Technical field

The present disclosure relates to a digital output (DO) module, and to a method of a digital output module. More particularly, the present disclosure relates to digital output modules to be used in various railway applications, and provided with safety capabilities for controlling railway applications, and also for monitoring and avoiding irregularities in operation.

Background

Digital outputs are widely used in railway applications for general purpose control of external equipment and loads. This imposes integrity requirements on the design of the digital output channels in order to achieve the required safety integrity level (SIL).

The protection of digital outputs which are used for general control functions within the railway vehicle are necessary in order to meet safety integrity requirements.

EP 1727157 relates to a safety protection instrumentation system for a nuclear reactor that is constructed by using a digital logic, in which the digital logic includes functional units in which output patterns corresponding to all input logic patterns are verified in advance and a functional module formed by combining the functional units.

The object of the present invention is to achieve an improved digital output (DO) module, and a method in relation to the DO module, that meet the safety integrity requirements, and also includes inherent safety monitoring capabilities.

Summary

The above-mentioned object is achieved by the present invention according to the independent claims.

Preferred embodiments are set forth in the dependent claims. The function described herein is where a galvanically isolated dedicated power supply is controlled in order to enable or disable the digital outputs. One of the benefits of galvanically isolated or floating digital outputs is that this enables full flexibility in the application of the output, as several digital outputs may be connected in series or in parallel depending on the needs of the respective application.

According to the present invention, a digital output (DO) power control signal is used to control the state of a dedicated power supply which is used to power the driver stage unit of the digital output stage. In order to activate the output both the DO power control signal and a DO control signal must be active. A further signal, denoted DO feedback signal, is used to monitor the state of the output of a DO switch to ensure it is functioning correctly. In the event that a hazard occurs where for example the DO feedback signal is active when it should not be, i.e. indicating that the output stage is active when it should not be, then the safest precaution or reaction to initiate is to remove the power to the DO driver stage. By doing so, nearly all possible failure modes are handled (with the exception of the output transistor itself being short circuit). Thereby, the DO driver stage unit and therefore the DO switch is disabled.

The dedicated power supply can be used to power several digital outputs, e.g. six DOs or twelve DOs, as long as they belong to the same galvanically isolated group.

Preferably, the control signals and the feedback signal are connected to the module via a galvanically isolated connection, e.g. optocouplers.

The digital output module is integrated on a circuit board used to control e.g. motor contactor, separation contactor, line contactor etc. within traction converters of railway applications.

The DO switch is preferably a MOSFET switch which is controlled by the driver signal from the driver stage unit. The switch is inactive in its safe state, i.e. switched off.

The driver unit is configured to receive the DO power control signal and the DO control signal. As mentioned above, a presumption for activation of the switch is that both control signals are in their active states, and when the DO switch is activated, the DO feedback signal is active. The DO power signal is activated before the DO control signal since this enables the DO output stage by activating the power supply circuitry.

In one embodiment, the DO feedback signal changes state (intentionally) under a finite period of time (e.g. 10ms) following setting the DO power control signal in an active state “1”. This facilitates verification of the feedback circuit without the need for dedicated control signals or additional components.

For example, as part of the start-up sequence, the DO power control signal is set in state “1” in order to perform an integrity check on all digital output feedback signals within the same galvanically isolated group. This function tests both states since the initial state of the DO feedback signal is “0”, then following activation of the DO power control signal the state changes to being active, i.e. “1”, for a finite period (e.g. 10ms) and then returns to logic “0” once again until the DO control signal is activated.

The integrity check of diagnostic test circuitry is very important for safety relevant applications, in order to meet the diagnostic coverage criteria of the safety standards.

One advantage of the test procedure according to this embodiment of the present invention is that it may be implemented without the need for extra circuitry, which improves reliability.

Brief description of the drawings

Figure l is a schematic illustration of a digital output (DO) module according to the present invention.

Figure 2 shows schematic graphs illustrating various signals applied in the DO module. Figure 3 is a flow diagram illustrating the method according to the present invention. Figure 4 is a flow diagram illustrating the safety procedure according to one embodiment of the present invention.

