EP1953063B1 - Field vital output device and system for directly interfacing a control logic unit with at least one or more wayside units - Google Patents

Field vital output device and system for directly interfacing a control logic unit with at least one or more wayside units Download PDF

Info

Publication number
EP1953063B1
EP1953063B1 EP07425064A EP07425064A EP1953063B1 EP 1953063 B1 EP1953063 B1 EP 1953063B1 EP 07425064 A EP07425064 A EP 07425064A EP 07425064 A EP07425064 A EP 07425064A EP 1953063 B1 EP1953063 B1 EP 1953063B1
Authority
EP
European Patent Office
Prior art keywords
output
port
unit
contacts
vital
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Not-in-force
Application number
EP07425064A
Other languages
German (de)
English (en)
French (fr)
Other versions
EP1953063A1 (en
Inventor
Francesco Campedelli
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alstom Ferroviaria SpA
Original Assignee
Alstom Ferroviaria SpA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alstom Ferroviaria SpA filed Critical Alstom Ferroviaria SpA
Priority to DE602007000438T priority Critical patent/DE602007000438D1/de
Priority to ES07425064T priority patent/ES2320711T3/es
Priority to AT07425064T priority patent/ATE419160T1/de
Priority to EP07425064A priority patent/EP1953063B1/en
Publication of EP1953063A1 publication Critical patent/EP1953063A1/en
Application granted granted Critical
Publication of EP1953063B1 publication Critical patent/EP1953063B1/en
Not-in-force legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • B—PERFORMING OPERATIONS; TRANSPORTING
    • B61—RAILWAYS
    • B61L—GUIDING RAILWAY TRAFFIC; ENSURING THE SAFETY OF RAILWAY TRAFFIC
    • B61L7/00—Remote control of local operating means for points, signals, or track-mounted scotch-blocks
    • B61L7/06—Remote control of local operating means for points, signals, or track-mounted scotch-blocks using electrical transmission
    • B61L7/08—Circuitry

