FIELD OF INVENTION

This invention relates to a safety device for use with a railway signalling interlock arrangerr nt according to the preamble of the attached main claim.

DESCRIPTION OF PRIOR ART

Safety devices of the kind mentioned in the introduction are known, e. g. from the Swedish patent number 362 041, in which a computer in the interlock arrangement delivers to the safety device two instruc¬ tions having the same meaning but having different forms. Other inter¬ lock arrangements are known which contain two computers programmed to deliver two identical instructions to the safety device. The inter¬ pretation of the instructions for the safety device has originally been carried out by decoders containing relays. When the relays of the decoders were replaced by electronic circuits, it was feared that the degree of safety would decrease unless special measures were taken.

SUMMARY OF THE INVENTION

The safety device according to the invention has the special features which are set out in the characterizing part of the main claim.

With the safety device according to the invention, the certainty of a control device which controls the railway operations being 'set accord¬ ing to the proper instructions is considerably increased by virtue of the fact that relay-contacts with their well recognized isolating ability are used to keep circuits open that are intended to be open, while thyristors with their ability to break current without wear are used to break the current in the circuits which normally causes wear in relay-contacts.

It is a further object of the invention to ensure that indication signals are delivered from the safety device indicating every initiatc-d εettinri of the control device, and that the sectinα is

it is of a wrong kind before it has been fully carried out. It is a still further object of the invention to ensure that the correct func tion of the instruction receivers of the safety device can be checked by setting them to combinations of positions other than those which initiate setting of the control device and ^' operating the receivers for such a short period of time that the control device is not affect

BRIEF DESCRIPTION OF DRAWINGS

In the following, an example of a safety device according to the invention for use with a railway signalling interlock arrangement will be ^' described wherein reference is made to the attached drawing, in whi Figure 1 shows a safety device connected to a signal light, and

Figure 2 shows a safety device connected to a railway point machine.

PREFERRED EMBODIMENT

The safety device 1 in Figure 1 for a railway signalling interlock arrangement is connected to a signal light 2 provided with two signal lamps 2a, 2b for green light and with one signal lamp 2c for red light

The safety device 1 comprises three instruction receivers 3a, 3b, 3c, connected to an indication processing means 5 in a central lock unit 6 by means of a digital data communication cable 4.

Two of the instruction receivers 3a and 3b are each provided with one decoder 7a and 7b respectively for decoding received data words. The decoders are each connected to one relay 8a, 8b which are each provide with one normally closed contact 9a, 9b which are shunt connected and connected to the signal lamp 2c for red light. The relays are also each provided with one normally open contact 10a, 10b which are series connected and connected to the two signal lamps 2a, 2b for green light which are connected in parallel.

The safety device 1 is further provided with a third instruction receiver 3c which comprises a decoder 7c and two switches 20a and 20b connected to the decoder. The switches are each connected in ore of

the circuits for the green lights 2a, 2b. The decoders 7a, b, c are made from electronic logic circuits and the switches 20a and 20b are thyristors.

The safety device is supplied with alternating current for driving the three signal lamps by means of three separate transformers 19a, 19b, 19c.

The safety device 1 comprises further indication means in the form of voltage sensors 12 in a circuit for the signal lamp 2c for red light and 13 in the common circuit for feeding the signal lamps 2a, 2b for green light. Voltage sensors 14 and 15 are further arranged in each of the circuits for the signal lamps for green light. Indication means in the form of a current sensor 16 are connected in the circuit for the red signal lamp and one current sensor 17, 18 is connected in each of the circuits for the green lamps. Indication signals from the signal means are transmitted by a wire in the cable 4 back to the indication processing means 5 in the central interlock unit 6, although separate wires for this purpose are not shown in Figure 1.

