General Signal Corporation

Sasib S.p.a.

David B Rutherford

John H Auer, Jr

Robert F Anderson

Henry C Sibley

John W Parker

Mark H Sluis

Carl G Shook

The invention describes a method and apparatus for effecting vital functions notwithstanding the fact that non-vital hardware is employed. A vital processor is implemented using non-vital hardware in the form of a digital computer which may for example be a microprocessor. The vital processor accepts binary input values and, based on a series of logical expressions relating output values to input values, determines the appropriate output values. Rather than employing a single bit to represent the condition of a particular input or output, unique multibit binary values or names are used. Each input or output has assigned to it at least two unique multibit values, each satisfying the code rules of a different code. Thus rather than representing a closed contact as a single 1 bit, and an open contact as a single 0 bit, in accordance with the invention the closed contact is represented by a unique multibit name which satisfies the code rules of a first code. At any point in the processing the value representing the contact can be checked to see if it satisfies the code rules, and if it does not a potential error is detected and handled. Before actually controlling output devices in accordance with the processing, further tests are implemented which ensure that the multibit value computed for a particular output not only satifies the predetermined code rule which is required, but is also correct bit for bit. Logic equations describing the relationship between output and input are actually computed using the multibit values as opposed to single bit values.

Apparatus for vitally sensing binary data for a vital processor

A vital microcompressor-based rate decoder for use in a vital processing system in on-board main line railroad and rapid transit automatic train protection systems; the design is such that a method is incorporated for tolerating specific kinds of signal disruption and in such a way that the probability of a wrongside failure has a calculable upper bound. A pickup coil transmits external or wayside signals to an arrangement which involves two channels and which provides period and duty cycle measurement of the pulses resulting from demodulation of the external signals. A counter is employed in each of the channels and a tolerance accumulation rate decoding device is included, the maximum amount of tolerance accumulated, and the minimum time required to accumulate it, being functions of the rate code selected.

Vital rate decoder

The invention describes a method and apparatus for effecting vital functions notwithstanding the fact that non-vital hardware is employed. A vital processor is implemented using non-vital hardware in the form of a digital computer which may for example be a microprocessor. The vital processor accepts binary input values and, based on a series of logical expressions relating output values to input values, determines the appropriate output values. Rather than employing a single bit to represent the condition of a particular input or output, unique multibit binary values or names are used. Each input or output has assigned to it at least two unique multibit values, each satisfying the code rules of a different code. Thus rather than representing a closed contact as a single 1 bit, and an open contact as a single 0 bit, in accordance with the invention the closed contact is represented by a unique multibit name which satisfies the code rules of a first code. At any point in the processing the value representing the contact can be checked to see if it satisfies the code rules, and if it does not a potential error is detected and handled. Although it is highly unlikely that a hardware failure would result in generating one of the few multibit names satisfying the code rule, that occurrence is not unlikely enough to be considered vital. Before actually controlling output devices in accordance with the processing, further tests are implemented which ensure that the multibit value computed for a particular output not only satisfies the predetermined code rule which is required, but is also correct bit for bit. Logic equations describing the relationship between output and input are actually computed using the multibit values as opposed to single bit values.

Vital processor implemented with non-vital hardware

The functions to be performed by a digital overspeed controller are implemented by application of two concepts, namely 'diverse channels' and 'even/odd systems cycles'; in accordance with the first concept, two channels are maintained throughout the overspeed controller, beginning with two independent tachometer inputs; all of the functions involve operations to be performed in each of the two channels separately. The numerical results for each of the channels are different and the numerical difference between the two channels is used to prove the integrity of the functions described. The second concept of 'even/odd system cycles' involves a 'system cycle time', denoted T.sub.CYC, that is nominally 100 milliseconds. All of the functions of the controller are performed each system cycle. In order to be able to vitally distinguish data results between adjacent cycles, the cycles are denoted EVEN and ODD, and the results of each of the operations produce different numerical values on even and odd cycles.

Digital overspeed controller for use in a vital processing system

The present device, a vital power controller with forgiveness, is a subsystem of a larger vital processing system, the function of the subsystem being to verify the proper operation of the larger system and to provide power to the system outputs only when the larger system functions correctly; the larger system periodically delivers checkword sets to the vital power controller (VPC); the checkwords verify the correct operation of the larger system, a valid checkword set enabling the VPC to generate vital power for a limited time; the forgiveness feature allows the VPC to tolerate an occasional bad checkword set and yet continue to provide vital power if the rate at which bad checkword sets is encountered is below a specified rate, thereby providing improved performance in the presence of noise which tends to produce occasional bad checkwords and which would otherwise cause loss of vital power.