Definitions

  • the invention relates to a field vital output device for directly interfacing a control logic unit with at least one or more wayside units, such as relays, contacts, lamps and the like, which device comprises:
  • railway safety relays consist of railway safety relays. They are used, for instance, for actuating remote safety relays, which are situated at or near the wayside units, such as particularly the relays used for remote parallel information transmission.
  • US 6,463,337 B1 describes a vital signal output module using random numbers for validating the commands to the field elements.
  • Prior art railway safety relays and thermal cutout circuits have a complex and bulky construction and do not ensure electrical insulation between field devices, i.e. wayside units and electronic devices. Furthermore, prior art railway safety relays require regular maintenance.
  • the invention is based on the problem of providing a stationary output device for actuating field devices, such as wayside units or the like, which may be used instead of prior art railway safety relays, and provide at least the same or better safety standards as compared with prior art relays.
  • the invention fulfils the above objects by providing an output device as described hereinbefore, having:
  • the conventional enabling/disabling means typically fail-safe railway relays
  • the conventional enabling/disabling means may be replaced by commercial non-fail-safe electromechanical enabling/disabling means, such as force guided relays, without affecting the required safety standard, thereby reducing the volume for the requested function, and avoiding regular maintenance needs.
  • This is achieved by associating the electromechanical means to electronics that, using an efficient mechanism for vital control of the switching state, allows to disable the output device whenever it comes to an unsafe permissive state.
  • the electromechanical switching element comprises at least one input and at least one output.
  • the input-to-output relation is a function of the port enabled/disabled state and is vitally detectable by the electronics by comparison of the output of the switching element with a check code transmitted to its input.
  • the switching element has at least one pair of relay contacts, also known as auxiliary contacts, which are electrically connected to the input and the output of the switching element respectively.
  • This pair of contacts is mechanically connected to the port enabling/disabling means, which are advantageously a second pair of relay contacts, so-called main contacts, which are electrically connected to the output signal generating means and the output port respectively.
  • the two pairs of contacts are mechanically interconnected so that switching of one pair causes switching of the other, and are typically part of the same relay, which is also known as a force guided relay for its mechanical characteristic of only allowing rigid movements between the contacts. This allows to assess the closed/open state of the main contacts, and of the port, by analyzing the open/closed state of the auxiliary contacts.
  • the auxiliary contacts are not energized by the wayside unit control voltage, thence their state may be easily detected by determining whether or not a control signal transmitted to one contact reaches the other contact of the pair. If the closed/open state of the auxiliary contacts, and therefore the enabled/disabled state of the port, is not consistent with the transmitted actuating control, the vital supply voltage is promptly cut off, and the port output is set to a safe non permissive state, corresponding to a de-energized condition of the wayside unit.
  • the main contacts are normally open when idle (i.e. when no control is transmitted thereto) to ensure a safe non permissive state when the port is not selected/enabled, whereas the auxiliary contacts are normally closed when idle. Furthermore, the mechanical linkage among the contacts prevents them from being simultaneously closed/open. Thus, the logic port enabled state is reversed with respect to the state of the auxiliary contacts, which provides further protection against short-circuit failures.
  • the device may also include a signal polarity selection circuit, which may also accomplish the task of the output port enabling/disabling means.
  • a signal polarity selection circuit which may also accomplish the task of the output port enabling/disabling means.
  • the device operates in a safe manner, as the mechanisms for checking the actual port enabled/disabled state are directly operative on the function of vitally enabling output signal generation, and typically consist of DC/DC or DC/AC converters which are pulse-driven under the control of a DC enabling signal.
  • the device may advantageously comprise an overcurrent protection circuit, typically between the signal generator and the enabling/disabling relays, which is calibrated to prevent the generated output signal from reaching the output port, typically using a manually or software-wise resetting double break mechanism, as soon as a current absorption above a given trigger value is detected.
  • This provides an additional safety mechanism for the device, particularly against short-circuit failures, such as those caused by cable insulation losses, especially if the output ports of the uncontrolled devices are normally short-circuited, e.g. by means of force guided relays.
  • the combination of the overcurrent protection and short-circuit functions is particularly effective in protecting the wayside units from undue actuation, e.g. caused by double, separate, ordered contact failures, i.e.
  • the device typically has a local unit interfacing with the central logic unit for controlling the device.
  • the local unit is configured to convert the port enabling/disabling controls from the central logic unit to corresponding relay switching controls and is interfaced with the overcurrent protection circuit to disable the relay switching controls whenever the protection circuit is triggered.
  • the local unit further comprises electronics for vital detection of the wayside unit actuating signal transmission enabled/disabled state of the output port.
