Actuating and monitoring module, particularly for operating units, i.e. wayside equipment, of railway systems or the like

Abstract

 An actuating and monitoring module, particularly for operating units, i.e. wayside equipment, of railway systems or the like, comprising:
a communication line with the operating unit to be controlled for transmitting an actuating signal, and for receiving so-called feedback signals, which feedback signals are generated by an oscillatory circuit generating a signal at a predetermined frequency when the operating unit switches to one of the predetermined operating states, a specific frequency being uniquely associated to each operating state and the oscillatory circuit being formed by the wires of the communication line between the control actuator and the operating unit and by a separate capacitor for each operating state, whereas the operating unit has feedback switch means operated thereby upon transition from a first to a second of such operating states, so that the attainment of an operating condition automatically generates a feedback signal at the predetermined unique frequency, which is detected by detection means of the actuating and monitoring module, which include analyzers for checking the correctness of the frequency of the feedback signal, which generate a signal indicating that the operating unit has correctly switched to the corresponding operating state. The module of the invention further includes means for modulating the feedback signal according to a predetermined modulation protocol.

Description

[0001] The invention relates to an actuating and monitoring module, particularly for operating units, i.e. wayside equipment, of railway systems or the like, comprising:

a communication line with the operating unit to be controlled, for transmitting operating unit control signals, i.e. actuating signals, and for receiving operating unit state signals, i.e. feedback signals;

which feedback signals are generated by an oscillatory circuit which generates a signal at a predetermined frequency when the operating unit switches to one of the predetermined operating states, a specific feedback signal frequency being provided in unique association with each operating state of the operating unit;

and the oscillatory circuit being formed by the secondary of a transformer connected to the communication cable, the wires of the communication line between the control actuator and the operating unit and a separate capacitor for each predetermined operating state of the operating unit, the operating unit having feedback switch means operated thereby upon transition from a first to a second of said predetermined operating states;

the whole in such a manner that, as an operating state is attained, a feedback signal having the predetermined unique frequency is automatically generated, which feedback signal is detected by detection means of the actuating and monitoring module,

which detection means include means for analyzing the feedback signal to check the correctness of the feedback signal frequency and generate a signal to indicate that the operating unit has correctly switched to the corresponding operating state.

[0002] Particularly, the invention addresses actuating and monitoring modules for railway systems or the like, in which the control or actuating signal to the operating unit is a Direct Current signal. Furthermore, this actuating and monitoring module shall be operable in railway systems in which the train is supplied with Alternating Current power.

[0003] Typical operating units are switch stands for railway switches or the like and/or other wayside equipment having solenoids controlled by a central station.

[0004] Railway equipment or operating units are arranged in remote positions, at a long distance from the actuating and monitoring module, which is generally situated in the premises that also contain other control and monitoring units, known as cabins.

[0005] Therefore, there exists on the one hand the need of reducing the number of wires used to connect the actuators and the wayside devices, the system being only partly distributed, as the central location is in series communication with the various zone controllers (containing the equipment actuating subsystem), which may be even placed at a considerable distance (2 - 3 km) from the wayside equipment. On the other hand, the wires of the communication lines shall still comply with length limits, imposed by electric and electronic needs.

[0006] In the particular field of railway systems, actuating and monitoring modules and operating units must operate at high degrees of safety and in a vital manner. Thus, should any malfunctioning occur, the units affected thereby are brought back to safety conditions, which are generally restrictive conditions.

[0007] Particularly, when AC power is supplied to trains, the safety conditions for operation on AC electrified lines essentially require protection against any undue control caused by induced and conducted voltage at 50 Hz, as well as a protection key on the feedback signal, which in prior art system is a fixed 400 or 120 Hz carrier.

[0008] An undue control may be caused by the fact that, if one of the wires of the communication line is in contact with the ground at two locations, i.e. one at the wayside device, i.e. the operating unit, and the other near the cabin, which contains the actuating and monitoring module, an induced and/or conducted AC noise voltage may occur on that wire, due to the traction current at 50 Hz. In this case, if an AC-to-DC converter is provided at the output of the module, the noise voltage generates a current having a non-zero average value, circulating across the converter, the non faulty wire and the load. Thus, this noise signal may simulate an undue accidental control signal.

[0009] An undue feedback may be caused by the presence of a signal having a certain frequency in the cable, still in case of a double ground fault. Once more, the noise signal may simulate an undue feedback signal, which might be interpreted as an indication that the remote operating unit has switched to a given operating state, and false information might be generated thereby.

[0010] As is better explained below in the disclosure, the solution to these problems of prior art actuating and monitoring modules is not trivial at all. Particularly, the need to improve safe control and/or monitoring using vital functions, in the context of AC train electrification at 50 Hz, and the need to reduce or maintain the number of wires in communication lines are at least partly in contrast with each other.

[0011] Therefore, the invention has the object of providing an actuating and monitoring module which, using simple and inexpensive arrangements, overcomes the safety problems of prior art modules having the same basic operation principles, while improving other safety features not directly associated to the AC traction problem.

[0012] First, the invention solves the above problem by providing an actuating and monitoring module, particularly for operating units, i.e. wayside equipment of railway systems or the like, comprising:

a communication line with the operating unit to be controlled, for transmitting operating unit control signals, i.e. actuating signals, and for receiving operating unit state signals, i.e. feedback signals;

which feedback signals are generated by an oscillatory circuit which generates a signal at a predetermined frequency when the operating unit switches to either of the predetermined operating states;

and the oscillatory circuit being formed by an inductor contained in the actuator, the wires of the communication lines between the control actuator and the operating unit and a separate capacitor for each predetermined operating state of the operating unit, the operating unit having feedback switch means operated thereby upon transition from a first to a second of said predetermined operating states;

the whole in such a manner that, as an operating state is attained, a feedback signal having the predetermined unique frequency is automatically generated, which feedback signal is detected by detection means of the actuating and monitoring module,

which detection means include means for analyzing the feedback signal to check the correctness of the feedback signal frequency and generate a signal to indicate that the operating unit has correctly switched to the corresponding operating state.

and which module of the invention further includes means for modulating the feedback signal according to a predetermined modulation protocol.

[0013] According to a further feature, the feedback signal modulation protocol is a pulse amplitude modulation (PAM) scheme.