Detailed description

The digital output module, and the method of the digital output module, will now be described in detail with references to the appended figures. Throughout the figures the same, or similar, items have the same reference signs. Moreover, the items and the figures are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the invention.

First with references to figure 1, a digital output (DO) module 2 is provided, to be applied for control purposes in a vehicle, such as a railway vehicle.

The DO module 2 comprises two galvanically isolated inputs, configured to receive a DO power control signal 4 and a DO control signal 8, respectively, and one galvanically isolated feedback signal output, configured to provide a DO feedback signal 6.

The DO module 2 further comprises a driver stage unit 10 to provide electrical state control to a DO switch 12 and configured to receive the DO power control signal 4 and the DO control signal 8.

The driver stage unit 10 is further configured to generate an active driver signal 14 to be supplied to the DO switch 12 that is adapted to control the conductive state of a DO output 16 upon receipt of the active driver signal 14. The galvanically isolated feedback signal output is connected to the DO output 16.

The DO module 2 also comprises a control unit 18 that may be embodied by any unit provided with processing and storage capabilities to perform the intended function. The control unit may be one or many units physically integrated in the DO module, but may also be one or many external units, e.g. an external control system.

The DO switch 12 is configured to be in a conductive state and in a non-conductive state in dependence of the driver signal 14 such that the DO switch 12 is in its conductive state when the driver signal 14 is activated and is then configured to control the conductive state of the digital output 16. The driver stage unit 10 is configured to generate an active driver signal 14 only if both the DO power control signal 4 and the DO control signal 8 are in their active states “1” at the same time, and wherein the DO feedback signal 6 then indicates the state of the DO switch 12.

Figure 2 illustrates graphs showing the states “0” or “1” of the DO power control signal, the DO control signal, the DO feedback signal, and the driver signal, being in an active or in a non-active state, generated by the driver stage unit, over time. Four different points of time A, B, C, and D, have been indicated to illustrate various aspects of the function of the DO module. The DO power control signal, the DO control signal, and the DO feedback signal are electrical signals. Each of these electrical signal is configured to be in either of two voltage levels, where a first level corresponds to the active state, denoted logic “1”, and a second voltage level that corresponds to the non-active state, denoted logic “0”.

According to an embodiment, the control unit 18 is configured to compare the states of the DO control signal 8 and the DO feedback signal 6, and if those signals are in different states, the control unit 18 is configured to set the DO power control signal 2 in state “0” resulting in that the driver stage unit 10 is set in its non-active state and thus the DO switch(s) 12 powered by DO power is set in a non-condutive state.

In figure 2, this embodiment is illustrated in point of time C, where the DO feedback signal, due to some unknown reason, changes from “1” to “0”. The DO control signal therefore changes from state “1” to “0” because those signals are in different digital states, which in turn will set the DO stage unit in non-active state as the DO power control signal and the DO control signal are in different states.

During the time period between B and C in figure 2, both DO power control signal and the DO control signal are “1” resulting in activation of the DO switch, and the DO feedback signal indicates, by also being in state “1” as the DO control signal, that everything works as intended.

In the event that a hazard occurs where for example the DO feedback signal is active when it should not be. This situation is illustrated in figure 2 around point of time D where, for an unknown reason, the DO feedback signal during a short time period changes state from “0” to “1” and then back to “0”. In the illustrated example, this results in that the DO power control signal will change state from “1” to “0” in D. Thereby, the DO driver stage unit and therefore the DO switch is disabled.

According to another embodiment, the DO switch 16 is a MOSFET switch. As an alternative, the DO switch may be a relay switch.

According to still another embodiment, the galvanically isolated inputs and output are realized by optocouplers 20. According to a further embodiment, the control unit 18 is configured to perform a safety test procedure of the DO module 2. The safety test procedure will be described with references to figure 1 and the graphs shown in figure 2, and in particular the state of the signals around point of time A.

The control unit is then configured to check the states of the feedback signal 6 and the DO control signal 8. If both signals are “0”, the control unit is further configured to generate a DO power control signal 4 that is “1”, and to generate a feedback signal 6 that is “1” during a predetermined test period of e.g. 10 ms. (see figure 2, around point of time A). The duration of the predetermined test period should be long enough to be detected, but short enough not to disturb the function of the DO switch module. Therefore, a suitable length of the test period is in the range of 5 - 25 ms, and preferably 10 ms.

