Patent Application
20240274378
The present invention relates to a safety contact which can be used on a safety line such as can be used on a train consisting of one or more carriages. The safety contact hereby is designed to interrupt the safety line in case of a failure indication.
Trains consisting of multiple carriages typically have a safety line running from the first carriage to the last carriage or vice versa. Hereby, each carriage may have one or more safety contacts which are designed to interrupt the safety line in case of a failure. For instance, a safety contact could receive input from a sensor placed on a door of a carriage, the sensor being configured to give a signal when the door does not close when requested. Consequently, the input signal from the sensor can be used as an indication for the safety contact to interrupt the safety line. The driver of the train, positioned in the first carriage, may then see or hear an alarm signal due to the interruption of the safety line. Basically, the safety line is one of the major safety components in a train, and one must make sure that failure of the safety line itself is avoided, or at least is indicated as soon as it occurs.
An example of a system which includes such a safety line for a rail vehicle is disclosed in international application WO 2010/031570 A1. This application discloses a distributed safety monitoring system provided with a first safety loop for connecting safety relays in series to a common power supply. The opening of any one of the safety relays can be detected by a current detector located in the safety loop. Each safety relay is part of a local safety monitoring device, which is provided with a local power supply and a test circuit, to allow local testing of the safety relay independently from the common power supply. Hence, the safety relays can be tested simultaneously.
However, there is a problem when using electrical relays as switches in the safety line, because they are sensitive to vibrations. Hence, when they are applied for instance on a bogie, or on another component of a railway vehicle, they could actually interrupt the safety line due to vibrations, and not due to a failure. Hence the use of solid state switches can be preferred, i.e. switches without moving parts. The above mentioned international application discloses the solid state switches which have a significant voltage drop across the switch, e.g. opto-coupled switches. Consequently, there is a limit to the amount of switches that can be placed in series in the safety line. It should be clear that this is not an optimal solution, particularly not for large trains.
The present invention aims to provide a safety contact, which can be completely implemented using solid state technology, i.e. electronics without moving parts, and without limitation as to the amount of switches in the safety line. As a result, the amount of safety contacts which are put in series on the safety line, can be very large.
The present invention relates to a safety contact for a safety line in a train, the safety contact comprising a controller and a safety switch circuit, wherein the controller comprises a sensor input for receiving signals indicating a safety function failure, wherein the safety contact comprises an input for a safety line input signal, which input is operably connected to the controller, whereby the controller is configured to receive a control signal representing a safety line state which is dependent on the safety line input signal received at the input, wherein the safety switch circuit comprises a set of at least one safety switch, the safety switch being positioned between a power supply and an output, wherein the controller is configured to:
Preferably, the safety contact further comprises a safety line state detector, wherein safety line state detector comprises said input for the safety line input signal, and wherein the input is operably connected to the controller via the safety line state detector, whereby the safety line state detector comprises a control signal output, said safety line state detector being configured to provide the controller with a control signal via said control signal output representing a safety line state which is dependent on the safety line input signal received at the input.
The safety line state detector may be comprised in the controller.
The controller comprises a control signal output configured for controlling the safety switch circuit. The safety switch circuit comprises a set of at least one safety switch controlled by the control signal output of the controller, the safety switch being positioned between a power supply and an output. As such, the output signal at the output can be controlled by the controller. The controller is configured, preferably during an operational phase of the safety contact, to:
Because the output of the safety switch circuit is connected to the power supply in case of a working safety line state, there are no additive voltage drops when using many safety contacts in series on the safety line, i.e. the output signal for each safety contact in the safety line is typically the voltage provided by the power supply, with a small voltage drop due to the safety switch circuit. Hence, when the safety switch is closed, the output of the safety switch circuit is essentially connected to the power supply, thus putting an output signal on the output indicating a working safety line state.
