In particular, this system and the related method are advantageously applicable to tram vehicles, like underground railways and trams, to railway vehicles, like locomotives, and to automobiles (like taxi), coaches and buses.

By way of explanation and not by way of limitation, in the following we will refer to the case in which the vehicle is a tram. However, it has to be considered that the vehicle could be any kind of vehicle.

Presently, a safety device is present on railway vehicles and on tram vehicles. This device, known with the term"dead-man"includes a push button that has to be periodically pressed by the driver in order to signal his presence. In particular, the timing cadence for the operation of this push button is about 15 seconds. If the push button is not pressed for more time than this period, the safety device activates all the brake systems of the vehicle.

DESCRIPTION This invention relates to a safety system for vehicles, and the related method that could be applied advantageously, but not by way of limitations, to vehicles for public transport in urban areas, which allows the control of the vigilant presence of the vehicle driver in a simple, highly reliable and efficient way, and the insertion of brake devices of the vehicle if inactivity of the driver is sensed, modulating this insertion in relation to the vehicle speed and on the base of normal drive operations carried out by the driver.

In particular, this system and the related method are advantageously applicable to tram vehicles, like underground railways and trams, to railway vehicles, like locomotives, and to automobiles (like taxi), coaches and buses.

By way of explanation and not by way of limitation, in the following we will refer to the case in which the vehicle is a tram. However, it has to be considered that the vehicle could be any kind of vehicle.

Presently, a safety device is present on railway vehicles and on tram vehicles. This device, known with the term"dead-man"includes a push button that has to be periodically pressed by the driver in order to signal his presence. In particular, the timing cadence for the operation of this push button is about 15 seconds. If the push button is not pressed for more time than this period, the safety device activates all the brake systems of the vehicle.

Anyway, those conventional"dead-man"devices present some problems, above all in drive situations in which is necessary the execution of many close actions, as for example in driving a tram in the urban traffic.

In this regard, it could be considered the hard and stressful use of the movement manipulator and of the brake manipulator of a tram moving in a condition of congested traffic, or even to a locomotive manoeuvring in a station.

Indeed, in those conditions, the driver could not have the possibility for signaling his presence to the"dead-man"device and this could provoke the total block of the vehicle and a danger situation for the passengers. Moreover, even if the vehicle speed is high, the mechanism always operates in the same way, namely waiting for a period of 15 seconds before activating the vehicle block systems; in this situation, the stop of the vehicle requires more braking space and more or less serious incidents may happen for the long way run by the vehicle before stopping.

Similarly, if the driver activates the"dead-man"device, diverting his concentration from the control of the traffic condition, he could neglect the execution of a drive operation, provoking a danger for the vehicle passengers and for people and the things placed in the movement area of the vehicle.

Even in case of a vehicle moving in condition of not congested traffic, as, for example, a locomotive during normal travelling, the operation of a"dead-man"device psychically and physicaly tires the driver.

This implies that in some conditions, as for example in case of driving a tram, the installed"dead-man"device is not activated and so depriving the device of every kind of safety device. That has sometime provoked accidents in case of collapse of the driver or due to a sudden moving of a vehicle improperly blocked along a slope.

It is an object of this invention, therefore, to carry out in a simple, highly reliable and efficient way the control of the vigilant presence of vehicle driver and the insertion of the brake devices of the vehicle when the driver's inactivity is sensed.

It is a further object of this invention to modulate the insertion of vehicle braking devices in relation to the vehicle speed and on the base of normal drive operations carried out by the driver, removing the necessity of diverting the concentration from the control of the traffic condition.

It is specific subject matter of this invention, a safety system for vehicles, the guiding of which requires the operation of one or more control means, the vehicle to which the system is applied including one or more braking means, the system being characterised in that it includes means to sense the vehicle speed, which send a signal representing the vehicle speed to first electronic control means, the first electronic control means generating one or more activation signals that they send to first timing means, the first timing means carrying out, when activated, at least one time count, at the end of which they generate at least one activation signal that they transmit to second electronic means which generate, when activated, one or more activation signals of the braking means, the system

also including generating means for generating a reset signal, depending on one or more signals corresponding to the operation of the control means, that is sent to the first timing means, in order to interrupt and reset said at least one time count, and to the second electronic control means, in order to disable said activation signals of the braking means.