  • the port enabled/disabled state is detected by circulation of functional check codes (codewords) from the central logic unit to the local unit.
  • the local unit turns the codewords into input signals for the switching element, reads the output thereof and codes such output into corresponding codewords to be transmitted back to the central logic unit.
  • the central unit can assess the port state by checking the open/closed states of the contacts of the switching element, i.e. the auxiliary contacts of the enabling/disabling relay. Particularly, in the specific case of auxiliary contacts that are normally open when idle, the port is in the enabled state when the codewords do not circulate through said contacts.
  • the invention relates to a vital input and/or output field system comprising:
  • the protection unit preferably comprises a power source which is controlled to deliver vital supply voltage to the output device in response to checkword/codewords correctness and sequence checks.
  • the vital supply voltage is cut off when the enabled/disabled state of the output device does not correspond to the control condition imposed by the control logic.
  • the system is preferably of the redundant type, which means that all wayside units or at least some of them are controlled by a pair of parallel equivalent vital output devices.
  • the system comprises a vital redundancy management circuit which is configured to exclusively enable the first or second device respectively, to ensure safe actuation of the wayside unit in case of malfunction of either device.
  • the system comprises two or more vital output devices for directly interfacing a control logic unit with two or more wayside units, such as relays, contacts, lamps and the like, which devices comprise:
  • the system is configured to protect the units from undue actuation caused by double separate ordered contact on multipolar cables and the relays used to short circuit the ports are force guided by auxiliary contacts to allow rereading of the actual enabled state, by codeword circulation.
  • the invention in another aspect, relates to a system for safe digital information exchange between a control logic unit and one or more remote wayside units, by means of electrically insulated control conductors, which information is transmitted by the logic unit to the remote unit/s in the form of controls for forcing the presence/absence of voltage corresponding to the type of binary information desired on one or more ports that can be accessed by the remote unit/s.
  • the energized/de-energized state of the port/s is determined by enabling/disabling one or more force guided relays in electric communication with voltage generating means.
  • the enabled/disabled state of said relay/s is reread by the control logic by circulation of codewords for vitally disabling such generating means when the enabled/disabled state of the relay/s does not correspond to the control condition imposed by the control logic due to the presence of failures or undesired potentials possibly induced on control conductors due to degradation of ground and mutual insulation of conductors.
  • the system is configured to cyclically check the insulation of control conductors by repeated vital reading of the actual enabled state of a remote port after transmission of a predetermined sequence of enabling codewords to the control conductors.
  • the subsystem of this block diagram comprises a control logic unit 1, which interfaces with one or more wayside units 3, such as relays, contacts, lamps or the like, through a Field Vital Input/Output FVIO.
  • the device 2 is designed both to interpret the control signals from the logic 1 and convert them into safe actuation signals 9 for the wayside unit 3 (Field Vital Output function, i.e. FVO 102), and to safely read data 10 from the wayside unit 3 (Field Vital Input function, i.e. FVI 202).
  • the device 2 interfaces with the logic unit 1 by one or more data buses, two data buses being shown in Fig. 1 , for output 4 and input 5 respectively.
  • the device 2 receives power 6 for its internal digital circuits (+5V), AC voltage 7, typically 220 VAC, for generating the actuation signal and a DC voltage 8 (12 VIT) for vitally enabling the generation of such actuation signal.
  • Fig. 2 is a block diagram of the vital output device FVO 102 with reference to a single output port.
  • the device 102 comprises 8 overcurrent-protected output modules which, depending on the control from the logic 1, can provide a positive or negative DC voltage (typically ⁇ 48V, ⁇ 144V) or an AC voltage (typically 150 Vac), for actuating the wayside unit 3.
  • a positive or negative DC voltage typically ⁇ 48V, ⁇ 144V
  • AC voltage typically 150 Vac
  • the voltage for actuating the wayside unit connected to the output port 9 is generated by the module 10 which comprises, in a preferred embodiment, switching converters that can convert the input AC voltage 7 into the desired output voltage V when the vital signal 8 is enabled.
  • the generator 10 comprises four converters to provide DC voltages of 24V, 48V and 144V and an AC voltage of 150 V respectively.
  • the circuit 110 selects the appropriate output voltage by actuating the corresponding converter. According to an embodiment, such selection occurs by grouping ports: preferably eight modules, or six and two modules, or four and four modules. Thus, each port may be freely configured as needed. For safety, such configuration is performed manually by the installation and/or testing operator during installation and/or testing, by using jumpers or connectors on the motherboard of the module 110. Fig.
  • FIG. 4 shows the structure of the generator module 10, which is well known in the art, in greater detail.
  • the rectifier 410 typically a diode bridge
  • the AC/DC or DC/DC conversion stage Conversion occurs by switching, as is known in the art, and is PWM driven under the control of the DC enabling signal 8.
  • the enabling signal is operative on the pulsed-driving stage to prevent generation of driving pulses when vital power +12VIT is not present.
  • the diagram of Fig. 4 is complemented by additional overcurrent protection components 910 and insulation components 710.
  • the insulation measurement circuit is the one designated by 103 in Fig. 2 .