In the preferred embodiment of the invention, the safety switch circuit comprises at least two safety switches in series between the power supply and the output. Each of the at least two safety switches is operably connected to the controller, whereby the controller is configured, to:
Hence, when each of the at least two safety switches is closed, the output of the safety switch circuit is essentially connected to the power supply, thus putting an output signal on the output indicating a working safety line state.
The presence of two safety switches, and optionally even more than two safety switches in series, reduces the risk of a failing safety contact. For instance, a single point of failure such as a short circuited switch, does not lead to a failing safety contact, i.e. a safety contact that falsely puts a voltage on the output of the safety contact. In a particularly preferred embodiment, the safety switch circuit comprises a feedback logic circuit for each of the at least two safety switches, each feedback logic circuit operably connected to the controller, for providing the controller with a signal indicative of the signal on the safety line after each safety switch. As such, the controller is allowed to, and preferably is configured to, check after each safety switch, if the signal on the safety line corresponds to the expected signal. Hereby, in case of failure of one of the safety switches, the controller is capable of identifying which safety switch is failing, thereby avoiding dormant failures.
In an embodiment, the safety contact is unidirectional. However, in a preferred embodiment, the safety contact is bi-directional. In case the safety contact of the present invention is implanted in a safety line, e.g. of a train, it may not be certain up front in which direction the safety line is configured to operate. In such cases it is preferred to use a bidirectional safety contact. For example, a train may be operated from both sides of the train, and thus the active driver cabinet (“cab”) is determined by where the driver of the train is seated which is typically the front carriage. The non-active cab, where the power supply can be connected to the safety line, is then at the opposite side of the train, typically the back carriage of the train. In practice, the driver may insert and switch a driver key. Hereby, typically a power voltage is put on the safety line at the side of the non-active cab.
In an embodiment, a bidirectional safety contact may comprise two unidirectional safety contacts, one arranged for each direction. Hereby, the safety contacts may be implemented separated. The safety contacts may hereby also preferably comprise a unidirectional pass-through subcircuit at the input of the safety line state detector and/or at the output of the safety switch circuit. This may ensure unidirectional flow and/or isolated self-test capabilities for the safety contact, in particular for the safety line state detector.
However, the present invention also concerns a bidirectional safety contact comprising a safety contact according to the present invention, the safety contact comprising the controller, the safety line state detector and the safety switch circuit as discussed previously, wherein the safety line state detector will be termed the left-to-right (L2R) safety line state detector and the safety switch circuit will be termed the left-to-right (L2R) safety switch circuit within the context of this bidirectional safety contact. This bidirectional safety contact further comprises a right-to-left (R2L) safety line state detector and a right-to-left (R2L) safety switch circuit. Hereby, the input of the L2R safety line state detector is connected to the output of the R2L safety switch circuit and the output of the L2R safety switch circuit is connected to the input of the R2L safety line state detector. Furthermore, the R2L safety line state detector is operably connected to the controller via an R2L control signal output. This R2L safety line state detector is configured to provide the controller with an R2L control signal representing a safety line state which is dependent on the safety line input signal received at the input of the R2L safety line state detector. The R2L safety switch circuit comprises a set of at least one safety switch, the safety switch being positioned between a power supply and an R2L output.
The controller is configured to detect an active safety line operation direction during a safety line direction detection phase, and, on the basis of the detected safety line operation direction, to:
Hence, when the safety switch of the linked safety switch is closed, the output of the linked safety switch circuit is essentially connected to the power supply, thus putting an output signal on the output indicating a working safety line state.
Linking a safety line state detector and a safety switch circuit in the safety line refers to configuring the controller to use this safety line state detector and this safety switch for any input and output signals concerned with driving the safety switches during an operational phase. Disconnecting a safety line state detector and a safety switch circuit from the safety line refers to configuring the controller to not use this safety line state detector and this safety switch for any input and output signals concerned with driving the safety switches.