Always according to the invention, the first control electronic means could generate said activation signals only in the case the speed of the vehicle is higher than a preset minimum value, preferably equal to 0 Km/h or 0.800 Km/h.

Still according to the invention, the first timing means could include two or more timers, each one of which is activated by a corresponding activation signal generated by the first control electronic means and carries out a time count for a corresponding time period, the first electronic control means generating said activation signals in relation to the signal representing the vehicle speed which is received from the vehicle speed sensing means.

Further according to the invention, the first timing means could include, for at least a timer, a corresponding redundant timer connected to it and activated by the same activation signal of the corresponding timer, the redundant timer verifying the correct operation of the corresponding timer and, when a malfunction is detected, generating an activation signal that is sent to at least one further timer.

Always according to the invention, the first timing means could include, for at least a timer, a corresponding redundant timer in parallel

connection, adapted to be activated by the same activation signal of the corresponding timer.

Preferably according to the invention, said vehicle speed sensing means are also connected to second electronic control means, to which they send the signal representing the vehicle speed, the second electronic control means generating, when activated, said one or more activation signal of the braking means on the basis of the signal representing the vehicle speed.

Still according to the invention, the vehicle could include a driving place for a driver and in that the system also includes means for sensing that the driving place is occupied, which send a signal that representing the sensing result to the first electronic control means, which generate said activation signals also on the basis of said signal representing the sensing of driving slot occupied.

Further according to the invention, the transmission of the activation signal from the first timing means to the second electronic control means may be carried out by means of time delay electronic means.

Always according to the invention, the time delay electronic means may include acoustic and/or luminous signaling means.

Still according to the invention, the time delay electronic means could include a cascade of one or more timers activated by the activation signal generated by the first timing means, the timers of the cascade, when activated, carrying out time counts for corresponding time periods, at

the end of which the cascade generates at least one activation signal that sends to the second electronic control means.

Further according to the invention, said time count of the cascade could be interrupted and set at zero by the resetting signal.

Still according to the invention, the system further could include another timer, activated by the same activation signal of the second electronic control means, that carries out, when activated, a time count for a corresponding time period, at the end of which it generates at least a disabling signal that it sends to the second electronic control means to disable the disabling of the activation signals of the braking means due to the reset signal.

Further according to the invention, said time count of the other timer could be interrupted and set to zero by the resetting signal.

Further according to the invention, the vehicle could include electric and/or electronic and/or electromagnetic supply means and in that the system could also include a further timer, activated by a corresponding activation signal generated by second electronic control means, that carries out, when activated, a time count for a corresponding time period, at the end of which it generates at least a signal to disable the electric and/or electronic and/or electromagnetic supply means.

Always according to the invention, said time count of the other timer could be interrupted and set to zero by a corresponding resetting signal generated through operating suitable switch means.

Further according to the invention, the generator means may include at least one device adapted to be manually activated and to generate, when activated, the resetting signal.

Still according to the invention, the control means may include push buttons and/or one or more levers and/or one or more bars and/or one or more pedals and/or one or more wheels.

Always according to the invention, the braking means could include devices with electromagnetic sliding blocks and emergency maximum braking devices, and in that the second electronic control means, when activated, may generate a preliminary activation signal for the devices with electromagnetic sliding blocks and a subsequent activation signal for the emergency maximum braking devices.

Still according to the invention, the preliminary activation signal may be intermittent in order to activate the devices with electromagnetic sliding blocks for one or more time.

Further according to the invention, in the case the vehicle speed is higher than a predetermined speed threshold, the second electronic control means may generate only one activation signal for the emergency maximum braking devices.

