38 results about "Safety Integrity Level" patented technology

The invention relates to the technical field of electrical instrument management, in particular to a petroleum drilling machine electrical instrument management system and method based on SIL analysis, and the management system comprises a drilling machine electrical instrument function management module and an electrical instrument safety management module. The drilling machine electrical instrument function management module is used for completing periodic management screening and qualitative analysis of a drilling machine electrical instrument, function identification of an electrical instrument system and safety integrity level determination of the electrical instrument system; the electrical instrument safety management module is used for determining the working range of a drilling machine and the management range of electrical instruments of the drilling machine, screening to-be-evaluated scenes, selecting initial events, identifying independent protection layers, determining the average failure probability of all the protection layers, calculating the frequency of all the scenes and determining risk reduction factors. And confirming the security integrity level of the target. Through the management system and method, the problems that the accuracy of risk assessment of an electrical instrument system of a petroleum drilling machine in a scene event is poor and safety assessment is not facilitated can be solved.

The invention discloses a monitoring method, system and device for a braking function and electronic equipment, and the method comprises the steps that multiple paths of brake pedal signals are obtained, and the multiple paths of brake pedal signals are transmitted by multiple heterogeneous sensors through respective two paths of signal channels; performing diagnosis detection on the multiple paths of brake pedal signals, and determining a fault signal and a target channel signal in the multiple paths of brake pedal signals; when the signal number of the target channel signals meets a preset number condition, credible signals are obtained through screening by a voting mechanism based on the target channel signals; obtaining a braking request based on the credible signal to realize a braking function based on the braking request; and fault information is obtained based on the fault signal and other signals except the credible signal in the target channel signal, and fault reminding is carried out based on the fault information. The safety integrity level of the braking function can be improved, and the fault-tolerant performance of a braking product is improved.

The invention relates to imaging 3-D time-of-flight sensors that are particularly suitable for the detection of objects and individuals in three-dimensional space. This capability results from the basic principle. In each image point of the sensor, the distance to the object located in the observation space is determined by using the propagation time (time of flight) of light pulses. The sensor therefore supplies a three-dimensional image, which can be analyzed by means of suitable processing algorithms. In specific applications, in particular in the interaction of human and machine, machine and machine, or machine and space, it is necessary that the detection is carried out safely. The level of safety is classified in various standards into safety integrity levels.

The embodiment of the invention provides a vehicle controller system and method and a computer readable storage medium, and the system comprises an application processing unit which is used for executing application software based on a quality management level corresponding to a vehicle industry standard; the software monitoring processing unit is used for monitoring the software running state of the application software based on the first security level; the hardware monitoring processing unit is used for monitoring the first hardware running state of the application processing unit and the second hardware running state of the software monitoring processing unit based on the second security level; wherein the first safety level and the second safety level meet a target function safety level corresponding to the controller system through level decomposition and superposition, and the first safety level, the second safety level and the target function safety level are selected from a plurality of safety integrity levels corresponding to the vehicle industry standard. The technical problem that the flexibility of a controller system of a vehicle is poor is solved.

The invention provides an escalator remote function safety device based on a safety PLC and a control method, and relates to the technical field of elevator safety control, and the escalator remote function safety device based on the safety PLC comprises an AI abnormal behavior detection module; a master control room monitoring and output module; a signal transmission module; an escalator control cabinet detection module; and a safety loop control module. By means of AI behavior recognition, safety PLC closed-loop control and remote signal transmission, remote emergency stopping of the escalator under the abnormal working condition is achieved, the SIL2 safety integrity level requirement of the IEC61508 standard is met, and the system is suitable for escalators and moving sidewalks in crowded places such as shopping malls, subway stations and airports.

A selection of a hydrocarbon well of a hydrocarbon production system is received at a safety logic solver (SLS) for proof testing. Test mode pressure sensors attached to a common header of the hydrocarbon production system are activated to monitor a live process condition status of the common header from all wells of the hydrocarbon production system. A simulated overpressure condition is induced in the operation pressure sensors. An indication of overpressure is received at the SLS from at least two operation pressure sensors. Final elements associated with the hydrocarbon well are signaled to close while leaving other wells in the hydrocarbon production system in operation. The operation pressure sensors are restored to a normal pressure condition, and the final elements associated with the selected hydrocarbon well are signaled to re-open the hydrocarbon well.