For bidirectional safety contacts, as described above and further in this document, the safety line operation direction is detected during a safety line detection phase which is different from an operational phase of the safety contact during which the safety contact is configured to close the safety switch upon receiving a control signal indicating a working safety line state and a sensor input value representing no safety function failure and to open the safety switch upon a non-working safety line state or a sensor input value representing a safety function failure. During an operational phase, and while the control signal indicates a working safety line state and the sensor input value represents no safety function failure, it may be difficult to detect the safety line operation direction because the difference of the signal, typically the voltage, between the input and the output may be very small.
Preferably for a bidirectional contact, safety line direction detection comprises monitoring a first signal at the input of the L2R safety line state detector, which is connected to the output of the R2L safety switch circuit, and a second signal at the output of the L2R safety switch circuit, which is connected to the input of the R2L safety line state detector. The difference in signal can hereby be indicative of the safety line operation direction. Hence, the controller is preferably configured to monitor a first signal at the input of the L2R safety line state detector, which is connected to the output of the R2L safety switch circuit, and a second signal at the output of the L2R safety switch circuit, which is connected to the input of the R2L safety line state detector and to detect an active safety line operation direction on the basis of said first signal and said second signal, preferably on the basis of the difference thereof.
It should be noted that detecting the safety line operation direction was not necessary in prior art safety line setups wherein bidirectional relays were used as safety switches. Hence, in the present invention, preferably the safety switch, and more preferably each safety switch, is a unidirectional safety switch.
Furthermore, the present invention relates in a further aspect to a bidirectional safety contact comprising a controller which is configured for performing a safety line operation direction detection method, the bidirectional safety contact comprising a first input/output (I/O) contact and a second I/O contact, the first and second I/O contacts configured to allow insertion of the bidirectional safety contact in series in a safety line, said safety line operation direction detection method comprising the steps of:
The invention will now be described in more detail, with reference to the figures.
It should be noted that the safety line is typically used for checking the proper functioning of critical components of the train, i.e. typically components which are critical for ensuring safety of passengers or goods. As illustrated in
Note that, in general, it may not be known which carriage will serve as the active cab of the train. Moreover, a train may comprise a number of consists, each consist comprising a number of carriage. Typically the active cab will be a carriage at the end of a consist. Hence, preferably every carriage at the end of a consist is provided with a power supply (4), and with an alarm (5). Once the composition of the train is known, the active cab is known as well as the back carriage, i.e. the carriage at the opposite end of the active cab. Then, the alarm of the active cab and the power supply of the back carriage can be connected to the safety line.
Preferably the safety switch (17) is open unless actively closed by the control signal.
Because the output (19) of the safety switch circuit (13) is connected via the safety switch (17) to the power supply (18) in case of a working safety line state, there are no additive voltage drops when using many safety contacts in series on the safety line, i.e. the output signal for each safety contact in the safety line is typically the voltage provided by the power supply, with only a small voltage drop due to a single safety switch circuit (13) and therefore does not degrade with additional safety switches (6A-C) connected in series.
In an embodiment of the invention, as illustrated in
In an embodiment of the invention, the safety switch circuit (13) comprises a current sensor (20) between the power supply (18) and the safety switch (17), the current sensor (20) being operably connected (21) to the controller (11). Hereby, the controller (11) is configured to interrupt the safety switch (17) upon receiving a signal from the current sensor (21) indicative of an over-current. Preferably, the controller (11) is configured to interrupt the safety switch (17) if the signal from the current sensor (20) indicates that the current is larger than a pre-set current threshold. The presence of a current sensor (20) basically protects the one or more switches in the safety switch circuit against current surges.
The controller may preferably comprise a discrete logic circuitry, a programmable logic component, a field programmable gate array, a CPLD, a microcontroller and/or any combination thereof.
