Rail Brake Controller Gatekeeper Logic for Fail-Safe Signal Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing electrically controlled brake systems in rail vehicles do not meet the stringent requirements of international functional safety standards, such as IEC 61508 and EN 50128, and are prone to failures that compromise braking integrity.
Innovation Solution
A brake controller for rail vehicles featuring dual control units with diverse technologies and uncorrelated instruction sets, a gatekeeper unit ensuring identical control signals, and redundant switch branches in MOSFET technology, along with feedback and diagnostic mechanisms to validate braking operations and component health.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single control unit is used to simplify the brake controller, then device complexity is reduced, but reliability deteriorates due to higher risk of malfunction and failure
Solution Approach 1:
The brake controller is segmented into two independent control units (first control unit with processing circuitry and second control unit with state machine) that operate in parallel. Each control unit independently processes brake commands and generates control signals, eliminating single-point failure risks while maintaining manageable complexity through modular design.
Solution Approach 2:
Different control units are implemented with functionally diverse technologies and uncorrelated instruction sets, creating local quality differences that ensure independence of error modes. The first control unit uses processing circuitry with a computer program, while the second uses a state machine, ensuring that errors in one unit do not propagate to the other.
2Reliability
If functionally diverse control units with uncorrelated instruction sets are used to improve reliability, then safety increases, but device complexity increases
Solution Approach 1:
A gatekeeper unit acts as an intermediary between the first and second control units. It receives control signals from both units, validates their agreement, and only then produces the master control signal. This intermediary simplifies the overall architecture by providing a clear validation mechanism while enabling the use of functionally diverse control units for enhanced reliability.
Solution Approach 2:
The gatekeeper unit implements a feedback mechanism where control signals from both control units are compared for agreement before producing the master control signal. This feedback loop ensures functional safety by verifying consistency between independent control paths, while the automated agreement validation keeps the system architecture manageable.
3Reliability
If redundant control units and gatekeeper validation are implemented to meet safety standards, then reliability improves, but ease of manufacture deteriorates
Solution Approach 1:
The gatekeeper unit serves multiple functions: it receives control signals from both control units, validates their agreement, produces the master control signal, and generates diagnostic information. This multi-functionality reduces the need for separate components, simplifying manufacturing while maintaining the redundant control architecture required for functional integrity.
Solution Approach 2:
The gatekeeper unit combines the validation logic and master control signal generation into a single integrated component. By merging these functions, the system reduces assembly complexity while maintaining the necessary redundancy and validation mechanisms to meet international functional safety standards.
4Reliability
If the gatekeeper unit validates agreement between control signals before producing master control signal, then reliability improves, but response time deteriorates
Solution Approach 1:
The first and second control units independently process brake commands and generate control signals in parallel before they reach the gatekeeper unit. This preliminary action allows the validation process in the gatekeeper unit to work with pre-computed signals, minimizing the additional time required for agreement validation while maintaining control signal integrity.
Solution Approach 2:
The gatekeeper unit uses electronic signal comparison and logical operations to validate agreement between control signals, replacing slower mechanical validation methods. This electronic substitution enables rapid validation of control signal agreement, maintaining fast braking response while ensuring control signal integrity through automated comparison.
Data Source
Figure 1~3
Figure 4
AI summary
A rail vehicle brake controller (100) receives a brake command (BC), and in response thereto, produces a master control signal (CTRL) that controls an electrically operated brake unit (140) to perform a braking operation. The brake controller (100) contains first and second control units (110; 120) and a gatekeeper unit (130). The first control unit (110) includes a processing circuitry (111) arranged to process the brake command (BC) to produce a first control signal (CTRL1) as a result of running a computer program on the processing circuitry (111). The second control unit (120) includes a state machine (121) arranged to take the brake command (BC) as an input state and produce a second control signal (CTRL2) as an output state resulting from said input state being fed into the state machine (121). The gatekeeper unit (130) receives the first and second control signals (CTRL1; CTRL2), and in response thereto, produces the master control signal (CTRL) if and only if the first and second control signals (CTRL1; CTRL2) fulfil an identity criterion. If the identity criterion is not fulfilled, the gatekeeper unit (130) produces no master control signal (CTRL).