Switch with high safety and high availability

Abstract

The invention discloses a switch with high safety and high availability, which comprises a plurality of independent switch components integrated together, each independent switch component is at least provided with a normally open contact and a normally closed contact, and the normally open contact and the normally closed contact are linked through a first mechanical component. The normally-open contact and the normally-closed contact control the switch action through a second mechanical part, the normally-open contact of each independent switch part is connected to an external function loop in series, and the normally-closed contact of each independent switch part is connected to an external monitoring loop in series. The switch provided by the invention has four high-safety advantages: (1) when a fault occurs, the switch is oriented to a safety design and has high availability; (2) no single-point fault exists; (3) the dangerous fault rate is lower than 1E-8 / h; and (4) the danger of multiple redundant channels can be detected, and fault safety monitoring under complex conditions can be realized.

Description

Technical Field

[0001] This invention relates to rail transit vehicles, and more specifically to a switch with high safety and high availability. Background Technology

[0002] Railway vehicles use multiple switches in various locations to achieve important control functions, such as driver's cab occupancy switches, emergency brake switches, and emergency brake isolation switches. Each switch needs to meet high safety standards. According to EN50129, systems meeting SIL3 / 4 functionality cannot contain single points of failure, have a dangerous failure rate of less than 1E-8 / h, and must have fault safety under complex conditions. This means that the design of individual switches in existing railway vehicles cannot meet the safety performance requirements. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to address the shortcomings of using a single switch to control important control functions on railway vehicles. The present invention provides a switch that can avoid single point of failure and guide safety in the event of a failure, thus possessing high safety and high availability.

[0004] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0005] A highly secure and highly available switch includes multiple independent switching components integrated together. Each independent switching component has at least one normally open contact and one normally closed contact. The normally open contact and the normally closed contact are linked by a first mechanical component, and the normally open contact and the normally closed contact control the switch operation by a second mechanical component. Its structural feature is that the normally open contact of each independent switching component is connected in series to an external functional circuit, and the normally closed contact of each independent switching component is connected in series to an external monitoring circuit.

[0006] The present invention designs a highly safe and highly available switch that uses a second mechanical component to control the operation of each independent switch component. Each independent switch component has two contacts with opposite switching states: one normally open contact and the other normally closed contact. These two normally open / normally closed contacts are linked by a first mechanical component to ensure that the contact states are always opposite. Furthermore, the normally open contacts of each independent switch component are connected in series with an external functional circuit, so that the normally open contacts of each independent switch component can independently disconnect the external functional circuit, thereby avoiding single-point failures from affecting the operation of the entire high-safety switch control system. Meanwhile, this invention connects the normally closed contacts, which are linked to the normally open contacts of each independent switch component, in series to an external monitoring circuit. In this way, when a single independent switch component fails (the normally open contact fails to open properly), the external monitoring circuit can accurately detect this information (when an independent switch component fails, its normally closed contact used for monitoring cannot close, making the external monitoring circuit disconnected). That is, the external monitoring circuit can detect the status of each independent switch component and issue corresponding guidance safety warnings, reminding maintenance personnel to repair or replace the faulty independent switch in a timely manner after the vehicle is taken out of service, so as to avoid the failure of the independent switch component reducing the safety level of the entire switch.

[0007] Preferably, the independent switch component adopts a redundant design to further avoid single point of failure. Before the faulty independent switch is repaired, the function of the independent switch component remains normal due to the redundant design of the entire switch, without affecting operation, and has high availability.

[0008] Preferably, the independent switching components are of the same type or different types.

[0009] Preferably, the external monitoring circuit is a hardware monitoring circuit or a monitoring circuit connected to railway vehicle control and diagnostic software.

[0010] Preferably, the second mechanical component is a mechanical part that directly controls the operation of the independent switching component or a mechanical part that indirectly controls the operation of the independent switching component through a mechanical structure.

[0011] Preferably, the second mechanical component is a push button or a key knob and cam plate linkage, wherein when the key knob is rotated, it drives the cam plate to move.

[0012] The switch designed in this invention, possessing high safety and high availability, meets the requirements of EN50129 for SIL3 / 4 safety level: a high-safety switch must avoid single-point failures, with a dangerous failure rate below 1E-8 / h, and must also be fault-safe under complex conditions. Furthermore, to further avoid hazardous situations, the switch needs a fault-guided safety design. The aforementioned requirements are specifically achieved through the following scheme:

[0013] 1) No Single Point of Failure Design: The independent switching components of the switch in this invention adopt a redundant design, and the normally open contact of each independent switching component is connected in series with an external functional circuit. The normally closed contact linked with the normally open contact of each independent switching component is connected in series with an external monitoring circuit. This allows the normally open contact of each independent switching component to be independently disconnected, avoiding the impact of a single point of failure on the operation of the entire system controlled by the high-safety switch of this invention. At the same time, when an independent switching component fails, the normally closed contact linked with the normally open contact of that independent switching component will prevent the external monitoring circuit from being connected (the normally closed contact of the faulty independent switch will remain open). This allows the external monitoring circuit to detect the fault of the independent switching component and issue a corresponding safety warning, preventing the failure of an independent switching component from reducing the safety level of the entire switch.

