Direct Connect Algorithm for Railway Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Fault-tolerant failsafe computer systems in safety-critical applications, such as railway systems, face challenges in validating data packets to prevent erroneous instructions due to hardware or software faults, which can lead to unsafe operations.
Innovation Solution
A system that continuously asserts and de-asserts health signals based on packet validity, using a direct connect algorithm state machine to determine the operational mode of fail-safe chassis, ensuring only valid packets are communicated to safety-critical hardware and software, and employing redundant processing and voting subsystems to detect and respond to faults.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If fault-tolerant failsafe computer systems implement safety applications with multiple hardware components, then system reliability is improved, but device complexity increases
Solution Approach 1:
The system is divided into multiple independent fail-safe chassis (FSC), each with its own processing capabilities. Each FSC independently validates data packets and maintains health signals, allowing the system to segment safety-critical functions across multiple modular units rather than relying on a single complex system.
Solution Approach 2:
The patent implements redundant copies of critical components - multiple FSCs with identical validation logic and health monitoring capabilities. Each FSC maintains copies of safety applications and independently verifies data packets, ensuring that if one copy fails, others can take over without compromising system reliability.
2Reliability
If the system continuously validates data packets to prevent erroneous instructions, then safety is improved, but processing time increases
Solution Approach 1:
The system performs preliminary validation of data packets through the direct connect algorithm state machine before executing safety-critical instructions. Health signals are continuously monitored and validated in advance, ensuring that only pre-verified valid packets are processed by safety-critical hardware and software, preventing erroneous instructions before they can cause harm.
Solution Approach 2:
The direct connect algorithm state machine acts as an intermediary between data packet reception and execution. It validates packets and manages health signals, serving as a mediator that filters out invalid instructions before they reach safety-critical components, thus maintaining safety without requiring continuous interruption of the main processing flow.
3Difficulty of detecting and measuring
If the system uses multiple chassis health signals to detect faults, then fault detection capability is improved, but system complexity increases
Solution Approach 1:
The system uses distinct health signals (first through fourth chassis health signals) that act as status indicators for different FSC components. Each health signal represents a specific operational state, allowing the direct connect algorithm state machine to detect faults by monitoring changes in these signals, similar to how color changes indicate different states in visual systems.
Solution Approach 2:
Multiple chassis health signals serve multiple functions simultaneously - they indicate the operational status of individual FSCs, provide input to the direct connect algorithm for fault detection, and enable the system to determine when to de-assert signals or switch to predetermined modes. This multi-functionality reduces the need for separate dedicated fault detection mechanisms.
Data Source
AI summary
A system includes a safety relevant component that generates a data packet in response to receiving a request to perform a task and that communicates the data packet. The system further includes a first fail-safe chassis (FSC) that continuously generates a first and second chassis health signals, that determines whether the data packet is valid, and that selectively determines whether to de-assert the first and second chassis health signals based on the determination. The system also includes a second FSC that continuously generates a third a fourth chassis health signals, that determines whether a data packet is valid, and that selectively determines whether to de-assert the third and fourth chassis health signals based on the determination. The system includes a direct connect algorithm state machine that determines whether to instruct the one of the first and second FSCs to operate in a predetermined mode based on the chassis health signals.