[0014] The actuating and monitoring module of this invention comprises a local feedback signal generator having a local feedback signal carrier generating section and a local pulse amplitude modulation signal generating section, which local feedback signal generator is triggered to generate said feedback signal by a variable capacitance resonant grid, which is composed of a local inductor, a resistor provided by the wires of the communication line between the module and a remote operating unit and the contacts of the feedback switch of said remote operating unit, and a separate capacitor for each operating state of the remote operating unit, which capacitors are located in the remote operating unit and are alternately connected together in the resonant grid by the feedback switch depending on the operating state of the operating unit, whereas the module includes a local receiver having means for analyzing the feedback signal with respect to the frequency of the feedback signal carrier and the frequency of the pulse amplitude modulation of said feedback signal carrier, and which feedback signal analyzing means are of the vital type and generate a vital signal indicating that the operating unit has correctly switched to the corresponding operating state.

[0015] The feedback signal receiver comprises a vital AND port which generates a vital signal indicating that the operating unit has correctly switched to the corresponding operating state, when the two inputs of said AND port are presented with signals at the correct feedback signal carrier frequency and at the correct modulation frequency, which are provided by the output of the feedback signal analyzer.

[0016] Advantageously, the feedback signal analyzer means consist of a single feedback signal extraction/demodulation channel for extraction/demodulation of the feedback signal carrier frequency and of feedback signal carrier modulation frequency. The output of this channel enables one of the two final vital AND ports, whose second input is directly actuated by the frequency generator in operation (one of the two generators).

[0017] The inductor of the resonant grids of the feedback signal generator consists of the winding of a galvanic isolation transformer at the connection between the module and the operating unit.

[0018] According to yet another feature, the feedback signal presented to the receiver is taken from a winding of a galvanic isolation transformer at the connection between the module and the operating unit. To this purpose, a galvanic isolation transformer is provided between each input/output of the module and the corresponding input/output of the operating unit.

[0019] According to an improvement, the module of this invention further comprises means for detecting the lack of any feedback signal, which means compare the time during which no feedback signal has been detected with an adjustable maximum allowed threshold, and which means control means for locking, suppressing and/or delaying the signal indicating that the operating unit has correctly switched to the corresponding operating state during a predetermined time longer than said maximum allowed threshold, or generate a signal indicating that the operating unit has not correctly switched to the operating state when the time during which no feedback signal has been detected exceeds said maximum allowed threshold.

[0020] The vital AND port for generating the correct feedback signal is connected to a timer whose output is connected to at least two or a plurality of AND ports, whose number corresponds to the operating states of the operating unit and whose other input is respectively connected to one of the wires of the communication line between the module and the operating unit.

[0021] In one embodiment, the module of this invention is provided in combination with an operating unit which is able to switch to one of two different operating states, said module being connected to said operating unit by means of a communication line comprising at least two signal wires and a common neutral wire, each wire being associated to a different capacitor and each wire being connected to the feedback signal generator unit with its corresponding capacitor through a galvanic isolation transformer, and each wire being connected to the receiver unit, whereas the timer controls two vital AND ports designed to generate two different signals indicating that the operating unit has correctly switched to the corresponding operating state, each of which signals is uniquely related to one of the two operating states, whereas each AND port whose output is connected to the timer is connected by the other input to one of the two signal wires of the line between the module and the operating unit.

[0022] An example of this operating unit is a switch stand of a turnout or the like, which is powered by a DC motor. Here, the switch stand has one control or actuating input for a signal designed to control the displacement of the switch points from a first or normal position to a second or reverse position, and one control or actuating input for controlling the displacement of the switch points from the second to the first position, the switch stand having a communication line with the actuating and monitoring module, which communication line comprises a wire for transmitting the switch point displacement control signal for each of said two control or actuating inputs, whereas the switch stand further comprises a switch to close a resonant grid which simultaneously and alternately connects in series, in said grid, one of two capacitors, each having a specific value for each of the two operating positions of the switch stands, said capacitor being connected to one corresponding input of two separate feedback signal inputs of the monitoring section of the actuating and monitoring module by the same control or actuating signal transmitting wires.

[0023] The module of this invention is connected to the switch stand of the railway turnout or the like by means of three wires, two of which are for respectively transmitting one of two actuating signals for displacement of the switch points from a first to a second position and vice versa, and a third is a neutral wire, said two actuating signal wires also forming, with the neutral wire, a resonant grid for actuating a feedback signal generator.

[0024] Advantages resulted from using the following, as a carrier frequency and as a feedback signal modulation frequency: a carrier frequency of about 400 Hz, which is pulse amplitude modulated with a frequency of about 10.4 Hz.

[0025] In a second possible embodiment, the module of the invention is provided in combination with an operating unit having at least one solenoid, said module being designed for controlling and/or monitoring the operating state or position of the solenoid, there being provided a separate cable for controlling solenoid energization, and a further separate cable for the feedback signal, whereas the solenoid controls a feedback switch which, in one of the two operating states of the solenoid, closes a resonant grid whereby a capacitor is connected in series therein, which resonant grid actuates a feedback signal generator in the actuating and monitoring module, which generates a feedback signal having a predetermined carrier frequency and pulse amplitude modulated with a second modulation frequency, said feedback signal being provided to a receiver of the actuating and monitoring module having signal analyzer means for detecting the carrier frequency and the pulse amplitude modulation frequency and for generating a signal indicating that the operating unit has correctly switched to the corresponding operating state upon detection of the correct carrier frequency and the correct pulse modulation frequency of the feedback signal.

[0026] In a second possible embodiment, the module of this invention has two control outputs for the signals designed to energize two different solenoids, each of such outputs being connected by a dedicated cable to two wires, and an input for respectively controlling one of the two solenoids, whereas each solenoid controls a feedback switch which closes, in one of the operating states of the solenoid, a separate resonant grid for each solenoid, by connecting a predetermined capacitor in series, which resonant grid of each solenoid comprises a dedicated two-wire cable for the feedback signal and a dedicated capacitor.

[0027] In this embodiment, the pulse amplitude modulation frequency of the feedback signal is detected by an active filter.

[0028] Particularly, when the actuating and monitoring module is provided in combination with a central control unit which generates a solenoid energizing control signal, which energization signal is generated by the actuating and monitoring module itself in the presence of said energizing control signal, means being provided for delaying the actuation of the energization signal generator by a predetermined delay time.

[0029] One embodiment provides two PC-board relays for breaking the connection between the energization signal generator and the solenoid, which locking relays are controlled to restore the connection by the delay means after the predetermined delay time.