Always according to the invention, the resetting signal generating means may include one or more means for sensing the position of corresponding control means.

It is still specific subject matter of this invention a method for controlling vehicle safety, the guiding of which requires the operation of

one or more control means, the vehicle including one or more braking means, the method being characterised in that it include the following steps: A. verifying the operation of the control means; B. carrying out at least one time count; and C. at the completion of said at least one time count, activating the braking means; the method interrupting and resetting said at least one time count and disabling the braking means in the case operation of control means is sensed.

Preferably according to the invention, the method it further includes the following steps: D. sensing the vehicle speed; and E. verifying that the vehicle speed is higher than a preset minimum value, preferably 0 Km/h or 0.800 Km/h ; the method carrying out the steps B and C only if the step E gives a positive result.

Always according to the invention, step B may carry out at least two time counts for corresponding time periods, each time count being related to the vehicle speed.

Still according to the invention, step C may activate the braking means on the basis of vehicle speed.

Further according to the invention, the method could include also the follow step:

F. sensing the occupation of a vehicle driving place ; the time count of step B being based on the sensing of driving place occupied.

Always according to the invention, the method may also include the following step: G. acoustically and/or optically signaling that the activation of braking means is to occur and/or is in progress.

Still according to the invention, step C could also carry out another time count, at the end of which it disable the disabling of braking means due to detection of the operation of the control means.

Further according to the present invention, the time count of step C could be interrupted and reset in the case the operation of control means is sensed.

Always according to the present invention, when the time count of step C is completed, the method may include the follow step: H. carrying out a further time count, at the completion of which the method diables the electrical and/or electronic and/or electromagnetic supply means of the vehicle.

Still according to the invention, the time count of step H may be interrupted and reset in the case suitable switch means are operated.

Always according to the present invention, the method could interrupt and reset said at least one time count of the step B, and it could disable the braking means in the case the operation of at least one manually operable device is detected.

Always according to the present invention, the braking means could include devices with electromagnetic sliding blocks and emergency maximum braking devices, and in that the step C may previously activate the devices with electromagnetic sliding blocks, preferably for one or more times, and subsequently the emergency maximum braking device.

Still according to the invention, in the case the vehicle speed is higher than a preset speed threshold, the step C may activate only the emergency maximum braking device Preferably according to the present invention, the step A senses the position of one or more control means.

This invention will be now described, by way of explanation and not by way of limitation, according to its preferred embodiments, by particularly referring to the attached drawings, in which: figure 1 shows a block diagram of a preferred embodiment of the safety system according to the invention; figure 2 shows a top view of the movement manipulator of a tram to which the system according to the invention is applied ; figure 3 shows a top view of the brake manipulator of the tram of figure 2; figure 4 shows a block diagram of a detail of another preferred embodiment of the safety system according to the invention; figure 5 shows a circuit diagram of a first portion of another preferred embodiment of the safety system according to the invention;

figure 6 shows a circuit diagram of a second portion of the system of figure 5; figure 7 shows a circuit diagram of a third portion of the system of figure 5; figure 8 shows a circuit diagram of a fourth portion of the system of figure 5; figure 9 shows a circuit diagram of a fifth portion of the system of figure 5; figure 10 shows a circuit diagram of a sixth portion of the system of figure 5; figure 11 shows a circuit diagram of a seventh portion of the system of figure 5; figure 12 shows a circuit diagram of a eighth portion of the system of figure 5; figure 13 shows a circuit diagram of a ninth portion of the system of figure 5; figure 14 shows a circuit diagram of a tenth portion of the system of figure 5; figure 15 shows a top view of the movement manipulator of another tram to which the system according to the invention is applied; figure 16 shows a side view of the accelerator pedal of a motor vehicle to which the system according to the invention is applied; and figure 17 shows a side view of the brake pedal of the motor vehicle of figure 16.

In the following description, the same reference numerals will be used to designate the same items in the figures.

