Modular device for executing at least one function of a vehicle according to a predetermined safety level
Patent Information
- Application Number
- PCT/IB2025/052992
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2024-03-22
- Filing Date
- 2025-03-21
- Publication Date
- 2026-02-05
AI Technical Summary
Existing safety architectures for vehicles, particularly in the railway sector, are limited to specific functions due to ad hoc electronic designs on single circuit boards, leading to high costs and long development times, as they cannot be adapted for different functions.
A modular device with a modular safety architecture comprising multiple electronic modules, each with specific functions, allowing adaptation to various vehicle functions while maintaining a predetermined safety level, such as SIL4, using electronic circuit boards for input and output signal management.
Enables flexible adaptation of safety architectures to different vehicle functions, reducing costs and development time by allowing modular assembly and reconfiguration for diverse input and output signals, ensuring consistent safety performance.
Smart Images
Figure IB2025052992_05022026_PF_FP_ABST
Abstract
Description
[0001] Modular device for executing at least one function of a vehicle according to a predetermined safety level
[0002] Technical field
[0003] The present invention generally pertains to the field of devices for vehicles; in particular, the invention relates to a modular device for executing, according to a predetermined safety level, at least one function of a vehicle.
[0004] Prior art
[0005] Hereinafter, the prior art is described with particular reference to the railway vehicle sector; however, what is described may find analogous application also for vehicles in other sectors.
[0006] As observable by way of example in figure 1, usually, in an electronic device that implements a safety architecture, the composite safety ("Composite Fail Safety") against functional faults is implemented through solutions based on multi-channeling.
[0007] In particular, in railway applications, 2oo2 ("two out of two") structures are normally used.
[0008] Such structures may be implemented with a common device ("voter") that ensures the evaluation / voting and the inhibition of blocked or malfunctioning channels. Such common device has at least in part the properties of an intrinsic safety device (i.e. fail-safe) and must be evaluated accordingly.
[0009] Disadvantageously, generally, the generic safety architecture of the common device is implemented through an ad hoc electronic design, for example a single circuit board, to implement only one specific safety function characterized by specific input and output signals.
[0010] This limitation, understandably, compromises the possibility for such safety architecture of the common device to also be used for different functions, since its architecture was specifically designed in view of a specific function to be implemented.
[0011] Furthermore, since such common device is made through a single circuit board solution, it is not possible to adapt / remodulate the architecture structure of such device in order to adapt it to further functions.
[0012] Consequently, for each function, it will be necessary to design specific architectures of the common device, i.e. a respective circuit board for each function. Therefore, the cost and development time of such common devices of a vehicle are high.
[0013] Summary of the invention
[0014] An object of the present invention is to provide a solution that solves the drawbacks previously described with respect to the prior art solutions.
[0015] For example, a first object is to provide a solution that allows the architecture of a device for executing a safety function of a vehicle to be remodulated, so as to adapt it to any function to be executed.
[0016] For example, a second object is to reduce the cost and development time of a device for executing a function of a vehicle.
[0017] In summary, the present invention provides a device having a modular safety architecture (for example, developable according to a SIL4 safety level, in accordance with the EN50129 standard) that comprises a plurality of electronic modules.
[0018] For example, each electronic module may be made through a respective electronic circuit board.
[0019] The aforementioned electronic modules of the device comprise, besides at least one electronic module for executing at least one function, at least one electronic module for acquiring input signals and at least one electronic module for conditioning output signals, which allow the modular device to be used to execute different safety vehicle functions according to a predetermined safety level, which must be implemented as required and having a plurality and diversity of input and / or output signals.
[0020] The aforementioned and other objects and advantages are achieved, according to an aspect of the invention, by a modular device for executing at least one function of a vehicle according to a predetermined safety level, particularly a function of a railway vehicle, having the features defined in claim 1. Preferred embodiments of the invention are defined in the dependent claims, the content of which is to be understood as an integral part of the present description.