The invention discloses a rail transit monitoring and decision-making method and device based on image recognition and artificial intelligence. The rail transit monitoring and decision-making method based on image recognition and artificial intelligence comprises the following steps: acquiring an ATS interface frame image with a timestamp acquired by an external camera device or a video acquisition card; performing information extraction on the ATS interface frame image to obtain a structured real-time information set; obtaining abnormal event detail information according to the obtained structured real-time information set; generating suggested operation instruction information according to the abnormal event detail information; and displaying the suggested operation instruction information and carrying out multi-channel pushing. The ATS interface image is acquired through the external camera or the video acquisition card, direct data interaction with software and hardware of the ATS system is avoided, interference on the SIL (security integrity level) of the ATS system is avoided, the ATS interface image acquisition device can adapt to the ATS systems of different manufacturers and different versions, and compatibility risks and potential safety hazards caused by traditional intrusive interface modification are solved.

Safety mechanisms are embedded into a System on a Chip (SoC) and are operable to detect faults present in the logic circuitry in the SoC. Various types of faults in logic circuitry can occur, for example, a bit stuck at 0 or 1, or a transient or temporary fault due to radiation impacting the SoC. SoC devices are required to meet certain automotive safety integrity standards. The most stringent automotive safety integrity level requires that 90% of random latent faults are detected in all relevant logic, including all safety mechanism. Examples disclosed include hardware based checkers and hardware or software based pattern generation methods that achieve high online fault coverage in safety mechanism circuitry used for functional safety. A hardware based safety mechanism monitors the logic circuitry during operation. Any time the safety mechanism detects any faults in the logic circuitry, a fault notification is propagated to upstream logic.

A railway vehicle monitoring and signaling system 30 includes trackside devices (e.g. track circuits 36 and signals Sx, Sy) for reporting Safety Integrity Level 2 (SIL2) data regarding the presence or

This invention belongs to the technical field of Safety Integrity Level (SIL) verification for Safety Instrumented Systems (SIS), specifically disclosing a dynamic verification method and system for SIL considering uncertainty. Addressing the uncertainty issues in SIL verification, this invention introduces stochastic uncertainty theory and fuzzy uncertainty theory, combining stochastic uncertainty theory with LSTM networks and fuzzy uncertainty theory with fuzzy logic to propose a novel dynamic SIL verification method. It also performs source tracing analysis on the SIL verification results and uses a random forest method for feature importance analysis. The SIL level is dynamically updated as data is updated. This invention solves the problems of uncertainty and static lag in traditional SIL verification, eliminates the fuzzy uncertainty of expert judgment and the static nature of field data, and enables the final verification results to be dynamic and up-to-date.

This invention provides a remote functional safety device and control method for escalators based on a safety PLC, relating to the field of elevator safety control technology. The remote functional safety device for escalators based on a safety PLC includes: an AI abnormal behavior detection module; a main control room monitoring and output module; a signal transmission module; an escalator control cabinet detection module; and a safety loop control module. Through AI behavior recognition, safety PLC closed-loop control, and long-distance signal transmission, it enables remote emergency stopping of the escalator under abnormal operating conditions, meeting the SIL2 safety integrity level requirements of the IEC61508 standard. It is suitable for escalators and moving walkways in densely populated places such as shopping malls, subway stations, and airports.

A railway vehicle monitoring and signaling system 30 includes trackside devices (e.g. track circuits 36 and signals Sx, Sy) for reporting Safety Integrity Level 2 (SIL2) data regarding the presence or

A method for carrying out an at least partly automated driving function provided by means of a motor vehicle. The method includes: determining that an infrastructure element is located in an environment of the motor vehicle, wherein the infrastructure element is part of an event chain for the at least partly automated guidance of a motor vehicle during a trip that is guided in an at least partly automated manner; determining a minimum safety integrity level that the event chain must have; determining which safety integrity level the event chain maximally fulfills; determining, based on the minimum safety integrity level and the maximum safety integrity level of the event chain, whether the driving function may be carried out; and carrying out the driving function.