  • a circuit for checking ground insulation 610 may be used, which is interfaced with the local logic through a diagnostic circuit 70. Any ground insulation loss measurement device may also be used, provided that it complies with EEC standard EN 61557-8.
  • the output voltage from the generator 10 reaches the overcurrent protection circuit 20 which disables the output whenever current absorption exceeds the trigger value.
  • a solid state double break switch 320' and a double measurement circuit 120' may be possibly provided.
  • the first threshold (known as “thermal” threshold) is lower than the second threshold (known as “magnetic” threshold) but may be held for a longer time.
  • the solid state switches 320 and the relays 130 and 230 of Fig. 3 may be disabled under the control of the ZLC control logic software, which may break both phases of the signal (double-break) and directly remove the port enabling control, when the "thermal" current threshold is exceeded: this condition is communicated by the central control logic by corresponding codewords.
  • the local logic (designated as 20 in Fig. 2 ) that causes the solid state switches 320 and/or 320', referring to the variants of Figures 5A and 5B respectively, and possibly the relays 130 and 230 of Fig. 3 , to break both signal phases (double-break).
  • Such condition is indicated by a LED on the front panel 80 and is diagnosed by the module 70 through the local logic 60.
  • a button is provided on the panel 80 which enables the modules of the overcurrent device 20 again. Reset may be also controlled remotely, by software means.
  • the trigger value of the protection circuit 20 is defined by local configuration, as a function of the output voltage and the type of controlled unit. For example, a default "thermal" value of 0.1 A corresponds to the 48V outputs.
  • the overcurrent protection function 20 is provided by current measurement (sensing) circuits 120, and a static switch 320, which is set to the open state by the circuit 220, when the sensed current exceeds the trigger threshold.
  • the overcurrent protection function 20 is provided by current measurement (sensing) circuits 120, 120' on both power conductors, and a double static switch 320, 320' which is set to the open state by the circuit 220, when the sensed current exceeds the trigger threshold.
  • a test is regularly provided to check overcurrent protection effectiveness, which test is controlled by the central logic SW (software) before ports are enabled.
  • the SW closes a dummy load of known value is closed for a short time, to cause the "thermal" current threshold to be exceeded, and checks that the local sensing circuit detects this situation by dedicated codewords, and then the SW opens the switch 320 and checks that the sensed current changes back to zero. If one of these conditions is not fulfilled, the overcurrent protection circuit does not operate properly and the corresponding port is not enabled.
  • the output voltage from the overcurrent protection module 20 reaches the output of the port 9 through the relay-driven actuation and polarity selection stage 30 which form the core of the device.
  • the relay-driven actuation and polarity selection stage 30 comprises a pair of force guided relays 130 and 230, each having two pairs of main contacts 133-134, 135-126 and 233-234, 235-236, which are normally open when idle, i.e. are able to break the circuit when no driving signal 137, 237 is detected.
  • Each relay 130, 230 further comprises a pair of auxiliary Drive-Sense contacts (131-132, 231-232), which are normally closed when idle.
  • the components 138 and 238 reverse the output signal with respect to the input to protect against short circuit failures between Drive 131, 231 and Sense 132, 232.
  • Force guided relays such as those compliant with EN 50205 and UIC736e, sold by ELESTA relays GmbH, are so called because they have mechanically linked contacts, so that switching of one pair of contacts causes switching of the other pair/s of contacts.
  • normally open and normally closed contacts cannot be closed at the same time. According to the above mentioned standard, if one pair of normally closed contacts does not open when the relay is actuated, e.g. due to contacts being joined together, all the remaining normally open contacts of the relay must not close or must be spaced at least 0.5 mm apart.
  • the pair of force guided relays 130, 230 has the function of actuating the device, i.e. of transmitting the voltage generated by the module 10 to the output port 9, and of reversing the polarity thereof.
  • the two relays 130, 230 are connected with parallel inputs 133/233, 135/235 and antiparallel outputs 134/236, 136/234, to provide a bipolar output signal which is in phase with the input signal, if the relay 130 is actuated, or in counterphase with the input signal, if the relay 230 is actuated.
  • the two relays 130, 230 are actuated by a high logic signal "1" on the control terminals 137, 237.
  • the driving logic is configured to actuate the two relays 130, 230 when the ON+ and ON- controls 530, 430 are at the high logic level “1" and in the enabled "overcurrent protection” signal conditions respectively.
  • This signal comes from the block 20, upstream from the stage 30, and is disabled, i.e. assumes the low logic value "0", when overcurrent protection is triggered, whereas the controls 530 and 430 come from the central logic unit 1 through the local logic 60.
  • the driving signals 137, 237 of the relays 130 and 230 come from the AND ports 630 and 730 respectively, which have the "overcurrent protection" signal 330 at their outputs, as well as the ON+ signal 530 and ON- signal 430 respectively. If overcurrent protection is triggered, then the relay drive is disabled whatever the control condition on the terminals 430 and 530. If protection is not triggered, the two relays 130, 230 may be controlled by sending a high logic level signal on ON+ or ON-.
  • the local control logic 60 shall ensure that these controls are mutually exclusive, to prevent both relays 130, 230 from being in a simultaneously actuated condition, which would cause the port to be shorted. Should such short-circuit occur due to a failure, safety would be ensured anyway by overcurrent protection, which causes both relays 130, 230 to be disabled, by disabling the signal 330.