[0030] According to yet another embodiment, power is supplied to the active filter either through the locking relays or directly by the delay means so that, when the control connection between the energization signal generator and the solenoid is locked, power is supplied to the active filter through said locking relays, whereas when the connection between the energization signal generator and the solenoid is restored, power is supplied by the delay means whereby, when either locking relay becomes stuck in the energized position and no energizing control signal is provided at the input of the timer, position is no longer monitored and the above fault condition (dangerous for safety) is detected.

[0031] To obtain a higher safety degree, considering that the lack of position monitoring due to the auxiliary relay being stuck would not prevent an alternative noise from unduly actuating the remote unit, a redundant function of opening the output of the power circuit when no control is provided (use of two relays).

[0032] In the embodiment that provides energization control and solenoid position feedback, the feedback signal carrier has a frequency of 125 Hz and the pulse amplitude modulation frequency is of about 5.2 Hz.

[0033] Also, the module is advantageously provided in combination with a cyclically operating central control unit, which generates and transmits operating unit control signals to said module, for generating operating unit control or actuating signals and for generating and receiving feedback signals indicating the operating states of said operating units, whereas the actuating and monitoring module generates signals indicating that the operating unit has correctly switched to the corresponding operating state, which are provided to the central control unit after feedback signal analysis, and a signal is generated to indicate that the monitoring function is halted when the feedback signal receiving delay exceeds a given maximum threshold.

[0034] Advantageously, the halted monitoring function signal is generated by delaying the signal indicating correct switching to the corresponding operating state by a time corresponding to the cycle time of the central control unit.

[0035] The actuating and monitoring module of this invention may be even simply used as a monitoring module, the section having the above described monitoring functions being only provided in the circuit.

[0036] The invention further relates to two particular embodiments of the actuating and/or monitoring module, i.e. a railway turnout position feedback unit and an operating unit comprising two control relays, which are actuated by said actuating module, and generate feedback signals therewith.

[0037] Thanks to the above arrangements, the actuating module of this invention obviates the above drawbacks and further provided additional advantages.

[0038] In the variant embodiment of the module for actuating and/or monitoring railway turnout operation, such module is a stationary module allowing to control a DC (144 V) powered turnout, having limit contacts, through the three-wire actuator cable. Therefore, the module of this invention allows to avoid the use of a 4 x 1 control cable and can interface both with two ports of the Solid State Interlocking (SSI) (12 V and 800 Ohm each, and connected together in parallel) and in an electromechanical system, having neutral FS 840 relays with the two coils connected in parallel (12 V and 400 Ohm each). In the latter case, where the actuating and/or monitoring module would be used as an electronic apparatus, there is no need to use magnetically polarized relays. The module includes a signal receiver widely independent of the output load, which can absorb up to about 1 W.

[0039] Furthermore, the actuating and monitoring module in the above variant allows safe detection of the failure of the "third wire", i.e. the wire along which the feedback current does not circulate. If this wire fails, position monitoring functions are halted. Therefore, maintenance may be performed before transmission of an impossible drive request by the interlocking system.

[0040] In the preferred embodiment, the actuating and/or monitoring module has a 4 kV DC isolation provided between the wayside cable and the IN/OUT vital ports of the Solid-State Interlocking (SSI) and between such cable and the power supply unit. The actuating and monitoring module also has a transformer for supplying power to the internal circuits, which allows direct interfacing with the 150 V, 83.3 Hz power supply unit (with 4 kV isolation).

[0041] Thanks to the possibility of managing feedback signal generating delays, any temporary halt of the monitoring function to at least 70 ms is ignored; after 160 ms without any monitoring signal being detected, this temporary lack of signals is always detected and later stored by the logic of the apparatus. With central control units (CCU) having a cycle time of or below 0.5 seconds, this is achieved by using an instant reset vital timer, which delays the output of the feedback signal by about 750 ms. This allows to meet a safety critical requirement, as in electromechanical apparatuses.

[0042] The external monitoring circuit is equivalent to a current loop, and not to a voltage loop as in non solid-state, i.e. electromechanical interlockings (PBRRI). Thus, the external circuit is particularly responsive to the resistance of the actuator cable and the switch stand monitoring contacts, which sometimes have resistances much greater than zero. In a typical communication instance, there are two switch stands to be monitored and a section of the (4x1 or 4x2.5) monitoring cable between such two switch stands. While in prior art actuating and monitoring modules, the maximum resistance provided for the external circuit is of 10 Ohm and 20 Ohm respectively (7 Ohm max, in the three-core actuator cable) the actuating and monitoring module of this invention ensures proper operation to at least 30 Ohm, which value cannot be exceeded.

[0043] Regarding the feedback signal management function, the module of this invention has an additional safety key with respect to prior art actuating and monitoring modules. The feedback carrier, whose frequency is always in a range of about 60 Hz below/above 400 Hz, is amplitude modulated with a 10.4 Hz pulse signal. Then, the modulation frequency is vitally detected in the receiver. This allows to considerably enhance safety of operation, especially over AC electrified lines at 50 Hz, where a double ground fault of the actuator cable allows circulation of the (induced and conducted) traction current through the signaling circuits.

[0044] The actuating and monitoring module of this invention also implies what has been highlighted in the first operational step of such monitoring system. Therefore, it provides an evolution of prior art modules while being mechanically interchangeable therewith. Electric interchangeability is achieved by the use of a 150 VAC, 83.3 Hz power source, providing the power (about 4.5 W) required by the internal circuits, which are currently supplied with power by an external 24 VDC power source.

[0045] In the embodiment of the actuating and monitoring module which provides control and monitoring of the position of direct current powered solenoids, the module is a solid-state module which uses four separate cables to control and monitor the positions of two solenoids, powered with a 48 V DC voltage. The maximum continuous power required for each control is of 20 W. As a rule, the maximum allowed length for the control cable is such that its resistance does not exceed 15% of the resistance of the unit. The maximum length for the feedback cable is of 5 km and the maximum resistance of the external circuit (cable + unit's position contact resistance) is of 100 Ohm, unlike prior art modules which only allow a maximum overall resistance of 50 Ohm. Since proper operation of the position monitoring function requires the cable to have a minimum resistance of 50 Ohm, adjustment thereof has been provided in the cabin upon installation, to be performed only in cases in which resistance is lower than this limit. If position contacts oppose a high resistance (up to 20 Ohm), the maximum recommended resistance for the cable is of 80 Ohm.