[0021] Brief description of the drawings
[0022] The functional and structural features of some preferred embodiments of a modular device for executing at least one function of a vehicle according to a predetermined safety level, specifically a function of a railway vehicle, according to the invention, will now be described. Reference is made to the accompanying drawings, wherein:
[0023] - figure 1 illustrates an architecture of a common device according to the prior art;
[0024] - figure 2 illustrates a first embodiment of a modular device for executing at least one function of a vehicle according to a predetermined safety level, according to the present invention;
[0025] - figure 3 illustrates an embodiment of a first electronic module of the modular device;
[0026] - figure 4 illustrates an embodiment of a second electronic module of the modular device;
[0027] - figure 5 illustrates an embodiment of a third electronic module of the modular device;
[0028] - figure 6 illustrates an exemplary embodiment of a first electronic module of the modular device;
[0029] - figure 7 illustrates an exemplary embodiment of a second electronic module of the modular device;
[0030] - figure 8 illustrates an exemplary embodiment of a third electronic module of the modular device. Detailed description
[0031] Before explaining in detail a plurality of embodiments of the invention, it should be clarified that the invention is not limited in its application to the construction details and to the configuration of the components presented in the following description or illustrated in the drawings. The invention is capable of taking on other embodiments and of being practised or implemented in various ways. It should also be understood that the phraseology and terminology are for descriptive purposes and should not be construed as limiting. The use of “including” and “comprising” and their variations are to be understood as encompassing the elements listed hereinafter and their equivalents, as well as additional elements and equivalents thereof.
[0032] With initial reference to figure 2, a first embodiment is described hereinafter of a modular device 100 for executing, according to a predetermined safety level, at least one function of a vehicle.
[0033] As observable in said figure 2, the modular device for executing at least one function of a vehicle according to a predetermined safety level, particularly a function of a railway vehicle, comprises:
[0034] - at least a first electronic module 102 comprising electronic processing means 300 arranged to execute the function of the vehicle;
[0035] - at least a second electronic module 104 comprising first communication means 400 arranged for transmitting to the electronic processing means 300 installed in the first electronic module 102, according to the predetermined safety level with which the function is executed, at least one signal indicative of at least one parameter or datum required by the at least one function;
[0036] - at least a third electronic module 106 comprising second communication means 500 arranged to receive, according to the predetermined safety level with which the function is executed, at least one signal indicative of at least one parameter or datum determined by the at least one function executed by said electronic processing means 300 installed in the first electronic module 102. The first electronic module 102, the second electronic module 104 and the third electronic module 106 are adapted to be connected to one another, in a removable manner, by means of electrical connection means 108.
[0037] In other words, depending on the specifications of the function to be executed, the device may be formed by coupling to one another one first module or more first modules, one second module or more second modules, and one third module or more third modules.
[0038] Clearly, each signal indicative of at least one parameter or datum required by the at least one function may be indicative of a single parameter or datum or may be indicative of multiple parameters or data. Furthermore, each signal indicative of at least one parameter or datum determined by the at least one function executed by said electronic processing means 300 may likewise be indicative of a single parameter or datum or be indicative of multiple parameters or data.
[0039] As for example observable in figure 4, the first communication means 400 of the second electronic module 104 may receive the at least one signal indicative of at least one parameter or datum required by said at least one function from one or more sensors or devices 402.
[0040] As for example observable in figure 5, the second communication means 500 of the third electronic module 106 may transmit the at least one signal indicative of at least one parameter or datum determined by said at least one function to one or more devices or systems 504.
[0041] In one exemplary implementation, the modular device 100 may have a functional architecture in modules 102, 104, 106, whose physical layout may be implemented by means of ‘packages’ made through respective electronic boards, electrically connectable and disconnectable to one another. For example, the different modules, that is the different boards, of the modular device may be designed to be integrated into a subsystem based on a G2PPC packaged architecture.