In an embodiment of the invention, the safety switch circuit (13) comprises a feedback logic circuit (22) connected between the output (19) of the safety switch circuit (13) and the controller (11) for providing the controller (11) with a signal indicative of the output signal. This feedback logic circuit (22) allows the controller (11) to check if the output signal corresponds with the state of the safety switch (17) controlled by the controller (11), i.e. if the controller has closed the safety switch, it can check via the feedback logic circuit that the output signal indeed corresponds to a closed safety switch, and thus to a working safety line state, while if the controller has opened the safety switch, it can check via the feedback logic circuit that the output signal indeed is zero, as it should be for an open safety switch. Hereby, if the controller (11) detects a discrepancy between the measured output signal and the expected output signal, the controller (11) is preferably configured to open the safety switch (17) and notify a central train controller of the occurrence of said discrepancy. As such, the controller (11) comprises a self-testing capability.
The operation of the safety contact is outlined in the flowchart of
The presence of two safety switches (17, 42), and optionally even more than two safety switches in series, reduces the risk of a dangerously non functional safety switch through the failure of a safety contact. For instance, a single point of failure such as a short circuited switch, does not lead to a failing safety contact. In a particularly preferred embodiment, the safety switch circuits (17, 42) comprises a feedback logic circuit (22, 45) for each of the at least two safety switches, each feedback logic circuit (22, 45) operably connected to the controller (11), for providing the controller with a signal indicative of the signal on the safety line after each safety switch (17, 42). As such, the controller is allowed to, and preferably is configured to, check after each safety switch, if the signal on the safety line corresponds to the expected signal. Hereby, in case of failure of one of the safety switches, the controller is capable of identifying which safety switch is failing.
The presence of two safety switches (17, 42), and optionally even more than two safety switches in series, reduces the risk of a dangerously non functional safety switch through the failure of a safety contact. For instance, a single point of failure such as a short circuited switch, does not lead to a failing safety contact. In a particularly preferred embodiment, the safety switch circuits (17, 42) comprises a feedback logic circuit (22, 45) for each of the at least two safety switches, each feedback logic circuit (22, 45) operably connected to the controller (11), for providing the controller with a signal indicative of the signal on the safety line after each safety switch (17, 42). As such, the controller is allowed to, and preferably is configured to, check after each safety switch, if the signal on the safety line corresponds to the expected signal. Hereby, in case of failure of one of the safety switches, the controller is capable of identifying which safety switch is failing.
The controller (11) may open and close the one or more safety switches (17, 42) by sending a switch control signal. The exact form of the switch control signal depends on the nature of the one or more safety switches. Preferably the one, two or more safety switches do not have moving parts, preferably the safety switches are solid state switches, more preferably electronic switches, still more preferably purely electronic switches, such as transistors, more preferably MOSFET switches and/or bipolar switches, more preferably MOSFET power switches, such as pMOS and/or nMOS power switches. Solid state switches are particularly preferred because they are vibration insensitive, which makes them possible to install and use on high-vibration train components such as bogies. Furthermore, purely electronic switches are preferred to switches such as the opto-electronic switches in document WO 2010/031570 A1, because purely electronic switches comprise lower impedance.
In a preferred embodiment of the invention, the safety line state detector (12) comprises self-testing capability. Preferably hereby, and with reference to the figures, the safety line state detector (12) comprises an active testing switch (47) and/or an inactive testing switch (46). Preferably the active testing switch (47) and/or the inactive testing switch (46) are electronic switches, such as transistors, more preferably MOSFET switches and/or bipolar switches, more preferably MOSFET power switches, such as pMOS and/or nMOS power switches. In a particularly preferred embodiment, the active testing switch (47) and/or the inactive testing switch (46) implemented in the same technology as the safety switches (14, 42). Thus preferably, the one, two or more safety switches, the active testing switch (47) and the inactive testing switch (46) are each an electronic switch, such as a transistor, more preferably a MOSFET switch or a bipolar switch, more preferably a MOSFET power switch, such as a pMOS or an nMOS power switch.
The inactive testing switch (46) is positioned in series between the input (15) of the emulator (12) and the control signal output (16) and is thus configured to disconnect the input (15) from the control signal output (16) if the inactive testing switch (46) is opened. The active testing switch (47) is positioned between the power supply (18) and the control signal output (16) and is thus configured to provide a power input to the control signal output (16), independent of the input signal at the input (15). The inactive testing switch (46) and/or active testing switch (47) allow testing of the input and input signal.