[0046] Safe operation conditions over AC electrified lines essentially require protection against undue controls caused by induced voltage at 50 Hz and a protection key over the feedback signal.

[0047] An undue control may be caused by the fact that, if one of the wires of the control cable fall in contact with the ground at two locations, i.e. one at the wayside device, and the other near the cabin, an induced and/or conducted AC noise voltage may occur on that wire, due to the traction current at 50 Hz. In this case, since an AC-to-DC converter is provided at the output of the module, the noise voltage generates a current having a non-zero average value, circulating across the converter, the non faulty wire and the load. To prevent this and allow the load to have an adequate impedance at 50 Hz, the AC-to-DC converter shall be safely isolated when no control is provided.

[0048] An undue feedback may be caused by the presence of a 125 Hz frequency in the cable, still in case of a double ground fault. The presence of harmonics in the 50 Hz noise (the second and particularly the third harmonics) is not directly dangerous because, if the position contact is open and does not insert the 3.3 uF remote capacitor, the external circuit is of the ohmic-inductive type, thence it attenuates harmonics, whereas upon reception the carrier filter is driven by a photocoupler/squaring circuit, which shapes the sine signal in the cable into a square wave to neutralize the amplitude thereof. For these reasons, there is little likelihood of a signal other than the fundamental harmonic, with a prevailing amplitude, being presented to the input. Nevertheless, also considering that the maximum passband of the carrier filter is rather wide (about 40 Hz), the degree of safety has been increased by pulse modulation of the feedback signal to 125 Hz, as in the module of the previous embodiment.

[0049] The modulation frequency is obtained from the network frequency and is of about 5.2 Hz (T=192 ms). The OFF time of the modulation frequency upon transmission is of 36 ms with a power supply at 83 Hz and of 30 ms with a power supply at 50 Hz. The decoder extracts the cycle of the demodulated signal by means two frequency dividers having complementary operations, and then monitors such cycle by means of an active filter, which is essentially required for space saving reasons. A 5 Hz L/C filter would require an inductor whose size and weight would be incompatible with the application.

[0050] Two controls and two feedbacks as described above shall have to be placed in a closed module having a size of 235 x 285 mm and a thickness of 10 TE, so as to achieve mechanical interchangeability with prior art modules, to minimize space requirements, and to be competitive in terms of volume occupancy even with relay-operated systems. Electric interchangeability is achieved by using of a 150 VAC, 83.3 Hz power source which delivers, instead of 24 VDC, as currently available, the power required by the signal circuits (an overall power of about 12 W for each module).

[0051] The provision of pulse modulation increases the response time, i.e. the time after which there is no output from the opening of the remote position contact. This time may reach the value of 350 ms. The requirements of the 5.2 Hz active filter determine a maximum delay time in feedback reception of about 1.7 s.

[0052] The power stage is an open-loop fixed-voltage forward stage (single stage). The overload protection at the output automatically rearms and makes a reset attempt about every 15 seconds. The delay time (about 350 ms) on the control signal is set by a vital timer.

[0053] Further improvements will form the subject of the dependent claims.

[0054] The characteristics of the invention will appear more clearly from the following description of two embodiments, which are shown in the annexed drawings, in which:

Figure 1 is a block diagram of the monitoring section of a module according to the present invention which is specifically configured for monitoring the position of the switch points of a railway turnout.

Figure 2 is a block diagram of a variant embodiment of the actuating and monitoring module according to this invention, which is designed for controlling and monitoring solenoid positions.

Figure 3 is a block diagram of the vital active filter of the modulation frequency in the module of Figure 2.

[0055] Figure 1 shows the block diagram of the monitoring section of a module according to the present invention which is specifically configured for monitoring the position of the switch points of a railway turnout.

[0056] Once the switch points have been controlled for displacement into the proper position, position monitoring is obtained by the circulation of a frequency of about 400 Hz, generated by an oscillator placed in the cabin that contains the module, in two of the three control transmission wires. The oscillator is only triggered if the contact (cpn or cpr) of the position cam inside the switch stand inserts a capacitor (Cn or Cr) into the grid, which capacitor is in the terminal box of the wayside device, i.e. the turnout.

[0057] In the example of Figure 1, the last operation caused the switch points to move from the reverse position to the normal position. During such operation, the relay MN was energized, the controls KN and KR were reset, the DC motor moved the switch points and at the end of the stroke of the latter, the contact of the position monitoring cam FCn broke the actuating current supply and disconnected the motor from the grid. With the switch points in the correct position the contact cpn of the position monitoring cam is established and the capacitor Cn forms a resonant circuit with one of the secondaries of the 4KV isolation transformer, designated by 2 and also contained in the cabin. The overall monitoring grid is composed of:

144 V single-phase or three-phase power source;

Contact of the relay MN established, with the relay MN energized;

Secondary of the isolation transformer;

Actuating wire A (+);

Remote capacitor Cn;

Contact cpn established by the cam in the switch stand of the turnout;

Actuating wire C (-);

[0058] In these conditions, the oscillator 1 is triggered, whereas the reverse position oscillator 5, at the start of the motion from the reverse to the normal position shuts off, both because the cam contact cpr cuts the Cr out, and because the limit contact FCr closes, and puts the motor in parallel with the secondary of the isolation transformer 3, thereby short-circuiting the output. Therefore, no monitoring current circulates on the actuating wire B (+).

[0059] Once the normal position monitoring operation has been completed, the apparatus de-energizes the control relay MN, which forms the neutral closed circuit in the cabin, wherethrough the monitoring current may circulate, while maintaining the oscillator in the triggered state. If the contact FCr wasn't established at the start of the motion from the reverse to the normal position due to a fault (e.g. caused by overvoltage at the end of the previous operation) or the wire C is broken, the oscillator 5 is triggered due to the stray capacitance of the transformer 3 and the distributed cable capacitance and oscillates at a frequency of 1 to 2.5 Hz. This signal adds noise to the signal of the other channel and will lead, as better explained below, to monitoring KN being halted.