[0042] For example, the electronic processing means 300 may be or comprise at least one among: a microprocessor, a processor, a microcontroller, a controller, a PLC, an FPGA, a control unit, or similar.
[0043] For example, in the present description, the communication means may be or comprise at least one communication channel (also called communication line). For example, each communication channel may be a wired communication channel and may be implemented by means of a communication bus.
[0044] Preferably, the first electronic module 102 may comprise third communication means 302 arranged to:
[0045] - receive, from the first communication means 400 of the second electronic module 104, the at least one signal indicative of at least one parameter or datum required by the at least one function; and
[0046] - transmit, to the electronic processing means 300 of the first electronic module 102, said at least one signal indicative of at least one parameter or datum required by the at least one function.
[0047] In such case, the third communication means 302 may be arranged to receive and / or transmit according to a safety communication protocol (also called protected communication protocol).
[0048] Preferably, as for example observable in figure 3, the electronic processing means of the first electronic module may comprise at least first processing means 300 and second processing means 300' each arranged to execute the at least one function of a vehicle according to the predetermined safety level.
[0049] In such case, preferably, the first electronic module 102 may further comprise:
[0050] - third communication means 302 arranged for receiving, from the first communication means 400 of the second electronic module, the at least one signal indicative of at least one parameter or datum required by the at least one function and transmitting, to the first processing means 300 of the first electronic module 102, said at least one signal indicative of at least one parameter or datum required by said at least one function; - fourth communication means 304 arranged for receiving, from the first communication means 400' of the second electronic module 104, the at least one signal indicative of at least one parameter or datum required by said at least one function and transmitting, to the second processing means 300' of the first electronic module 102, said at least one signal indicative of at least one parameter or datum required by the at least one function.
[0051] In such case, the third communication means 302 and the fourth communication means 304 may be arranged to receive and / or transmit according to a safety communication protocol.
[0052] Preferably, the third electronic module 106 may comprise at least one verification submodule 502 arranged to:
[0053] - receive, via said second communication means of the third electronic module 500, 500', the at least one signal indicative of at least one parameter or datum determined by the at least one function executed by said electronic processing means 300, 300' installed in the first electronic module 102;
[0054] - determine, as a function of the at least one received signal indicative of at least one parameter or datum determined by the at least one function, that the electronic processing means 300, 300' have correctly executed the at least one function.
[0055] Preferably, when the first electronic module 102 comprises first processing means 300 and second processing means 300', the second communication means 500, 500' of the third electronic module may comprise at least a first communication channel 500 arranged to receive at least a first signal indicative of at least one parameter or datum determined by the at least one function executed by the first processing means 300 installed in the first electronic module 102 and a second communication channel 500' arranged to receive at least a second signal indicative of at least one parameter or datum determined by the at least one function executed by the second processing means 300' installed in the first electronic module 102.
[0056] In such case, the third electronic module 106 may comprise at least one verification submodule 502 arranged to:
[0057] - receive, via the first communication channel 500, the first signal indicative of at least one parameter or datum determined by said at least one function executed by the first processing means 300 installed in the first electronic module 102;
[0058] - receive, via the second communication channel 500', the second signal indicative of at least one parameter or datum determined by said at least one function executed by the second processing means 300' installed in the first electronic module 102;
[0059] - determine, as a function of the first signal indicative of at least one parameter or datum determined by the at least one function executed by the first processing means 300 and the second signal indicative of at least one parameter or datum determined by said at least one function executed by said second processing means 300', that the first processing means 300 and the second processing means 300' have correctly executed the at least one function.
[0060] Preferably, the verification sub-module 502 may be arranged to determine that the first processing means 300 and the second processing means 300' have correctly executed the at least one function when the first signal indicative of at least one parameter or datum determined by the at least one function executed by the first processing means 300 and the second signal indicative of at least one parameter or datum determined by the at least one function executed by the second processing means 300' are consistent with each other.
[0061] For example, by consistent with each other, one may understand the case in which the first processing means 300 and the second processing means 300' determine the same result.