The DO module 2 works as required if the feedback signal 6 is “1” during the predetermined test period, and thereafter changes state to “0”, thus returning to ordinary function of indicating conductive state of the DO switch 16.

According to another embodiment, the control unit 2 is configured to generate an alarm signal 22 if the feedback signal 8 not is “1” during the predetermined test period or does not return to “0” following the predetermined test period. The result of the alarm is that the respective DO module is set in a non-conductive state and diagnostic information provided to the control system indicating the issue. This alarm signal may be used to inactivate the DO power control signal and the DO control signal, i.e. set those signals in state “0”, as well as indicating the erroneous state of the DO module to an external control system. The alarm signal is preferably implemented in firmware within a control logic, e.g. an FPGA device.

The present invention also relates to a method of controlling the state of a digital output (DO) module to be applied for control purposes in a vehicle, such as a railway vehicle.

The method will be presented with references to the flow diagram of figure 3, and further embodiments of the method will be discussed with references to the flow diagram of figure 4. Thus, the method relates to a method of the DO module that has been described in detail above, and it is herein referred to that description.

All steps of the method are controlled and supervised by the control unit 18 that has been discussed above.

Thus, the DO module comprises two galvanically isolated inputs, configured to receive a DO power control signal 4 and a DO control signal 6, respectively, and one galvanically isolated feedback signal output, configured to provide a DO feedback signal 6. The DO module 2 further comprises a driver stage unit 10 to provide electrical state control to a DO switch 12 and configured to receive the DO power control signal 4 and the DO control signal 8. The driver stage unit 10 is configured to generate an active driver signal 14 to be supplied to the DO switch 12 that is adapted to control the conductive state of a DO output 16 upon receipt of the active driver signal 14, wherein said galvanically isolated feedback signal output is connected to the DO output 16.

The DO module 2 also comprises a control unit 18.

Figure 3 shows a flow diagram illustrating the method that comprises:

- controlling said DO switch to be in in its conductive state by said DO driver signal when said driver signal is activated and then controlling the conductive state of said digital output,

- generating an active driver signal (14) only if both the DO power control signal (4) and the DO control signal (8) are in their active states “1” at the same time, and

- indicating the state of the DO switch (12) by the DO feedback signal.

The method is also illustrated by the graphs shown in figure 2, and in particular the activation of the DO switch during the time period between B and C, where it is clearly shown that a presumption for setting the DO switch in its active state is that the driver signal is in its active state, which only occurs if both the DO power control signal and the DO control signal are in their logic state “1”.

In a further embodiment, the method also comprises:

- comparing said DO control signal 8 and said DO feedback signal 6, and if the states of these signals differ, the method further comprises:

- deactivating the DO power control signal 2 resulting in that the driver stage unit 10 is deactivated and thus the DO switch(s) 12 powered by DO power is set in a passive state.

In order to verify the function of the DO module, a further embodiment of the method is provided, comprising performing a safety test procedure of the DO module. This embodiment is illustrated by the flow diagram of figure 4, and also by the graphs shown in figure 2.

Thus, the method according to the embodiment comprises: checking that both the feedback signal 6 and the DO control signal 8 are “0”, and if those signals are “0”: generating a DO power control signal 4 that is “1”, the DO power control signal is preferably controlled by an external control system and shall be activated in the initial stages of operation, generating a feedback signal 6 that is “1” during a predetermined test period of e.g. 10 ms. The DO module 2 works as required if the feedback signal 6 is “1” during the predetermined test period, and thereafter changes state to “0”, thus returning to ordinary function of indicating the conductive state of the DO switch 16.

In still another embodiment, the method comprises generating an alarm signal 22 if the feedback signal 6 not is “1” during the predetermined test period or does not return to “0” following the predetermined test period.

The present invention also relates to a railway vehicle, e.g. a train, comprising one or many digital output (DO) modules as described above.

The present invention is not limited to the above-described preferred embodiments. Various alternatives, modifications and equivalents may be used. Therefore, the above embodiments should not be taken as limiting the scope of the invention, which is defined by the appending claims.