Abstract: Various embodiments include modeling a component fault tree for a circuit with an input-side and an output-side component. These include using a fault tree corresponding to a hazard for each respective component, obtaining information about the components of the circuit and a connection between components, and connecting the respective fault trees based on the circuit description. Each fault tree includes an input fault mode or a basic event and an output fault mode. The output fault mode and the input fault mode are each assigned to a component terminal. An output fault mode of the input-side component tree is connected to an input fault mode of the output-side component tree if: there is a connection between the assigned terminal of the input-side component and the output-side component and the output fault mode of the input-side component correlates to an input fault mode of the output-side component.

Abstract: Provided is a method for analyzing and designing a physical system architecture of a safety-critical system, wherein a physical system analysis model representing the physical system architecture of the safety-critical system is modified incrementally until calculated failure rates of failure modes of the physical system analysis model are less or equal to failure rates of corresponding failure modes of a functional system analysis model representing a functional system architecture of the safety-critical system.

Abstract: Various embodiments include modeling a component fault tree for a circuit with an input-side and an output-side component. These include using a fault tree corresponding to a hazard for each respective component, obtaining information about the components of the circuit and a connection between components, and connecting the respective fault trees based on the circuit description. Each fault tree includes an input fault mode or a basic event and an output fault mode. The output fault mode and the input fault mode are each assigned to a component terminal. An output fault mode of the input-side component tree is connected to an input fault mode of the output-side component tree if: there is a connection between the assigned terminal of the input-side component and the output-side component and the output fault mode of the input-side component correlates to an input fault mode of the output-side component.

Abstract: Techniques of safety assurance using fault trees for identifying dormant system failure states are provided. Both operational failure events, as well as diagnostic failure events are included in a fault tree and the operational failure events are then correlated with the diagnostic failure events, which enables an identification of the dormant system failure states. A component fault tree can be used.

Abstract: Provided is a method for analyzing and designing a physical system architecture of a safety-critical system, wherein a physical system analysis model representing the physical system architecture of the safety-critical system is modified incrementally until calculated failure rates of failure modes of the physical system analysis model are less or equal to failure rates of corresponding failure modes of a functional system analysis model representing a functional system architecture of the safety-critical system.

Abstract: Techniques of safety assurance using fault trees for identifying dormant system failure states are provided. Both operational failure events, as well as diagnostic failure events are included in a fault tree and the operational failure events are then correlated with the diagnostic failure events, which enables an identification of the dormant system failure states. A component fault tree can be used.

Abstract: The invention relates to a 1st power supply arrangement for a rail vehicle. The rail vehicle includes at least one driven car with an intermediate circuit, a brake system and an energy supply system for supplying the brake system with operating energy. In order to improve the framework conditions to ensure reliable electrodynamic braking, the energy supply system contains at least two energy supply units, for the driven car, arranged at the intermediate circuit, for the redundant energy supply to the brake system.

Abstract: A rail vehicle braking device has at least one electrodynamic brake, which comprises a drive unit, which has at least one drive motor and a power supply unit for supplying the drive motor when the drive unit is in a traction mode. The rail vehicle braking device has at least two brake control units in order to increase the safety of the electrodynamic brake. In a first braking mode, a first brake control unit in an active state controls the power supply unit for providing a braking effect, a first brake effect monitoring unit and a switching unit, which serves to switch, depending on a brake effect parameter in the first braking mode, into a second braking mode, in which the second brake control unit in an active state controls the power supply unit for providing a brake effect.

Abstract: A rail vehicle braking device has at least one first electrodynamic brake with a drive unit that includes at least one drive motor and a power supply unit for supplying the drive motor in a traction mode of the drive unit. A brake control unit controls, in a first brake mode, the respective power supply unit for providing a braking effect. In order to optimize the system with a fall-back measure in case of a braking effect loss in respect of the cause thereof, there is provided at least one sensor unit, which detects a braking effect parameter for the first braking mode of the brake. A monitoring device is assigned to the first brake. It is independent of the brake control unit and considers, in a first monitoring mode, the braking effect parameter for the introduction of a fall-back measure concerning the brake.

Abstract: The invention relates to a 1st power supply arrangement for a rail vehicle. The rail vehicle includes at least one driven car with an intermediate circuit, a brake system and an energy supply system for supplying the brake system with operating energy. In order to improve the framework conditions to ensure reliable electrodynamic braking, the energy supply system contains at least two energy supply units, for the driven car, arranged at the intermediate circuit, for the redundant energy supply to the brake system.

Abstract: A rail vehicle braking device has at least one first electrodynamic brake with a drive unit that includes at least one drive motor and a power supply unit for supplying the drive motor in a traction mode of the drive unit. A brake control unit controls, in a first brake mode, the respective power supply unit for providing a braking effect. In order to optimize the system with a fall-back measure in case of a braking effect loss in respect of the cause thereof, there is provided at least one sensor unit, which detects a braking effect parameter for the first braking mode of the brake. A monitoring device is assigned to the first brake. It is independent of the brake control unit and considers, in a first monitoring mode, the braking effect parameter for the introduction of a fall-back measure concerning the brake.

Abstract: A rail vehicle braking device has at least one electrodynamic brake, which comprises a drive unit, which has at least one drive motor and a power supply unit for supplying the drive motor when the drive unit is in a traction mode. The rail vehicle braking device has at least two brake control units in order to increase the safety of the electrodynamic brake. In a first braking mode, a first brake control unit in an active state controls the power supply unit for providing a braking effect, a first brake effect monitoring unit and a switching unit, which serves to switch, depending on a brake effect parameter in the first braking mode, into a second braking mode, in which the second brake control unit in an active state controls the power supply unit for providing a brake effect.

Abstract: A method for performing a three-dimensional analysis of an investigated technical system represented by a corresponding fault tree is provided. The method includes linking basic events logically to a top event of the investigated system. The fault tree is a three-dimensional fault tree. Each event of the fault tree is represented by a three-dimensional body having projection surfaces adapted to output analysis data of the respective event to a user.