The system according to the invention (and the related method) will be now described by way of illustration, and not by way of limitation, with particular reference to an application to a tram vehicle, in particular a tram. However, it must be considered that the system according to the invention could be applied to any kind of tram vehicle (such as underground railways), railway vehicle (such as locomotives), and motor vehicles (such as cars, coaches and buses), being anyway included in the scope of protection of the present invention.

Referring to figure 1, it could be observed that a preferred embodiment of the safety system for vehicles according to the invention includes a device 1 for sensing that the drive seat is occupied and a device 2 for sensing the vehicle speed. The sensing devices 1 and 2 are connected to one first electronic control unit 3, that, in relation to the signals received from those, generates four activation signal which are sent to a timing unit 4.

The timing unit 4 includes four timers, respectively 5,6, 7 and 8, each one of which is activated by one of the four corresponding signals generated by the first electronic unit 3. Each timer, when activated, carries out a time count, preferably adjustable, at the end of which it generates an activation signal on a corresponding output. In particular, each one of the four timers refers to a corresponding preset threshold speed, preferably adjustable, and carries out the counting for a corresponding time period,

respectively T1, T2, T3, and T4 where T1< T2< T3< T4. The four timer outputs, advantageously short-circuited each other, are connected to a first signaling device 9, preferably an acoustic and luminous one, and to a fifth timer 10, which are activated when at least one of the four timers 5,6, 7 and 8 generates the activation signal.

The fifth timer 10, when activated, carries out a time count for a corresponding time period T5, preferably adjustable, at the end of which it generates an activation signal that is sent to a second signaling device 11, preferably an acoustic and luminous one, and to a sixth timer 12.

Alternately, the fifth timer 10 could be replaced with a circuit which transfers, with a certain delay, to the output the activation signal coming from the unit 4.

The sixth timer, when activated, carries out a time count for a corresponding time period T6, preferably adjustable, at the end of which it generates an activation signal that is sent to a seventh timer 13, which carries out a time count for a corresponding time period T7, preferably adjustable, and to a second electronic control unit 14.

The second electronic control unit 14 receives also an activation signal generated by the seventh timer 13 at the end of the counting, and a signal indicating the vehicle speed that comes from the sensing device 2.

If the vehicle moves at a speed not higher than a fifth threshold speed, preferably adjustable, due to the activation signal reception the second electronic unit 14 activates for an initial period only the electromagnetic sliding blocks 15 and subsequently all the vehicle emergency maximum

braking devices 16. If on the contrary the vehicle moves at a speed higher than the fifth threshold speed, due to the activation signal reception the second electronic unit 14 immediately activates all the vehicle emergency maximum braking devices 16.

A unit 17 for generating a reset signal R1 receives in the input some signals, corresponding to operations of push buttons and levers by the driver, in relation to which it generates the signal R1. This operates as reset signal for the four timer of the timing unit 4, for the fifth timer 10, for the sixth timer 12, and for the seventh timer 13. The signal R1 also operates as a disabling signal of the braking procedure operated by the second electronic control unit 14, in the case the seventh timer 13 has not yet generated the activation signal.

On the contrary, in the case the seventh timer 13 has generated the activation signal, the second electronic unit 14 sends an activation signal to an eighth timer 18, which carries out a time count for a corresponding time period T8, preferably adjustable, that may be interrupted and reset through operating a special switch device 19, for example a pawl protected by glass in order to allow the occurred operation to be verified for control purposes. At the end of the counting, the eighth timer 18 generates a disabling signal that sends to the vehicle electronic unit 20 to disable electrically the same vehicle, so that the engines and the electromagnetic devices are not subjected at stress.

In detail, the system operates only if the vehicle is moving, preferably with a speed higher than a minimum preset value.

In order to better understand the present invention, in the following the operating modes of the preferred embodiments of figure 1 will be described, similar modes being applied to other embodiments.