[0014] 2) Safety-oriented design: In the absence of external force, the normally open contact of the independent switching component of the switch of the present invention remains open, ensuring safety. In addition, the switch of the present invention controls the operation of the independent switching component through a second mechanical component. The normally open contact of the independent switching component is connected in series to the external functional circuit. Since the failure of the normally open contact to open due to contact sticking is less likely than the failure of the contact to close, the present invention can ensure that the external functional circuit can be safely disconnected.

[0015] 3) Failure rate below 1E-8 / h: The dangerous failure rate of each independent switching component is below 1E-6 / h; experimental verification shows that if the independent switching components are of the same type, their common cause failure rate is below 5%. Figure 3 Fault tree calculations show that the failure rate of the entire independent switch is less than 5E-9 / h, far less than 1E-8 / h, indicating high safety and high availability.

[0016] 4) Fault safety under complex conditions: If the function of a component is implemented by multiple redundant channels, the state of each of these redundant channels can be detected. The high-safety switch for railway vehicles of this invention has a built-in monitoring circuit interface; each independent switch component has two contacts with opposite switching states, one normally open and the other normally closed, and these two normally open / normally closed contacts are linked by a first mechanical component to ensure that the contact states are always opposite; the normally closed contacts of each independent switch component are connected in series to the monitoring circuit. When a single independent switch component fails, the monitoring circuit can detect the state of that independent switch component, preventing the failure of that independent switch component from lowering the safety level of the entire switch. Therefore, each independent switch component can disconnect external functional circuits, and the fault of each independent switch component can be monitored.

[0017] Compared with the prior art, the beneficial effects of the present invention are:

[0018] 1) The high safety switch for railway vehicles of the present invention has the following four advantages of high safety: (1) safe design for faults and high availability; (2) no single point of failure; (3) dangerous failure rate is less than 1E-8 / h; (4) dangers of multiple redundant channels can be detected, and fault safety monitoring is available in complex situations.

[0019] 2) The switch of the present invention uses a second mechanical component to drive two or more independent switching components to operate, which meets the SIL3 / 4 safety level requirements of EN50129.

[0020] 3) The independent switching components of the switch of the present invention adopt a redundant design with multiple paths, which further eliminates single point of failure and has high safety; and monitors the status of the control path of each independent switching component to ensure a high level of safety during the use of the high-safety switch.

[0021] 4) The high-safety switch of the present invention has a simple structure.

[0022] 5) The high-safety switch of the present invention has a simple monitoring interface, using only one monitoring channel to monitor the status of multiple redundant internal channels.

[0023] 6) The method used in this invention can achieve large-scale preparation at low cost and has broad practical prospects. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of the circuit structure of an embodiment of the present invention.

[0026] Figure 2 This is a schematic diagram of the mechanical structure of an embodiment of the present invention, wherein the gray-blue part is the key and the mechanical fixing hook, the blue part is the cam plate driving key structure, and the yellow part is two independent switch components. The switch wiring is not shown.

[0027] Figure 3 This is a fault tree diagram of an independent switching component according to an embodiment of the present invention.

[0028] Figure 4 This is a feasible implementation method for an external monitoring loop.

[0029] Figure 5 This is another feasible implementation method for external monitoring loops. Detailed Implementation

[0030] The present invention will be further described below with reference to specific preferred embodiments, but this does not limit the scope of protection of the present invention.

[0031] In the description of this invention, it should be noted that the terms "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0032] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "joining" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal communication between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0033] Please see Figure 1 , Figure 2 An embodiment of the highly safe and highly available switch of the present invention includes multiple independent switch components integrated together (two independent switch components are used as an example in the figure). Each independent switch component has at least one normally open contact and one normally closed contact. The normally open contact and the normally closed contact are linked by a first mechanical component. The normally open contact and the normally closed contact control the switch action by a second mechanical component. The normally open contact of each independent switch component is connected in series to an external functional circuit, and the normally closed contact of each independent switch component is connected in series to an external monitoring circuit.

[0034] To further avoid single points of failure, the independent switching components are designed with redundancy.