The invention discloses a design method for ensuring the integrity of satellite system software based on DO-278A. The method comprises the following steps: defining a satellite dedicated software security integrity level SSIL and mapping the satellite dedicated software security integrity level SSIL with a software integrity level SWIL of a DO-278A standard; constructing a satellite-ground cooperative dual V model containing a ground development V model and an on-orbit maintenance V model; designing a space software fault-tolerant architecture and carrying out a fault injection test; and establishing an on-orbit software health state monitoring and evidence collection closed-loop process. According to the method provided by the invention, the full life cycle of the satellite software is covered, the fault-tolerant capability and on-orbit maintainability of the satellite software are improved, the blank of an integrity guarantee scheme of the satellite exclusive software in the prior art is filled, and long-period and high-reliability operation of the satellite software is guaranteed.

The invention relates to a brake system for performing emergency braking of a rail vehicle, comprising: at least one brake cylinder (14); a pressure regulating device (12) for providing a brake cylinder pressure (Pb) to the brake cylinder (14); and a control device (16) for actuating the pressure regulating device (12). In order to enable flexible adaptation of the brake pressure even during emergency braking, the control device (16) comprises a control system (16i) and at least one further control system (16ii), each for actuating the pressure regulating device (12), wherein the different control systems (16i, 16ii) of the control device (16) are designed according to different safety integrity levels.

The invention provides an equipment remote control method and device, equipment and a storage medium, and the method comprises the steps: carrying out the layered wake-up processing of subway maintenance equipment after receiving a remote control request, and obtaining a wake-up confirmation signal and a network delay compensation parameter; performing dynamic allocation on the maintenance equipment operation authority according to an awakening confirmation signal and a delay compensation parameter in combination with a subway safety integrity level requirement to obtain an authority level and a hierarchical control channel; aiming at maintenance operation time window limitation, performing optimization generation on the control instruction according to the authority level and the hierarchical control channel to obtain a remote control instruction and an execution timing schedule; and performing closed-loop monitoring on the execution process of the remote control instruction according to the execution timing schedule, adjusting the execution process through state estimation and anomaly detection, and starting an emergency processing mechanism when an anomaly is detected. According to the invention, accurate remote control of maintenance equipment can be realized in a complex subway tunnel network environment, and the control efficiency and safety are improved.

The application relates to the technical field of industrial safety control, and discloses a double-hand button synchronous interlocking safety control module and a control method. The module comprises two input channels, a cross fault detection circuit, a synchronism detection circuit, a redundant output unit and an internal feedback monitoring circuit. The cross fault detection circuit continuously monitors the electrical isolation state between the channels during operation, and disconnects the output when an abnormality is found. The synchronism detection circuit measures the time difference when the two input signals become valid, and only allows the output when the time difference is not greater than a preset synchronization time window. The redundant output unit is composed of at least two series-connected forced direction switching elements, and cooperates with the feedback monitoring to ensure that the safety circuit can still be cut off under single-point fault. The application improves the safety and reliability and the response speed through real-time channel isolation monitoring, pure hardware synchronization judgment and redundant output fault-tolerant design, meets the requirements of high safety integrity level, and is suitable for safety application scenarios of various double-hand button control.

A failsafe counter module includes a controller that includes a processor and memory and circuitry for failsafe counting. The failsafe counter module also includes computer readable safety rating support code stored in the memory that, when executed by the processor, causes the controller to provide an international standard level of safety rating, such as Safety Integrity Level (SIL) 3, Category (CAT) 4, Performance Level (PL) e. The failsafe counter module also includes computer readable "safety monitoring" function code stored in the memory that, when executed by the processor, causes the controller to work with a user interface to select and configure a "safety monitoring" function. The failsafe counter module is a functional safety rated device with the intended rating for SIL 3, CAT 4, PL e applications and is designed to calculate position and / or speed with an external quadrature encoder sensor that produces a waveform that allows counting of specific electrical pulses.