The safety system for vehicles according to the invention monitors the continuous and ordinary driver's activity by means of a set of sensors and switches placed on the levers and push buttons and on the switches used during the driving of the vehicle. Only in the case the system senses, when the vehicle is moving, an inactivity in the operating of said levers and in activating of said push buttons and switches, it activates the vehicle braking devices according to modes depending on the vehicle speed and according to the driver's posture. It is evident that, especially when the traffic is congested, the probability of sensing such an inactivity is very low, and it can take place only in anomalous situations, such as a driver's collapse.

The essential feature of the system according to the invention is the presence of a set of timers and of control electronic means which, in relation to the vehicle speed and to the driver's posture, fix the allowed time interval, during movement, for which the driver is allowed not to carry out any detectable operation.

Each timer, once the time period of the corresponding vehicle speed is fixed, starts a count down. Every time that the driver carries out any kind of detectable manoeuvre, the timers are interrupted and reset.

When a vehicle is moving in a urban tramway network, the driver carries out frequent manoeuvres of the movement manipulator and of the

brake manipulator during ordinary driving; therefore, there are very rare cases in which it is necessary to carry out a different operation that may be sensed by the system in order to show the driver's vigilant presence. In other words, the system according to the invention substantially eliminates the heavy necessary operations requested to the driver by the conventional"dead-man"devices.

When the speed increases, the system reduces the intervention interval times of the braking devices.

In a preferred embodiment of the system according to the invention, the movement manipulator lever may interrupt and reset the timers by means of the operation of three different reset devices.

The first device is associated to the horizontal angular position of the movement manipulator; in particular, this first device, introducing a gradual shift of the movement manipulator, indirectly reduces the incorrect use of this by many inexpert drivers, which quickly, instead of gradually, move the lever from the initial position to full scale, provoking stress for electronic and electric components, reducing their life, and stress for vehicle mechanic components and for the network, wheels, tracks, and making the travel uncomfortable for the passengers. In particular, the preferred embodiment the system includes the movement manipulator of figure 2 and provides for its complete angular shift is divided in thirty intervals in order to generate a reset signal for the timers whenever the lever is shifted in one of them.

The movement manipulator second device is a switch associated to the lever vertical angular position: when such lever is lowered and then released, a reset signal is generated.

The third device is a push button placed on the lever.

The second and the third device are mono-stroke, i. e. it is necessary to release them for generating a reset signal.

The braking manipulator lever, which is shown in figure 3 for the preferred emodiment, may reset the timers by means of devices similar to the movement manipulator lever.

This correct driving system, considering the proximity of the stops in the tram network, allows the driver to reduce drastically the use of special reset timer devices, which are similar to the push button of the "dead-man"device.

An other advantageous feature of the system according to the invention is that, at low speed, preferably until 20 Km/h, it provides for that the braking device initially activated are only the electromagnetic sliding blocks, which are lowered three times with a close cadence, alerting both the driver, which may eventually take the control through carrying out an operation that may be sensed by the system, and the passengers, which are induced to support themselves before the possible total blocking of the vehicle. This is particularly advantageous, since it is proved that the emergency braking are the most traumatic ones for the passengers.

One preferred embodiment of the system according to the invention also provides for the emission of at least a pre-alerting acoustic

signal, to attract the driver's attention before the activation of the braking devices.

A preferred embodiment of the system further provides that also the operation of the switch lever of the direction indicators (right and left flashing indicators) resets the timers. Similarly, the operation of the mushroom-head push button controlling the electromagnetic sliding block brake also generates the reset signal.

In the tram drive cabin there are some push buttons for signaling the faults (visual alarms and audio buzzers) placed on any control panel, that the driver, getting up from his seat, must switch off when they are activated to signal a fault of the vehicle. A preferred embodiment of the system also provides that the activation of anyone of such fault signaling push buttons resets the timers. In particular, the system according to the invention takes account of the fact that, getting up from his seat, the driver does not have a perfect view for driving. In fact, when the speed is very low, the timer which is activated is the one having minimum duration (the system presumes that the vehicle was still and improperly gets moving); in case of higher speeds, the timer which is activated is always the one related to intermediate speeds (the system presumes that the vehicle was in normal moving conditions and, thus, even if it has short times for inserting the braking devices, it gives to the driver the sufficient time to turn off the fault signaling push buttons). Therefore, by pressing a fault signaling push button, the fault signaling device is disabled, and the timers of the system according to the invention are reset.