[0060] The selection of the carrier frequency first depends on the requirement of placing the isolation transformers on a PC board, even though such transformers have a large size, because their resonant secondaries are placed in series on the power circuit and a permanent direct current of about 7A shall have to circulate thereon, if the switch stand is in the friction clutched position. In certain types of switch stands, at the start of the motor operation, there may be a transient current of up to about 20 A during a few tens of ms. Therefore, the minimization of the inductance value of the resonant secondary and safety requirements in AC electrified lines lead to the selection of a carrier much higher than 50 Hz; on the other hand, the maximum limit is determined by the maximum length of the cable whose distributed parameters R and C cause the frequency of oscillators to be increasingly displaced as such frequency increases. Therefore, the selected frequency is a compromise between these contrasting needs. Operation will not be possible in an intermediate position between an even harmonic and an odd harmonic of 50 Hz, because increased cable resistance causes the nominal frequency to be also increased, whereas the increased capacitance causes it to be decreased. Since these two parameters may evolve independently of each other, a maximum resistance of 7 Ohm being required to limit voltage drop, the carrier frequency may be in a range of about 375 to 430 Hz Isolation transformers may be displaced to the control relay c.c.n. branch, to prevent the actuating DC from circulating therein; this requires the control functions to be timed, as well as other important circuit arrangements, which will be added if the module is designed to also accomplish actuator functions.

[0061] The fact that the resonant grid is associated to the transmitting oscillator and not to the receiving filter causes the feedback signal to be totally absent in the grid prepared for the next operation, and requires safety thresholds to be set at the receiver input, and also allows very small changes in the received voltage, i.e. of about 20%, as the cable resistance changes from 5 to 30 Ohm. No adaptation step is required for wayside equipment during installation and the selectivity of the receiving filter is independent of resistance. The latter only has some effect on oscillator stability (for Meissner oscillators), although this leads to little consequences on frequency change, due to the small thermal range and limited voltage changes.

[0062] The carrier generators 1 and 5 are amplitude modulated by one pulse generator driven by a reference signal withdrawn by the mains voltage at 83.3 Hz (block 21). This, the carrier is cut off during 12 msec every 96 msec, therefore the frequency of the modulating signal is of 10.4 Hz.

[0063] Amplitude modulation is further important as it allows the oscillator to be triggered after an operation even when the cable has a high resistance, which reduces the gain of the active stage of the oscillator, and pushes it to the limit of the oscillating condition. Since the oscillator is disabled during an operation, the connection of the remote capacitor to the secondary of the isolation transformer does not always ensure proper trigging, as the active stage is not susceptible to voltage or current changes. Amplitude modulation produces these changes and substantially facilitates triggering. Certain prior art modules include a pulse generator which disables the oscillator for a very short time (about 50 µsec every 100 msec). In the module of this invention, the features of this generator have been modified, particularly changing the pulse duration from 50 µsec to 12 ms. This provides an amplitude modulation whose duty-cycle (about 88/12) depends on the modulation type and on receiver response time specifications.

[0064] The feedback signals are withdrawn from the isolation transformers (2 and 3) and summed together in block 6. Then, the modulated signal is transmitted over two separate channels: the first channel, formed by the passive filter 8, the controlled threshold amplifier 11 operating at 11 kHz and the converter 14, detects the carrier frequency, while the second channel, formed by the converter 9, the monostable section 12, generating a signal at 10.4 Hz with a duty-cycle of about 50/50, the passive filter 10, the controlled threshold amplifier 13 and the converter 15 detects the modulating frequency. The correct provision of both signals actuates the vital AND 17, which drives the timer 18, whose function is to create a disabled monitoring function condition for more than 500 ms if no modulated feedback signal is detected in a time of more than 150 ms, which time is set in block 14. Thus the interlocking logic (central logic computer, CLD having a cycle time of 0.5 sec) can always detect an event which might affect safety and store it. The timer has two outputs, one of which is enabled to reach the output through the vital ANDs 19 and 20, which receive a DC voltage on the second input, which voltage is directly obtained, through the converters 7 and 16, from the isolation transformers. If the actuating wire C breaks off, both ports 19 and 20 are enabled, and the timer output is neutralized, as the 400 Hz highest frequency sum signal from block 3 is actually filtered off by the filter 8 and the output of the AND port 17 is neutralized.

[0065] Since certain switch stands, e.g. the P64 switch stand, have a series excitation motor, the internal impedance at 400 Hz is much higher than that of other switch stand types, e.g. P80 switch stands, having a permanent magnet motor, which is electrically equivalent to a separate excitation motor. The series excitation motor hinders the passage of the 400 Hz signal. For this reason, and to avoid the generation of a frequency above 400 Hz in the grid, in such type of switch stand a 1 W 1000 Vr diode shall be directly connected, in antiparallel with each winding of the motor. Obviously, in this case the motor cannot be tested by the feedback signal. The connection of the diode is only allowed in DC electrified lines. Over AC electrified lines, the only requested arrangement with such switch stands relates to the passive external unit for feedback termination and may become of general use.

[0066] All blocks have been implemented using an analog fail-safe technology, comprising both discrete components (traditional PTH/SMD and special components) and linear integrated circuits. In the testing process, the carrier filter is the only component that requires calibration. The amplifiers and the AND ports in the block diagram are differential oscillators, operating at a frequency slightly above 10 kHz, which use two common ground power supplies (+12 and -24 VDC), obtained through blocks 21 and 22.

[0067] Regarding functional safety, the method as described above meets a number of requirements:

By mechanically assuring consistency between the position of the position monitoring cam contacts in the switch stand and the switch point position, it is necessary and sufficient that the feedback signals should only be generated if such contacts (cpn or cpr) are established and if, at the same time, limit contacts (FCn or FCr) are open.

[0068] If there is no feedback signal during a time of more than 160 msec, the interlocking system shall be able to store this event, and generate a permanent zero of the internal feedback variable.

[0069] If the wire A fails and comes in contact with the wire C, or the wire C fails and comes in contact with the wire A or, with unbroken A and C, the wire B fails, the outputs KN and KR shall be inhibited.

[0070] A sine or square wave noise at a fixed or modulated 50 Hz frequency shall not affect the outputs KN and KR.

[0071] Regarding functional regularity, the method as described above fulfils the following conditions:

At any instant, only one of the two outputs KN and KR may be enabled; the enabled output is the one corresponding to the actual turnout position.

[0072] If the circuit prepared for the next operation opens, the outputs KN and KR are inhibited.

[0073] If the capacitors Cn and CR, having different capacitance values are exchanged, the outputs KN and KR are neutralized.

[0074] The highest possible resistance in each of the two monitoring grids, outside the CPA-25, is of 30 Ohm.

[0075] A feedback signal inactivity at the receiver input of 70 ms or less is not detected.

[0076] The actuating wires are connected by transformers, whose isolation voltage is not less than 4 kV DC.