[0035] It should be noted that, in this invention, the independent switching components can be of the same type or different types; the external monitoring circuit is a hardware monitoring circuit or a monitoring circuit connected to railway vehicle control and diagnostic software. For example, the external monitoring circuit can be a fault indicator light (see [reference]). Figure 4 The indicator light (which indicates an internal fault in an independent switch component) can also be used as a digital input to connect to the train control system or the fault prediction and health management (PHM) system (see [reference]). Figure 5The second mechanical component is a mechanical part that directly controls the operation of the independent switch component, such as pressing a button; or a mechanical part that directly controls the operation of the independent switch component through a mechanical structure, such as indirectly controlling the operation of the independent switch component through pressing a button and a mechanical structure. The mechanical structure here can be a key knob and a cam plate linkage component. When the key knob is rotated, it drives the cam plate to move.

[0036] In specific implementation of this invention, it can be: Figure 1 , Figure 2 The high-security key switch shown has a circuit disconnection safety level of SIL4, and specifically includes the following structure:

[0037] like Figure 1 As shown, it has: interfaces X1_1 and X1_2 for connecting external functional loops; and interfaces X2_1 and X2_2 for connecting external monitoring loops.

[0038] like Figure 1 , 2 As shown, the mechanical structure of the switch in this embodiment consists of a key knob 1, a cam plate 2, and two independent switch components 3. The mechanical structure of the switch is a conventional structure. During the rotation of the key knob 1, the cam plate 2 is directly driven to rotate via the column under the keyhole (the column and cam plate 2 are an integral structure). The cam plate 2 presses against the independent switch components 3. Each independent switch component 3 has two contacts with opposite switching states: one contact is a normally open contact, and the other is a normally closed contact. The pressure from the cam plate 2 causes the normally closed contact to open and the normally open contact to close. Moreover, these two normally open / normally closed contacts are linked by the first mechanical component 4 inside the independent switch component 3, ensuring that the states of the normally open and normally closed contacts are always opposite.

[0039] like Figure 1 As shown, the circuit structure of the switch in this embodiment is as follows: the normally open contacts of each independent switch component 3 are connected in series for connecting to an external functional circuit, and the normally closed contacts of each independent switch component 3 are connected in series for connecting to an external monitoring circuit.

[0040] When the key is inserted and the key knob 1 is turned, the cam plate 2 is driven to compress the spring (not shown in the figure) and press the button (second mechanical component) of the two independent switch components 3. The normally open contact closes and conducts the external functional circuit; at the same time, the normally closed contact opens and disconnects the monitoring circuit.

[0041] After the key is removed, the cam plate 2 automatically returns to its original position under the action of the spring force. Releasing the button on the independent switch component 3 opens the normally open contact, disconnecting the external functional circuit. Simultaneously, the normally closed contact closes. The monitoring circuit checks whether any normally closed contact of the independent switch component 3 remains open. If so, it indicates that the corresponding normally open contact is still closed, indicating low switch safety and requiring maintenance. If all normally closed contacts are detected to be closed, it indicates that the switch is working normally.

[0042] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can make many possible variations and modifications to the technical solution of the present invention, or modify it into equivalent embodiments with equivalent changes, without departing from the scope of the technical solution of the present invention. Therefore, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention should fall within the scope of protection of the technical solution of the present invention.

Claims

1. A switch with high safety and high availability, comprising multiple independent switching components integrated together, each independent switching component having at least one normally open contact and one normally closed contact, wherein the normally open contact and the normally closed contact are linked by a first mechanical component, and the normally open contact and the normally closed contact control the switch operation by a second mechanical component, characterized in that: The normally open contacts of each independent switching component are connected in series to an external functional circuit, and the normally closed contacts of each independent switching component are connected in series to an external monitoring circuit.

2. The switch with high security and high availability according to claim 1, characterized in that, The independent switching components are designed with redundancy.

3. The switch with high security and high availability according to claim 1, characterized in that, The independent switching components can be of the same type or different types.

4. The switch with high security and high availability according to claim 1, characterized in that, The external monitoring circuit is either a hardware monitoring circuit or a monitoring circuit connected to railway vehicle control and diagnostic software.

5. The switch with high security and high availability according to claim 1, characterized in that, The second mechanical component is a mechanical part that directly controls the operation of the independent switching component or a mechanical part that indirectly controls the operation of the independent switching component through a mechanical structure.

6. The switch with high security and high availability according to claim 5, characterized in that, The second mechanical component is a push button or a key knob and cam plate linkage component, wherein the key knob drives the cam plate to move when it is turned.

Images