The system according to the invention is based on the wheel speed. When the vehicle is enabled, the system starts to work.

The preferred embodiment of the system provides that the operations, which may be sensed and which activate the generating unit 17 for generating the reset signal R1, particularly include : - increasing or reducing the movement manipulator angular shift of figure 2; - increasing or reducing the brake manipulator angular shift of figure 3; - pressing the mushroom-head push button for controlling the brake manipulator (electromagnetic sliding blocks) ; - shifting the switch lever of the direction indicators (right and left flashing indicators); - bringing the direction indicator switch levers back to rest position; and - pressing one of a plurality of push buttons for acoustically and luminously signalling faults and anomalies, placed on a control panel.

The preferred embodiment of the system also provides for a manual reset through a driver's intervention with the following actions: - pressing a push button placed on the movement manipulator lever ; and - lowering and releasing the movement manipulator lever (mono- stroke).

In the preferred embodiment, the reset times (coinciding with the counting time periods T1, T2, T3, and T4) of the timers 5,6, 7 and 8 of the timing unit 4 are the following : - in the case the vehicle speed varies from 0.1 Km/h (first threshold speed v1) to 9 Km/h (second threshold speed v2), only the first timer 5 starts to operate and the driver has T1 = 15 seconds to reset it by means of one of the above described modes; - in the case the vehicle speed varies from 9 Km/h to 20 Km/h (third threshold speed v3), the second timer 6 also starts to operate and the driver has T2 = 10 seconds to reset it by means of one of the above described modes; - in the case the vehicle speed varies from 20 Km/h to 35 Km/h (fourth threshold speed v4), the third timer 7 also starts to operate and the driver has T3 = 6 seconds to reset it by means of one of the above described modes; - in the case the vehicle speed exceeds 35 Km/h, the fourth timer 8 also starts to operate and the driver has only T4 = 3 seconds to reset it by means of one of the above listed modes; In the case the driver does not reset the timers within the time established by the timing unit 4, the first signaling device 9 emits an acoustic signal. If the driver does not manually reset the timers within the period T5, preferably very short, the second signaling device 11 emits an acoustic signal much louder then the first one, for a time period T6 of 2 seconds.

If in spite of even this warning the driver does not intervene, one of two events may happen depending on the vehicle speed in that moment: 1) in the case the speed is not higher than a fifth threshold speed v5, preferably equal to the third speed v3 of 20 Km/h, the second electronic unit 14 activates for an initial period of 1 second only the electromagnetic sliding blocks 15, lowering them three times, allowing the driver to take the control manually resetting the timers; if the manual reset does not occur, the second electronic unit 14 activates the total block of the vehicle (maximum braking); 2) if the speed is higher than the fifth threshold speed v5, the second electronic unit 14 activates the block of the vehicle according to the maximum braking.

At the beginning of the activation of the vehicle braking procedure, the driver can still stop it through resetting the timers, within a time period T7 equal to 2 seconds, stopping the emergency condition and getting back to normal driving conditions; if this time is exceeded the vehicle will be blocked and no push button or lever will be able to let it move again.

In this case, for releasing the vehicle the driver has to activate the specific switch device 19, preferably through breaking a seal and turning a reactivation key.

If this does not occur within a time period T8 equal to 3 minutes, the vehicle gets disabled, turning off all the electric, electronic and electromagnetic devices.

The system operates even in a further case of danger.