  • a third relay NCC 40 provides the "neutral closed circuit" function, when the port is not actuated, i.e. when both ON+ and ON- controls 530, 430 are at the low logic level "0" and the board is operating, as two boards belonging to the systems N and R respectively (see Fig. 8 ) may be connected in parallel to the same units. This condition ensures that no failure or off condition of one of the systems causes the relay to close (undue NCC).
  • This normally open forced guide relay 40 is driven 140 by a logic port NOR 830 having the ON+ and ON- signals 530, 430 as inputs. Actuation of the relay causes the port to be shorted, thereby ensuring effective protection against cable insulation loss failures, as better shown hereafter.
  • the actuation state of the NCC relay 40 may be diagnosed from its auxiliary contact (not shown).
  • the two relays 130 and 230 are independently managed by the local logic 60 through the Drive+/Sense+ circuits 131-132 and Drive-/Sense- circuits 231-232, under the control of the central logic 1 of the ZLC subsystem.
  • Checking occurs by circulating a binary check word (codeword), generated by the logic 1 of the ZLC system, through the (normally closed) auxiliary contact, corresponding to the (normally open) main contact of the relevant relay 130, 230.
  • codeword When the port is not controlled, the codeword circulates through the closed contacts and is reread and denied by the logic. Codeword denial protects against short circuit failures between Drive and Sense.
  • the ZLC system disables vital power 7 to the subsystem in use, and the relevant output ports 9 are not powered.
  • the system is set to unpowered port conditions, in a response time of less than 200 ms.
  • the wayside units 3 with which the FVO subsystem 102 interfaces shall ensure they will not be set to a permissive state for a time not shorter than such safe response time.
  • the central logic 1 is a vital computer logic, such as the one disclosed in WO03093999 , and is basically composed of two main sections:
  • the control section 101 and the protection section 201 are managed by two independent processors, which communicate by a Dual Port RAM 301. More specifically, the control section 101 generates codewords to feed the protection section 201, which cyclically consumes the codewords and detects possible control process errors.
  • the protection section 201 vitally generates the voltage 8 required to enable the voltage generators 10 on the vital output device 102.
  • the checks performed by the protection section 201 are both logic and time checks; the protection section periodically receives codewords from the control section 101, which codewords are used to confirm proper performance of all safety-related operations, and checks the validity thereof. If codewords are logically correct, they arrive in well defined time ranges and the self-diagnostic process of the protection section 201 detects no failure, then the protection section 201 provides vital power supply 8, otherwise, it removes such power supply, and prevents any signal transmission to the wayside units.
  • the output device 102 can safely deliver the power required to actuate the wayside unit 3, without using expensive and bulky fail-safe railway relays.
  • the vital output device 102 of the invention is designed to be interfaced with diagnostic devices 601, 103 for measuring ground insulation losses, pursuant to EEC standard EN 61557-8. Insulation loss checks may be performed either at the supply cables and at wayside cables. In the former case, the measuring device indicates ground insulation losses of the group of ports having the same power source, in the latter, insulation loss is indicated for each port. In both cases, the control unit can promptly disable the relevant port.
  • any undesired control induced by noise on the cables that interface the control unit 1 with the vital output device 102 is prevented by the vital port state control mechanism, whereas the combination of the above discussed overcurrent 20 and short-circuit 40 protection functions is particularly effective in protecting the wayside units from undue actuation, e.g. caused by double separate ordered contact failures (d.s.o.c.), as schematically shown in Fig. 7 .
  • These failures involve a short circuit between cables directed to different units and cause an uncontrolled unit (unit2) to be in parallel with a controlled unit (unit1) and to be unduly actuated as a result.
  • the port (OUT#1) that delivers the required power to actuate the unit is also short-circuited, thereby generating an increase of the delivered current (Imax), which causes overcurrent protection 20 to be triggered before any undue actuation.
  • the overcurrent protection 20 trigger value shall be such that the residual voltage at the ends of the unit2 is lower than its minimum actuation threshold.
  • the residual voltage value at the ends of the unit is closely related to the length of the cable section, whose resistance is designated by R.
  • the NCC relay state is controlled by the ZLC logic SW by circulation of codewords through one of the auxiliary contacts of such relay.
  • the ZLC subystem is preferably of the hot backup redundant type, which means that the wayside unit 3 is driven by a pair of equivalent subsystems as described and shown in Fig. 1 .
  • Fig. 8 is a block diagram of this redundant subsystem.
  • N and B designate Normal and Backup respectively.
  • Each of the N and B subsystems can safely provide the same functions. Particularly, they operate in parallel, i.e. they transmit the same controls and perform the same processing, although only the input/output port of one of the two devices 2, 2', typically the N device, is enabled. Should a malfunction occur to one of the two subsystems, a vital redundancy management circuit (not shown) enables the other subsystem to assure safe actuation of the wayside unit 3.
  • Redundancy is particularly advantageous in case of failure of the short circuit protection circuit 40 of one of the ports of the vital output device 102.
  • the same function may be thus accomplished by the short circuit protection circuit of the output device of the parallel redundant subsystem associated to the unit, which further increases the safety of the whole ZLC subsystem.

