operate without limitation and delivering at same time highest performance possible, Wabtec has developed a WSP supervisor based on a SIL4 hardware & software platform (EB2022-IBC-009). This article will: - identify the use cases where a traditional watchdog is limiting the correct operations of WSP system - propose an algorithm, to supervise the behaviour of WSP, based on wheels angular velocity and/or brake cylinder pressures - validate the supervising function on a test bench (class 1 according to UIC 541-05 : 2016) ensuring the algorithm is capable to distinguish the unsafe conditions (microprocess or software failures) from the normal operation of WSP related to low adhesion. The final scope is to save the wheels (preventing flats and related maintenance), even during extremely low adhesion, without jeopardizing the safety.

Dr. Matteo Frea, Head of R&D, Wabtec