In the case, after having enabled the vehicle, the driver leaves the his seat and the vehicle, due to any reason (as for example because it is improperly blocked along a slope), gets moving by itself and it reaches a speed higher than a sixth threshold speed v6, the first electronic unit 3 directly activates the fourth timer 8 as if the vehicle would have exceeded 36 Km/h, activating the above described procedure till the complete block of the vehicle. The first electronic unit 3 discriminates such situation by means of the signal received from the device 1, preferably including a microswitch placed under the driver's seat, which detects whether the driver's seat is occupied.

A second embodiment of the system according to the invention includes some redundant timers, in order to be able to manage possible faults. For example, in figure 4 is shown a timing unit 4 comprising four redundant timers, respectively 5', 6', 7'and 8', each one of which manages the possible fault of a corresponding timer. In particular, each one of the first three redundant timers 5', 6'and 7', is activated by the same activation signal of the corresponding timer, respectively 5,6, 7, and compares its counting with the one received from a special signal received from the corresponding timer. In the case the latter does not properly operate, the redundant timer generates an activation signal which is sent to the input of the subsequent timer. Differently, the fourth redundant timer 8'is in parallel connection with the fourth timer 8.

In figures 5-14 the circuit diagrams of a further preferred embodiment according to the invention are shown. According to what

previously described, such circuit diagrams are immediately understood by the persons skilled in the art.

Referring to figure 5, it can be observed a first circuit portion of the system comprising a first interface having push buttons and levers. In figure 5: the push button P1 is a microswitch installed inside the movement manipulator, which is activated (closed) through lowering the manipulator handlebar (lever) ; the push button P2 is a switch installed on the same lever ; the push button P3 is associated to the push button requesting braking by means of electromagnetic sliding blocks ; the push button P4 is associated to the plurality of fault signaling push buttons placed on the control panel.

In figure 5 the lever L1 of the direction indicators is also shown, while in figure 6 the mono-stroke reset circuit associated to the lever L1 is shown. In particular, such circuit allows the generation of a reset signal when the lever L1 is operated either to activate an indicator or to disable it, through bringing the lever L1 back to the rest position. In the case the circuit of figure 6 faults, the diode LED1 remains alight and, by means of the connection of terminal N5 with the corresponding terminal N5 of the circuit of figure 8, a first buzzer U1 will be activated. In this situation, the switch Int1 of figure 6 has to be opened, excluding the whole circuit of the direction indicators.

Figure 7 shows the circuit for sensing that the driver's seat is occupied, which includes the microswitch M1, which is closed only when the driver is seated on the seat. If the driver is not present, the microswitch

M1 remains opened and in the case the vehicle gets moving and exceeds the sixth threshold speed v6 (which, in the system of the figure, is equal to 0.800 Km/h), the circuit directly activates, by means of the connection of terminal N7 with the corresponding terminal N7 of the circuit of figure 11, the fourth timer having counting period T4 shorter, that is equal to 3 seconds in the system of the figure. If the driver gets up to reset the fault signaling push buttons on the panel, the microswitch M1 opens again and, in the case the vehicle exceeds a seventh threshold speed v7 (which, in the system of the figure, is equal to 8 Km/h), the circuit recognises a not perfect driving condition and directly activates, by means of the connection of the terminal N8 with the corresponding terminal N8 of the circuit of figure 11, the third timer having counting period T3, equal to 6 seconds in the system of the figure. These conditions take place only when the microswitch M1 remains opened and the vehicle gets moving.

Figure 8 shows the circuit for generating the reset signal due to the operation of push button P1, push button P2, push button P3, push button P4 and direction indicator lever L1. In particular, the circuit does not generate a reset signal if one of the push buttons remains pressed, but only when the push button is closed after having been opened. The circuit of figure 8 further provides for the acoustic and luminous signaling of possible faults, through activation of the diodes LED2, LED3 and LED4 and of the first buzzer U1. In this case, among the switches Int1, Int2 and Int3, it has to be opened the one corresponding to the alight diode. In particular, the reset signal generated at the terminal N9 is long enough for

resetting the timers to which it is connected by means of the corresponding terminal N9 of the circuit of figure 13.