[0077] Figures 2 and 3 are two block diagrams of a second embodiment of the actuating and monitoring module of this invention, which is specifically designed for Direct Current control and position monitoring of solenoids.

[0078] Referring to Figure 2, block 101 is directly connected to the 50 Hz power supply. The latter supplies power to a DC-to-DC converter, formed by blocks 101 (AC-to-DC converter), 102 (stabilized DC-to-AC forward converter, operating at 60 kHz), 104 (4 KV DC step-down isolation transformer), 105 (AC-to-DC converter), at whose output a DC voltage of 48 VDC 50 W is provided. The control from a vital interlocking system enables the DC-to-AC-converter after a time of about 350 ms, which is provided by the vital timer 103, the latter always providing a delay of not less than 200 ms, slightly longer than the time during which an undue control wrongly generated by the interlocking logic may be presented to the input. The timer also causes two auxiliary (force guided) relays K1 and K2 to be energized. When these relays are de-energized, they provide the c.c.n. of the output and cut off, immediately upstream from the c.c.n., one of the cable wires, to shunt the AC-to-DC converter (105) and thereby protect the device from any AC voltage induced in case of double ground fault on either cable wire.

[0079] In the de-energized state, the relays K further allow power supply to block 115, which is vital for operation of the position monitoring receiver. When these relays are energized to allow control actuation, the timer provides a 12 V power supply to block 116. Thus, if one of the relays is stuck high, once the control has been removed and the timer output has been neutralized, position monitoring is disabled, which allows fault detection.

[0080] Position monitoring is performed on a special cable, separated from the power circuit of the control. Thanks to this arrangement, the carrier frequency may be considerably lower than in the case of combined monitoring and control functions, wherefore a much higher resistance and a much longer cables may be tolerated. The principle is the same as used in the turnout monitoring unit of the previous Figure 1, but the two embodiments have different circuit implementations. Block 110 is a Meissner oscillator, interfacing with the cable through an isolation transformer (block 106), on which one of the secondaries forms an inductor having an appropriate inductance value, to determine, with the 3.3 uG remote capacitor directly downstream from the position contact to be monitored, a nominal frequency oscillation of 125 Hz, when the contact is closed. This carrier generator is pulse amplitude modulated by block 107, in which the frequency dividers obtain the 5.2 Hz modulating signal directly from the mains sine-wave signal, withdrawn by an on-board transformer (block 108) which is adapted to supply two DC voltages (+12 and -24 V respectively) to the circuits of both solenoids. The signal for the receiver is also taken from the isolation transformer and transmitted both to a squaring circuit which drives the selective carrier amplifier (blocks 111 and 112), and to an AC-to-DC converter (block 114) which is designed to demodulate and drive block 115, the latter essentially consisting of two frequency divider channels, operating in complementary manners, whose function is to extract the cycle of the modulating signal. This cycle is measured by block 116 (active filter); if it is in the range of 170 to 214 ms (nominal passband), with T_nom = 192 ms (Q_eq = 5.6), then the filter generates a signal at about 11 kHz, which can safely enable the AND port 118 for access by two inputs. The second input is obtained from the carrier filter and is active if this frequency is in the range of 112 to 138 Hz, with nominal internal supply voltages. The increase in the resistance of the external circuit from the minimum value (50 Ohm) to the maximum value (100 Ohm) causes an increase of the carrier frequency, whereas an increase in cable length, thence in its distributed capacitance, causes a decrease of the frequency. In practice, changes from 120 to about 130 Hz may occur. The above block diagram is provided in simplified form, and does not show the blocks for overload protection of the DC-to-AC converter upon transmission and those of LC oscillators required for the vital blocks (timer and logic ports) to be dynamic. These oscillators shall be deemed to be within the blocks 1033, 116 and 118.

[0081] The block diagram of Figure 3 describes the operation principle of the modulating filter (blocks 115 and 116 of the diagram of Figure 2).

[0082] The output signal from block 201 (amplitude demodulator) is transmitted to two identical and complementary channels. Therefore, the operation of channel A will be only described hereinafter. Such operation starts in block 202, a hysteresis comparator, which is designed to remove the distortion from the received waveform and switches at two different input signal levels, to remove false switching due to the ripple. The minimum threshold also sets the required modulation depth. The pulses generated by the block 202 drive a frequency divider (block 203), whose output is presented with a square wave having exactly twice the cycle of the modulating signal. Block 212 of the second channel produces an exactly complementary square wave. The ON half-cycle of the output square wave from block 202 actuates the monostable 1A (block 206), whose time constant is theoretically equal to the nominal cycle plus half the tolerance allowed for the cycle. Since such monostable is only active in the presence of an input enabling signal, once the ON of the output square wave to block 203 has been completed, the negative front of such wave must trigger the monostable 1B, whose time constant is equal to the tolerance admitted for the cycle (a nominal tolerance of 34 ms ± 30%, corresponding to a band of 0.8 Hz ± 30%). Thus, considering a cycle of about 192 ms (nominal value), the negative front of the output signal from the monostable 1A occurs exactly at the center of the output tolerance pulse to the monostable 1B at an instant in which the frequency divider output 203 is in the OFF state. This front is extracted from block 205 and is combined in an AND relationship (block 209) with the output of the divider of channel B (block 212). The square wave at such output is in the ON phase, therefore the shunt pulse generated by block 205 may reach the output of block 209 and, once it is completed, it may keep it high until the end of the ON at the output from block 212, thanks to a stick connection on port 209. The safety-critical dynamism of the outputs of ports 209 and 218 is controlled by the shunt sections which form blocks 210 and 219. A sawtooth signal to drive the timer 221 is at the output of these blocks. Its delay is of about 1 sec, its reset time is of the order of 2 ms. Therefore, if one of the channels generates the output, the timer continuously resets and its output is zero. The delay is preset to such a value as to make the output wholly unresponsive to a single change acting on one of the shunts. The filtering function may be explained as follows.

[0083] If the signal cycle is of less than 175 ms (nominal value), the monostable 2021 resets before its time constant has passed and in this case the shunt can be generate the set pulse for the next memory. On the contrary, if the signal cycle is of more than 209 ms (nominal value), the set pulse is produced, but during the OFF of the channel B and has no effect.

[0084] All blocks, except 201, 202, 203, 211, 212 are fail-safe analog HW. This diagram also does not show, for the sake of simplicity, the oscillator blocks required for all signals to become dynamic, so that all logic and analog functions can be vital.