[0062] Preferably, when the verification sub-module 502 determines that the first processing means 300 have not correctly executed said at least one function, the verification sub-module 502 may be arranged to:
[0063] - allow the second processing means 300' to continue to execute the function;
[0064] - prevent the first processing means 300 from executing the function.
[0065] Conversely, when the verification sub-module 502 determines that the second processing means 300' have not correctly executed the function, the verification sub-module 502 may be arranged to:
[0066] - allow the first processing means 300 to continue to execute the function; - prevent the second processing means 300' from executing the function.
[0067] Preferably, the electrical connection means 108 may comprise at least one among:
[0068] - at least one electrical connector,
[0069] - at least one conductive pin,
[0070] - at least one conductive pad.
[0071] Preferably, the modular device 100 for executing at least one function of a vehicle according to a predetermined safety level may comprise a plurality of second electronic modules 104 including respective first communication means. Each of the first communication means may be arranged to transmit to the electronic processing means installed in said first electronic module, according to the predetermined safety level with which the function is executed, at least one signal indicative of at least one respective parameter or respective datum required by the function.
[0072] Preferably, the modular device 100 for executing at least one function of a vehicle according to a predetermined safety level may comprise a plurality of third electronic modules 106 including respective second communication means. Each of the second communication means may be arranged to receive, according to said predetermined safety level with which said function is executed, at least one signal indicative of at least one respective parameter or respective datum determined by said at least one function executed by the electronic processing means installed in said first electronic module.
[0073] For example, preferably, the function of the vehicle may be an operational function of the vehicle, e.g. a function related to the control or monitoring of vehicle braking.
[0074] By way of non-limiting example, preferably, the function of the vehicle may be at least one among the following functions:
[0075] - emergency braking management;
[0076] - monitoring of the axle anti-skid function;
[0077] - electrodynamic emergency braking monitoring;
[0078] - axle anti-lock monitoring; - calculation of vehicle deceleration during emergency.
[0079] By way of non-limiting example, the predetermined safety level with which the at least one function of a vehicle is executed may be a SIL4 safety level, in accordance with theEN50129 standard.
[0080] Hereinafter, some non-limiting exemplary implementations are described, respectively relating to the architectures of the first electronic module 102, the second electronic module 104 and the third electronic module 106.
[0081] 1) Exemplary implementation of the first electronic module: For the description of the present exemplary implementation, reference may be made to figure 6. The first electronic module may be a G2PPC board. The reference safety architecture for the G2PPC board may be based on a "dual electronic structure based on composite fail-safety with fail-safe comparison" according to the EN50129 standard.
[0082] The architecture of the first module 102 may comprise two channels connected in parallel. During normal operation, both channels must request the safety function before it takes place.
[0083] Furthermore, if the diagnostic test in one of the two channels detects a fault in one of the two channels, a) the output voting is adapted, excluding the faulty channel from output operation; b) the MJF is activated. This is defined as the "Degraded Mode" condition.
[0084] If the diagnostic tests detect faults in both channels or a discrepancy that cannot be attributed to either of the two channels, then: a) the output goes to the safe state; b) MJF is asserted.
[0085] In a dual-channel safety architecture, the diagnostic functions of single-channel processing means are complemented by cross-checking between two channels processing means. The logic behind this safety mechanism is to involve in the cross-checking both the self-checking tests for each of said processing means and the control / result flow checks for the running application software. The guidelines for implementing this method are the following: the two processing means receive the same input data at the same time and individually execute the mission algorithm, that is the specific function.
[0086] The first electronic module 102, i.e. the G2PPC board, may export 2 “fail safe” signals for each safety computation channel. Such signals may be used by an external electronic module of the system to manage the safety functions: the safety signals are redundant and are identified on the G2PPC board as CH1_FS[O: 1] and CH2_FS[0: l],
[0087] The safety signals (FS_1, FS_0) of each computation channel of the G2PPC board are generated by the channel monitoring device of the processing means, based on the following information:
[0088] - power supply monitoring;
[0089] - die out of range temperature monitoring;
[0090] - state of the independent safety watchdog embedded within the monitoring device;
[0091] - state of the safety signals (FCCUfl :0]) generated by the PPC safety processor.