Figure 9 shows the circuit for generating the reset signal due to the operation of the movement manipulator or of the braking manipulator.

At the input terminal N10 there is a voltage signal, ranging from 0 to 10 Volt, which corresponds to the manipulator angular position. The circuit discriminates thirty intervals to which the input tension may belong. In particular, the trimmer R50 allows a possible calibration of the circuit. The reset signal is present on terminal N11.

Figure 10 shows the circuit for generating four signals of the exceeding of four corresponding threshold speeds: v1= 0.800 Km/h, v2= 9.5 Km/h, v3= 20 Km/h and v4= 35 Km/h. The input terminals N12, N13, N14, and N15 may receive the voltage signal either from the odometer or from a speed detector, or tachometer. For speed ranging from 0 to 80 Km/h, the corresponding voltage signal is proportionally variable from 0 to 10 Volt. In particular, in figure 10 there are four speed references, one for each tram vehicle axis, so as to grant a redundant circuit. Only one of the four switches of the integrated circuit IC24 (CD 4016), a four input electronic switch, is off. At each outputs N16, N17, N18 and N19 there is a corresponding signal of the exceeding of threshold speed only when the voltage signal corresponding to the speed is higher than a corresponding threshold voltage.

Figure 11 shows the timing circuit including four timers, realised through four integrated circuit NE555 in monostable configuration. This

circuit establishes the pre-alert intervals depending on the speed reached by the vehicle : the first timer IC33, activated for speed higher than v1 = 0.800 Km/h, has T1 equal to 15 seconds; the second timer IC34, activated for speed higher than v = 9.5Km/h, has T2 equal to 10 seconds; the third timer IC35, activated for speed higher than v3 = 20 Km/h, has T3 equal to 6 seconds; the third timer IC36, activated for speed higher than v4 = 35 Km/h, has T4 equal to 3 seconds. T1, T2, T3 and T4 can be adjusted by means of trimmers of the timers.

Figure 12 shows a redundant timing circuit, which carries out a control of possible faults occurring in the timers of figure 11. The circuit includes four timers set to time intervals one second longer than the corresponding timers of figure 11.

Figure 13 shows a circuit for activating and controlling the vehicle braking procedure. There are shown: a medium-powered second buzzer U2, a third buzzer U3 having a tone higher than the second buzzer U2, which activates for two seconds together with the external emergency indicators. If the vehicle is moving at a speed ranging from 0.800 Km/h to 20 Km/h, the sliding blocks are activated for three times during 1 second and subsequently the emergency maximum braking. If the vehicle is moving at a speed higher than 20 Km/h, the emergency maximum braking is immediately activated. The timer IC58, set for three minutes, activates the vehicle complete disabling.

Figure 14 shows the supply circuit.

The safety system according to the invention may also be applied to tram vehicles provided with different movement manipulators, such as for example the one shown in figure 15, in which it is sensed the linear shift, rather than the angular one, of the lever and the whole lever range is partitioned into a plurality of intervals.

Similarly, with reference to figures 16 and 17, the system may also be applied to motor vehicles, in which, instead of the movement manipulator and the brake manipulator, there are respectively an accelerator pedal 28 and a brake pedal 29. Even in such case the position of the pedals 28 and 29 may be sensed by means of corresponding sensing devices, respectively 30 and 31, through partitioning the total range of the pedals in a plurality of intervals. In motor vehicles not having an automatic gear, a similar solution may also be adopted for the clutch pedal.

The safety system according to the invention satisfy the requirement for increasing the safety in transportation, particularly for passengers in urban areas, without forcing the driver to divert his attention for controlling systems like the so-called"dead-man"ones.

In the above preferred embodiments of the present invention have been described and modifications have been suggested, but it has to be understood that the persons skilled in the art may make modifications and changes without escaping from the related scope of protection, as defined in the enclosed claims.