[0085] The actuating and monitoring module as illustrated in Figures 2 and 3 meets the following functional safety requirements:

The 48 V control voltage is only present at the output if 22 V enabling is received by an ODB port of the solid-state interlocking.

[0086] An abnormal current of 3 mA or less from the ODB does not enable the 48 VDC power output.

[0087] The power output is present with a minimum delay of 200 ms from the positive front of the control signal whose maximum amplitude may increase to 27 V due to a fault.

[0088] The power output is nullified with a maximum delay of 100 ms from the negative front of the control signal.

[0089] When no control is detected, at least one of the wires is certainly cut off at the 48 VDC output, to nullify the rectification effect of the relevant AC-to-DC converter on any induced voltage in the wayside cable, when the latter is connected to two ground at two separate locations, due to a fault.

[0090] Monitoring occurs through a two-wire wayside cable. The feedback signal receiver is irresponsive to the opening and short-circuit of the cable.

[0091] The 12V feedback output is only present if the remote position contact is closed and the feedback carrier is regularly modulated at 5.2 Hz +/- 0.5 Hz. Any noise at a fixed or modulated frequency of 50 Hz on the cable does not actuate this output.

[0092] The feedback signal receiver is irresponsive to any signal from any other position monitoring transmitter, when these signals are conveyed through a multi-core cable and two separate contacts occurred on the two circuits due to a fault.

[0093] The maximum cable length is of 5 km and its maximum distributed capacitance is of 85 nF/km.

[0094] The feedback output has a value of less than 4 V after a maximum time of 350 ms from the opening of the remote position contact.

[0095] Themodule as illustrated in Figures 2 and 3 further fulfils the following functional regularity requirements:

The maximum deliverable power at the 48 VDC output is of 50 W.

[0096] The power transmitter is switched off in overload conditions. Overload removal causes the generator to automatically reset after a time of 13 to 15 s.

[0097] The minimum passband of the feedback carrier filter, with a min. Val, is of 118 to 132 Hz. The fixed-carrier minimum power that can actuate the receiver is of not less than 100 mW.

[0098] The maximum induced noise at 50 Hz on the feedback cable is of 20 VAC, the maximum cross-talk noise at 125 Hz, if a multicore cable is used for the position monitoring transmitter, is of 5 VAC (about 10% of the maximum transmitted signal).

[0099] The minimum passband of the modulation frequency filter is of about 0.6 Hz (from 4.9 to 5.5 Hz).

[0100] The resistance of the circuit outside the cabin is of 50 to 100 Ohm. If this resistance is of less than 50 Ohm the feedback signal is adjusted on the transmitter to add a dummy load to the resonant circuit of the oscillator. For a cable resistance of 0 to 25 Ohm, the plug for an internal resistance of 39 Ohm shall be connected to the front of the tray. For a cable resistance of 26 to 50 Ohm, the plug to be connected is for an internal resistance of 68 Ohm.

[0101] A feedback signal inactivity at the receiver input of 25 ms or less is not detected.

[0102] The tolerance for the 150 V supply voltage is of ± 5%. The tolerance for the supply frequency is of ± 1%.

[0103] The separate actuating and monitoring cables are connected by means of 4 kVDC isolated transformers.

Claims

1. An actuating and monitoring module, particularly for operating units, i.e. wayside equipment, of railway systems or the like, comprising:

a communication line with the operating unit to be controlled, for transmitting operating unit control signals, i.e. actuating signals, and for receiving operating unit state signals, i.e. feedback signals;

which feedback signals are generated by an oscillatory circuit which generates a signal at a predetermined frequency when the operating unit switches to one of the predetermined operating states, a specific feedback signal frequency being provided in unique association with each operating state of the operating unit;

and the oscillatory circuit being formed by the wires of the communication lines between the control actuator and the operating unit and a separate capacitor for each predetermined operating state of the operating unit, the operating unit having feedback switch means operated thereby upon transition from a first to a second of said predetermined operating states;

the whole in such a manner that, as an operating state is attained, a feedback signal having the predetermined unique frequency is automatically generated, which feedback signal is detected by detection means of the actuating and monitoring module,

which detection means include means for analyzing the feedback signal to check the correctness of the feedback signal frequency and generate a signal to indicate that the operating unit has correctly switched to the corresponding operating state,

characterized in that it includes means for modulating the feedback signal according to a predetermined modulation protocol.

2. A module as claimed in claim 1, characterized in that the feedback signal amplitude modulation protocol is a pulse amplitude modulation (PAM) scheme.

3. A module as claimed in claims 1 and 2,
characterized in that it comprises a local feedback signal generator having a local feedback signal carrier generating section and a local pulse amplitude modulation signal generating section, which local feedback signal generator is triggered to generate said feedback signal by a variable capacitance resonant grid, which is composed of a local inductor, a resistor provided by the wires of the communication line between the module and a remote operating unit and the contacts of the feedback switch of said remote operating unit, and a separate capacitor for each operating state of the remote operating unit, which capacitors are located in the remote operating unit and are alternately connected together in the resonant grid by the feedback switch depending on the operating state of the operating unit, whereas the module includes a local receiver having means for analyzing the feedback signal with respect to the frequency of the feedback signal carrier and the frequency of the pulse amplitude modulation of said feedback signal carrier, and which feedback signal analyzing means are of the vital type and generate a vital signal indicating that the operating unit has correctly switched to the corresponding operating state.

4. A module as claimed in one or more of the preceding claims, characterized in that the feedback signal receiver comprises a vital AND port which generates a vital signal indicating that the operating unit has correctly switched to the corresponding operating state, when the two inputs of said AND port are presented with signals at the correct feedback signal carrier frequency and at the correct modulation frequency, which are provided by the output of the feedback signal analyzer.

5. A module as claimed in claim 4, characterized in that the feedback signal analyzer means consist of one carrier filtering and feedback signal demodulating channel, and each channel has means for generating two DC signals, one related to the carrier frequency and the other to the modulation frequency, each being presented to a vital AND port with two inputs.

6. A module as claimed in one or more of the preceding claims, characterized in that the inductor of the resonant grids of the feedback signal generator consists of the winding of a galvanic isolation transformer at the connection between the module and the operating unit.

7. A module as claimed in one or more of the preceding claims, characterized in that the feedback signal presented to the receiver is taken from a winding of a galvanic isolation transformer at the connection between the module and the operating unit.