Landscapes

  • Engineering & Computer Science (AREA)
  • Mechanical Engineering (AREA)
  • Arrangements For Transmission Of Measured Signals (AREA)
  • Train Traffic Observation, Control, And Security (AREA)
  • Communication Control (AREA)
  • Relay Circuits (AREA)
  • Testing Electric Properties And Detecting Electric Faults (AREA)
EP07425064A 2007-02-05 2007-02-05 Field vital output device and system for directly interfacing a control logic unit with at least one or more wayside units Not-in-force EP1953063B1 (en)

Priority Applications (4)

Application Number Priority Date Filing Date Title
DE602007000438T DE602007000438D1 (de) 2007-02-05 2007-02-05 Ausgabegerät und System zur Verbindung einer Steuerungslogik-Einheit mit einer oder mehreren streckenseitigen Einheiten
ES07425064T ES2320711T3 (es) 2007-02-05 2007-02-05 Dispositivo de campo de salida vital para interconectar directamente una unidad de control logico con al menos una o mas unidades de borde de via.
AT07425064T ATE419160T1 (de) 2007-02-05 2007-02-05 Ausgabegerät und system zur verbindung einer steuerungslogik-einheit mit einer oder mehreren streckenseitigen einheiten
EP07425064A EP1953063B1 (en) 2007-02-05 2007-02-05 Field vital output device and system for directly interfacing a control logic unit with at least one or more wayside units

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP07425064A EP1953063B1 (en) 2007-02-05 2007-02-05 Field vital output device and system for directly interfacing a control logic unit with at least one or more wayside units

Publications (2)

Publication Number Publication Date
EP1953063A1 EP1953063A1 (en) 2008-08-06
EP1953063B1 true EP1953063B1 (en) 2008-12-31

Family

ID=38246329

Family Applications (1)

Application Number Title Priority Date Filing Date
EP07425064A Not-in-force EP1953063B1 (en) 2007-02-05 2007-02-05 Field vital output device and system for directly interfacing a control logic unit with at least one or more wayside units

Country Status (4)

Country Link
EP (1) EP1953063B1 (es)
AT (1) ATE419160T1 (es)
DE (1) DE602007000438D1 (es)
ES (1) ES2320711T3 (es)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
NL2010803C2 (nl) * 2012-10-04 2013-12-02 Volkerrail Nederland B V Systeem en werkwijze voor het bewaken van de bedrijfsfuncties van mechanisch bewogen componenten van een spoorweg, door relaissensoren en motorstroombewaking.
FR3012100B1 (fr) * 2013-10-18 2017-06-09 Scle Systemes Pour Le Ferroviaire Et L'energie Dispositif pour securiser un systeme utilisant des commandes electriques
CN107942646B (zh) * 2017-12-27 2024-01-23 卡斯柯信号有限公司 一种安全性独立主备切换设备及方法
IT201900009879A1 (it) * 2019-06-24 2020-12-24 Tekfer S R L Disposizione circuitale di relè a doppio scambio, in particolare per applicazioni di segnalamento ferroviario, e procedimento per il suo controllo
CN115195814B (zh) * 2022-07-15 2024-01-12 中国铁道科学研究院集团有限公司 一种车站地面控制系统及电码化单元控制方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5922034A (en) * 1996-12-06 1999-07-13 Union Switch & Signal Inc. Programmable relay driver
DE19836079A1 (de) * 1998-07-30 2000-02-10 Siemens Ag Anordnung und Verfahren zur sicheren Prozeßsteuerung
US6463337B1 (en) * 1999-12-20 2002-10-08 Safetran Systems Corporation Railroad vital signal output module with cryptographic safe drive
EP1524167B1 (de) * 2003-10-14 2010-11-03 Siemens Schweiz AG Verfahren und Schaltungsanordnung zur Erzeugung einer eisenbahntechnisch sicheren Rückmeldung
EP1594101A1 (de) * 2004-05-08 2005-11-09 Siemens Schweiz AG Verfahren und Stellteil zur Steuerung und/oder Überwachung von Funktionseinheiten mittels Speisesignalmodulation