An automated driving system includes a security companion subsystem to access data generated at a compute subsystem of the automated driving system, which indicates a determination by the compute subsystem associated with an automated driving task. The security companion subsystem determines whether the determination is safe based on the data. The security companion subsystem is configured to realize a higher safety integrity level than the compute subsystem.

A fail-safe counter module comprises a controller including a processor and a memory and circuitry for fail-safe counting. The fail-safe counter module further comprises computer-readable safety rating support code stored in the memory which, when executed by the processor, causes the controller to provide safety rating to International Standard levels such as Safety Integrity Level (SIL) 3, Category (CAT) 4, Performance Level (PL) e. The fail-safe counter module further comprises computer-readable “Safety Monitoring” functions code stored in the memory which, when executed by the processor, causes the controller to work with a user interface to select and configure the “Safety Monitoring” functions. The fail-safe counter module is a functional safety-rated device with an expected rating for SIL 3, CAT 4, PL e applications and is engineered to calculate position and / or speed utilizing an external quadrature encoder sensor that generates waveforms which permits counting of specific electrical pulses.

A Steering Angle Sensor (SAS), equipped with a redundancy system to allow the bypass of any failing part, keeping all functionalities intact, while ensuring all the required safety integrity levels is provided. The proposed fail operational redundant steering angle sensor (100) has two functional blocks (70) responsible to determine the absolute angle between at least two angling sensing devices, detecting systematic failures of the devices.

The invention provides a multi-safety-level service fusion bearing vehicle integrated platform and a vehicle, and belongs to the technical field of rail transit. The system comprises an input and output device, an execution mechanism, a first host and a second host. The first host is in communication connection with the input and output device and the execution mechanism, and the second host is in communication connection with the input and output device and the execution mechanism. The first host integrates business software of each first-class subsystem of the train, and the second host integrates business software of each second-class subsystem and each third-class subsystem of the train; wherein the safety integrity levels of the first-class subsystem, the second-class subsystem and the third-class subsystem are sequentially reduced. According to the train control system, the functions of each first-class subsystem, each second-class subsystem and each third-class subsystem can be realized through two hosts, and the number of hosts occupied by each subsystem is reduced, so that the software and hardware cost of the train control system is reduced, and fusion of vehicles and signals is realized.

An automated driving system includes a security companion subsystem to access data generated at a compute subsystem of the automated driving system, which indicates a determination by the compute subsystem associated with an automated driving task. The security companion subsystem determines whether the determination is safe based on the data. The security companion subsystem is configured to realize a higher safety integrity level than the compute subsystem.

The invention discloses a vehicle system fault diagnosis method, a controller and a vehicle system.The method is applied to the vehicle system, the vehicle system comprises a master controller, a first controller and a second controller, and the method comprises the steps that the first controller sends a diagnosis request to the second controller, the second controller obtains diagnosis data according to the diagnosis request; the first controller performs fault diagnosis according to the first data and received diagnosis data sent by the second controller or the master controller; the first controller determines that the vehicle system has a fault in a case where the first data is not the same as the diagnostic data. Fault diagnosis is carried out through the first controller according to whether the collected data are the same or not, the diagnosis coverage rate of the system can be improved, faults in the system can be comprehensively detected, measures are taken under the condition that the faults exist, accidents are prevented, and it is guaranteed that the vehicle system has the high safety integrity level.

The invention provides an automobile safety integrity grade decomposition device and method, and the device comprises a first function layer which obtains a second signal through calculation according to a first signal of a first grade; the second functional layer calculates a third signal according to the first signal; the merging module is used for merging the second signal and the third signal to obtain a fourth signal of a second level; wherein the first function layer and the second function layer are used for calculating the same physical quantity, the calculation modes are different, the first signal is utilized in a time-sharing mode, the first function layer and the second function layer are developed according to the first level, and the safety level of the second level is higher than that of the first level. The common cause failure is avoided by using the first signal in a time-sharing manner, so that the safety levels of the second signal and the third signal obtained by processing the two functional layers are the same as those of the first signal, and then the second signal and the third signal are combined, so that a fourth signal with a higher safety level can be obtained according to an ASIL decomposition method; and a higher ASIL function security target is realized by ingeniously utilizing low development cost.