Vital processing system including a vital power controller with

A method and apparatus for effecting vital functions notwithstanding the fact that non-vital hardware is employed. A vital processor is implemented using non-vital hardware in the form of a digital computer which may for example be a microprocessor. The vital processor accepts binary input values and, based on a series of logical expressions relating output values to input values, determines the appropriate output values. Rather than employing a single bit to represent the condition of a particular input or output, unique multibit binary values or names are used. Each input or output has assigned to it at least two unique multibit values, each satisfying the code rules of a different code. Thus rather than representing a closed contact as a single 1 bit, and an open contact as a single 0 bit, the closed contact is represented by a unique multibit name which satisfies the code rules of a first code. At any point in the processing the value representing the contact can be checked to see if it satisfies the code rules, and if it does not a potential error is detected and handled. Although it is highly unlikely that a hardware failure would result in generating one of the few multibit names satisfying the code rule, that occurrence is not unlikely enough to be considered vital. Before actually controlling output devices in accordance with the processing, further tests are implemented which ensure that the multibit value computed for a particular output not only satisfies the predetermined code rule which is required, but is also correct bit for bit. Logic equations describing the relationship between output and input are actually computed using the multibit values as opposed to single bit values.

Continuous verification of vital (fail-safe) outputs from an information processing system is obtained without the need for large computing capacity (overhead). Multibit test sequences are provided continuously during successive subparts of the processor system cycle to vital output interfaces which invert the bits of the signals or do not pass them depending upon the state of the output. A compiler including a random access memory (RAM) addressed by a read only memory (ROM) is configured to divide each sequence by direct and inverse polynomials on alternately occurring parts of the system cycle to provide compressed data. After each part of the system cycle, checkwords are constructed using the resultant compressed data corresponding to each output which must be proven to be in its `off` state. These checkwords are used to verify the vital operation of the system and may be applied to a vital decoder which controls the application of operating power to the output interfaces to disconnect operating power therefrom and condition the outputs to the restrictive state upon detection of a failure which may occur at any time during the entire system cycle.

Vital processing system adapted for the continuous verification of vital

A tachometer signal provides input to first and second parallel connected channels, each of the channels comprising in series operational amplifier, threshold detector, and counting devices. A comparator checks that the same count is registered by the counters of both channels. Each of the threshold detectors is biased to require a minimum amplitude over and under tachometer pulse input in order to deliver an output to the pulse counter of the associated channel. Attenuating circuits act on the inputs of the operational amplifiers of both channels during predetermined intervals to check that the amplitude of the tachometer pulses is sufficient to be counted by the tachometer counters. Dynamic checking circuits are provided to check the integrity of the attenuating system.

Speed control systems for governing the speed of a vehicle

Apparatus for insuring a vehicle operator's attentiveness at potentially dangerous locations along a path of travel. A signalling device is provided in advance of a potentially dangerous location, in the direction of travel of the vehicle. A vehicle carried signal responsive device responds to the signalling device when within the effective zone of the signalling device. The vehicle includes warning apparatus, for example, an alarm and a buzzer. The vehicle also includes an operator actuatable push button and a speed sensing apparatus. A control device responds to the push button and to the vehicle carried signal responsive device to operate either the buzzer or the alarm. If the operator evidences his alertness to the potentially dangerous location by actuating the push button prior to reaching the signalling device (within some constraint), the control apparatus merely sounds the buzzer when the signalling device is detected and resets itself. On the other hand, if the operator fails to actuate the push button in advance of detection of the signalling device, or, if his actuation is too far in advance of detection, then the alarm is energized and will remain energized until the vehicle is brought to a stop, or a low speed, at which point, push button actuation can cancel the alarm.

Driver alert system

A microprocessor based vital delay circuit is provided which is arranged to emit an output no less than a predetermined time after an input stimulus. The predetermined time, which corresponds to the delay, is controlled by selecting the relationship between two quantities. A digital processor performs a series of computations on the two quantities, each computation is arranged to take unit time and by selecting the proper relationship between the two quantities, the total series of computations takes a predetermined amount of time. Before the output is allowed to occur, several checks are performed to insure that no hardware or software failures have erroneously generated the result. One novel checking technique insures that the clock frequency has not changed, and this technique is applicable to a wide variety of devices in which digital techniques are employed.

Digital circuit generating a vital relay

A fail-safe time delay circuit is provided to produce an output a predetermined time, and no less than a predetermined time after an input stimulus. The circuit includes a driving circuit for a pair of relays which are operated at slightly greater than 50% duty cycle and out of phase such that, except when the circuit is de-energized, at least one of the relays is always energized. The contacts of the two relays are employed in a balanced voltage amplifier to produce a bi-polar signal, with the magnitude of both polarities increasing, with the time required for the increase to a defined threshold establishing the time delay. A pair of threshold circuits are coupled to the output of the balanced voltage amplifier such that each threshold circuit (one responding to the positive portion, and the other the negative portion of the bi-polar output) is energized when the respective portion of the bi-polar signal is detected to reach the associated threshold. Each of the threshold circuits provides an input to a vital AND gate such that only when the excursion in the bi-polar signal exceeds the threshold of both threshold circuits will the vital AND gate produce an output to energize a load.

Growing community of inventors

Rochester, NY, United States of America

David B Rutherford