In normal operation the signal lamp 2c for red light - stop signal - is illuminated as long as no instruction to switch on a drive signal for green light has been received by the safety device 1. Both in¬ struction receivers 7a, 7b are arranged in a manner known per se each to receive an instruction with the same meaning, i.e. that the signal lamp for red light is to be switched off and at least one of the signal lamps for green light is to be switched on, but the instruc- tions for each of the instruction receivers may be coded in a different manner. The decoders of the instruction receivers are arranged to supply current to their respective relay coils 8a, 8b upon receipt of the pre-deter ined code word to cause the contacts of the relay to switch over. As the normally closed contacts 9a, 9b for the signal Lamp for red light are shunt connected and the normally open contacts 10a, 10b for the signal lamps for green light are series connected, change-over between red and green light is brought about only by switching both relays 8a and 8b together. Both instructions to the

instruction receivers were prepared independently and at different times in a process computer which is contained in the central inter lock unit 6. The instructions are transmitted as digital messages in series form over the communication cables 4 and are coded so as to b received by special instruction receivers, ^' in this case by the two instruction receivers 7a and 7b. Only if both instructions have been received properly and the relays have closed as a consequence of the instructions is the change in setting of the light signal initiated.

The third instruction receivers 3c in the safety device is arranged to receive a third instruction which indicates which kind of setting of a signal light, i.e. if one or two signal lamps for green light is to be switched on. The current to the lamps is closed by either or both of the thyristors 19a, 19b which are controlled by the third decoder 7c.

As soon as a change in the signal setting has been initiated by the instruction receivers 3a and 3b and the kind of signal has been determined by the instruction receivers 3c, the result of the operat is reported back to the indicating means 5 at the central interlock unit 6 with the aid of indicators, i.e., the four sensors for voltag 12-15, the three sensors for current 16-18 and the signal contacts 11a, 11b at the relays. The computer at the central interlock unit determines by different, independent procedures whether the required change in the setting of signal lamps has been initiated correctly o wrongly. If at least one of the check procedures indicates that the initiated change in setting is wrong, an instruction is immediately delivered to the respective instruction receiver to break its relay contact. The signal light thus reverts to showing red light.

The safety device 1 and the cooperating central interlock unit 6 are arranged so*that the initiated change in setting of signals is inhibited and the return is made to red light after a time duraxion of less than approximately 1/20 seconds. This time duration is so sh that the signal lamps for green light do not have time to be illumin ed and show any green light; no wrong and dangerous information can thus be shown by the signal light, fυκ oi

The safety device according to the invention is further arranged in such a manner that a condition for the light signal to show one or two green Lights is that the instruction for showing any green light be received at the safety device approximately 100 times per second. Should instructions to show green light be absent for longer than approximately 1/20 seconds, the relay in at least one of the instruc¬ tion receivers 3a, 3b opens and the signal reverts to showing red light.

The fact that the safety device is arranged to inhibit the initiated change in setting approximately 1/20 seconds after receiving the instructions to change the setting while the interval between the instructions is only approximately 1/100 seconds and thus significant¬ ly shorter is explained by the fact that a number of consecutive instructions - 3 to 5 instructions - are required for the relays of the instruction receivers to reach the closed position.

The sensors for voltage and current arranged in the safety device allow the proper functioning of the components of the safety device and of the control device connected to it to be checked by special check programs in the computer of the central interlock unit. It will be assumed for example that the signal Light for a time period is set to show one single green light. The check program may instruct the instruction receiver 3a to break the current to its relay 7a and instruct the instruction receiver 3c to connect current to both the signal lamps for green light. If then, e.g., the voltage sensor 13 still indicates the presence of _ voltage, that must be interpreted as a relay contact 10a of the indicating receiver 3a being stuck in closed position. If at the same time the current sensor 17 indicates that current is flowing to one of the lamps 2a for green current and the current sensor 18 indicates that current is not flowing to the other lamp 2b although the indicating receiver 3c is set for delivering current to both lamps, the conclusion may be drawn that the second lamp is suffering from a break of its incandescent filament.

As mentioned before the special check operation has so short a duration that no change in the lamp signal is visible. The check

performed only as often as is regarded necessary to give a sufficien high probability for correct functioning of the components.

The safety device described is arranged to. provide only two distinct drive signals. In other cases it can be arranged to provide more tha two drive signals; one signal may for instance be a flashing signal. In that case the third instruction receiver 3c is provided with more than two thyristors for switching on Lamps to show the signal desire

Another example of a safety device, which is connected to a control device in the form of a point machine, is shown in Figure 2. In this case a safety device 31 substantially the same as the one described before is connected to a point machine 32 and provided with three instruction receivers 33a, 33b, 33c. They are, as before, connected by the cable 4 for digital data communication to the indication processing means 5 in the central interlock unit 6.