The inactive testing switch (46) and/or the active testing switch (47) are controlled by the controller (11). During an operational phase of the safety line (3), the inactive testing switch (46) is closed and the active testing switch is open (47), allowing to send a control signal on the basis of the safety line input signal to the controller (11). Preferably the controller (11) is configured to test the safety contact, and preferably the line state detector (12), for failure during a testing phase at certain moments, e.g. at start-up and/or on regular intervals. The controller (11) is hereby preferably configured to:
In a preferred embodiment, the safety line state detector (12) comprises a logic level convertor (48) positioned in series between the input (15) and the control signal output (16), and preferably between the active and/or inactive switches (46, 47) on the one side and the controller output (16) on the other side. The logic level convertor (48) is configured to transform a power supply voltage level to a controller voltage level.
In a preferred embodiment, the safety line state detector (12) comprises a leaking protection subcircuit (49) between the input (15) and other electronic components (46, 47, 48) of the safety line state detector (12) to protect the input (15) from leaking test voltages out of the input. Preferably, the leakage protection subcircuit (49) comprises a diode (50) positioned between the input (15) and the other electronic components of the safety line state detector (12).
In a preferred embodiment and with reference to
Preferably, in the case the safety switch circuit (13) comprises at least two safety switches (17, 42), as is shown in
In an embodiment, the safety contact is uni-directional as shown in
In an embodiment, a bidirectional safety contact may comprise two unidirectional safety contacts, one arranged for each direction. Hereby, the safety contacts may be implemented separated. The safety contacts may hereby also preferably comprise a unidirectional pass-through subcircuit at the input of the safety line state detector and/or at the output of the safety switch circuit, to ensure unidirectional flow.
However, the present invention also concerns a bidirectional safety contact (60) comprising a safety contact according to the present invention and as illustrated in
Linking a safety line state detector and a safety switch circuit in the safety line refers to configuring the controller to use this safety line state detector and this safety switch for any input and output signals concerned with driving the safety switches. Disconnecting a safety line state detector and a safety switch circuit from the safety line refers to configuring the controller to not use this safety line state detector and this safety switch for any input and output signals concerned with driving the safety switches. Disconnecting may preferably be achieved by opening at least one, and preferably each of the safety switches of the disconnected safety switch circuit, and/or by opening at least one, and preferably each of testing switches, such as the active testing switch and/or the inactive testing switch, of the disconnected safety line state detector. Alternatively or additionally, disconnecting may preferably be achieved by the controller being configured to ignore signals from the disconnected safety line state detector and/or the disconnected safety switch circuit.
The methodology for deciding upon the direction of flow, is illustrated in the flow chart of
It is understood that the terms left-to-right (L2R) and right-to-left (R2L) are used to distinguish between the two possible directions in which a safety line can be operated, and do not necessarily indicate the actual directions in space. The terms are merely coined this way in order to correspond to the directions in the figures for ease of explanation.
In a preferred embodiment, the controller comprises a field-programmable gate array (FPGA), a complex programmable logic device (CPLD), an application-specific integrated circuit (ASIC) and/or a processing unit, such as a central processing unit (CPU), most preferably the controller comprises or is implemented in a field-programmable array.
It is understood that the different embodiments described above with respect to more specific implementations of the invention, in particular related to the safety line state detector, the safety switch circuit, the logic safe-guard circuit, etc. can also be implemented in the bidirectional safety contact according to the present invention. For instance, the embodiment wherein the safety switch circuit comprises at least two safety switches in series in the safety line can be applied to the bidirectional safety contact whereby the LR2 safety switch circuit and/or the R2L safety switch circuit comprises at least two safety switches. Further,
| Number | Date | Country | Kind |
|---|---|---|---|
| 21188867.2 | Jul 2021 | EP | regional |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/EP2022/071530 | 8/1/2022 | WO |