The invention discloses an automatic measurement and control device for a deuterium-tritium fuel circulation system of a magnetic confinement fusion reactor and a control method, and belongs to the technical field of industrial control, the device comprises an OCS industrial optical bus control system and an SIS safety interlocking system which are dispatched by an intelligent production scheduling system, the OCS industrial optical bus control system and the SIS safety interlocking system are of three-level structures, and the OCS industrial optical bus control system and the SIS safety interlocking system are connected with the intelligent production scheduling system. Comprising a field level, a control level and a monitoring level. The control level of the OCS industrial optical bus control system is connected with the field level through an optical bus, and software definition of signal types is realized by adopting a general I / O module; the SIS safety interlocking system operates independently based on the SIL3 safety integrity level. The OCS industrial optical bus control system is adopted to replace a traditional DCS / PLC architecture, and the problems of electromagnetic interference, poor system collaboration and the like are solved through the optical bus and the universal I / O module; the safety and the redundancy capability are improved through an independent SIS safety interlocking system; meanwhile, intelligent production scheduling control is integrated, and the production efficiency is remarkably improved.

A computer-implemented method for determining a safety integrity level of a safety-related vehicle function of a motor vehicle, includes providing at least one infrastructure and / or vehicle sensor data signal, which represents infrastructure and / or vehicle sensor data, which are intended for the safety-related vehicle function provided by the motor vehicle. The method further includes determining a safety integrity level of the safety-related vehicle function based on the infrastructure and / or vehicle sensor data signal provided; and allocating a calculation of the safety-related vehicle function to an in-vehicle and / or an off-vehicle system, taking into account a predetermined safety integrity of the in-vehicle and / or the off-vehicle system.

Embodiments relate to a method for enhancing and prioritizing operation technology (OT) control systems in a safety instrumented system (SIS) environment by incorporating safety levels. The method includes receiving network packets associated with OT systems by network interface. From network packets, OT systems associated with safety integrity level (SIL) values are identified. In response to identifying OT control systems associated with SIL values, determining priority levels from SIL values of OT systems. The method includes identifying, among OT control systems, network packets associated with a critical OT system associated with a SIL value having a higher priority level. The critical OT system may be prioritized that comprises encoding the network packets of the critical OT system, with corresponding SIL value. The prioritized critical OT system may be prioritized based on SIL value and classified into a network group associated with a network tag to deliver traffic with higher priority.

An automotive storage device includes: a nonvolatile memory device configured to store data; and a storage controller configured to receive a first request from a first host, control the nonvolatile memory device so that the nonvolatile memory device performs an operation corresponding to the first request by using a first function including a first physical function, receive a second request from a second host having a safety integrity level that is different from that of the first host, and control the nonvolatile memory device so that the nonvolatile memory device performs an operation corresponding to the second request by using a second function including a second physical function.

The invention relates to a method for checking a planned trajectory (T) of a vehicle (1) for collision-free travel based on an environment model (2, 2') comprising a plurality of cells (Z), wherein the cells each correspond to an environmental area in the vicinity of the vehicle (1) and each cell (Z) is assigned information indicating whether the environmental area represented by the cell (Z) can be traversed without collision, wherein the first environment model (2) is provided by a first processor (P1) having a first safety integrity level that is lower than a safety level required for checking the trajectory (T) for collision-free travel, wherein the first processor (P1) determines at least one trajectory (T) to be checked for collision-free travel based on the first environment model (2), wherein the first environment model (2) or a different environment model (2) is used to determine the trajectory (T) to be checked for collision-free travel.a second, information-reduced environment model (3) is generated from the first environment model (2) or the further environment model (2') by reducing the first environment model (2) or the further environment model (2') to information relevant for the collision check of the trajectory (T), and wherein a second processor (P2), which has a second safety integrity level that is at least equivalent to the safety integrity level required for checking the trajectory (T) for collision-free operation, performs a collision check of the trajectory (T) based on the second, information-reduced environment model (3).