Also Published As

Publication number Publication date
ES2320711T3 (es) 2009-05-27
ATE419160T1 (de) 2009-01-15
DE602007000438D1 (de) 2009-02-12
EP1953063A1 (en) 2008-08-06

Similar Documents

Publication Publication Date Title
RU2604633C2 (ru) Интерфейсный блок, транспортировочная система и способ контроля рабочего состояния входной схемы в схеме обеспечения безопасности транспортировочной системы
JP5728095B2 (ja) 電気負荷をフェイルセーフに停止させるための安全開閉装置
CN100471034C (zh) 禁止大功率器件操作的独立安全处理器
EP1953063B1 (en) Field vital output device and system for directly interfacing a control logic unit with at least one or more wayside units
JP2554042B2 (ja) プログラマブルコントローラの入出力装置
JP6025219B2 (ja) 安全回路アセンブリ
US3888772A (en) Communication between redundant protection and safeguards logic systems within nuclear reactor power plants by means of light
JP4263339B2 (ja) 安全スイッチ装置
EP0241270B1 (en) Self-testing monitoring circuit
RU2679754C1 (ru) Релейный объектный контроллер для железнодорожной автоматики и телемеханики, способ безопасного определения состояния реле, способ безопасного управления реле, способ тестирования обмотки реле
EP1938356B1 (de) Überwachung einer vorgeschalteten schutzeinrichtung an einem schaltgerät
JPH0782369B2 (ja) プログラマブルコントローラの入出力装置
US8274771B2 (en) Safety switching device and modular failsafe control system
JP4313199B2 (ja) 少なくとも２つの航空機座席用の制御及び電源システム
CN108847789B (zh) 用于交流伺服驱动器的安全转矩关断电路及系统
CN113759291B (zh) 故障检测方法、装置、储能系统及可读存储介质
KR100201404B1 (ko) 바이탈 전원차단 계전기를 이용한 페일세이프 구현장치 및 제어방법
CN108965314B (zh) 基于飞腾处理器的网络通信装置
CN109586618B (zh) 一种用于电气设备的驱动系统
US20240103474A1 (en) Safety i/o module with multi-channel high side switch
JP5190032B2 (ja) 遮断器用操作器
KR0186119B1 (ko) 철도신호용 바이틀입력 인터페이스 회로 및 방법
GB2142756A (en) Safety switching system
JP2024000586A (ja) 電子制御装置
AU596531B2 (en) Switching control and monitoring apparatus

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20080114

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA HR MK RS

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

Ref country code: CH

Ref legal event code: EP

REF Corresponds to:

Ref document number: 602007000438

Country of ref document: DE

Date of ref document: 20090212

Kind code of ref document: P

REG Reference to a national code

Ref country code: GR

Ref legal event code: EP

Ref document number: 20090400136

Country of ref document: GR

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

AKX Designation fees paid

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2320711

Country of ref document: ES

Kind code of ref document: T3

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

NLV1 Nl: lapsed or annulled due to failure to fulfill the requirements of art. 29p and 29m of the patents act
PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

Ref country code: BE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090331

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090601

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090430

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

Ref country code: MC

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090228

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

REG Reference to a national code

Ref country code: FR

Ref legal event code: ST

Effective date: 20091030

26N No opposition filed

Effective date: 20091001

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090901

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090331

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090205

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090302

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20090205

PGRI Patent reinstated in contracting state [announced from national office to epo]

Ref country code: IT

Effective date: 20110501

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20090701

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20081231

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20110205

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110228

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110228

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110205

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: ES

Payment date: 20210422

Year of fee payment: 15

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: IT

Payment date: 20220218

Year of fee payment: 16

Ref country code: GR

Payment date: 20220221

Year of fee payment: 16

REG Reference to a national code

Ref country code: ES

Ref legal event code: FD2A

Effective date: 20230329

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220206

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230906

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230205