[0092] 2) Exemplary implementations of the second electronic module 104: For the description of the present exemplary implementations, reference may be made to figure 7. The input signals relevant to the function to be executed may be read redundantly by one second electronic module or by multiple second electronic modules (each module being, for example, an electronic input board) and are directed to each computation channel of the first electronic module of the modular device.
[0093] The internal interface between the first electronic module (i.e. the G2PPC core) and the second electronic module (i.e. the digital input safety board) may be based on a defined serial communication bus for reading the state of each digital input and managing the related diagnostics.
[0094] 3) Exemplary embodiment of the third electronic module 106: For the description of the present exemplary embodiment, reference may be made to figure 8. The output signals of each computation channel of the first electronic module, which are relevant to the executed safety function, may be directed to an external VOTER logic together with the pair of FAIL SAFE signals CH1_FS[O: 1] and CH2_FS[0: l]; all this information may be used by the VOTER to validate the state of the respective safety output.
[0095] The VOTER logic may act in such a way that if both computation channels do not produce the same output, it forces the “Fail Safe” for the specific safety function output implemented.
[0096] As described above, the present invention is preferably applicable to at least one railway vehicle, travelling on track rails. For example, a vehicle as described herein may be a locomotive or a towed vehicle, and a route / section may include rails on which the wheels of the locomotive or the towed vehicle roll. The embodiments described herein are not to be understood as limited to rail vehicles. For example, the vehicle may be a car, a truck (for example, a highway semi-trailer, a mining truck, a timber transport truck or similar), a motorcycle or similar, and the route may be a road or a path.
[0097] The advantage achieved by the present invention is therefore that of having provided a solution that resolves the drawbacks previously described with respect to the solutions of the prior art.
[0098] Various aspects and embodiments of a modular device for executing at least one function of a vehicle according to a predetermined safety level according to the invention have been described. It is intended that each embodiment may be combined with any other embodiment. The invention, moreover, is not limited to the described embodiments, but may be varied within the scope defined by the appended claims.
Claims
CLAIMS1. A modular device (100) for executing at least one function of a vehicle according to a predetermined safety level, particularly a function of a railway vehicle, comprising:- at least a first electronic module (102) comprising electronic processing means (300) arranged to execute said function of the vehicle;- at least a second electronic module (104) comprising first communication means (400) arranged for transmitting to said electronic processing means (300) installed in said first electronic module (102), according to said predetermined safety level with which said function is executed, at least one signal indicative of at least one parameter or datum required by said at least one function;- at least one third electronic module (106) comprising second communication means (500) arranged to receive, according to said predetermined safety level with which said function is executed, at least one signal indicative of at least one parameter or datum determined by said at least one function executed by said electronic processing means (300) installed in said first electronic module (102); wherein said first electronic module (102), said second electronic module (104) and said third electronic module (106) are adapted to be connected to each other, in a removable manner, by means of electrical connection means (108).
2. Modular device according to claim 1, wherein said first electronic module (102) comprises third communication means (302) arranged to:- receive, from said first communication means (400) of said second electronic module (104), the at least one signal indicative of at least one parameter or datum required by said at least one function; and- transmit, to said electronic processing means (300) of said first electronic module (102), said at least one signal indicative of at least one parameter or datum required by said at least one function.
3. Modular device according to claim 2, wherein said third communication means (302) are arranged to receive and / or transmit according to a safety communication protocol.
4. Modular device according to claim 1, wherein said electronic processing means of the first electronic module comprise at least first processing means (300) and second processing means (300') each arranged to perform said at least one function of the vehicle according to said predetermined safety level.