8. A module as claimed in one or more of the preceding claims, characterized in that a galvanic isolation transformer is provided between each input/output of the module and the corresponding input/output of the operating unit.

9. A module as claimed in one or more of the preceding claims, characterized in that it comprises means for detecting the lack of any feedback signal, which means compare the time during which no feedback signal has been detected with an adjustable maximum allowed threshold, and which means control means for locking, suppressing and/or delaying the signal indicating that the operating unit has correctly switched to the corresponding operating state during a predetermined time longer than said maximum allowed threshold, or generate a signal indicating that the operating unit has not correctly switched to the operating state when the time during which no feedback signal has been detected exceeds said maximum allowed threshold.

10. A module as claimed in claim 9, characterized in that the vital AND port for generating the correct feedback signal is connected to a timer whose output is connected to at least two or a plurality of AND ports, whose number corresponds to the operating states of the operating unit and whose other input is connected to its respective isolation transformer.

11. A module as claimed in one or more of the preceding claims, characterized in that it is provided in combination with an operating unit which is able to switch to one of two different operating states, said module being connected to said operating unit by means of a communication line comprising at least two signal wires and a common neutral wire, each wire being associated to a different capacitor and each wire being connected to the feedback signal generator unit with its corresponding capacitor through a galvanic isolation transformer, and each wire being connected to the receiver unit, whereas the timer controls two vital AND ports designed to generate two different signals indicating that the operating unit has correctly switched to the corresponding operating state, each of which signals is uniquely related to one of the two operating states, whereas each AND port whose output is connected to the timer is connected by the other input to one of the two isolation transformers.

12. A module as claimed in one or more of the preceding claims, characterized in that it is an actuating and monitoring module of a switch stand of a P80 railway turnout which is powered by a permanent magnet DC motor, which switch stand has one control or actuating input for a signal designed to control the displacement of the switch points from a first or normal position to a second or reverse position, and one control or actuating input for controlling the displacement of the switch points from the second to the first position, the switch stand having a communication line with the actuating and monitoring module, which communication line comprises a wire for transmitting the switch point displacement control signal for each of said two control or actuating inputs, whereas the switch stand further comprises a switch to close a resonant grid which simultaneously and alternately connects in series, in said grid, one of two capacitors, each having a specific value for each of the two operating positions of the switch stands, said capacitor being connected to one corresponding input of two separate feedback signal inputs of the monitoring section of the actuating and monitoring module by the same control or actuating signal transmitting wires.

13. A module as claimed in claim 12, characterized in that it is connected to the switch stand of the railway turnout or the like by means of three wires, two of which are for respectively transmitting the positive polarity of one of two actuating signals for displacement of the switch points from a first to a second position and vice versa, and a third is a neutral wire, said two actuating signal wires also forming, with the neutral wire, a resonant grid for actuating a feedback signal generator.

14. A module as claimed in claim 12 or 13, characterized in that the feedback signal has a carrier frequency of about 400 Hz, which is pulse amplitude modulated with a frequency of about 10.4 Hz.

15. A module as claimed in one or more of claims 1 to 11, characterized in that it is provided in combination with an operating unit having at least one solenoid, said module being designed for controlling and/or monitoring the operating state or position of the solenoid, there being provided a two-core cable for controlling solenoid energization, and a further two-core cable, separated from the other, for the feedback signal, whereas the solenoid controls a feedback switch which, in one of the two operating states of the solenoid, closes a resonant grid whereby a capacitor is connected in series therein, which resonant grid actuates a feedback signal generator in the actuating and monitoring module, which generates a feedback signal having a predetermined carrier frequency and pulse amplitude modulated with a second modulation frequency, said feedback signal being provided to a receiver of the actuating and monitoring module having signal analyzer means for detecting the carrier frequency and the pulse amplitude modulation frequency and for generating a signal indicating that the operating unit has correctly switched to the corresponding operating state upon detection of the correct carrier frequency and the correct pulse modulation frequency of the feedback signal.

16. A module as claimed in claim 15, characterized in that the pulse amplitude modulation frequency of the feedback signal is detected by an active filter, having no magnetic elements with a very low operation frequency.

17. A module as claimed in claim 15 or 16, characterized in that it has two control outputs for the signals designed to energize two different solenoids, each of such outputs being connected by a dedicated cable to two wires, and an input for respectively controlling one of the two solenoids, whereas each solenoid controls a feedback switch which closes, in one of the operating states of the solenoid, a separate resonant grid for each solenoid, by connecting in series a predetermined capacitor located near the wayside device, which resonant grid of each solenoid, in which the respective feedback signal circulates, comprises said capacitor, a dedicated two-core cable, which is different from the control cable, and a secondary of the isolation transformer, which is part of the feedback signal generator, placed in the actuator.

18. A module as claimed in one or more of the preceding claims, characterized in that it is provided in combination with a central control unit which generates a solenoid energizing control signal, which energization signal is generated by the actuating and monitoring module itself in the presence of said energizing control signal, means being provided for delaying the actuation of the energization signal generator by a predetermined delay time.

19. A module as claimed in one or more of the preceding claims, characterized in that two PC-board relays for breaking the connection between the energization signal generator and the solenoid, which locking relays are controlled to restore the connection by the delay means after the predetermined delay time.

20. A module as claimed in one or more of the preceding claims, characterized in that power is supplied to the active filter either through the locking relays or directly by the delay means so that, when the control connection between the energization signal generator and the solenoid is locked, power is supplied to the active filter through said locking relays, whereas when the connection between the energization signal generator and the solenoid is restored, power is supplied to the active filter by the delay means whereby, when either locking relay becomes stuck in a condition of restored connection between the energization signal generator and the solenoid, and when no energizing control signal is provided at the input of the timer, a fault condition is detected.

21. A module as claimed in one or more of claims 15 to 20, characterized in that the feedback signal carrier has a frequency of 125 Hz and the pulse amplitude modulation frequency is of about 5.2 Hz.

22. A module as claimed in one or more of the preceding claims, characterized in that it is provided in combination with a cyclically operating central control unit, which generates and transmits operating unit control signals to said module, for generating operating unit control or actuating signals and for generating and receiving feedback signals indicating the operating states of said operating units, whereas the actuating and monitoring module generates signals indicating that the operating unit has correctly switched to the corresponding operating state, which are provided to the central control unit after feedback signal analysis, and a signal is generated to indicate that the monitoring function is halted when the feedback signal receiving delay exceeds a given maximum threshold.

Drawing