The indication receivers are all provided with decoders for the received messages, and in two of the indication receivers 33a, 33b, the decoders are connected to relay coils 38a, 38b which in turn eac act on one normally open contact 39a, 39b for. closing the circuit to the point machine 32, and each is provided with one normally closed contact 40a, 40b for indicating the position of the relays.

The motor 32 of the point machine is a direct current electric motor with an armature 43 and two excitation windings 44A and 44B of which winding 44A is connected in series with the armature during switchin of the points to the right and the other winding 44B is connected during switching to the Left. A Limit switch 46A breaks the current the motor ^' when switching to the right is completed and a second limi switch.46B breaks the current after switching to the Left. The motor of the point machine is supplied with direct current from two separa rectifiers 47A and 47B, i.e., one rectifier for each direction.

The third indication receiver 33c is arranged with two pairs of switches 48A, 48B connected to the decoder 37c for switching alterna ing current to the desired winding of the motor of the poin'c machine

the current is rectified by the rectifiers 47Λ, 47B. The switches a re thyristors in this case.

Like the safety device described above, the safety device 31 is further provided with sensors, in this case with three voltage sensors 50, 51A 5 and 51B. The sensor 50 indicates the voltage after the contacts of the relays of the two first instruction receivers 33a, b, and the other sensors indicate the voltage to each separate excitation winding of the motor after the thyristors of the third instruction receiver 33c.

The point machine 32 is further provided with two pairs of signal ^■ contacts 53A and 538, that are connected to a rectifier 54 and arranged to be closed at the same time as the corresponding Limit switch 46A and 463 respectively when τhe switching is completed. The signal con¬ tacts are arranged to deliver a DC-voltage with different polarity in one end position and in the other. The signal contacts are connected 5 to a low pass filter 55 in the safety device 31 and the filter in its turn is connected to sensors 5όA and 56B for indicating to the central interlock unit 6 the polarity of the signal voltage. A relay contact in a test relay 61 is connected in the circuit between the signal contacts 53A, B and the filter 55 to be used for testing of the in- 0 dicating arrangement proper.

The sensors 50-52 and 56A, B are connected to the digital communication cable 4, but separate wires for this purpose are not shown in Figure 2.

The safety device 31 for the point machine 32 is arranged in principle Like the safety device 1 for the signal light, that is to say that the

25 two indicating receivers 33a, 33b decode the instructions received, and when it has been confirmed that the instructions to both the instruction receivers indicate that the point machine is to be switched over, although the instructions may have different forms, the relay contacts 39a, 39b are dosed. The third instruction receiver

30 33c decodes another instruction that determines in which direction the point machine is to start and closes the circuit to the proper excitation winding with the aid of either of the double pole connected thyristors 4SA, 488.

As in the previous embodiment the central interlock unit is informed, with the aid of the voltage sensors 50-52 and the relay contacts 40a, 40b, which type of switching has been initiated. Should the check at the central interlock unit reveal that an improper switching action has been initiated, an instruction is sent to at least one of the two instruction receivers 33a, 33b so that at Least one relay brea.es the circuit to the point machine and inhibits the initiated switching. The safety device 31 is also in this case arranged to inhibit the initiate switching Less than 1/20 seconds after receiving instructions to start operation of the point machine, which causes further switching of the point machine to be inhibited before it has actually started its movement.

The instruction receivers 33a, 33b and 33c are arranged to receive instructions of switching the point machine repeatedly approximately 100 times per second. Should a number of instructions be absent during the switching at least one of the relays 38a, 38b opens and the move¬ ment of the point machine is stopped.

With the aid of the contacts 53A, B of the point machine and the sensors 56.A, B the central interlock unit is informed that the point machine and the points operated thereby have reached an end position and which end position.

The safety device 31 for the point machines is provided with a relay 61 having a normalLy closed contact in the circuit from the signal contac 53A, B of the point machine. The contact of the test relay 61 is used to break the signal voltage when the point machine is in an end posi¬ tion and continuously delivers a DC signal voltage. Thus it is con¬ firmed that the sensors 56A and 56B are capable of distinguishing between the conditions where signal voltage is present and absent.

Safety devices of the type described can be arranged and connected to devices for the control of railway operations other than the signal lights and point machines described here.