5. Modular device according to claim 4, wherein said first electronic module (102) further comprises:- third communication means (302) arranged for receiving, from said first communication means of the second electronic module, the at least one signal indicative of at least one parameter or datum required by said at least one function and transmitting, to said first processing means of said first electronic module, said at least one signal indicative of at least one parameter or datum required by said at least one function;- fourth communication means (304) arranged for receiving, from said first communication means of said second electronic module, the at least one signal indicative of at least one parameter or datum required by said at least one function and transmitting, to said second processing means of the first electronic module, said at least one signal indicative of at least one parameter or datum required by said at least one function.
6. Modular device according to claim 5, wherein said third communication means (302) and said fourth communication means (304) are arranged to receive and / or transmit according to a safety communication protocol.
7. Modular device according to any one of the preceding claims, wherein said third electronic module (106) comprises at least one verification sub-module (502) arranged to:- receive, via said second communication means of the third electronic module (500, 500'), the at least one signal indicative of at least one parameter or datum determined by said at least one function executed by said electronic processing means installed in said first electronic module;- determining, according to the received at least one signal indicative of at least one parameter or datum determined by said at least one function received, that said electronic processing means have correctly executed said at least one function.
8. Modular device according to any one of claims 4 to 6, wherein said second communication means of said third electronic module comprise at least a first communication channel arranged to receive a first signal indicative of at least one parameter or datum determined by said at least one function executed by said first processing means installed in said first electronic module and a second communication channel arranged to receive a second signal indicative of at least one parameter or datum determined by said at least one function executed by said second processing means installed in said first electronic module; said third electronic module comprising at least one verification sub-module arranged to:- receive, via said first communication channel, the first signal indicative of at least one parameter or datum determined by said at least one function executed by said first processing means installed in said first electronic module;- receive, by means of said second communication channel, the second signal indicative of at least one parameter or datum determined by said at least one function executed by said second processing means installed in said first electronic module;- determining, according to the first signal indicative of at least one parameter or datum determined by said at least one function executed by said first processing means and the second signal indicative of at least one parameter or datum determined by said at least one function executed by said second processing means, that said first processing means and said second processing means have correctly executed said at least one function.
9. Modular device according to claim 8, wherein said verification sub-module is arranged to determine that said first processing means and said second processing means have correctly executed said at least one function when the first signal indicative of at least one parameter or datum determined by said at least one function executed by said first processing means and the second signal indicative of at least one parameter or datum determined by said at least one function executed by said second processing means are consistent with each other.
10. Modular device according to claim 8 or 9, where-in, when said verification submodule determines that said first processing means have not correctly executed said at least one function, said verification sub-module is arranged to:- allow said second processing means to continue to execute said function;- prevent the first processing means from executing said function; or, when said verification sub-module determines that said second processing means have not correctly executed said function, said verification sub-module is arranged to:- allow the first processing means to continue to execute said function;- prevent the second processing means from executing said function.
11. Modular device according to any of the preceding claims, wherein said electrical connection means (108) comprises at least one of:- at least one electrical connector,- at least one conductive pin,- at least one conductive pad.
12. Modular device according to any one of the preceding claims, comprising a plurality of second electronic modules including respective first communication means; each of said first communication means being arranged to transmit to said electronic processing means installed in said first electronic module, according to said predetermined safety level with which said function is executed, at least one signal indicative of at least one respective parameter or respective datum required by said at least one function.
13. Modular device according to any one of the preceding claims, comprising a plurality of third electronic modules including respective second communication means; each of said second communication means being arranged to receive, according to said predetermined safety level with which said function is executed, at least one signal indicative of at least one respective parameter or respective datum determined by said at least one function executed by the electronic processing means installed in said first electronic module.
14. Modular device according to any of the preceding claims, wherein said function of the vehicle is at least one of the following:- emergency braking management;- monitoring of the axle anti-skid function;- electrodynamic emergency braking monitoring;- axle anti-lock monitoring;- calculation of vehicle deceleration during emergency braking.